Bumpsnokogiri from 1.10.7 to 1.13.9.
Release notes
Sourced fromnokogiri's releases.
1.13.9 / 2022-10-18
Security
Dependencies
- [CRuby] Vendored libxml2 is updated tov2.10.3 from v2.9.14.
- [CRuby] Vendored libxslt is updated tov1.1.37 from v1.1.35.
- [CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (SeeLICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)
Fixed
- [CRuby]
Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks,@eightbitraptor and@peterzhu2118!) - [CRuby]
Document#remove_namespaces! now defers freeing the underlyingxmlNs struct until theDocument is GCed. Previously, maintaining a reference to aNamespace object that was removed in this way could lead to a segfault. [#2658]
sha256 checksums:
9b69829561d30c4461ea803baeaf3460e8b145cff7a26ce397119577a4083a02 nokogiri-1.13.9-aarch64-linux.geme76ebb4b7b2e02c72b2d1541289f8b0679fb5984867cf199d89b8ef485764956 nokogiri-1.13.9-arm64-darwin.gem15bae7d08bddeaa898d8e3f558723300137c26a2dc2632a1f89c8574c4467165 nokogiri-1.13.9-java.gemf6a1dbc7229184357f3129503530af73cc59ceba4932c700a458a561edbe04b9 nokogiri-1.13.9-x64-mingw-ucrt.gem36d935d799baa4dc488024f71881ff0bc8b172cecdfc54781169c40ec02cbdb3 nokogiri-1.13.9-x64-mingw32.gemebaf82aa9a11b8fafb67873d19ee48efb565040f04c898cdce8ca0cd53ff1a12 nokogiri-1.13.9-x86-linux.gem11789a2a11b28bc028ee111f23311461104d8c4468d5b901ab7536b282504154 nokogiri-1.13.9-x86-mingw32.gem01830e1646803ff91c0fe94bc768ff40082c6de8cfa563dafd01b3f7d5f9d795 nokogiri-1.13.9-x86_64-darwin.gem8e93b8adec22958013799c8690d81c2cdf8a90b6f6e8150ab22e11895844d781 nokogiri-1.13.9-x86_64-linux.gem96f37c1baf0234d3ae54c2c89aef7220d4a8a1b03d2675ff7723565b0a095531 nokogiri-1.13.9.gem
1.13.8 / 2022-07-23
Deprecated
XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2'sxmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use#attribute_hash instead. [#2598]
Improvements
XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node fromXML::Reader. [#2598,#2599]
Fixed
... (truncated)
Changelog
Sourced fromnokogiri's changelog.
1.13.9 / 2022-10-18
Security
Dependencies
- [CRuby] Vendored libxml2 is updated tov2.10.3 from v2.9.14.
- [CRuby] Vendored libxslt is updated tov1.1.37 from v1.1.35.
- [CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (SeeLICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)
Fixed
- [CRuby]
Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks,@eightbitraptor and@peterzhu2118!) - [CRuby]
Document#remove_namespaces! now defers freeing the underlyingxmlNs struct until theDocument is GCed. Previously, maintaining a reference to aNamespace object that was removed in this way could lead to a segfault. [#2658]
1.13.8 / 2022-07-23
Deprecated
XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2'sxmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use#attribute_hash instead. [#2598]
Improvements
XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node fromXML::Reader. [#2598,#2599]
Fixed
- [CRuby] Calling
XML::Reader#attributes is now safe to call. In Nokogiri <= 1.13.7 this method may segfault. [#2598,#2599]
1.13.7 / 2022-07-12
Fixed
XML::Node objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2578] (Thanks,@eightbitraptor!)
1.13.6 / 2022-05-08
Security
- [CRuby] AddressCVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. SeeGHSA-xh29-r2w5-wx8m for more information.
... (truncated)
Commits
897759c version bump to v1.13.9aeb1ac3 doc: update CHANGELOGc663e49 Merge pull request#2671 from sparklemotion/flavorjones-update-zlib-1.2.13_v1...212e07d ext: hack to cross-compile zlib v1.2.13 on darwin76dbc8c dep: update zlib to v1.2.1324e3a9c doc: update CHANGELOG4db3b4d Merge pull request#2668 from sparklemotion/flavorjones-namespace-scopes-comp...73d73d6 fix: Document#remove_namespaces! use-after-free bug5f58b34 fix: namespace nodes behave properly when compactedb08a858 test: repro namespace_scopes compaction issue- Additional commits viewable incompare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting@dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR@dependabot recreate will recreate this PR, overwriting any edits that have been made to it@dependabot merge will merge this PR after your CI passes on it@dependabot squash and merge will squash and merge this PR after your CI passes on it@dependabot cancel merge will cancel a previously requested merge and block automerging@dependabot reopen will reopen this PR if it is closed@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labels will set the current labels as the default for future PRs for this repo and language@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from theSecurity Alerts page.
Bumpsnokogiri from 1.10.7 to 1.13.9.
Release notes
Sourced fromnokogiri's releases.
... (truncated)
Changelog
Sourced fromnokogiri's changelog.
... (truncated)
Commits
897759cversion bump to v1.13.9aeb1ac3doc: update CHANGELOGc663e49Merge pull request#2671 from sparklemotion/flavorjones-update-zlib-1.2.13_v1...212e07dext: hack to cross-compile zlib v1.2.13 on darwin76dbc8cdep: update zlib to v1.2.1324e3a9cdoc: update CHANGELOG4db3b4dMerge pull request#2668 from sparklemotion/flavorjones-namespace-scopes-comp...73d73d6fix: Document#remove_namespaces! use-after-free bug5f58b34fix: namespace nodes behave properly when compactedb08a858test: repro namespace_scopes compaction issueDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)@dependabot use these labelswill set the current labels as the default for future PRs for this repo and language@dependabot use these reviewerswill set the current reviewers as the default for future PRs for this repo and language@dependabot use these assigneeswill set the current assignees as the default for future PRs for this repo and language@dependabot use this milestonewill set the current milestone as the default for future PRs for this repo and languageYou can disable automated security fix PRs for this repo from theSecurity Alerts page.