Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.
The first release in the 1.0.0 series. 🎉 For the 1.x releases, we will follow Semantic Versioning very strictly; please keep this in mind when submitting fixes/suggesting changes.
Breaking changes:
Always set CONTENT_TYPE for non-GET requests
(Per Lundberg #223)
Minor enhancements / bug fixes:
Create tempfile using the basename without extension
(Edouard Chin #201)
Save session during follow_redirect!
(Alexander Popov #218)
Document how to use URL params with DELETE method
(Timur Platonov #220)
Support recursively (deep) freezing Country and Timezone instances. #80.
Allow negative daylight savings time offsets to be derived when reading from zoneinfo files. The utc_offset and std_offset are now derived correctly for Europe/Dublin in the 2018a and 2018b releases of the Time Zone Database.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
We've updated a dependency and here is what you need to know:
Additionally, the update changed a few other dependencies as well:
You should probably take a good look at the info here and the test results before merging this pull request, of course.
What changed?
✳️ webpacker (3.0.2 → 3.5.0) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ crass (indirect, 1.0.3 → 1.0.4) · Repo · Changelog
Release Notes
From the Github release:
Commits
See the full diff on Github. The new version differs by 5 commits:
chore: Release 1.0.4
chore: Enable warnings when running tests
Address `warning: mismatched indentations at 'when' with 'case'`
Merge pull request #6 from nicolasleger/patch-1
[CI] Test against Ruby 2.5
↗️ erubi (indirect, 1.7.0 → 1.7.1) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 7 commits:
Bump version to 1.7.1
Remove one difference from README
Minor tweak to README
Bump copyright year
Make whitespace handling for <%# %> tags more compatible with Erubis (Fixes #14)
Test on ruby 2.5 on Travis
remove unnecessary ternary operation
↗️ i18n (indirect, 0.9.1 → 0.9.5) · Repo · Changelog
Release Notes
From the Github release:
Thanks @wjordan!
Commits
See the full diff on Github. The new version differs by 34 commits:
Bump to 0.9.5
Lock Rake to 12.2.x versions
Merge pull request #408 from wjordan/enforce_available_locales_false_fix
store translations for unavailable locales if enforce_available_locales is false
Bump to 0.9.4
Merge pull request #407 from fatkodima/fix-key-value-subtrees
Merge pull request #406 from jhawthorn/optimize_available_locales
Fix Chained backend with KeyValue
Optimize Backend::Simple#available_locales
Bump to 0.9.3
Merge pull request #395 from stereobooster/interpolate-for-arrays
Merge pull request #402 from fatkodima/subtrees-bug
Merge pull request #403 from fatkodima/ci-ruby2.5.0
CI against ruby 2.5.0
Fix issue with disabled subtrees and pluralization for KeyValue backend
Bump to 0.9.2
Merge pull request #400 from fatkodima/fix-t-empty-keys
Merge pull request #399 from fatkodima/fix-t-with-false
Fix translate with nil and empty keys
Fix translate with default: [false]
Merge pull request #396 from lulalala/fix-lambda-doc
Merge pull request #398 from stereobooster/oj
Use oj if available instead ActiveSupport::JSON
Document about lambda return value also being interpolated
Fix lambda document example
Remove redundant test for lookup
Fix specs for array interpolation
Add comments exaplining new array behaviour for #interpolate
Refactor interpolation method
Update interpolation.rb
Interpolate now works for array
Merge pull request #391 from stereobooster/dont-store-tr-for-locales-not-set-as-available
Fix CR notes
Don't store translations for locales not set as available
↗️ loofah (indirect, 2.1.1 → 2.2.2) · Repo · Changelog
Release Notes
From the Github release:
2.2.2 / 2018-03-22
Make public
Loofah::HTML5::Scrub.force_correct_attribute_escaping!
,which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.
Commits
See the full diff on Github. The new version differs by 47 commits:
version bump to 2.2.2
Make public `force_correct_attribute_escaping!`
use VersionInfo.instance
version bump to 2.2.1
update Manifest.txt and CHANGELOG.md
Merge branch 'flavorjones-remediate-attribute-escaping'
tests and fix for CVE-2018-8048
SECURITY.md to publish vuln reporting process
bump the fake gemspec
fix remaining rdoc format in README
fix Hoe config to use README.md
version bump to v2.2.0
finishes previous logical commit
convert README from rdoc to markdown
remove travis config
update CHANGELOG
Merge pull request #142 from eventfuel/added_list_type_style_to_css_props
whitelist CSS function `rgb`
Added list-type-style as a safe CSS property to whitelist by default (replacement for PR #137)
Merge branch 'pr136-block-level'
update CHANGELOG
tidy elements.rb, cover html5 block elements
update CHANGELOG
Merge pull request #123 from eventfuel/enable_whitelisting_css_functions
Merge pull request #141 from david-a-wheeler/doc-xxe
Merge pull request #138 from rmacklin/fix-inaccurate-example-in-readme
concourse: fix rubinius builds
Document doesn't use dangerous Nokogiri config
Fix inaccurate example in README
add html5 block-level elements
frozen-string-literal support in tests
update CHANGELOG
Merge branch '127-nested-script-tags'
handle nested script tags
update CHANGELOG
Merge pull request #131 from baopham/add-symbol
update CHANGELOG
Merge pull request #134 from MothOnMars/whitelist_main
whitelist HTML5 <main> element
concourse: remove serialness of PR builds
concourse: run PRs on all MRIs
nest non-spec tests to avoid duplicate test runs
Add symbol to list of SVG_ELEMENTS
Merge pull request #126 from aried3r/patch-1
Update CHANGELOG.md
concourse: add windows tests
jruby shouldn't be a blocker to PR success for now
↗️ minitest (indirect, 5.10.3 → 5.11.3) · Repo · Changelog
✳️ nokogiri (1.8.1 → 1.8.2) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 29 commits:
version bump to 1.8.2
update CHANGELOG
update CHANGELOG
Merge pull request #1713 from sparklemotion/flavorjones-1238-segfault-reparented-entities
ensure EntityReferences ignore malformed children
update CHANGELOG
remove hacks to discover the path to `racc`
Merge pull request #1704 from larskanis/win-ruby-2.5
Appveyor: Add ruby-2.4 and ruby-head to build matrix
Windows: Add cross build for ruby-2.5
Merge branch '1688-upgrade-libxml-to-2.9.7'
update CHANGELOG
update libxslt from 1.1.30 to 1.1.32
update libxml2 from 2.9.5 to 2.9.7
update changelog
Merge pull request #1674 from larskanis/serialize-default-utf8
update changelog
Merge pull request #1685 from jeremyevans/openbsd
Fix a couple of issues on OpenBSD
Merge pull request #1676 from andrew-aladev/character-stack-vs-string-buffer
replaced StringBuffer with StringBuilder, because we don't need synchronization in handler
replaced %i with regular array of symbols to fit ruby-1.9.3
concourse: more coverage for PRs
added tests for html and xml sax parsers that will verify the order of parsed text items
added helper document that can test a strict order of items produced by parsers
replaced character stack with string buffer, fixed characters population mechanism
concourse: windows 2.4 build
concourse: libxmlruby jobs repositioned ...
Use UTF-8 as default encoding for Node#serialize
↗️ rack (indirect, 2.0.3 → 2.0.5) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 14 commits:
Bump version for release
Merge pull request #1268 from eileencodes/forwardport-pr-1249-to-2-0-stable
Merge pull request #1249 from mclark/handle-invalid-method-parameters
Stick with a passing version of Rubygems and bundler
Leahize
Bumping version
webrick: remove concurrent-ruby dev dependency
Merge pull request #1190 from hugoabonizio/master
Merge pull request #1193 from tompng/multipart_less_memory
Merge pull request #1192 from jkowens/master
Merge pull request #1179 from tompng/master
Merge pull request #1151 from cremno/simplify-some-string-creations
Merge pull request #1189 from lugray/fix_rack_lock
Require the right file for the digest we're using
↗️ rack-proxy (indirect, 0.6.2 → 0.6.4) · Repo
Commits
See the full diff on Github. The new version differs by 7 commits:
Merge pull request #72 from danmayer/master
Update readme and examples to make it easier for other folks to make user of rack-proxy.
Merge pull request #69 from bevanloon/remove-spurious-whitespace
Merge pull request #67 from javan/patch-1
Update vulnerable rack, bump version
Remove spurious whitespace
Change homepage to GitHub URL
↗️ rack-test (indirect, 0.8.2 → 1.0.0) · Repo · Changelog
Release Notes
From the Github release:
1.0.0 / 2018-03-27
The first release in the 1.0.0 series.🎉 For the 1.x releases, we will follow Semantic Versioning very strictly; please keep this in mind when submitting fixes/suggesting changes.
Breaking changes:
(Per Lundberg #223)
Minor enhancements / bug fixes:
(Edouard Chin #201)
session
duringfollow_redirect!
(Alexander Popov #218)
(Timur Platonov #220)
Commits
See the full diff on Github. The new version differs by 15 commits:
Release v1.0.0
Create tempfile using the basename without extension: (#201)
Always set CONTENT_TYPE for non-GET requests (#223)
README.md: Removed 'require' in Gemfile
Added missing 0.8.3 commit
RFC 6265 adjustment: Delimit cookies by semicolon and single space (#221)
History.md: Added note about #220
Document how to use URL params with DELETE method (#220)
:cop: Exclude bin/ in Rubocop
Save `session` during `follow_redirect!` (#218)
README.md: Add note about Capybara incompatibility
Do not set Content-Type if params are explicitly set to nil (#212)
:cop: Change the BlockDelimieter setting
[CI] Test against Ruby 2.5 (#217)
Fix UploadedFile#new regression (#215)
↗️ rails-html-sanitizer (indirect, 1.0.3 → 1.0.4) · Repo · Changelog
Release Notes
From the Github release:
Commits
See the full diff on Github. The new version differs by 16 commits:
Prepare to 1.0.4 release
Make sure we address CVE-2018-8048
Remove rbx since it doesn't seem to install.
Merge pull request #66 from fschwahn/improve-tests
Fix deprecation warning from Minitest
Make tests pass again with recent nokogiri versions
Rename test to better reflect what is actually tested
typos
We're still testing against ruby 1.9 and 2.0 that aren't supported by nokogiri 1.7
activesupport 5 doesn't support ruby < 2.2.2 that are still tested in this repo
bundle with the newest released bundler
Test against newer released rubies
[ci skip] Remove faulty overrides in scrubber example.
[ci skip] Change override method in PermitScrubber.
Merge pull request #47 from pvalena/patch-1
Correct license filename
↗️ rake (indirect, 12.3.0 → 12.3.1) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 41 commits:
bump version to 12.3.1
Fixed rdoc style
rubocop -a
Merge pull request #262 from gfx/did_you_mean-v1.2.0
support did_you_mean >= v1.2.0 which has a breaking change on formatters
Merge pull request #252 from grzuy/fix_multitask_failures
Prefer #refute over negated #assert
Merge pull request #259 from grzuy/fix_leading_whitespaces
Keep original test case testing spaces in some arguments
Merge pull request #261 from aycabta/use-jruby-9.1.16.0
Use JRuby 9.1.16.0
Make space trimming consistent for all task arguments. Fixes #260
Merge pull request #258 from grzuy/ruby_2_5_ci
Merge pull request #254 from grzuy/remove_dup_inclusion
make AppVeyor test with ruby 2.5 also
Removes duplicated inclusion of Rake::DSL
Merge pull request #256 from ruby/avoid-install-needless-deps
To use gem install insteaad of bundle install
Merge pull request #253 from radar/patch-1
Remove date field from rake.gemspec
Don't run tasks if it depends on already invoked but failed task. Fixes #189
rubocop -a
Merge pull request #250 from dylanahsmith/re-raise-load-error-without-path
Re-raise a LoadError that didn't come from require in the test loader
Merge pull request #249 from esparta/fix_readme_minimal_ruby_version
[skip ci] Fix minimal ruby version on README
rubocop -a
Merge remote-tracking branch 'origin/v11'
prefer to use %x literal instead of back-tick
Support non-bundler environment
Merge pull request #244 from aycabta/2.5.0
Merge pull request #245 from aycabta/force-installation-bundler
Force installation Bundler
Use 2.5.0 and more latest Ruby versions
Merge pull request #242 from stomar/ftp-publishing
Add missing information on FTP publishing to README
Merge pull request #240 from aycabta/jruby-9.1.15.0
Use JRuby 9.1.15.0 on .travis.yml
Merge pull request #239 from donv/patch-1
[skip-ci] Fixed typo
bump release date
↗️ tzinfo (indirect, 1.2.4 → 1.2.5) · Repo · Changelog
Release Notes
From the Github release:
TZInfo v1.2.5 on RubyGems.org
Commits
See the full diff on Github. The new version differs by 10 commits:
Preparing v1.2.5.
Update copyright years.
Use Ruby 1.8 compatible syntax.
Document that utc_offset and std_offset may be inaccurate with zoneinfo.
Allow zoneinfo offset derivation to pick a negative std_offset.
Don't store lazily-evaluated results if the object has been frozen.
Remove unnecessary calls to Country.get in tests.
Restore $SAFE after running a safe mode test (if possible).
Disable Minitest's use of external diff tools during safe mode tests.
Add Ruby 2.5.0 and update to the latest Ruby, JRuby and Rbx releases.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.