fix: bump dash-form dated URLs on version changev1.1.3

--hintfile -V and --new -V only substituted the packaged underscore form
of the old version, so download URLs using the upstream dash form (dates
like 2026-07-07, tags) kept pointing at the old tarball and their md5
went stale. Now both the underscore and dash variants of old->new are
rewritten. exploitdb was the trigger case.

Tests T74 (--hintfile) and T75 (--new) cover the dashed-URL bump.

Release v1.1.3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

5 files changed, 65 insertions, 3 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a018b8..e7278c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,15 @@ All notable changes to this project are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.1.3] - 2026-07-07
+
+### Fixed
+- Version bump now rewrites download URLs that use the upstream `-` form of a
+  date/tag, not just the packaged `_` form. Previously a hint like exploitdb
+  (`VERSION="2026_07_07"`, `DOWNLOAD=".../2026-07-07/..."`) kept its stale URL
+  and md5 after `--hintfile -V` / `--new -V`. Both `_` and `-` variants of the
+  old→new version are now substituted.
+
 ## [1.1.2] - 2026-07-05
 
 ### Fixed
diff --git a/mkhint b/mkhint
index 80cd029..b0a7705 100755
--- a/mkhint
+++ b/mkhint
@@ -39,7 +39,7 @@ if [[ ! -d $TMP_DIR ]]; then
     mkdir $TMP_DIR
 fi
 
-readonly MKHINT_VERSION="1.1.2"
+readonly MKHINT_VERSION="1.1.3"
 
 # Variables
 VERSION=""
@@ -463,7 +463,11 @@ create_new_hint_file() {
             if [[ -n "$VERSION" ]]; then
                 local old_version
                 old_version=$(grep '^VERSION=' "$normalized_file" | sed 's/VERSION="//;s/"$//')
+                # bump both '_' and '-' variants (see update_hint_file note)
                 sed -i "s/${old_version}/${VERSION}/g" "$normalized_file"
+                if [[ "$old_version" == *_* || "$VERSION" == *_* ]]; then
+                    sed -i "s/${old_version//_/-}/${VERSION//_/-}/g" "$normalized_file"
+                fi
                 update_checksums "$normalized_file"
             fi
 
@@ -792,8 +796,14 @@ update_hint_file() {
     # Extract current version from hint file
     old_version=$(grep '^VERSION=' "$normalized_file" | sed 's/VERSION="//;s/"$//')
 
-    # Use sed for global replacement of OLD_VERSION in all variables
+    # Use sed for global replacement of OLD_VERSION in all variables.
+    # SlackBuild VERSION uses '_' but download URLs often carry the upstream
+    # '-' form (dates like 2026-07-07, tags), so bump both variants — otherwise
+    # a dated URL keeps pointing at the old tarball and its md5 goes stale.
     sed -i "s/${old_version}/${new_version}/g" "$normalized_file"
+    if [[ "$old_version" == *_* || "$new_version" == *_* ]]; then
+        sed -i "s/${old_version//_/-}/${new_version//_/-}/g" "$normalized_file"
+    fi
 
     update_checksums "$normalized_file"
 
diff --git a/mkhint.1.gz b/mkhint.1.gz
index 3f96fa3..3a40666 100644
--- a/mkhint.1.gz
+++ b/mkhint.1.gz
diff --git a/mkhint.1.md b/mkhint.1.md
index 3f87454..af22096 100644
--- a/mkhint.1.md
+++ b/mkhint.1.md
@@ -1,4 +1,4 @@
-% MKHINT(1) mkhint 1.1.2 | User Commands
+% MKHINT(1) mkhint 1.1.3 | User Commands
 % Danilo M.
 % July 2026
 
diff --git a/tests/mkhint_test.sh b/tests/mkhint_test.sh
index ff8bffc..18f0e43 100755
--- a/tests/mkhint_test.sh
+++ b/tests/mkhint_test.sh
@@ -22,6 +22,7 @@ setup() {
              "$MOCK_REPO/development/gopkg" \
              "$MOCK_REPO/development/rustpkg" \
              "$MOCK_REPO/development/mixedpkg" \
+             "$MOCK_REPO/system/datedpkg" \
              "$MOCK_HINT" \
              "$MOCK_TMP"
 
@@ -39,6 +40,21 @@ MAINTAINER="Test"
 EMAIL="test@test.com"
 EOF
 
+    # .info whose VERSION is underscore-dated but DOWNLOAD URL is dash-dated
+    # (exploitdb pattern). --new -V must bump both forms.
+    cat > "$MOCK_REPO/system/datedpkg/datedpkg.info" << 'EOF'
+PRGNAM="datedpkg"
+VERSION="2026_04_30"
+HOMEPAGE="https://example.com/"
+DOWNLOAD="https://example.com/archive/2026-04-30/datedpkg-2026-04-30.tar.gz"
+MD5SUM="abc123def456abc123def456abc123de"
+DOWNLOAD_x86_64=""
+MD5SUM_x86_64=""
+REQUIRES=""
+MAINTAINER="Test"
+EMAIL="test@test.com"
+EOF
+
     # Multiline DOWNLOAD .info
     cat > "$MOCK_REPO/development/protoc-gen-go-grpc/protoc-gen-go-grpc.info" << 'EOF'
 PRGNAM="protoc-gen-go-grpc"
@@ -1413,6 +1429,33 @@ echo "$out" | grep -q 'man mkhint' \
     && { echo "  PASS: --help points at man page"; (( PASS++ )); } \
     || { echo "  FAIL: --help missing man pointer: $out"; (( FAIL++ )); ERRORS+=("T73 pointer"); }
 
+# ── T74: --hintfile -V dash-dated URL → both '_' and '-' forms bumped ────────
+echo ""
+echo "T74: --hintfile -V dashed URL → underscore VERSION and dashed URL both bumped"
+cat > "$MOCK_HINT/datedpkg.hint" << 'EOF'
+VERSION="2026_04_30"
+ARCH="x86_64"
+DOWNLOAD="https://example.com/archive/2026-04-30/datedpkg-2026-04-30.tar.gz"
+MD5SUM="abc123def456abc123def456abc123de"
+DOWNLOAD_x86_64=""
+MD5SUM_x86_64=""
+EOF
+run_mkhint -f datedpkg -V 2026_07_07 < <(printf 'n\n')
+assert_contains       "VERSION underscore bumped"  "$MOCK_HINT/datedpkg.hint" 'VERSION="2026_07_07"'
+assert_contains       "URL dashed date bumped"     "$MOCK_HINT/datedpkg.hint" 'datedpkg-2026-07-07.tar.gz'
+assert_not_contains   "no stale dashed date"       "$MOCK_HINT/datedpkg.hint" '2026-04-30'
+assert_not_contains   "MD5SUM recalculated"        "$MOCK_HINT/datedpkg.hint" 'abc123def456'
+
+# ── T75: --new -V dash-dated .info → both forms bumped ───────────────────────
+echo ""
+echo "T75: --new -V dashed .info URL → underscore VERSION and dashed URL both bumped"
+rm -f "$MOCK_HINT/datedpkg.hint" "$MOCK_HINT/datedpkg.hint.bak"
+run_mkhint -n datedpkg -V 2026_07_07
+assert_contains       "VERSION underscore bumped"  "$MOCK_HINT/datedpkg.hint" 'VERSION="2026_07_07"'
+assert_contains       "URL dashed date bumped"     "$MOCK_HINT/datedpkg.hint" 'datedpkg-2026-07-07.tar.gz'
+assert_not_contains   "no stale dashed date"       "$MOCK_HINT/datedpkg.hint" '2026-04-30'
+assert_not_contains   "MD5SUM recalculated"        "$MOCK_HINT/datedpkg.hint" 'abc123def456'
+
 # ─── SUMMARY ──────────────────────────────────────────────────────────────────
 teardown