1.13.10 / 2022-12-07

Security

[CRuby] Address CVE-2022-23476, unchecked return value from xmlTextReaderExpand. See GHSA-qv4q-mr5r-qprj for more information.

Improvements

[CRuby] XML::Reader#attribute_hash now returns nil on parse errors. This restores the behavior of #attributes from v1.13.7 and earlier. [#2715]

sha256 checksums:

777ce2e80f64772e91459b943e531dfef387e768f2255f9bc7a1655f254bbaa1  nokogiri-1.13.10-aarch64-linux.gem
b432ff47c51386e07f7e275374fe031c1349e37eaef2216759063bc5fa5624aa  nokogiri-1.13.10-arm64-darwin.gem
73ac581ddcb680a912e92da928ffdbac7b36afd3368418f2cee861b96e8c830b  nokogiri-1.13.10-java.gem
916aa17e624611dddbf2976ecce1b4a80633c6378f8465cff0efab022ebc2900  nokogiri-1.13.10-x64-mingw-ucrt.gem
0f85a1ad8c2b02c166a6637237133505b71a05f1bb41b91447005449769bced0  nokogiri-1.13.10-x64-mingw32.gem
91fa3a8724a1ce20fccbd718dafd9acbde099258183ac486992a61b00bb17020  nokogiri-1.13.10-x86-linux.gem
d6663f5900ccd8f72d43660d7f082565b7ffcaade0b9a59a74b3ef8791034168  nokogiri-1.13.10-x86-mingw32.gem
81755fc4b8130ef9678c76a2e5af3db7a0a6664b3cba7d9fe8ef75e7d979e91b  nokogiri-1.13.10-x86_64-darwin.gem
51d5246705dedad0a09b374d09cc193e7383a5dd32136a690a3cd56e95adf0a3  nokogiri-1.13.10-x86_64-linux.gem
d3ee00f26c151763da1691c7fc6871ddd03e532f74f85101f5acedc2d099e958  nokogiri-1.13.10.gem

Changelog

Sourced from nokogiri's changelog.

1.13.10 / 2022-12-07

Security

[CRuby] Address CVE-2022-23476, unchecked return value from xmlTextReaderExpand. See GHSA-qv4q-mr5r-qprj for more information.

Improvements

[CRuby] XML::Reader#attribute_hash now returns nil on parse errors. This restores the behavior of #attributes from v1.13.7 and earlier. [#2715]

Commits

4c80121 version bump to v1.13.10
85410e3 Merge pull request #2715 from sparklemotion/flavorjones-fix-reader-error-hand...
9fe0761 fix(cruby): XML::Reader#attribute_hash returns nil on error
3b9c736 Merge pull request #2717 from sparklemotion/flavorjones-lock-psych-to-fix-bui...
2efa87b test: skip large cdata test on system libxml2
3187d67 dep(dev): pin psych to v4 until v5 builds in CI
a16b4bf style(rubocop): disable Minitest/EmptyLineBeforeAssertionMethods
See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/perlun/perlun.eu.org/network/alerts).

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

perlun commented 1 year ago

Seems to fail in CI like this:

Conversion error: Jekyll::Converters::Markdown encountered an error while converting '_i18n/en/_posts/2017-03-17-new-features-in-c-sharp-6-0-and-7-0.md': Traceback (most recent call last): File "/home/runner/work/perlun.eu.org/perlun.eu.org/vendor/bundle/ruby/2.6.0/gems/pygments.rb-1.2.1/lib/pygments/mentos.py", line 303, in start res = self.get_data(method, lexer, args, kwargs, text) File "/home/runner/work/perlun.eu.org/perlun.eu.org/vendor/bundle/ruby/2.6.0/gems/pygments.rb-1.2.1/lib/pygments/mentos.py", line 167, in get_data text = text.decode('utf-8') AttributeError: 'str' object has no attribute 'decode'. Did you mean: 'encode'? During handling of the above exception, another exception occurred: Traceback (most recent call last): File "/home/runner/work/perlun.eu.org/perlun.eu.org/vendor/bundle/ruby/2.6.0/gems/pygments.rb-1.2.1/lib/pygments/mentos.py", line 348, in main() File "/home/runner/work/perlun.eu.org/perlun.eu.org/vendor/bundle/ruby/2.6.0/gems/pygments.rb-1.2.1/lib/pygments/mentos.py", line 345, in main mentos.start() File "/home/runner/work/perlun.eu.org/perlun.eu.org/vendor/bundle/ruby/2.6.0/gems/pygments.rb-1.2.1/lib/pygments/mentos.py", line 313, in start _write_error(tb) File "/home/runner/work/perlun.eu.org/perlun.eu.org/vendor/bundle/ruby/2.6.0/gems/pygments.rb-1.2.1/lib/pygments/mentos.py", line 38, in _write_error sys.stdout.write(out_header + "\n") TypeError: can't concat str to bytes

I'm really sick and tired of this website being maintained with Jekyll TBH; we should spend the time to convert it to sitegen instead: https://github.com/perlun/perlun.eu.org/issues/26

perlun commented 1 year ago

Seems to fail in CI like this:

The underlying cause is probably the change from Ubuntu 20.04 in e.g. https://github.com/perlun/perlun.eu.org/actions/runs/3535409818 to 22.04 in the CI job in this PR: https://github.com/perlun/perlun.eu.org/actions/runs/3645334300/jobs/6155393582. This change dropped Python 2.7 support entirely. We'll probably need to figure out a way to make pygments.rb-1.2.1 work on Python 3, or live with the fact that CI is permanently broken for now. 😬

(Or wait, can we just revert the Actions CI image to Ubuntu 20.04? Maybe we can. We seem to have specified runs-on: ubuntu-latest , and this was changed 4 days ago to point to Ubuntu 22.04 (https://github.com/actions/runner-images/pull/6776). That PR has the details on how to pin ourselves to Ubuntu 20.04 for now.)