Skip to content

Bump html5ever from 0.9.0 to 0.12.0#24

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/hex/html5ever-0.12.0
Closed

Bump html5ever from 0.9.0 to 0.12.0#24
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/hex/html5ever-0.12.0

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 15, 2022

Bumps html5ever from 0.9.0 to 0.12.0.

Release notes

Sourced from html5ever's releases.

v0.12.0

No release notes provided.

v0.11.0

Security

  • Add checksum verification of precompiled NIF files before extracting them to the correct location. This is to avoid supply chain attacks. With this change we added a new mix task to download all the files and generate the checksum before publishing the package. Additionally the user can download only the local NIF file with the checksum. See the RELEASE_CHECKLIST.md file for details on how we ensure this works correctly.

Removed

  • Remove support for Elixir 1.10 and below. This is to keep a policy of supporting the latest three Elixir versions.

Changed

  • Switch from thread pool to being a dirty NIF. This prevents the resulting term from having to be sent between processes, and therefore prevents an extra copy from having to be performed.
  • In the FlatSink implementation for the NIF, track children in a pool instead of allocating new vectors for every node. This significantly reduces allocator pressure while parsing, and improves performance.
  • When converting a parsed FlatSink into its term representation, use a common child node stack instead of allocating a new one for every node. This significantly reduces allocator pressure while creating terms, and improves performance.
  • Start using LTO for the NIF compilation. This reduces the build size and improves performance.

Fixed

  • Fix the target selection when using TARGET_* env vars on macOS.

Checksums

SHA256 Filename
8ba663d83766d5e0145106a532d1a0d1b115a40ec3cd88b3524c0a6dae2f2dea html5ever_nif-v0.11.0-nif-2.14-x86_64-pc-windows-gnu.dll.tar.gz
257bf1a147e5c0a36493f6f3db745690b9b1cff0e74cc56685c696279e319486 html5ever_nif-v0.11.0-nif-2.14-x86_64-pc-windows-msvc.dll.tar.gz
375c79c0f87dc707d376160fa0ca13001adc934912cb76abe0224ad74916759b html5ever_nif-v0.11.0-nif-2.15-x86_64-pc-windows-gnu.dll.tar.gz
07f9950f679ae5be853f50947272e7282e2683e53a325bff257ccb2d533e0470 html5ever_nif-v0.11.0-nif-2.15-x86_64-pc-windows-msvc.dll.tar.gz
8453d3cdb5dafe709133387b52548444ac44eca70735a7668190ef324204a7cf html5ever_nif-v0.11.0-nif-2.16-x86_64-pc-windows-gnu.dll.tar.gz
51904972b0f48afc1a64643f3a8d38389ce561eb12dfc34a9e087a63689ffc4c html5ever_nif-v0.11.0-nif-2.16-x86_64-pc-windows-msvc.dll.tar.gz
8f3e382177be3e0aebf6440b1b2ae1cde96786078dbf59cbcda1e1d79d46467b libhtml5ever_nif-v0.11.0-nif-2.14-aarch64-apple-darwin.so.tar.gz

... (truncated)

Changelog

Sourced from html5ever's changelog.

[0.12.0] - 2022-03-14

Changed

[0.11.0] - 2021-12-15

Security

  • Add checksum verification of precompiled NIF files before extracting them to the correct location. This is to avoid supply chain attacks. With this change we added a new mix task to download all the files and generate the checksum before publishing the package. Additionally the user can download only the local NIF file with the checksum. See the RELEASE_CHECKLIST.md file for details on how we ensure this works correctly.

Removed

  • Remove support for Elixir 1.10 and below. This is to keep a policy of supporting the latest three Elixir versions.

Changed

  • Switch from thread pool to being a dirty NIF. This prevents the resulting term from having to be sent between processes, and therefore prevents an extra copy from having to be performed.
  • In the FlatSink implementation for the NIF, track children in a pool instead of allocating new vectors for every node. This significantly reduces allocator pressure while parsing, and improves performance.
  • When converting a parsed FlatSink into its term representation, use a common child node stack instead of allocating a new one for every node. This significantly reduces allocator pressure while creating terms, and improves performance.
  • Start using LTO for the NIF compilation. This reduces the build size and improves performance.

Fixed

  • Fix the target selection when using TARGET_* env vars on macOS.

[0.10.1] - 2021-11-24

Fixed

  • It provides a precompiled NIF for ARM 64 bits running on Linux. This is needed for Raspberry PI 4.

... (truncated)

Commits
  • 05c9539 Release v0.12.0
  • 9ceb348 Use a more conservative version of Rustler crate
  • 7f10d99 Bump ex_doc from 0.28.1 to 0.28.2 (#52)
  • 6088d2a Bump Rustler to v0.24.0 (#54)
  • b4d788f Bump ex_doc from 0.28.0 to 0.28.1 (#51)
  • 95e1563 Improve release workflow to build in the main branch (#50)
  • 9ef4b79 Use rustler from GitHub (#49)
  • e3b3b7b Update rustler_precompiled to v0.2.0 (#48)
  • e5535d9 Replace built in precompiled module with dependency (#47)
  • b1e16b4 Bump castore from 0.1.14 to 0.1.15 (#46)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [html5ever](https://github.com/rusterlium/html5ever_elixir) from 0.9.0 to 0.12.0.
- [Release notes](https://github.com/rusterlium/html5ever_elixir/releases)
- [Changelog](https://github.com/rusterlium/html5ever_elixir/blob/master/CHANGELOG.md)
- [Commits](rusterlium/html5ever_elixir@v0.9.0...v0.12.0)

---
updated-dependencies:
- dependency-name: html5ever
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 15, 2022
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Apr 29, 2022

Superseded by #30.

@dependabot dependabot bot closed this Apr 29, 2022
@dependabot dependabot bot deleted the dependabot/hex/html5ever-0.12.0 branch April 29, 2022 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

Comments