🚨 [security] [ruby] Update sanitize 6.0.1 → 6.0.2 (patch)

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ sanitize (indirect, 6.0.1 → 6.0.2) · Repo · Changelog

Security Advisories 🚨

🚨 Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Impact

Using carefully crafted input, an attacker may be able to sneak
arbitrary HTML and CSS through Sanitize >= 3.0.0, < 6.0.2 when
Sanitize is configured to use the built-in "relaxed" config or
when using a custom config that allows style elements and one
or more CSS at-rules. This could result in XSS (cross-site scripting)
or other undesired behavior when the malicious HTML and CSS are
rendered in a browser.

Patches

Sanitize >= 6.0.2 performs additional escaping of CSS in style
element content, which fixes this issue.

Workarounds

Users who are unable to upgrade can prevent this issue by using a
Sanitize config that doesn't allow style elements, using a Sanitize
config that doesn't allow CSS at-rules, or by manually escaping the
character sequence </ as <\/ in style element content.

Credit

This issue was found by @cure53 during an audit of a project that
uses Sanitize and was reported by one of that project's maintainers.
Thank you!

Release Notes

6.0.2

Bug Fixes

CVE-2023-36823: Fixed an HTML+CSS sanitization bypass that could allow XSS (cross-site scripting). This issue affects Sanitize versions 3.0.0 through 6.0.1.

When using Sanitize's relaxed config or a custom config that allows <style> elements and one or more CSS at-rules, carefully crafted input could be used to sneak arbitrary HTML through Sanitize.

See the following security advisory for additional details: GHSA-f5ww-cq3m-q3g7

Thanks to @cure53 for finding this issue.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ mini_portile2 (indirect, 2.8.4 → 2.8.5) · Repo · Changelog

Release Notes

2.8.5

2.8.5 / 2023-10-22

Added

New methods #lib_path and #include_path which point at the installed directories under ports. (by @flavorjones)

Add config param for CMAKE_BUILD_TYPE, which now defaults to Release. (#136 by @Watson1978)

Experimental

Introduce experimental support for MiniPortile#mkmf_config which sets up MakeMakefile variables to properly link against the recipe. This should make it easier for C extensions to package third-party libraries. (by @flavorjones)

With no arguments, will set up just $INCFLAGS, $libs, and $LIBPATH.

Optionally, if provided a pkg-config file, will use that config to more precisely set $INCFLAGS, $libs, $LIBPATH, and $CFLAGS/$CXXFLAGS.

Optionally, if provided the name of a static archive, will rewrite linker flags to ensure correct linkage.

Note that the behavior may change slightly before official support is announced. Please comment on #118 if you have feedback.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ nokogiri (indirect, 1.15.4 → 1.15.5) · Repo · Changelog

Release Notes

1.15.5

1.15.5 / 2023-11-17

Dependencies

[CRuby] Vendored libxml2 is updated to v2.11.6 from v2.11.5. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.6
[CRuby] Vendored libxslt is updated to v1.1.39 from v1.1.38. For details please see https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.39

sha256 checksums:

6dfa1d9837ddb233e234d56e244560ab1bc545d3d1744478060e18691f44ded7  nokogiri-1.15.5-aarch64-linux.gem
e3ac6608c6e1714bc11ff04e29a43fedf4cac2aea1bd88256cc3b927c06f347f  nokogiri-1.15.5-arm-linux.gem
4d7b15d53c0397d131376a19875aa97dd1c8b404c2c03bd2171f9b77e9592d40  nokogiri-1.15.5-arm64-darwin.gem
5f87e71aaeb4f7479b94698737a0aacea77836b4805c7433b655e9565bd56cfe  nokogiri-1.15.5-java.gem
7612be800909ae51e0a7cfbe1f768757857a9ff0339686814ca67d9bae271ca2  nokogiri-1.15.5-x64-mingw-ucrt.gem
28fd78d98e12005fe017db5ceccb74b2497f30582e6e26a3344200625fe46aae  nokogiri-1.15.5-x64-mingw32.gem
0d1b564d7f148a6766380966bb48b23afa72c72c992c69c71d21acd4a7f5c0e4  nokogiri-1.15.5-x86-linux.gem
d27dbf44c19b83e570e65b660a8a921441d1e8b6063ab1b985b516f78e0a2854  nokogiri-1.15.5-x86-mingw32.gem
10bafa54935f68aebd23235cb0fc7dfb8f6f5e52131379484771247eb3a0cc70  nokogiri-1.15.5-x86_64-darwin.gem
c5d9453cc155dc15f08ac699cc1293fd994ec6cfacec48e67653aa95ee946adf  nokogiri-1.15.5-x86_64-linux.gem
22448ca35dbcbdcec60dbe25ccf452b685a5436c28f21b2fec2e20917aba9100  nokogiri-1.15.5.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ racc (indirect, 1.7.1 → 1.7.3) · Repo · Changelog

Release Notes

1.7.3

What's Changed

Exclude CRuby extension from JRuby gem by @nobu in #244

Fix for dummy rake/extensiontask.rb at ruby test-bundled-gems by @nobu in #245

Fix jar file path by @nobu in #246

Bump by @nobu in #247

Add srcs target to prepare to build by @nobu in #248

Make CI runnable for any push by @yui-knk in #249

Check rake build on CI by @yui-knk in #250

Bump up v1.7.3.pre.1 by @yui-knk in #251

Fix locations of expect param in docs by @yui-knk in #252

'lib/racc/parser-text.rb' depends on 'lib/racc/info.rb' by @yui-knk in #253

Bump up v1.7.3 by @yui-knk in #254

Full Changelog: v1.7.2...v1.7.3

1.7.2

What's Changed

Update parser.rb, fixed typo by @jwillemsen in #224

Remove leading newline from on_error exception messages. by @zenspider in #226

Add --frozen to add frozen_string_literals to top of generated files. by @zenspider in #225

Update development dependency to avoid ruby 2.5 failures by @flavorjones in #228

dep: pin development dependencies, and enable dependabot for gems by @flavorjones in #229

Clean embedded pragmas by @nobu in #230

Embed grammar file name into generated file by @yui-knk in #231

Bump actions/checkout from 3 to 4 by @dependabot in #232

Fix a typo by @yui-knk in #234

Add "Release flow" to README.rdoc by @yui-knk in #235

Prepare 1.7.2 by @nobu in #236

Remove install guide by setup.rb by @yui-knk in #237

Fix tiny typos by @makenowjust in #238

Remove old checks by @nobu in #240

Remove MANIFEST which was used by ancient extmk.rb by @nobu in #242

Extract Racc::VERSION from racc/info.rb at extconf.rb by @nobu in #241

Use prototype declarations by @nobu in #243

Bump up v1.7.2 by @yui-knk in #239

New Contributors

@makenowjust made their first contribution in #238

Full Changelog: v1.7.1...v1.7.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 67 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

sanger / samples_extraction