[Midnightbsd-cvs] [MidnightBSD/mports] 31b22c: Rails 8.1 gems: update to 8.1.3.1 (#1606)

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: 31b22c6dc335b9b3c3538c7179c16a8cb14cfd20
      https://github.com/MidnightBSD/mports/commit/31b22c6dc335b9b3c3538c7179c16a8cb14cfd20
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-23 (Wed, 23 Sep 2026)

  Changed paths:
    M databases/rubygem-activemodel81/Makefile
    M databases/rubygem-activemodel81/distinfo
    M databases/rubygem-activerecord81/Makefile
    M databases/rubygem-activerecord81/distinfo
    M devel/rubygem-actionview81/Makefile
    M devel/rubygem-actionview81/distinfo
    M devel/rubygem-activejob81/Makefile
    M devel/rubygem-activejob81/distinfo
    M devel/rubygem-activesupport81/Makefile
    M devel/rubygem-activesupport81/distinfo
    M www/rubygem-actionpack81/Makefile
    M www/rubygem-actionpack81/distinfo

  Log Message:
  -----------
  Rails 8.1 gems: update to 8.1.3.1 (#1606)

Updates the Rails 8.1 gem ports from 8.1.3 to 8.1.3.1:

- devel/rubygem-activesupport81
- databases/rubygem-activemodel81
- databases/rubygem-activerecord81 (PORTREVISION removed)
- devel/rubygem-activejob81
- devel/rubygem-actionview81
- www/rubygem-actionpack81

`net/rubygem-activestorage81` was already at 8.1.3.1 and requires
`>=${PORTVERSION}` of these, so until this lands it can't be installed.

## Why
8.1.3.1 is a security release. It fixes CVE-2026-66066 /
GHSA-xr9x-r78c-5hrm (critical), an arbitrary file read and possible RCE
in Active Storage variant processing.

Each gem's runtime dependencies and license (MIT) are the same as in
8.1.3, so only PORTVERSION and distinfo change.

## Testing
- `bmake makesum`: every SHA256 matches the rubygems.org API.
- `bmake package` succeeded for all 6 ports plus activestorage81,
including the fake-qa RubyGem dependency check.
- All of them load together as 8.1.3.1 (ActionPack, ActiveRecord,
ActiveJob, ActiveStorage, ActiveSupport).
- portlint: no fatal errors.
- I built with `DEFAULT_VERSIONS=ruby=3.2` (the build box's Ruby) and
`NO_DEPENDS`, with a `GEM_PATH` pointing at the freshly faked gems. I
didn't install the packages, because the `-rails81` helper gems would
conflict with the `-rails80` ones already installed. **I haven't built
them against Ruby 3.3 or installed them.**

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Update the Rails 8.1 gem ports to version 8.1.3.1.

Bug Fixes:
- Update the Rails 8.1 gem ports to the 8.1.3.1 security release,
addressing the Active Storage arbitrary file read and potential remote
code execution vulnerability.

Enhancements:
- Synchronize the six Rails 8.1 gem ports with the existing Active
Storage 8.1.3.1 port and remove the obsolete ActiveRecord port revision.

Signed-off-by: Lucas Holt <luke at foolishgames.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications