[Midnightbsd-cvs] [MidnightBSD/mports] a0dd70: Rails 7.2 gems: update to 7.2.3.2 (#1605)

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: a0dd70fb4ddfe08b15f1adc3d136c011edd005e9
      https://github.com/MidnightBSD/mports/commit/a0dd70fb4ddfe08b15f1adc3d136c011edd005e9
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-23 (Wed, 23 Sep 2026)

  Changed paths:
    M databases/rubygem-activemodel72/Makefile
    M databases/rubygem-activemodel72/distinfo
    M databases/rubygem-activerecord72/Makefile
    M databases/rubygem-activerecord72/distinfo
    M devel/rubygem-actionview72/Makefile
    M devel/rubygem-actionview72/distinfo
    M devel/rubygem-activejob72/Makefile
    M devel/rubygem-activejob72/distinfo
    M devel/rubygem-activesupport72/Makefile
    M devel/rubygem-activesupport72/distinfo
    M net/rubygem-activestorage72/Makefile
    M net/rubygem-activestorage72/distinfo
    M www/rubygem-actioncable72/Makefile
    M www/rubygem-actioncable72/distinfo
    M www/rubygem-actionpack72/Makefile
    M www/rubygem-actionpack72/distinfo
    M www/rubygem-railties72/Makefile
    M www/rubygem-railties72/distinfo

  Log Message:
  -----------
  Rails 7.2 gems: update to 7.2.3.2 (#1605)

Updates the Rails 7.2 gem ports from 7.2.3.1 to 7.2.3.2:

- devel/rubygem-activesupport72
- databases/rubygem-activemodel72
- databases/rubygem-activerecord72 (PORTREVISION removed)
- devel/rubygem-activejob72
- devel/rubygem-actionview72
- www/rubygem-actionpack72
- www/rubygem-actioncable72
- www/rubygem-railties72
- net/rubygem-activestorage72

These are in one PR because the gems pin each other to exact versions.

## Why
7.2.3.2 is a security release. It fixes CVE-2026-66066 /
GHSA-xr9x-r78c-5hrm (critical), an arbitrary file read and possible RCE
in Active Storage variant processing. Affected versions are
activestorage < 7.2.3.2.

Each gem's runtime dependencies and license (MIT) are the same as in
7.2.3.1, so only PORTVERSION and distinfo change. There's also a
separate commit fixing a portlint fatal error that was already on master
in activesupport72 (a space instead of a tab after `BUILD_DEPENDS=`).

## Testing
- `bmake makesum`: every SHA256 matches the rubygems.org API.
- `bmake package` succeeded for all 9 ports, including the fake-qa
RubyGem dependency check.
- All 9 load together as 7.2.3.2: `Rails`, `ActionPack`, `ActiveRecord`
and `ActiveStorage` report 7.2.3.2.
- portlint: no fatal errors.
- I built with `DEFAULT_VERSIONS=ruby=3.2` (the build box's Ruby). **I
haven't built them against Ruby 3.3.**
- I could only install activesupport72 and activemodel72. The others
were built with `NO_DEPENDS` and a `GEM_PATH` pointing at the freshly
faked gems. The reason is an existing packaging conflict:
`textproc/rubygem-rails-dom-testing-rails72` and `-rails80` install the
same `rails-dom-testing-2.3.0` files, so mport won't install both. It
isn't caused by this PR, but it means the 7.2 and 8.0 Rails sets can't
be installed on the same system.

## Not included
The `*-gitlab` Rails ports use `RAILS_VERSION=7.2.3` from
`www/gitlab/Makefile.common`, which follows GitLab's own lockfile.
They're still affected and need a separate update.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Update the complete Rails 7.2 gem port set to version 7.2.3.2 for
coordinated dependency and security maintenance.

Bug Fixes:
- Update the Rails 7.2 gem ports to the 7.2.3.2 security release,
addressing the Active Storage arbitrary file read and potential remote
code execution vulnerability.

Chores:
- Refresh distinfo for all nine Rails 7.2 gem ports and correct the
activesupport72 portlint formatting error.

---------

Signed-off-by: Lucas Holt <luke at foolishgames.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications