[Midnightbsd-cvs] [MidnightBSD/mports] e6ce42: databases/p5-DBD-Pg: update to 3.21.1 (#773)

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: e6ce42373a2bd51ec6095849b9c938ca36f2f687
      https://github.com/MidnightBSD/mports/commit/e6ce42373a2bd51ec6095849b9c938ca36f2f687
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-23 (Sun, 23 Aug 2026)

  Changed paths:
    M databases/p5-DBD-Pg/Makefile
    M databases/p5-DBD-Pg/distinfo
    M databases/p5-DBD-Pg/files/patch-Makefile.PL

  Log Message:
  -----------
  databases/p5-DBD-Pg: update to 3.21.1 (#773)

Updates `databases/p5-DBD-Pg` from 3.20.2 to 3.21.1.

## Security context

Upstream 3.21.1 fixes **CVE-2026-78183**, a heap out-of-bounds write in
`quote_float()`. For the special literals `NaN`, `Inf`, `+Inf`, `-Inf`,
`Infinity`, `+Infinity` and `-Infinity`, the function emitted the
literal wrapped in single quotes plus NUL (`length + 3` bytes) while
allocating only `length + 1` — a two-byte overflow, reachable via
`$dbh->quote($val, DBI::SQL_NUMERIC)`.

**mports was never vulnerable.** The bug was introduced in 3.21.0 by the
quote.c rewrite, and the tree was on 3.20.2, which predates it. No other
port bundles a copy — all consumers (`comms/atslog`, `databases/pgtop`,
`databases/postgresqltuner`, `mail/sympa`, `mail/spamassassin`,
`ports-mgmt/portscout`) depend on this port. This update is for
currency, not remediation.

Fix verified present in the new distfile — the special-literal branch
now allocates `length + 3` and returns early (`quote.c:374`). 3.21.1
also fixes allocations in `_dequote_bytea_hex()` and
`pg_destringify_array()`.

## Port changes

- **`patch-Makefile.PL` regenerated.** Upstream reworked the `INC` line
to use `qq{}` quoting, so the first hunk no longer applied (`1 out of 2
hunks failed`). Regenerated with `bmake makepatch`; the patch keeps its
original purpose of appending `$comp_opts` to `INC` instead of letting
`CCFLAGS` clobber perl's own compiler flags. Note the new
`strbuf$(OBJ_EXT)` object in `OBJECT`.
- **`NO_TEST= yes` added.** 3.21.1 calls `plan tests => N` at the top of
`t/03dbmethod.t`, `t/10_pg_error_field.t` and `t/30unicode.t`, *before*
the `connect_database()` check that calls `plan skip_all`. With no
reachable PostgreSQL server that's two `plan` calls, so the files die
with `You tried to plan twice` instead of skipping. 3.20.2 had no early
`plan` and skipped cleanly. This is an upstream test-harness bug, not a
module defect — the tests pass where a server is available.

`pkg-plist` needed no changes.

## Validation

| Check | Result |
|---|---|
| `bmake check-license` | pass |
| `bmake makesum` | SHA256 `f3fe2b2d…4db6`, 317973 bytes |
| `bmake patch` | pass (regenerated patch applies cleanly) |
| `bmake build` | pass — builds `Pg.o dbdimp.o quote.o types.o strbuf.o`
|
| `bmake fake` | pass, staged tree matches `pkg-plist` |
| `bmake package` | pass |
| `portlint` | looks fine |

Built on amd64 against `postgresql14-client-14.20`. The build host has
perl5-5.40.4 installed while the tree's `lang/perl5.40` is at 5.40.5, so
builds ran with `NO_DEPENDS=yes PERL_VERSION=5.40.4` to avoid an
unrelated perl upgrade; this port does build an arch-specific `Pg.so`,
so a rebuild against 5.40.5 is worth confirming on the cluster.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Update databases/p5-DBD-Pg to version 3.21.1 and adjust port build and
test handling for the new release.

Enhancements:
- Update the DBD::Pg port to upstream version 3.21.1.

Build:
- Regenerate the Makefile patch to support the updated upstream build
configuration while preserving compiler flag handling.

Tests:
- Disable the port test target because the updated upstream suite
incorrectly plans twice when PostgreSQL is unavailable.

Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications