p5-SQL-Abstract: update to 2.000003.
2.000003 - 2026-11-06
- SECURITY, CVE-2026-121265: generate() (and so AUTOLOAD with
allow_autoload) also treats an arrayref in its hashref or arrayref
as one bind value. 2.000002 fixed only insert(), update() and
values(): generate('update t', { name => [ "(SELECT ...)" ] })
still gave UPDATE T SET name = (SELECT ...). \[ $sql, @bind ] is
literal SQL in generate() too; array_datatypes => 0 restores the
old behaviour.
- every module has a $VERSION, the same as SQL::Abstract
2.000002 - 2026-11-05
- SECURITY, CVE-2026-121265: array_datatypes is on by default, so an
arrayref as a column value in insert() or update() (and values())
is one bind value. Before, it was literal SQL and its first element
went into the SQL text: a JSON array or a repeated form field like
{ name => [ "x, is_admin = 1" ] } gave
UPDATE t SET name = x, is_admin = 1. Literal SQL is
[170 lines not shown]
qt6: update comment
qt6 needs recursive bumps for _every_ version change, not only major
versions, otherwise we see
/usr/pkg/qt6/lib/libQt6Svg.so.6: Undefined PLT symbol "_ZN14QObjectPrivateC2E16QtPrivate_6_11_2" (symnum = 958)
www/ruby-rack-test: update to 2.3.0
2.3.0 (2026-10-21)
Bug fixes:
* Do not mutate arguments given to Rack::Utils.build_multipart (Oskar
Eichler #361)
* Rewind tempfile if there are errors when appending in
UploadedFile#append_to (Oskar Eichler #363)
* Preserve request method and params for 308 redirects (requires Rack 2+)
(Oskar Eichler #364)
* Reuse rack.input in 307/308 redirect request if it is rewindable, fixing
cases that use application/json and other content types (Oskar Eichler
#367)
[8 lines not shown]
www/ruby-rack2: update to 2.2.25
2.2.25 (2026-10-30)
Security
* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
buffer, allowing denial of service via memory exhaustion.
* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
unnormalized path, allowing dot segments to bypass them.
* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
parameter were accepted when the first value was empty or began with a
quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
Fixed
* Multipart parser: scan boundary lines with a literal newline search
[3 lines not shown]
www/ruby-rack: update to 3.2.8
3.2.8 (2026-10-30)
Security
* GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan
buffer, allowing denial of service via memory exhaustion.
* GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an
unnormalized path, allowing dot segments to bypass them.
* GHSA-2j8w-xcrc-x985 Rack::Request#host_with_port, #base_url, and #url
returned the raw authority when it was invalid; host_with_port now returns
nil in that case.
* GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary
parameter were accepted when the first value was empty or began with a
quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.
[6 lines not shown]
www/ruby-httpclient: update to 2.10.0
2.10.0 (2026-10-31)
* Refresh the bundled Mozilla CA certificates to the October 20, 2026
snapshot, building on #444 (#482)
* With peer verification enabled and no custom verification callback, reject
TLS connections when a server supplies certificates containing blocked
eMudhra intermediate CA public keys, including cross-signed variants
(#480, #481) Connections are also rejected when a server supplies an
unused certificate containing a blocked public key. VERIFY_NONE/nil
disables this check; a custom verification callback replaces the default
policy and is responsible for certificate validation.
* Report Java socket read timeouts on JRuby as
HTTPClient::ReceiveTimeoutError (#486)
* Add JRuby CI coverage (#486)
[7 lines not shown]
www/ruby-html-proofer: update to 5.2.3
5.2.3 (2026-10-16)
Bug Fixes
* Add ruby-json 3 support (de14af9)
Miscellaneous Chores
* reporter: Escape colons in swapped test URLs (#879)
* reporter: Avoid live external URLs (#879)
* Prefix Dependabot commits with a Conventional Commits type (#880)
* Lint PR titles for Conventional Commits (#880)
* Run release prep on every push to main (#880)
www/ruby-faraday-net_http: update to 3.5.0
3.5.0 (2026-10-11)
!! This release contains changes to errors raised !!
Please note: when responses cannot be correctly deflated, a
Faraday::ConnectionFailed error will be raised instead of raw Zlib::* errors
as before. This have been considered a bug rather than a breaking change,
and therefore included in the minor version bump.
What's Changed
* Bump actions/checkout from 6 to 7 by @dependabot[bot] in #58
* Add SOCKS proxy support by @iMacTia in #64
* Handle quoted and case-insensitive charset parameters by @OskarEichler in
#59
* Wrap deflate data and dictionary errors as connection failures by
@OskarEichler in #60
[8 lines not shown]
www/ruby-faraday: update to 2.15.1
2.15.0 (2026-10-16)
What's Changed
* [LOW] Keep Coveralls token out of pull-request code by @OskarEichler in
#1711
* [LOW] Remove vulnerable docs preview dependencies by @OskarEichler in
#1714
* chore: Use Docsify 5, to avoid the dropped 4.x version series by
@olleolleolle in #1670
* Fix typo in Faraday::Connection#options doc by @Bo98 in #1674
* Preserve request ports for no_proxy matching by @OskarEichler in #1705
* Preserve parallel manager across nested batches by @OskarEichler in #1704
* Reject adapter changes after locking the stack by @OskarEichler in #1701
* Preserve literal plus signs when decoding URI userinfo by @OskarEichler in
#1694
* Preserve explicit proxy settings when duplicating connections by
[52 lines not shown]
www/ruby-ethon: update to 0.19.1
0.19.0 (2026-10-28)
(Changes are too many to write here, please refer
<https://github.com/typhoeus/ethon/blob/b54ddf4a5b5e8580fea393db879253c88fd908d4/CHANGELOG.md>.
0.19.1 (2026-10-28)
Behavior changes
* Size a Multi's connection cache to twice the largest number of easy
handles attached at once. libcurl derives its default
CURLMOPT_MAXCONNECTS from the number of handles attached when a connection
is returned, but Ethon detaches finished handles immediately, which made
the default shrink during a run and close connections that later requests
could have reused. An explicit maxconnects: still takes precedence.
(#455)
[9 lines not shown]
www/ruby-css-parser: update to 3.4.0
3.3.0 (2026-10-07)
* Fix Arbitrary local-file read via attacker-controlled @import
3.4.0 (2026-11-01)
* Speed up RuleSet::Declarations#to_s ~20x: its clean-up regexp matched the
empty string at every character ([\n\r\f\t]*), making gsub! replace at
every position; the unreachable \s+$ branch is dropped, output unchanged
* Allocate less in RuleSet: skip the downcased copy of already normalized
property names, and build dimension shorthands without enumerators
* Allocate less when expanding and creating dimension shorthands, and skip
the colour regexp on values without a comma
* Return already sanitized media types as-is from sanitize_media_query, and
[5 lines not shown]
www/ruby-crass: update to 1.0.8
1.0.8 (2026-10-21)
Security
* Moderate: Fixed a tokenizer bug in which a ) following an escaped
backslash (\\) inside a bad URL didn't terminate the bad URL token,
causing Crass to consume more input than a spec-compliant browser would.
CSS sanitizers built on Crass could be tricked into passing through
declarations, rules, or at-rules that a browser would then apply.
(GHSA-pq4g-8rxf-4g29)
www/ruby-bullet: update to 8.3.1
8.3.0 (2026-10-10)
* Add support for ActiveRecord 8.2
8.3.1 (2026-10-24)
* Avoid redefining the footer_position getter
* Avoid the CGI loading warning on Ruby 4
* Keep request state separate for sibling fibers on one thread
