search

pivotal-cf / docs-book-pcfservices

May be obsolete -- it does not seem to be used for any of the services anymore.
Apache License 2.0
2 stars 6 forks source link

Bump nokogiri from 1.6.7.2 to 1.10.1 #149

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps nokogiri from 1.6.7.2 to 1.10.1.

Release notes

Sourced from nokogiri's releases.

1.10.1 / 2019-01-13

Features

Bug fixes

  • CSS selector :has() now correctly matches against any descendant. Previously this selector matched against only direct children). #350 (Thanks, @​Phrogz!)
  • NodeSet#attr now returns nil if it's empty. Previously this raised a NoMethodError.
  • [MRI] XPath errors are no longer suppressed during XSLT::Stylesheet#transform. Previously these errors were suppressed which led to silent failures and a subsequent segfault. #1802

1.10.0 / 2019-01-04

Features

  • [MRI] Cross-built Windows gems now support Ruby 2.6 [#1842, #1850]

Backwards incompatibilities

This release ends support for:

Dependencies

  • [MRI] libxml2 is updated from 2.9.8 to 2.9.9
  • [MRI] libxslt is updated from 1.1.32 to 1.1.33

v1.10.0.rc1

No release notes provided.

1.9.1 / 2018-12-17

Bug fixes

  • Fix a bug introduced in v1.9.0 where XML::DocumentFragment#dup no longer returned an instance of the callee's class, instead always returning an XML::DocumentFragment. This notably broke any subclass of XML::DocumentFragment including HTML::DocumentFragment as well as the Loofah gem's Loofah::HTML::DocumentFragment. #1846

1.9.0 / 2018-12-17

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.10.10 / 2020-07-06

Features

  • [MRI] Cross-built Windows gems now support Ruby 2.7 [#2029]. Note that prior to this release, the v1.11.x prereleases provided this support.

1.10.9 / 2020-03-01

Fixed

  • [MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]
  • [JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, @​headius!)

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Fixed

  • [MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6 / 2019-12-03

Fixed

1.10.5 / 2019-10-31

Security

[MRI] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs for libxslt:

  • CVE-2019-13117
  • CVE-2019-13118
  • CVE-2019-18197
  • CVE-2019-19956

More details are available at #1943.

... (truncated)

Commits
  • 320aadc version bump to v1.10.1
  • e515c15 update CHANGELOG for v1.10.1
  • a1b3c20 update CHANGELOG
  • c594d1d concourse: ignore changes to CHANGELOG when triggering
  • 75e9f2a Merge pull request #1860 from sparklemotion/1802-xpath2-causes-segfault-in-tr...
  • a8c032c add an <hr> to the PR template
  • 3ab0c9d ensure we trap XML errors while applying XSLT stylesheet
  • df1bfa0 issue template: note how to report security vulnerabilities
  • 9833526 update README and CONTRIBUTING with link to CoC file
  • 053b209 remove unneeded bug report template
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pivotal-cf/docs-book-pcfservices/network/alerts).
cf-gitbot commented 1 year ago

We have created an issue in Pivotal Tracker to manage this. Unfortunately, the Pivotal Tracker project is private so you may be unable to view the contents of the story.

The labels on this github issue will be updated when the story is started.