afo ( Alexander Fred-Ojala )

Bumps nokogiri from 1.10.9 to 1.11.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/releases">nokogiri's releases</a>.</em></p> <blockquote> <h2>1.11.5 / 2021-05-19</h2> <h3>Fixed</h3> <p>[Windows CRuby] Work around segfault at process exit on Windows when using libxml2 system DLLs.</p> <p>libxml 2.9.12 introduced new behavior to avoid memory leaks when unloading libxml2 shared libraries (see <a href="https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/66">libxml/!66</a>). Early testing caught this segfault on non-Windows platforms (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2059">#2059</a> and <a href="https://gitlab.gnome.org/GNOME/libxml2/-/commit/956534e02ef280795a187c16f6ac04e107f23c5d">libxml@956534e</a>) but it was incompletely fixed and is still an issue on Windows platforms that are using system DLLs.</p> <p>We work around this by configuring libxml2 in this situation to use its default memory management functions. Note that if Nokogiri is not on Windows, or is not using shared system libraries, it will will continue to configure libxml2 to use Ruby's memory management functions. <code>Nokogiri::VERSION_INFO["libxml"]["memory_management"]</code> will allow you to verify when the default memory management functions are being used. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2241">#2241</a>]</p> <h3>Added</h3> <p><code>Nokogiri::VERSION_INFO["libxml"]</code> now contains the key <code>"memory_management"</code> to declare whether libxml2 is using its <code>default</code> memory management functions, or whether it uses the memory management functions from <code>ruby</code>. See above for more details.</p> <h2>1.11.4 / 2021-05-14</h2> <h3>Security</h3> <p>[CRuby] Vendored libxml2 upgraded to v2.9.12 which addresses:</p> <ul> <li><a href="https://security.archlinux.org/CVE-2019-20388">CVE-2019-20388</a></li> <li><a href="https://security.archlinux.org/CVE-2020-24977">CVE-2020-24977</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3517">CVE-2021-3517</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3518">CVE-2021-3518</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3537">CVE-2021-3537</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3541">CVE-2021-3541</a></li> </ul> <p>Note that two additional CVEs were addressed upstream but are not relevant to this release. <a href="https://security.archlinux.org/CVE-2021-3516">CVE-2021-3516</a> via <code>xmllint</code> is not present in Nokogiri, and <a href="https://security.archlinux.org/CVE-2020-7595">CVE-2020-7595</a> has been patched in Nokogiri since v1.10.8 (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1992">#1992</a>).</p> <p>Please see <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64">nokogiri/GHSA-7rrm-v45f-jp64 </a> or <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2233">#2233</a> for a more complete analysis of these CVEs and patches.</p> <h3>Dependencies</h3> <ul> <li>[CRuby] vendored libxml2 is updated from 2.9.10 to 2.9.12. (Note that 2.9.11 was skipped because it was superseded by 2.9.12 a few hours after its release.)</li> </ul> <h2>1.11.3 / 2021-04-07</h2> <h3>Fixed</h3> <ul> <li>[CRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this likely segfaulted. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1900">#1900</a>]</li> <li>[JRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this raised a <code>TypeError</code> exception.</li> <li>[CRuby] arm64/aarch64 systems (like Apple's M1) can now compile libxml2 and libxslt from source (though we continue to strongly advise users to install the native gems for the best possible experience)</li> </ul> <h2>1.11.2 / 2021-03-11</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md">nokogiri's changelog</a>.</em></p> <blockquote> <h2>1.11.5 / 2021-05-19</h2> <h3>Fixed</h3> <p>[Windows CRuby] Work around segfault at process exit on Windows when using libxml2 system DLLs.</p> <p>libxml 2.9.12 introduced new behavior to avoid memory leaks when unloading libxml2 shared libraries (see <a href="https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/66">libxml/!66</a>). Early testing caught this segfault on non-Windows platforms (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2059">#2059</a> and <a href="https://gitlab.gnome.org/GNOME/libxml2/-/commit/956534e02ef280795a187c16f6ac04e107f23c5d">libxml@956534e</a>) but it was incompletely fixed and is still an issue on Windows platforms that are using system DLLs.</p> <p>We work around this by configuring libxml2 in this situation to use its default memory management functions. Note that if Nokogiri is not on Windows, or is not using shared system libraries, it will will continue to configure libxml2 to use Ruby's memory management functions. <code>Nokogiri::VERSION_INFO["libxml"]["memory_management"]</code> will allow you to verify when the default memory management functions are being used. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2241">#2241</a>]</p> <h3>Added</h3> <p><code>Nokogiri::VERSION_INFO["libxml"]</code> now contains the key <code>"memory_management"</code> to declare whether libxml2 is using its <code>default</code> memory management functions, or whether it uses the memory management functions from <code>ruby</code>. See above for more details.</p> <h2>1.11.4 / 2021-05-14</h2> <h3>Security</h3> <p>[CRuby] Vendored libxml2 upgraded to v2.9.12 which addresses:</p> <ul> <li><a href="https://security.archlinux.org/CVE-2019-20388">CVE-2019-20388</a></li> <li><a href="https://security.archlinux.org/CVE-2020-24977">CVE-2020-24977</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3517">CVE-2021-3517</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3518">CVE-2021-3518</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3537">CVE-2021-3537</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3541">CVE-2021-3541</a></li> </ul> <p>Note that two additional CVEs were addressed upstream but are not relevant to this release. <a href="https://security.archlinux.org/CVE-2021-3516">CVE-2021-3516</a> via <code>xmllint</code> is not present in Nokogiri, and <a href="https://security.archlinux.org/CVE-2020-7595">CVE-2020-7595</a> has been patched in Nokogiri since v1.10.8 (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1992">#1992</a>).</p> <p>Please see <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64">nokogiri/GHSA-7rrm-v45f-jp64 </a> or <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2233">#2233</a> for a more complete analysis of these CVEs and patches.</p> <h3>Dependencies</h3> <ul> <li>[CRuby] vendored libxml2 is updated from 2.9.10 to 2.9.12. (Note that 2.9.11 was skipped because it was superseded by 2.9.12 a few hours after its release.)</li> </ul> <h2>1.11.3 / 2021-04-07</h2> <h3>Fixed</h3> <ul> <li>[CRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this likely segfaulted. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1900">#1900</a>]</li> <li>[JRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this raised a <code>TypeError</code> exception.</li> <li>[CRuby] arm64/aarch64 systems (like Apple's M1) can now compile libxml2 and libxslt from source (though we continue to strongly advise users to install the native gems for the best possible experience)</li> </ul> <h2>1.11.2 / 2021-03-11</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e43f521caa4b29deba4089bd83ae2709c19c5942"><code>e43f521</code></a> version bump to v1.11.5</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/42354e479ae5702faa8aaa0e46a771f99fd676e6"><code>42354e4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2243">#2243</a> from sparklemotion/flavorjones-v1_11_x-update-tests-...</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/05f30eb4693cbfc900faced0b0ea172a8fc13df7"><code>05f30eb</code></a> update CHANGELOG</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e6709aaa14b8f8cd9e842bd07bb7f2edf94a4d7c"><code>e6709aa</code></a> windows: work around libxml2 xmlCleanupParser</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/8f54c0fc5a85e4d384f5dacefdfd5f595cf858a4"><code>8f54c0f</code></a> test: adjust tests to pass on system libxml2 >= 2.9.11</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/3d8a57075aebdc647728181f0fd279ed3d063857"><code>3d8a570</code></a> ci: windows config for github actions</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/4b9bfe3849f0c2ce1fb81d66249e738aa5a4f46b"><code>4b9bfe3</code></a> update CHANGELOG with the GHSA</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/9d69b44ed3357b8069856083d39ee418cd10109b"><code>9d69b44</code></a> version bump to v1.11.4</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/058e87fdfda2cc2f309df098d18fe8856e785fcc"><code>058e87f</code></a> update CHANGELOG with complete CVE information</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/92852514a0d4621961deb6ce249441ff5140358f"><code>9285251</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2234">#2234</a> from sparklemotion/2233-upgrade-to-libxml-2-9-12</li> <li>Additional commits viewable in <a href="https://github.com/sparklemotion/nokogiri/compare/v1.10.9...v1.11.5">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+5 -3

1 commit in afo/covid19/tree/dependabot/bundler/nokogiri-1.11.5 afo/covid19/tree/master

0 comment

1 changed file

pr created time in a month

create barnchafo/covid19

branch : dependabot/bundler/nokogiri-1.11.5

created branch time in a month

push eventbacktick-se/cowait-notebook-eval

Martin Jakobsson

commit sha 3873a65ee352f236b88b0beb2b89f96ff9ea174b

Reverted some more files

view details

push time in a month

push eventbacktick-se/cowait-notebook-eval

Johan Henriksson

commit sha 12f5c3eddb2a15053f468819ff99b42a930880f8

revert evaluation changes

view details

push time in a month

PublicEvent

delete branch afo/L2L2020

delete branch : dependabot/bundler/nokogiri-1.10.8

delete time in a month

PR closed afo/L2L2020

Bump nokogiri from 1.10.4 to 1.10.8 dependencies

Bumps nokogiri from 1.10.4 to 1.10.8. <details> <summary>Release notes</summary>

Sourced from nokogiri's releases.

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Bug

[MRI] Ensure the patch applied in v1.10.6 works with GNU patch. #1954

1.10.6 / 2019-12-03

Bug

[MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5 / 2019-10-31

Dependencies

[MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10

[MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

</details> <details> <summary>Changelog</summary>

Sourced from nokogiri's changelog.

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Fixed

[MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6 / 2019-12-03

Fixed

[MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5 / 2019-10-31

Security

[MRI] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs for libxslt:

CVE-2019-13117

CVE-2019-13118

CVE-2019-18197

CVE-2019-19956

More details are available at #1943.

Dependencies

[MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10

[MRI] vendored libxslt is updated from 1.1.33 to 1.1.34 </details> <details> <summary>Commits</summary>

6ce10d1 version bump to v1.10.8
2320f5b update CHANGELOG for v1.10.8
4a77fdb remove patches from the hoe Manifest
570b6cb update to use rake-compiler ~1.1.0
2cdb68e backport libxml2 patch for CVE-2020-7595
e6b3229 version bump to v1.10.7
4f9d443 update CHANGELOG
80e67ef Fix the patch from #1953 to work with both git and patch
7cf1b85 Fix typo in generated metadata
d76180d add gem metadata
Additional commits viewable in compare view </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

+2 -1

1 commit in afo/L2L2020/tree/dependabot/bundler/nokogiri-1.10.8 afo/L2L2020/tree/master

1 comment

1 changed file

dependabot[bot]

pr closed time in a month

pull request commentafo/L2L2020

Bump nokogiri from 1.10.4 to 1.10.8

Superseded by #4.

dependabot[bot]

comment created time in a month

PR opened afo/L2L2020

Bump nokogiri from 1.10.4 to 1.11.5

Bumps nokogiri from 1.10.4 to 1.11.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/releases">nokogiri's releases</a>.</em></p> <blockquote> <h2>1.11.5 / 2021-05-19</h2> <h3>Fixed</h3> <p>[Windows CRuby] Work around segfault at process exit on Windows when using libxml2 system DLLs.</p> <p>libxml 2.9.12 introduced new behavior to avoid memory leaks when unloading libxml2 shared libraries (see <a href="https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/66">libxml/!66</a>). Early testing caught this segfault on non-Windows platforms (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2059">#2059</a> and <a href="https://gitlab.gnome.org/GNOME/libxml2/-/commit/956534e02ef280795a187c16f6ac04e107f23c5d">libxml@956534e</a>) but it was incompletely fixed and is still an issue on Windows platforms that are using system DLLs.</p> <p>We work around this by configuring libxml2 in this situation to use its default memory management functions. Note that if Nokogiri is not on Windows, or is not using shared system libraries, it will will continue to configure libxml2 to use Ruby's memory management functions. <code>Nokogiri::VERSION_INFO["libxml"]["memory_management"]</code> will allow you to verify when the default memory management functions are being used. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2241">#2241</a>]</p> <h3>Added</h3> <p><code>Nokogiri::VERSION_INFO["libxml"]</code> now contains the key <code>"memory_management"</code> to declare whether libxml2 is using its <code>default</code> memory management functions, or whether it uses the memory management functions from <code>ruby</code>. See above for more details.</p> <h2>1.11.4 / 2021-05-14</h2> <h3>Security</h3> <p>[CRuby] Vendored libxml2 upgraded to v2.9.12 which addresses:</p> <ul> <li><a href="https://security.archlinux.org/CVE-2019-20388">CVE-2019-20388</a></li> <li><a href="https://security.archlinux.org/CVE-2020-24977">CVE-2020-24977</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3517">CVE-2021-3517</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3518">CVE-2021-3518</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3537">CVE-2021-3537</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3541">CVE-2021-3541</a></li> </ul> <p>Note that two additional CVEs were addressed upstream but are not relevant to this release. <a href="https://security.archlinux.org/CVE-2021-3516">CVE-2021-3516</a> via <code>xmllint</code> is not present in Nokogiri, and <a href="https://security.archlinux.org/CVE-2020-7595">CVE-2020-7595</a> has been patched in Nokogiri since v1.10.8 (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1992">#1992</a>).</p> <p>Please see <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64">nokogiri/GHSA-7rrm-v45f-jp64 </a> or <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2233">#2233</a> for a more complete analysis of these CVEs and patches.</p> <h3>Dependencies</h3> <ul> <li>[CRuby] vendored libxml2 is updated from 2.9.10 to 2.9.12. (Note that 2.9.11 was skipped because it was superseded by 2.9.12 a few hours after its release.)</li> </ul> <h2>1.11.3 / 2021-04-07</h2> <h3>Fixed</h3> <ul> <li>[CRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this likely segfaulted. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1900">#1900</a>]</li> <li>[JRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this raised a <code>TypeError</code> exception.</li> <li>[CRuby] arm64/aarch64 systems (like Apple's M1) can now compile libxml2 and libxslt from source (though we continue to strongly advise users to install the native gems for the best possible experience)</li> </ul> <h2>1.11.2 / 2021-03-11</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md">nokogiri's changelog</a>.</em></p> <blockquote> <h2>1.11.5 / 2021-05-19</h2> <h3>Fixed</h3> <p>[Windows CRuby] Work around segfault at process exit on Windows when using libxml2 system DLLs.</p> <p>libxml 2.9.12 introduced new behavior to avoid memory leaks when unloading libxml2 shared libraries (see <a href="https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/66">libxml/!66</a>). Early testing caught this segfault on non-Windows platforms (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2059">#2059</a> and <a href="https://gitlab.gnome.org/GNOME/libxml2/-/commit/956534e02ef280795a187c16f6ac04e107f23c5d">libxml@956534e</a>) but it was incompletely fixed and is still an issue on Windows platforms that are using system DLLs.</p> <p>We work around this by configuring libxml2 in this situation to use its default memory management functions. Note that if Nokogiri is not on Windows, or is not using shared system libraries, it will will continue to configure libxml2 to use Ruby's memory management functions. <code>Nokogiri::VERSION_INFO["libxml"]["memory_management"]</code> will allow you to verify when the default memory management functions are being used. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2241">#2241</a>]</p> <h3>Added</h3> <p><code>Nokogiri::VERSION_INFO["libxml"]</code> now contains the key <code>"memory_management"</code> to declare whether libxml2 is using its <code>default</code> memory management functions, or whether it uses the memory management functions from <code>ruby</code>. See above for more details.</p> <h2>1.11.4 / 2021-05-14</h2> <h3>Security</h3> <p>[CRuby] Vendored libxml2 upgraded to v2.9.12 which addresses:</p> <ul> <li><a href="https://security.archlinux.org/CVE-2019-20388">CVE-2019-20388</a></li> <li><a href="https://security.archlinux.org/CVE-2020-24977">CVE-2020-24977</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3517">CVE-2021-3517</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3518">CVE-2021-3518</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3537">CVE-2021-3537</a></li> <li><a href="https://security.archlinux.org/CVE-2021-3541">CVE-2021-3541</a></li> </ul> <p>Note that two additional CVEs were addressed upstream but are not relevant to this release. <a href="https://security.archlinux.org/CVE-2021-3516">CVE-2021-3516</a> via <code>xmllint</code> is not present in Nokogiri, and <a href="https://security.archlinux.org/CVE-2020-7595">CVE-2020-7595</a> has been patched in Nokogiri since v1.10.8 (see <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1992">#1992</a>).</p> <p>Please see <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64">nokogiri/GHSA-7rrm-v45f-jp64 </a> or <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2233">#2233</a> for a more complete analysis of these CVEs and patches.</p> <h3>Dependencies</h3> <ul> <li>[CRuby] vendored libxml2 is updated from 2.9.10 to 2.9.12. (Note that 2.9.11 was skipped because it was superseded by 2.9.12 a few hours after its release.)</li> </ul> <h2>1.11.3 / 2021-04-07</h2> <h3>Fixed</h3> <ul> <li>[CRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this likely segfaulted. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1900">#1900</a>]</li> <li>[JRuby] Passing non-<code>Node</code> objects to <code>Document#root=</code> now raises an <code>ArgumentError</code> exception. Previously this raised a <code>TypeError</code> exception.</li> <li>[CRuby] arm64/aarch64 systems (like Apple's M1) can now compile libxml2 and libxslt from source (though we continue to strongly advise users to install the native gems for the best possible experience)</li> </ul> <h2>1.11.2 / 2021-03-11</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e43f521caa4b29deba4089bd83ae2709c19c5942"><code>e43f521</code></a> version bump to v1.11.5</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/42354e479ae5702faa8aaa0e46a771f99fd676e6"><code>42354e4</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2243">#2243</a> from sparklemotion/flavorjones-v1_11_x-update-tests-...</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/05f30eb4693cbfc900faced0b0ea172a8fc13df7"><code>05f30eb</code></a> update CHANGELOG</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e6709aaa14b8f8cd9e842bd07bb7f2edf94a4d7c"><code>e6709aa</code></a> windows: work around libxml2 xmlCleanupParser</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/8f54c0fc5a85e4d384f5dacefdfd5f595cf858a4"><code>8f54c0f</code></a> test: adjust tests to pass on system libxml2 >= 2.9.11</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/3d8a57075aebdc647728181f0fd279ed3d063857"><code>3d8a570</code></a> ci: windows config for github actions</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/4b9bfe3849f0c2ce1fb81d66249e738aa5a4f46b"><code>4b9bfe3</code></a> update CHANGELOG with the GHSA</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/9d69b44ed3357b8069856083d39ee418cd10109b"><code>9d69b44</code></a> version bump to v1.11.4</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/058e87fdfda2cc2f309df098d18fe8856e785fcc"><code>058e87f</code></a> update CHANGELOG with complete CVE information</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/92852514a0d4621961deb6ce249441ff5140358f"><code>9285251</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2234">#2234</a> from sparklemotion/2233-upgrade-to-libxml-2-9-12</li> <li>Additional commits viewable in <a href="https://github.com/sparklemotion/nokogiri/compare/v1.10.4...v1.11.5">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language