🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.16.2, and only if the packaged libraries are being used. If
you've overridden defaults at installation time to use system libraries
instead of packaged libraries, you should instead pay attention to your
distro's libxml2 release announcements.
Severity
The Nokogiri maintainers have evaluated this as Moderate.
Mitigation
Upgrade to Nokogiri >= 1.16.2.
Users who are unable to upgrade Nokogiri may also choose a more complicated
mitigation: compile and link Nokogiri against external libraries libxml2 >=
2.12.5 which will also address these same issues.
[CRuby] XML::Reader defaults the encoding to UTF-8 if it's not specified in either the document or as a method parameter. Previously non-ASCII characters were serialized as NCRs in this case. [#2891] (@flavorjones)
[CRuby] Restored support for compilation by GCC versions earlier than 4.6, which was broken in v1.15.0 (540e9ae). [#3090] (@adfoster-r7)
[CRuby] Patched upstream libxml2 to allow parsing HTML5 in the context of a namespaced node (e.g., foreign content like MathML). [#3112, #3116] (@flavorjones)
[CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when the maximum tree depth limit is hit. [#3098, #3100] (@stevecheckoway)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
↗️ nokogiri (indirect, 1.16.0 → 1.16.2) · Repo · Changelog
Security Advisories 🚨
🚨 Improper Handling of Unexpected Data Type in Nokogiri
Release Notes
1.16.2
1.16.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 63 commits:
version bump to v1.16.2dep: update libxml to 2.12.5 (branch v1.16.x) (#3122)dep: update libxml2 to v2.12.5dep: remove patch from #3112 which has been released upstreamversion bump to v1.16.1dev: add files to manifest ignore listbuild(deps): bump actions/{download,upload}-artifact from 3 to 4.gitignore: clangd-related filesdoc: update CHANGELOGfix: apply upstream patch for in-context parsing (#3116)fix: apply upstream patch for in-context parsingbuild(deps-dev): update rake-compiler requirement from 1.2.5 to 1.2.6 (#3114)build(deps-dev): update rubocop requirement from 1.60.1 to 1.60.2 (#3113)build(deps-dev): update rake-compiler requirement from 1.2.5 to 1.2.6build(deps-dev): update rubocop requirement from 1.60.1 to 1.60.2test: handle upstream libxml2 error message changes (#3109)test: update to handle changed libxml 2.13 error messagesbuild(deps-dev): update rubocop-minitest requirement from 0.34.4 to 0.34.5 (#3107)build(deps-dev): update minitest requirement from 5.21.1 to 5.21.2 (#3106)style(rubocop/minitest): Minitest/AssertKindOfbuild(deps): bump actions/cache from 3 to 4 (#3108)build(deps-dev): update minitest requirement from 5.21.1 to 5.21.2build(deps-dev): update rubocop-minitest requirementbuild(deps-dev): update rubocop requirement from 1.59.0 to 1.60.1 (#3105)build(deps): bump actions/cache from 3 to 4build(deps-dev): update rubocop requirement from 1.59.0 to 1.60.1fix(fuzzer): ensure a failed build will fail earlyDelay breaking out of the parse loop when max_tree_depth is hit (#3100)doc: update CONTRIBUTING with info about `test:memory_suite`build(deps-dev): update rubocop-performance requirement from 1.20.1 to 1.20.2 (#3094)build(deps-dev): update rubocop-minitest requirement from 0.34.3 to 0.34.4 (#3095)build(deps-dev): update minitest requirement from 5.20.0 to 5.21.1 (#3096)dep: update libxml2 to 2.12.4 (#3097)dep: update libxml2 to 2.12.4build(deps-dev): update minitest requirement from 5.20.0 to 5.21.1build(deps-dev): update rubocop-minitest requirementbuild(deps-dev): update rubocop-performance requirementmaintain oss-fuzz target building upstream (#3093)fix extra new lineadded missing new linemaintain oss-fuzz target building upstreamci: declare mutex_m in Gemfile; it's been removed from ruby 3.4 (#3092)test: remove unnecessary dependency on NKFci: declare mutex_m in Gemfile; it's been removed from ruby 3.4ci: drop mingw from ci.yml because it's upstream ruby-head (#3091)ci: drop mingw from ci.yml because it's upstream ruby-headdoc: update CHANGELOGAllow compilation on older gcc versions (#3090)Allow compilation on older gcc versionsci: libxml2 callstack changed, so updating the suppression (#3087)ci: libxml2 callstack changed, so updating the suppressionbuild(deps-dev): update rubocop-minitest requirement from 0.34.2 to 0.34.3 (#3086)build(deps-dev): update rubocop-minitest requirementtests: support upstream libxml (#3085)test: accept upstream libxml2 error messages for IO errorsstyle: clean up test_entity_reference.rbfix(libxml): default Reader node encoding to UTF-8 (#3084)fix(libxml): default Reader node encoding to UTF-8doc: improve XSLT::Stylesheet doc stringsdoc: note that the Reader does not recover from syntax errorstests: updated for upstream libxml support (#3083)test: accept updated libxml2 IO error messagestest: accept updated libxml2 XPath error messagesDepfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands