Update ruby26{,-base} to 2.6.2.
Quote from release announce.
Ruby 2.6.2 (2019-03-13)
This release includes bug fixes and a security update of the bundled
RubyGems.
See details in Multiple vulnerabilities in RubyGems and the commit logs.
Update ruby25{,-base} to 2.5.5.
Quote from release announce:
Ruby 2.5.4 (2019-03-13)
This release includes bug fixes and a security update of the bundled
RubyGems. See details in Multiple vulnerabilities in RubyGems and the commit
logs.
Ruby 2.5.5 (2019-03-15)
This release includes a bug fix for the deadlock in the
multi-thread+multi-process (using Process.fork) applications (ex: puma).
go1.12.1 (released 2019/03/14) includes fixes to cgo, the compiler, the go
command, and the fmt, net/smtp, os, path/filepath, sync, and text/template
packages. See the Go 1.12.1 milestone on our issue tracker for details.
go1.11.6 (released 2019/03/14) includes fixes to cgo, the compiler, linker,
runtime, go command, and the crypto/x509, encoding/json, net, and net/url
packages. See the Go 1.11.6 milestone on our issue tracker for details.
- extract using gtar (hopefully more lenient than bsdtar)
- remove the files in question in post-extract
While here, re-add a PLIST.route conditional that was accidentally removed,
breaking the build on Linux (PR pkg/54054).
Add security patch for rubygems, fixing these problem.
* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handlin
g
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors
https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
Since original patch included in official announce dose not cleanly applied to
Ruby 2.4.5, use a local version which drop patch to none existing test.
Bump PKGREVISION.
Add security patch for rubygems, fixing these problem.
* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handlin
g
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors
https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
Since original patch included in official announce dose not cleanly applied to
Ruby 2.5.3, use a local version which drop patch to none existing test.
Bump PKGREVISION.
Add security patch for rubygems, fixing these problem.
* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handling
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors
Bump PKGREVISION.
Some of the highlights include opt-in support for TLS 1.3, improved modules
support (in preparation for being the default in Go 1.13), support for
windows/arm, and improved macOS & iOS forwards compatibility.
See https://blog.golang.org/go1.12.
In pkgsrc, this is _not_ the default version for Go package builds just yet.
6.9.0:
FEATURES
* Time traveling installs using the --before flag.
* Add support for package aliases. This allows packages to be installed under a
different directory than the package name listed in package.json, and adds a
new dependency type to allow this to be done for registry dependencies.
* Always save package-lock.json when using --package-lock-only.
* Make empty-string run-scripts run successfully as a no-op.
* Match git semver ranges when flattening the tree.
* Re-enable updating local packages.
BUGFIXES
* Set modified to undefined in npm view when time is not available. This
fixes a bug where npm view would crash on certain third-party registries.
* Print out tar version in install.sh only when the flag is supported not all
the tar implementations support --version flag. This allows the install script
to work in OpenBSD, for example.
* Fix typo in error message for npm stars.
* Strip version info from pkg on E404. This improves the error messaging format.
DOCS
* Add npm add as alias to npm install in docs.
* Fix link to RFC 10 in the changelog.
* Describe exit codes in npm-audit docs.
Changes:
2.7.16
======
Documentation
-------------
- bpo-35035: Rename documentation for :mod:`email.utils` to
``email.utils.rst``.
- bpo-34967: Use app.add_object_type() instead of the deprecated Sphinx
function app.description_unit()
- bpo-13407: Add a note to :mod:`bz2` and :mod:`tarfile` stating that
handling of multi-stream bzip2 files is not supported.
- bpo-33503: Fix broken pypi link
