For Cauldron, I asked for a freeze move.


Suggested advisory:
========================

The updated packages fix security vulnerabilities:

Rack has a Directory Traversal via Rack:Directory. (CVE-2026-22860)

Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href. (CVE-2026-25500)

References:
https://lists.debian.org/debian-security-announce/2026/msg00089.html
========================

Updated packages in core/updates_testing:
========================
ruby-rack-2.2.22-1.mga9
ruby-rack-doc-2.2.22-1.mga9

from SRPM:
ruby-rack-2.2.22-1.mga9.src.rpm

Whiteboard: MGA9TOO => (none)
Source RPM: ruby-rack-3.1.19-1.mga10.src.rpm, ruby-rack-2.2.21-1.mga9.src.rpm => ruby-rack-2.2.21-1.mga9.src.rpm
Status: NEW => ASSIGNED
Status comment: Fixed upstream in 3.1.20 and 2.2.22 => (none)
Assignee: bugsquad => qa-bugs
Version: Cauldron => 9
Flags: affects_mga9+ => (none)

MGA9-64 server Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 34755
$ ruby rackapp.rb
[2026-03-28 15:20:50] INFO  WEBrick 1.7.0
[2026-03-28 15:20:50] INFO  ruby 3.1.5 (2024-04-23) [x86_64-linux]
[2026-03-28 15:20:50] INFO  WEBrick::HTTPServer#start: pid=76970 port=8080
127.0.0.1 - - [28/Mar/2026:15:24:56 CET] "GET / HTTP/1.1" 200 21
- -> /
The message "A barebones rack app" appeared at localhost:8080/ in Firefox.
$ ruby function.rb
56
1
{false=>3, true=>2}
Should be good enough.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK
Flags: (none) => test_passed_mga9_64+

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2026-0075.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED