This repository was archived by the owner on Jul 12, 2022. It is now read-only.
🚨 [security] Update nokogiri: 1.6.6.2 → 1.8.4 (minor) #18
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Author
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Welcome to Depfu 👋
This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.
After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.
Let us know if you have any questions. Thanks so much for giving Depfu a try!
You don't seem to have any Continuous Integration service set up!
Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.
This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:
depfu/.It might be necessary to once deactivate and reactivate your project in Depfu for the CI service to be properly detected.
🚨 Your version of nokogiri has known security vulnerabilities 🚨
Advisory: CVE-2018-8048
Disclosed: March 29, 2018
URL: https://github.com/sparklemotion/nokogiri/pull/1746
Revert libxml2 behavior in Nokogiri gem that could cause XSS
🚨 We recommend to merge and deploy this update as soon as possible! 🚨
We've updated a dependency and here is what you need to know:
To resolve a dependency conflict, the update changed a few other dependencies as well:
You should probably take a good look at the info here and the test results before merging this pull request, of course.
What changed?
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
From the Github release:
Thanks @wjordan!
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
✳️ jquery-rails (4.0.4 → 4.0.5) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 11 commits:
Release 4.0.5Upgrade jquery-ujs to 1.1.0Merge pull request #194 from nicolasleger/patch-1Merge pull request #195 from nicolasleger/patch-2Merge pull request #199 from benpickles/3-1-3-changelogInclude details of 3.1.3 release.Merge pull request #198 from takiy33/patch-1Remove rubyforge_project optionMerge pull request #196 from attritionorg/patch-1update copyrightMerge branch '4-0-3-sec'Commits
See the full diff on Github. The new version differs by 31 commits:
Try to be compatible with ruby 1.8Update gemspecsStop testing on 1.8, it might work thoughTravis don't know how to build these rubiesFix conversion crash on 1.9Require ruby version 2.0 or betterReduce supported ruby versionsTest newer rubiesUse 2.3.1 for testingMerge RUBY_INTEGER_UNIFICATION changesMake it interactiveEasy diffingUse ~> 2.0 test-unit that runs on 1.8 rubies as wellOnly test main 2.2 branchMove dependencies into gemspec filesCheck for existence of #to_json method before callAvoid system stack errorRemove permutation dependencyBe gone…Attempt to switch jruby into 2.0 modeAdd 2.3.0 for travis tetingAdd missing testsCall OBJECT_HANDLER for objects without #to_jsonCorrect CHANGESConvert README to markdownFix some linksSkip 1.8.4Add 2.2.3 explicitelyRemove sdoc and upgrade dependenciesBump version to 1.8.4 and add to CHANGESRemove remnants of GPL licensesRelease Notes
From the Github release:
2.2.2 / 2018-03-22
Make public
Loofah::HTML5::Scrub.force_correct_attribute_escaping!,which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 26 commits:
Bump version for releaseMerge pull request #1249 from mclark/handle-invalid-method-parametershandle failure to upcase invalid stringsStick with a passing version of Rubygems and bundlerbump version for releaseMerge pull request #1237 from eileencodes/backport-1137Backport pull request #1137 from unabridged/fix-eof-failurebump versionMerge pull request #1170 from rack/1-8-fixMerge pull request #1169 from eileencodes/fix-mistake-in-encoding-changeRuby 1.8 doesn't know about encodingsFix mistake in encoding changeBump rack version for releaseEnsure env values are ASCII 8BIT encodedBump Rack version for releaseMerge pull request #1115 from Shopify/fix-multipart-parsing-with-null-byteMerge pull request #1158 from marshall-lee/1-6-stable-backport-2f8b710Merge pull request #1080 from sophiedeziel/masterbumping versionUse Mutex instead of Thread.exclusive for reloaderCI: Refresh and repair buildsValidate the SameSite cookie optionMerge pull request #1037 from mastahyeti/backport_same_site_cookiesfirst-party cookies are now same-site cookiesFirst-Party cookies, another line of CSRF defensefix 1.8 backwards compatCommits
See the full diff on Github. The new version differs by 19 commits:
Bump gem version to prep for releaseMerge pull request #70 from Tonkpils/frozen-selector-string-fixDup selector string when extracting in case it's frozenFix jruby on travis"2.3" seems too fuzzyCurrent rails 4.2 doesn't support ruby 2.4 and 2.5CI against ruby 2.3nokogiri 1.7 requires ruby version >= 2.1.0It's because bundler is too old that bundler tries to bundle AS 5.0.0.rc2This tries to bundle activesupport 5.0.0.rc2 where we actually need 4.2.xRelease 1.0.8Allow Nokogiri 1.7Release 1.0.7Merge pull request #37 from aar0nr/readme-fixesFix Nokogiri documentation links in READMEMerge pull request #36 from tgxworld/fix_incorrect_spellingMove `CountDescribable` into `Rails::Dom::Testing::Assertions::SelectorAssertions`.Fix incorrect spelling.Dont set @html_document to not collide with ActionDispatchRelease Notes
From the Github release:
Commits
See the full diff on Github. The new version differs by 27 commits:
Prepare to 1.0.4 releaseMake sure we address CVE-2018-8048Remove rbx since it doesn't seem to install.Merge pull request #66 from fschwahn/improve-testsFix deprecation warning from MinitestMake tests pass again with recent nokogiri versionsRename test to better reflect what is actually testedtyposWe're still testing against ruby 1.9 and 2.0 that aren't supported by nokogiri 1.7activesupport 5 doesn't support ruby < 2.2.2 that are still tested in this repobundle with the newest released bundlerTest against newer released rubies[ci skip] Remove faulty overrides in scrubber example.[ci skip] Change override method in PermitScrubber.Merge pull request #47 from pvalena/patch-1Correct license filenamebumping versionconvert CDATA nodes to TEXT nodes to avoid XSS issuesDo not unescape already escaped HTML entitiesDefine a less permissive list of tags and attributesUse the image hack name instead of the indexMerge pull request #43 from maclover7/contributingAdd CONTRIBUTING.md [ci skip]Merge pull request #40 from yui-knk/refactor/permitRefactor TargetScrubberMerge pull request #36 from JuanitoFatas/fix/gemspecFix homepage uri in gemspec.Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 20 commits:
Bump version to 0.3.6Merge pull request #29 from nomoon/integer_unificationBetter comparisonFix Ruby 2.4 Integer unification deprecation error and get tests/CI functioning again.Merge pull request #26 from keithrbennett/add-concurrent-ruby-note-to-readmeModify README.md to explain that this code has been moved into the concurrent-ruby gem.Merge pull request #20 from dzjuck/remove_1_8Merge pull request #18 from dzjuck/flunk_to_failMerge pull request #17 from dzjuck/cache_values_specRemove code related to Ruby 1.8Call fail instead flunkAdd Cache#values specMerge pull request #15 from dzjuck/rspec_testsRewrite tests from minitest to rspecMerge pull request #14 from ktdreyer/minitest-reporter-optionaltests: make minitest-reporters optionalMerge pull request #13 from ktdreyer/simplecov-optionalMerge pull request #12 from ktdreyer/gemspec-summary-descriptiontests: make simplecov/coveralls optionalgemspec: switch summary and descriptionRelease Notes
From the Github release:
TZInfo v1.2.5 on RubyGems.org
Commits
See the full diff on Github. The new version differs by 47 commits:
Preparing v1.2.5.Update copyright years.Use Ruby 1.8 compatible syntax.Document that utc_offset and std_offset may be inaccurate with zoneinfo.Allow zoneinfo offset derivation to pick a negative std_offset.Don't store lazily-evaluated results if the object has been frozen.Remove unnecessary calls to Country.get in tests.Restore $SAFE after running a safe mode test (if possible).Disable Minitest's use of external diff tools during safe mode tests.Add Ruby 2.5.0 and update to the latest Ruby, JRuby and Rbx releases.Replace expired gem signing certificate.Preparing v1.2.4.Update bundler before installing gems.Use the Trusty build environment.Update to Ruby 2.2.8, 2.3.5, 2.4.2, JRuby 1.7.27, 9.1.13.0 and rbx 3.86.Ignore the leapseconds file included in v2017c+ zoneinfo directories.Preparing v1.2.3.Add releases from the 0.3 branch.Fix Markdown syntax error.Update to Ruby 2.4.1.Test strftime %z support with DateTime and Time as well as Integer.Fix handling of strftime('%::::z') on Ruby 1.8.7 on Windows.Add deprecation warnings to documentation for methods removed in v2.0.0.Document changes to strftime %z support in v2.0.0.Improve documentation for Timezone#strftime.replace %z like %Zfix %Z replacing with many percentsHandle permission denied errors when creating symlinks.Ignore the timeconfig symlink included on Slackware.Don't exclude the Factory zone in ZoneinfoDataSource.Fix TimezoneProxy UnknownTimezone exception.use a more concise syntax and avoid unnecessary objectsRemove jruby-19mode.Update copyright years.Remove :rbx section.Test on Ruby versions supported in v1.2.x.Disable test when Encoding is not available (Ruby < 1.9).Rename the first_offset variable to indicate that it contains an index.Add a test for invalid zoneinfo files with no offsets.Improved algorithm for deriving the utc_offset for zoneinfo files.Don't return binary Strings in Timezone#friendly_identifier.Compatibility with Ruby 2.3's frozen string literals.freeze some strings that are created regularlySupport changes to tar execution in Rake 10.4.Update to the latest version of gem-public_cert.pem from master.Update to the latest version of .travis.yml from master.Replace expired gem signing certificate.Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.