Subject: CVS commit: pkgsrc/www/ruby-mechanize
From: Takahiro Kambe
Date: 2021-02-03 16:44:36
Message id: 20210203154436.33D26FA94@cvs.NetBSD.org

Log Message:
www/ruby-mechanize: update to 2.7.7

pkgsrc change: add "USE_LANGUAGES=	# empty"

2.7.7 / 2021-02-01

* Security fixes for CVE-2021-21289

  Mechanize `>= v2.0`, `< v2.7.7` allows for OS commands to be injected
  into several classes' methods via implicit use of Ruby's `Kernel.open`
  method. Exploitation is possible only if untrusted input is used as a
  local filename and passed to any of these calls:

  - `Mechanize::CookieJar#load`: since v2.0 (see 208e3ed)
  - `Mechanize::CookieJar#save_as`: since v2.0 (see 5b776a4)
  - `Mechanize#download`: since v2.2 (see dc91667)
  - `Mechanize::Download#save` and `#save!` since v2.1 (see 98b2f51, bd62ff0)
  - `Mechanize::File#save` and `#save_as`: since v2.1 (see 2bf7519)
  - `Mechanize::FileResponse#read_body`: since v2.0 (see 01039f5)

  See
  github.com/sparklemotion/mechanize/security/advisories/GHSA-qrqm-fpv6-6r8g
  for more information.

  Also see #547, #548. Thank you, @kyoshidajp!

New Features

* Support for Ruby 3.0 by adding `webrick` as a runtime dependency. (#557)
  @pvalena

Bug fix

* Ignore input fields with blank names (#542, #536)

Files:
RevisionActionfile
1.20modifypkgsrc/www/ruby-mechanize/Makefile
1.14modifypkgsrc/www/ruby-mechanize/PLIST
1.15modifypkgsrc/www/ruby-mechanize/distinfo