CVS commit: [pkgsrc-2026Q2] pkgsrc/www/ruby-http

Module Name:	pkgsrc
Committed By:	maya
Date:		Mon Aug  3 03:38:41 UTC 2026

Modified Files:
	pkgsrc/www/ruby-http [pkgsrc-2026Q2]: Makefile distinfo

Log Message:
Pullup ticket #7209 - requested by taca
www/ruby-http: Security fix

Revisions pulled up:
- www/ruby-http/Makefile                                        1.21
- www/ruby-http/distinfo                                        1.23

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Tue Jul 21 14:04:43 UTC 2026

   Modified Files:
   	pkgsrc/www/ruby-http: Makefile distinfo

   Log Message:
   www/ruby-http: update to 6.0.4

   6.0.4 -(2026-07-14)

   Fixed

   * On Ruby 3.4+ with TCPSocket, the redundant Timeout.timeout wrap around
     socket-level connect_timeout is removed.  The native timeout is used
     alone, which avoids a slow Thread leak from Timeout::Request retention
     under abnormal exit paths (see #542).  On Ruby 3.2/3.3 and with custom
     socket classes the previous Timeout.timeout wrap is preserved.

   Security

   * HTTP::Request::Builder#make_request_uri now rejects protocol-relative
     inputs (//host/path) when resolving against a configured base_uri or
     persistent origin.  Previously such inputs were treated as network-path
     references per RFC 3986 §5.2 and replaced the base authority ― via
     URI#join on the base_uri branch and via string concatenation on the
     persistent branch ― allowing an attacker who controlled the path argument
     to redirect the request to an arbitrary host and leak any
     connection-scoped headers (HTTP.auth(...), etc.). See GHSA-r98x-p6m8-xcrv
     for details.


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.20.2.1 pkgsrc/www/ruby-http/Makefile
cvs rdiff -u -r1.22 -r1.22.2.1 pkgsrc/www/ruby-http/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/ruby-http/Makefile
diff -u pkgsrc/www/ruby-http/Makefile:1.20 pkgsrc/www/ruby-http/Makefile:1.20.2.1
--- pkgsrc/www/ruby-http/Makefile:1.20	Tue May  5 13:44:56 2026
+++ pkgsrc/www/ruby-http/Makefile	Mon Aug  3 03:38:41 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.20 2026/05/05 13:44:56 taca Exp $
+# $NetBSD: Makefile,v 1.20.2.1 2026/08/03 03:38:41 maya Exp $
 #
 
-DISTNAME=	http-6.0.3
+DISTNAME=	http-6.0.4
 CATEGORIES=	www
 
 MAINTAINER=	[email protected]

Index: pkgsrc/www/ruby-http/distinfo
diff -u pkgsrc/www/ruby-http/distinfo:1.22 pkgsrc/www/ruby-http/distinfo:1.22.2.1
--- pkgsrc/www/ruby-http/distinfo:1.22	Tue May  5 13:44:56 2026
+++ pkgsrc/www/ruby-http/distinfo	Mon Aug  3 03:38:41 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.22 2026/05/05 13:44:56 taca Exp $
+$NetBSD: distinfo,v 1.22.2.1 2026/08/03 03:38:41 maya Exp $
 
-BLAKE2s (http-6.0.3.gem) = f227d9146f6a5a370d1bdc1247ae19a88a1d912e9e1ddb1fe536cf8bbe4f8bce
-SHA512 (http-6.0.3.gem) = 5527b7d853b25a6f247b387dbb63907c94e7da3777ce26b32792cf895f8bff2752bd8bfe840182c7ec81a2df678e917bc534f4f173ee9da8c466ad8086156163
-Size (http-6.0.3.gem) = 78336 bytes
+BLAKE2s (http-6.0.4.gem) = 10c39cf805634eeec9b68678b98559f112cbf67509703ea0d50c32f11312681b
+SHA512 (http-6.0.4.gem) = 363ac49b2b95186917e6f3fa48228c1b2644d4869496d3abe5afeb8f518333b00a31330594c4ba4c48161cba6e0b7ace58d234a5aecee45942752122e0d73afe
+Size (http-6.0.4.gem) = 78848 bytes