CVS commit: pkgsrc/graphics/ruby-RMagick

This is a multi-part message in MIME format.

--_----------=_1785853762119830
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"

Module Name:	pkgsrc
Committed By:	taca
Date:		Tue Aug  4 14:29:22 UTC 2026

Modified Files:
	pkgsrc/graphics/ruby-RMagick: Makefile distinfo

Log Message:
graphics/ruby-RMagick: update to 7.1.0

7.1.0 (2026-07-27)

Important

Draw#annotate and Draw#get_type_metrics no longer interpret the text they
are given. A %[...] or %x escape is now drawn as written instead of being
replaced.

Build the string in Ruby instead — everything those escapes provided has a
direct accessor:

# before
img.annotate(gc, 0, 0, 10, 20, '%wx%h')

# after
img.annotate(gc, 0, 0, 10, 20, "#{img.columns}x#{img.rows}")

%[width]/%w → Image#columns, %[height]/%h → Image#rows, %f/%d →
 Image#filename, %m → Image#format, %b → Image#filesize, %[EXIF:*] and
 other properties → Image#[], %[artifact:KEY] → Image#artifact (new in
 this release), %[mean] → Image#channel_mean, %[pixel:p{x,y}] →
 Image#pixel_color, %[fx:...] → Image#fx or plain Ruby.

The interpolation was never documented, and leaving it in place meant that
passing user-supplied text to annotate also handed that text to an
expression evaluator, a pixel and metadata reader, and an unbounded CPU sink
— on a 1500x1500 image, a 10 KB caption of %[mean] took 78 seconds.  It
also corrupted ordinary text: %d expanded to the directory the image had
been read from, so a caption of "%d items" was drawn as /srv/app/uploads
items.

Upgrading

* Text starting with @ is drawn instead of being read from that
  file. annotate(gc, 0, 0, 0, 20, '@notes.txt') now draws @notes.txt; read
  the file yourself if that is what you wanted.
* RVG path data is validated against the SVG path grammar. canvas.path(d)
  raises ArgumentError if d contains anything outside MmZzLlHhVvCcSsQqTtAa,
  digits, .,+-eE and whitespace.
* Pathnames containing a NUL byte raise ArgumentError instead of being
  silently truncated.
* Draw#clip_path and Draw#encoding now quote their argument in the generated
  MVG, and values interpolated by Draw#enquote have " and \
  escaped. Rendering is unchanged; this is only visible if you compare
  Draw#inspect output.
* Text containing a backslash is now drawn as written. Previously a trailing
  \ escaped the closing delimiter of the MVG token, so the text was mangled.

Breaking Changes

* Reject embedded NUL bytes in pathname arguments by @Watson1978 in #1827
* Fix arbitrary file read in Draw#annotate with text starting with '@' by
  @Watson1978 in #1837
* Fix MVG injection from unvalidated RVG::Path data by @Watson1978 in #1839
* Fix MVG injection from unescaped values in Draw#enquote by @Watson1978 in
  #1841
* Draw annotation text as given instead of interpreting it by @Watson1978 in
  #1843

Improvements

* Fix grammar, typos, and content errors in the documentation by @Watson1978
  in #1824
* Add Image#artifact to read the artifacts Image#define writes by
  @Watson1978 in #1842

Bug Fixes

* Fix unchecked SetImageArtifact() calls by @ndossche in #1822
* Fix copy_options() using the option value as the artifact key by
  @Watson1978 in #1823
* Fix Magick#set_log_event_mask() by @ndossche in #1826
* Fix SEGV in Info#stroke_width= and Info#attenuate= with a large Float by
  @Watson1978 in #1828
* Fix double free of the annotation text in Draw#annotate by @Watson1978 in
  #1829
* Fix double free of the interpreted text in Draw#get_type_metrics by
  @Watson1978 in #1830
* Fix use-after-free of cloned images in images_from_imagelist() by
  @Watson1978 in #1831
* Fix SEGV in Draw#marshal_load with a non-String pattern by @Watson1978 in
  #1832
* Fix heap over-read in Image#recolor by @Watson1978 in #1833
* Fix SEGV from integer overflow in Image#import_pixels geometry by
  @Watson1978 in #1834
* Fix heap over-read in Image#import_pixels with a long or empty map by
  @Watson1978 in #1835
* Fix memory leak in ImageList#composite_layers with an unusable source list
  by @Watson1978 in #1836
* Fix MVG injection in Draw#text from unescaped backslashes by @Watson1978
  in #1838
* Fix RVG text being quoted twice and the added quotes being drawn by
  @Watson1978 in #1840


To generate a diff of this commit:
cvs rdiff -u -r1.207 -r1.208 pkgsrc/graphics/ruby-RMagick/Makefile
cvs rdiff -u -r1.90 -r1.91 pkgsrc/graphics/ruby-RMagick/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


--_----------=_1785853762119830
Content-Disposition: inline
Content-Length: 1625
Content-Transfer-Encoding: binary
Content-Type: text/x-diff; charset=us-ascii

Modified files:

Index: pkgsrc/graphics/ruby-RMagick/Makefile
diff -u pkgsrc/graphics/ruby-RMagick/Makefile:1.207 pkgsrc/graphics/ruby-RMagick/Makefile:1.208
--- pkgsrc/graphics/ruby-RMagick/Makefile:1.207	Mon Aug  3 18:10:28 2026
+++ pkgsrc/graphics/ruby-RMagick/Makefile	Tue Aug  4 14:29:22 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.207 2026/08/03 18:10:28 wiz Exp $
+# $NetBSD: Makefile,v 1.208 2026/08/04 14:29:22 taca Exp $
 
-DISTNAME=	rmagick-7.0.5
+DISTNAME=	rmagick-7.1.0
 PKGNAME=	${RUBY_PKGPREFIX}-${DISTNAME:S/rmagick/RMagick/}
-PKGREVISION=	1
 CATEGORIES=	graphics
 
 MAINTAINER=	[email protected]

Index: pkgsrc/graphics/ruby-RMagick/distinfo
diff -u pkgsrc/graphics/ruby-RMagick/distinfo:1.90 pkgsrc/graphics/ruby-RMagick/distinfo:1.91
--- pkgsrc/graphics/ruby-RMagick/distinfo:1.90	Tue Jul  7 14:11:44 2026
+++ pkgsrc/graphics/ruby-RMagick/distinfo	Tue Aug  4 14:29:22 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.90 2026/07/07 14:11:44 taca Exp $
+$NetBSD: distinfo,v 1.91 2026/08/04 14:29:22 taca Exp $
 
-BLAKE2s (rmagick-7.0.5.gem) = 029cf030b2201e283804fceef0ab5cde286d53a5320c322a60b37ff924eb2de7
-SHA512 (rmagick-7.0.5.gem) = 6501e26b46aaed57b347b965a28e77a20af00e72d4449208467062eb8f5423e36f1464bcbe461d83e6ce39f7fa44c589a0589eb4e2e5df35932e374ee7cd60d7
-Size (rmagick-7.0.5.gem) = 263168 bytes
+BLAKE2s (rmagick-7.1.0.gem) = 974e353ad6b0eeedd9c421b110ffb5adba4d9cbd8b4ac9091d204639003bdf5e
+SHA512 (rmagick-7.1.0.gem) = 494609e11ffdae079c671f201d46b85809715a9e8fd09a8b6e5371e3cfa5bff7b3db5f37cab815db05170550133e1bdbc5c04b470154f53e1c2e9b7eb37c7f56
+Size (rmagick-7.1.0.gem) = 265216 bytes


--_----------=_1785853762119830--