[JRuby] Vendored Xalan-J is updated to v2.7.3. This is the first Xalan release in nine years, and it was done to address CVE-2022-34169.
The Nokogiri maintainers wish to stress that Nokogiri users were not vulnerable to this CVE, as we explained in GHSA-qwq9-89rg-ww72, and so upgrading is really at the discretion of users.
This release was cut primarily so that JRuby users of v1.14.x can avoid vulnerability scanner alerts on earlier versions of Xalan-J.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ nokogiri (1.14.3 → 1.14.4) · Repo · Changelog
Release Notes
1.14.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 6 commits:
version bump to v1.14.4Merge pull request #2875 from sparklemotion/xalan-273_v1.14.xdep(xalan): ensure output property method is settest: updating tests to match xalan 2.7.3 behaviordep: update jar files for xalandep: update xalan to 2.7.3↗️ mini_portile2 (indirect, 2.8.1 → 2.8.2) · Repo · Changelog
Release Notes
2.8.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 9 commits:
version bump to v2.8.2Merge pull request #126 from flavorjones/flavorjones-better-config-failure-logconvert source_directory into a posix pathomit misleading version number when using source_directoryfeat: output complete logs on error, including "config.log"Merge pull request #125 from petergoldstein/feature/add_ruby_3_2_to_ciAdds Ruby 3.2 to CI. Updates checkout action version.Merge pull request #124 from flavorjones/flavorjones-update-github-actions-v3ci: update github actions to avoid node version warningsDepfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands