Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.
Support recursively (deep) freezing Country and Timezone instances. #80.
Allow negative daylight savings time offsets to be derived when reading from zoneinfo files. The utc_offset and std_offset are now derived correctly for Europe/Dublin in the 2018a and 2018b releases of the Time Zone Database.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
We've updated a dependency and here is what you need to know:
Additionally, the update changed a few other dependencies as well:
You should probably take a good look at the info here and the test results before merging this pull request, of course.
What changed?
✳️ devise (4.3.0 → 4.5.0) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ bcrypt (indirect, 3.1.11 → 3.1.12) · Repo · Changelog
Release Notes
From the Github release:
Commits
See the full diff on Github. The new version differs by 20 commits:
Merge pull request #172 from codahale/gem_3-1-12-rc
3.1.12 final
RC for 3.1.12 release
Merge pull request #164 from besser82/libxcrypt
Merge pull request #171 from codahale/windows_ci
Use AppVeyor for testing Windows gem installs
Merge branch 'master' into libxcrypt
Merge pull request #167 from codahale/update-lockfile
Use RBX 3
Try updating Bundler too
Merge branch 'master' into update-lockfile
Merge pull request #169 from codahale/travis_more_rubies
Test on more Rubies in CI; looser version definition
Update RG and see if that fixes the build
bcrypt_ext: Add compatibility with libxcrypt
Update lockfile so newer Ruby works with JSON gem
Merge pull request #159 from cbrnrd/patch-1
Add syntax highlighting where applicable
Merge pull request #136 from remvee/fix/remove-forgot-password-example
Remove Rails forgot password example
↗️ crass (indirect, 1.0.3 → 1.0.4) · Repo · Changelog
Release Notes
From the Github release:
Commits
See the full diff on Github. The new version differs by 5 commits:
chore: Release 1.0.4
chore: Enable warnings when running tests
Address `warning: mismatched indentations at 'when' with 'case'`
Merge pull request #6 from nicolasleger/patch-1
[CI] Test against Ruby 2.5
↗️ erubi (indirect, 1.7.0 → 1.7.1) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 7 commits:
Bump version to 1.7.1
Remove one difference from README
Minor tweak to README
Bump copyright year
Make whitespace handling for <%# %> tags more compatible with Erubis (Fixes #14)
Test on ruby 2.5 on Travis
remove unnecessary ternary operation
↗️ i18n (indirect, 0.9.1 → 0.9.5) · Repo · Changelog
Release Notes
From the Github release:
Thanks @wjordan!
Commits
See the full diff on Github. The new version differs by 34 commits:
Bump to 0.9.5
Lock Rake to 12.2.x versions
Merge pull request #408 from wjordan/enforce_available_locales_false_fix
store translations for unavailable locales if enforce_available_locales is false
Bump to 0.9.4
Merge pull request #407 from fatkodima/fix-key-value-subtrees
Merge pull request #406 from jhawthorn/optimize_available_locales
Fix Chained backend with KeyValue
Optimize Backend::Simple#available_locales
Bump to 0.9.3
Merge pull request #395 from stereobooster/interpolate-for-arrays
Merge pull request #402 from fatkodima/subtrees-bug
Merge pull request #403 from fatkodima/ci-ruby2.5.0
CI against ruby 2.5.0
Fix issue with disabled subtrees and pluralization for KeyValue backend
Bump to 0.9.2
Merge pull request #400 from fatkodima/fix-t-empty-keys
Merge pull request #399 from fatkodima/fix-t-with-false
Fix translate with nil and empty keys
Fix translate with default: [false]
Merge pull request #396 from lulalala/fix-lambda-doc
Merge pull request #398 from stereobooster/oj
Use oj if available instead ActiveSupport::JSON
Document about lambda return value also being interpolated
Fix lambda document example
Remove redundant test for lookup
Fix specs for array interpolation
Add comments exaplining new array behaviour for #interpolate
Refactor interpolation method
Update interpolation.rb
Interpolate now works for array
Merge pull request #391 from stereobooster/dont-store-tr-for-locales-not-set-as-available
Fix CR notes
Don't store translations for locales not set as available
↗️ loofah (indirect, 2.1.1 → 2.2.2) · Repo · Changelog
Release Notes
From the Github release:
2.2.2 / 2018-03-22
Make public
Loofah::HTML5::Scrub.force_correct_attribute_escaping!
,which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.
Commits
See the full diff on Github. The new version differs by 47 commits:
version bump to 2.2.2
Make public `force_correct_attribute_escaping!`
use VersionInfo.instance
version bump to 2.2.1
update Manifest.txt and CHANGELOG.md
Merge branch 'flavorjones-remediate-attribute-escaping'
tests and fix for CVE-2018-8048
SECURITY.md to publish vuln reporting process
bump the fake gemspec
fix remaining rdoc format in README
fix Hoe config to use README.md
version bump to v2.2.0
finishes previous logical commit
convert README from rdoc to markdown
remove travis config
update CHANGELOG
Merge pull request #142 from eventfuel/added_list_type_style_to_css_props
whitelist CSS function `rgb`
Added list-type-style as a safe CSS property to whitelist by default (replacement for PR #137)
Merge branch 'pr136-block-level'
update CHANGELOG
tidy elements.rb, cover html5 block elements
update CHANGELOG
Merge pull request #123 from eventfuel/enable_whitelisting_css_functions
Merge pull request #141 from david-a-wheeler/doc-xxe
Merge pull request #138 from rmacklin/fix-inaccurate-example-in-readme
concourse: fix rubinius builds
Document doesn't use dangerous Nokogiri config
Fix inaccurate example in README
add html5 block-level elements
frozen-string-literal support in tests
update CHANGELOG
Merge branch '127-nested-script-tags'
handle nested script tags
update CHANGELOG
Merge pull request #131 from baopham/add-symbol
update CHANGELOG
Merge pull request #134 from MothOnMars/whitelist_main
whitelist HTML5 <main> element
concourse: remove serialness of PR builds
concourse: run PRs on all MRIs
nest non-spec tests to avoid duplicate test runs
Add symbol to list of SVG_ELEMENTS
Merge pull request #126 from aried3r/patch-1
Update CHANGELOG.md
concourse: add windows tests
jruby shouldn't be a blocker to PR success for now
↗️ minitest (indirect, 5.10.3 → 5.11.3) · Repo · Changelog
✳️ nokogiri (1.8.1 → 1.8.4) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rack (indirect, 2.0.3 → 2.0.5) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 14 commits:
Bump version for release
Merge pull request #1268 from eileencodes/forwardport-pr-1249-to-2-0-stable
Merge pull request #1249 from mclark/handle-invalid-method-parameters
Stick with a passing version of Rubygems and bundler
Leahize
Bumping version
webrick: remove concurrent-ruby dev dependency
Merge pull request #1190 from hugoabonizio/master
Merge pull request #1193 from tompng/multipart_less_memory
Merge pull request #1192 from jkowens/master
Merge pull request #1179 from tompng/master
Merge pull request #1151 from cremno/simplify-some-string-creations
Merge pull request #1189 from lugray/fix_rack_lock
Require the right file for the digest we're using
↗️ rack-test (indirect, 0.8.2 → 1.1.0) · Repo · Changelog
Release Notes
From the Github release:
1.1.0 / 2018-07-21
Breaking changes:
Minor enhancements / new functionality:
follow_direct
: Includerack.session.options
(Mark Edmondson #233)Bug fixes:
Commits
See the full diff on Github. The new version differs by 20 commits:
Release 1.1.0
Add simplecov (#227)
Follow relative locations correctly. Fixes #228 (#230)
follow_direct: Include rack.session.options (#233)
Added configuration for Stale (#232)
Release v1.0.0
Create tempfile using the basename without extension: (#201)
Always set CONTENT_TYPE for non-GET requests (#223)
README.md: Removed 'require' in Gemfile
Added missing 0.8.3 commit
RFC 6265 adjustment: Delimit cookies by semicolon and single space (#221)
History.md: Added note about #220
Document how to use URL params with DELETE method (#220)
:cop: Exclude bin/ in Rubocop
Save `session` during `follow_redirect!` (#218)
README.md: Add note about Capybara incompatibility
Do not set Content-Type if params are explicitly set to nil (#212)
:cop: Change the BlockDelimieter setting
[CI] Test against Ruby 2.5 (#217)
Fix UploadedFile#new regression (#215)
↗️ rails-html-sanitizer (indirect, 1.0.3 → 1.0.4) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 16 commits:
Prepare to 1.0.4 release
Make sure we address CVE-2018-8048
Remove rbx since it doesn't seem to install.
Merge pull request #66 from fschwahn/improve-tests
Fix deprecation warning from Minitest
Make tests pass again with recent nokogiri versions
Rename test to better reflect what is actually tested
typos
We're still testing against ruby 1.9 and 2.0 that aren't supported by nokogiri 1.7
activesupport 5 doesn't support ruby < 2.2.2 that are still tested in this repo
bundle with the newest released bundler
Test against newer released rubies
[ci skip] Remove faulty overrides in scrubber example.
[ci skip] Change override method in PermitScrubber.
Merge pull request #47 from pvalena/patch-1
Correct license filename
↗️ rake (indirect, 12.3.0 → 12.3.1) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 41 commits:
bump version to 12.3.1
Fixed rdoc style
rubocop -a
Merge pull request #262 from gfx/did_you_mean-v1.2.0
support did_you_mean >= v1.2.0 which has a breaking change on formatters
Merge pull request #252 from grzuy/fix_multitask_failures
Prefer #refute over negated #assert
Merge pull request #259 from grzuy/fix_leading_whitespaces
Keep original test case testing spaces in some arguments
Merge pull request #261 from aycabta/use-jruby-9.1.16.0
Use JRuby 9.1.16.0
Make space trimming consistent for all task arguments. Fixes #260
Merge pull request #258 from grzuy/ruby_2_5_ci
Merge pull request #254 from grzuy/remove_dup_inclusion
make AppVeyor test with ruby 2.5 also
Removes duplicated inclusion of Rake::DSL
Merge pull request #256 from ruby/avoid-install-needless-deps
To use gem install insteaad of bundle install
Merge pull request #253 from radar/patch-1
Remove date field from rake.gemspec
Don't run tasks if it depends on already invoked but failed task. Fixes #189
rubocop -a
Merge pull request #250 from dylanahsmith/re-raise-load-error-without-path
Re-raise a LoadError that didn't come from require in the test loader
Merge pull request #249 from esparta/fix_readme_minimal_ruby_version
[skip ci] Fix minimal ruby version on README
rubocop -a
Merge remote-tracking branch 'origin/v11'
prefer to use %x literal instead of back-tick
Support non-bundler environment
Merge pull request #244 from aycabta/2.5.0
Merge pull request #245 from aycabta/force-installation-bundler
Force installation Bundler
Use 2.5.0 and more latest Ruby versions
Merge pull request #242 from stomar/ftp-publishing
Add missing information on FTP publishing to README
Merge pull request #240 from aycabta/jruby-9.1.15.0
Use JRuby 9.1.15.0 on .travis.yml
Merge pull request #239 from donv/patch-1
[skip-ci] Fixed typo
bump release date
↗️ tzinfo (indirect, 1.2.4 → 1.2.5) · Repo · Changelog
Release Notes
From the Github release:
TZInfo v1.2.5 on RubyGems.org
Commits
See the full diff on Github. The new version differs by 10 commits:
Preparing v1.2.5.
Update copyright years.
Use Ruby 1.8 compatible syntax.
Document that utc_offset and std_offset may be inaccurate with zoneinfo.
Allow zoneinfo offset derivation to pick a negative std_offset.
Don't store lazily-evaluated results if the object has been frozen.
Remove unnecessary calls to Country.get in tests.
Restore $SAFE after running a safe mode test (if possible).
Disable Minitest's use of external diff tools during safe mode tests.
Add Ruby 2.5.0 and update to the latest Ruby, JRuby and Rbx releases.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.