This repository was archived by the owner on Jul 12, 2022. It is now read-only.
🚨 [security] Update nokogiri: 1.6.6.2 → 1.10.5 (minor) #36
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Welcome to Depfu 👋
This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.
After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.
Let us know if you have any questions. Thanks so much for giving Depfu a try!
🚨 Your version of nokogiri has known security vulnerabilities 🚨
Advisory: CVE-2019-13117
Disclosed: October 31, 2019
URL: https://github.com/sparklemotion/nokogiri/issues/1943
Nokogiri gem, via libxslt, is affected by multiple vulnerabilities
🚨 We recommend to merge and deploy this update as soon as possible! 🚨
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
Release Notes
1.10.5
1.10.4
1.10.3
1.10.2
1.10.1
1.10.0
1.9.1
1.9.0
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
✳️ jquery-rails (4.0.4 → 4.0.5) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by 11 commits:
Release 4.0.5Upgrade jquery-ujs to 1.1.0Merge pull request #194 from nicolasleger/patch-1Merge pull request #195 from nicolasleger/patch-2Merge pull request #199 from benpickles/3-1-3-changelogInclude details of 3.1.3 release.Merge pull request #198 from takiy33/patch-1Remove rubyforge_project optionMerge pull request #196 from attritionorg/patch-1update copyrightMerge branch '4-0-3-sec'Commits
See the full diff on Github. The new version differs by 11 commits:
Release 6.0.4Merge pull request #439 from koic/backport-integerSupport for unified Integer class in Ruby 2.4+Merge pull request #381 from carsonreinke/function_orderUse bundled gemsRun with Ruby 2.2Improve travis configurationFix testsRelease 6.0.3Merge pull request #361 from evgenim/masterMerge pull request #377 from Eric-Guo/masterRelease Notes
0.4.2
0.4.1
0.4.0
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
0.9.5
0.9.4
0.9.3
0.9.1
0.9.0
0.8.6
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 31 commits:
Try to be compatible with ruby 1.8Update gemspecsStop testing on 1.8, it might work thoughTravis don't know how to build these rubiesFix conversion crash on 1.9Require ruby version 2.0 or betterReduce supported ruby versionsTest newer rubiesUse 2.3.1 for testingMerge RUBY_INTEGER_UNIFICATION changesMake it interactiveEasy diffingUse ~> 2.0 test-unit that runs on 1.8 rubies as wellOnly test main 2.2 branchMove dependencies into gemspec filesCheck for existence of #to_json method before callAvoid system stack errorRemove permutation dependencyBe gone…Attempt to switch jruby into 2.0 modeAdd 2.3.0 for travis tetingAdd missing testsCall OBJECT_HANDLER for objects without #to_jsonCorrect CHANGESConvert README to markdownFix some linksSkip 1.8.4Add 2.2.3 explicitelyRemove sdoc and upgrade dependenciesBump version to 1.8.4 and add to CHANGESRemove remnants of GPL licensesRelease Notes
2.3.1
2.3.0 (from changelog)
2.2.3
2.2.2
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 22 commits:
Remove SimpleCov for 2.99.3 and latermime-types 2.99.3: data release (#122)mime-types 2.99.2: data release (#119)mime-types 2.99.1: data updateUpdate History doc for 2.99Updated data file for mime-types 2.99 releaseMerge pull request #110 from mime-types/mime-types-2.99mime-types 2.99Really protect against Ruby 2.0 gemsFix coverage report for Ruby 2.0 or higherAdd a code of conductChange to fivemat outputFinalizing for release of 2.6.2.Updated MIME type definitions for 2.6.2.IANA parser: Do not include xref data when missingMerge pull request #105 from JuanitoFatas/doc/readmeMerge pull request #109 from mattbeedle/fix-typoFix typo in MIME::Type::ColumnarMerge pull request #108 from losadaem/107-each-with-object'each_with_object' passes the given object as last argument.Correct anchor for rdoc [ci skip]Fix a section link in README.rdoc [ci skip]Release Notes
5.13.0 (from changelog)
5.12.2 (from changelog)
5.12.1 (from changelog)
5.12.0 (from changelog)
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 29 commits:
Bumping version for releaseWhitelist http/https schemesMerge pull request #1296 from tomelm/fix-prefers-plaintextBump version for releaseMerge pull request #1249 from mclark/handle-invalid-method-parametershandle failure to upcase invalid stringsStick with a passing version of Rubygems and bundlerbump version for releaseMerge pull request #1237 from eileencodes/backport-1137Backport pull request #1137 from unabridged/fix-eof-failurebump versionMerge pull request #1170 from rack/1-8-fixMerge pull request #1169 from eileencodes/fix-mistake-in-encoding-changeRuby 1.8 doesn't know about encodingsFix mistake in encoding changeBump rack version for releaseEnsure env values are ASCII 8BIT encodedBump Rack version for releaseMerge pull request #1115 from Shopify/fix-multipart-parsing-with-null-byteMerge pull request #1158 from marshall-lee/1-6-stable-backport-2f8b710Merge pull request #1080 from sophiedeziel/masterbumping versionUse Mutex instead of Thread.exclusive for reloaderCI: Refresh and repair buildsValidate the SameSite cookie optionMerge pull request #1037 from mastahyeti/backport_same_site_cookiesfirst-party cookies are now same-site cookiesFirst-Party cookies, another line of CSRF defensefix 1.8 backwards compatCommits
See the full diff on Github. The new version differs by 19 commits:
Bump gem version to prep for releaseMerge pull request #70 from Tonkpils/frozen-selector-string-fixDup selector string when extracting in case it's frozenFix jruby on travis"2.3" seems too fuzzyCurrent rails 4.2 doesn't support ruby 2.4 and 2.5CI against ruby 2.3nokogiri 1.7 requires ruby version >= 2.1.0It's because bundler is too old that bundler tries to bundle AS 5.0.0.rc2This tries to bundle activesupport 5.0.0.rc2 where we actually need 4.2.xRelease 1.0.8Allow Nokogiri 1.7Release 1.0.7Merge pull request #37 from aar0nr/readme-fixesFix Nokogiri documentation links in READMEMerge pull request #36 from tgxworld/fix_incorrect_spellingMove `CountDescribable` into `Rails::Dom::Testing::Assertions::SelectorAssertions`.Fix incorrect spelling.Dont set @html_document to not collide with ActionDispatchRelease Notes
1.3.0
1.2.0
1.1.0
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 57 commits:
v1.3.0Merge pull request #102 from orien/gem-metadataAdd project metadata to the gemspecMatch Loofah's API changes.Prepare 1.2.0Remove needless white list sanitizer deprecationsMerge pull request #96 from olleolleolle/patch-1CI: Drop unused sudo: false Travis directiveMerge pull request #95 from rwojnarowski/patch-1Deprecated warning text, missing spacePrepare version 1.1.0Merge pull request #91 from JuanitoFatas/doc/scrubbersMerge pull request #92 from JuanitoFatas/link-sanitizerImprove LinkSanitizer's documentationhref is not a HTML elementImprove Scrubber documentationsMerge pull request #87 from JuanitoFatas/migrate-to-safelistMigrate to SafeListSanitizerMerge pull request #90 from JuanitoFatas/jf.fix-testsUpdate test behavior for Nokogiri > 1.9.1.Merge pull request #89 from JuanitoFatas/rubiesMerge pull request #88 from JuanitoFatas/jf.relax-bundler-dependencyUpdate Ruby version matrix on CIUse a inclusive Bundler versionMerge pull request #86 from tebs/fix-documentation-linkFix Nokogiri link in documentation[ci skip] Please don't send more PRs trying to bump Loofah.Merge pull request #71 from nicolasleger/patch-1[CI] Allow failure with ruby head[CI] Test against Ruby 2.5Prepare to 1.0.4 releaseMake sure we address CVE-2018-8048Remove rbx since it doesn't seem to install.Merge pull request #66 from fschwahn/improve-testsFix deprecation warning from MinitestMake tests pass again with recent nokogiri versionsRename test to better reflect what is actually testedtyposWe're still testing against ruby 1.9 and 2.0 that aren't supported by nokogiri 1.7activesupport 5 doesn't support ruby < 2.2.2 that are still tested in this repobundle with the newest released bundlerTest against newer released rubies[ci skip] Remove faulty overrides in scrubber example.[ci skip] Change override method in PermitScrubber.Merge pull request #47 from pvalena/patch-1Correct license filenamebumping versionconvert CDATA nodes to TEXT nodes to avoid XSS issuesDo not unescape already escaped HTML entitiesDefine a less permissive list of tags and attributesUse the image hack name instead of the indexMerge pull request #43 from maclover7/contributingAdd CONTRIBUTING.md [ci skip]Merge pull request #40 from yui-knk/refactor/permitRefactor TargetScrubberMerge pull request #36 from JuanitoFatas/fix/gemspecFix homepage uri in gemspec.Release Notes
13.0.1 (from changelog)
13.0.0 (from changelog)
12.3.3 (from changelog)
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
3.2.1
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 20 commits:
Bump version to 0.3.6Merge pull request #29 from nomoon/integer_unificationBetter comparisonFix Ruby 2.4 Integer unification deprecation error and get tests/CI functioning again.Merge pull request #26 from keithrbennett/add-concurrent-ruby-note-to-readmeModify README.md to explain that this code has been moved into the concurrent-ruby gem.Merge pull request #20 from dzjuck/remove_1_8Merge pull request #18 from dzjuck/flunk_to_failMerge pull request #17 from dzjuck/cache_values_specRemove code related to Ruby 1.8Call fail instead flunkAdd Cache#values specMerge pull request #15 from dzjuck/rspec_testsRewrite tests from minitest to rspecMerge pull request #14 from ktdreyer/minitest-reporter-optionaltests: make minitest-reporters optionalMerge pull request #13 from ktdreyer/simplecov-optionalMerge pull request #12 from ktdreyer/gemspec-summary-descriptiontests: make simplecov/coveralls optionalgemspec: switch summary and descriptionRelease Notes
1.2.5
1.2.4
1.2.3
Not all release notes shown. View the full release notes.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 47 commits:
Preparing v1.2.5.Update copyright years.Use Ruby 1.8 compatible syntax.Document that utc_offset and std_offset may be inaccurate with zoneinfo.Allow zoneinfo offset derivation to pick a negative std_offset.Don't store lazily-evaluated results if the object has been frozen.Remove unnecessary calls to Country.get in tests.Restore $SAFE after running a safe mode test (if possible).Disable Minitest's use of external diff tools during safe mode tests.Add Ruby 2.5.0 and update to the latest Ruby, JRuby and Rbx releases.Replace expired gem signing certificate.Preparing v1.2.4.Update bundler before installing gems.Use the Trusty build environment.Update to Ruby 2.2.8, 2.3.5, 2.4.2, JRuby 1.7.27, 9.1.13.0 and rbx 3.86.Ignore the leapseconds file included in v2017c+ zoneinfo directories.Preparing v1.2.3.Add releases from the 0.3 branch.Fix Markdown syntax error.Update to Ruby 2.4.1.Test strftime %z support with DateTime and Time as well as Integer.Fix handling of strftime('%::::z') on Ruby 1.8.7 on Windows.Add deprecation warnings to documentation for methods removed in v2.0.0.Document changes to strftime %z support in v2.0.0.Improve documentation for Timezone#strftime.replace %z like %Zfix %Z replacing with many percentsHandle permission denied errors when creating symlinks.Ignore the timeconfig symlink included on Slackware.Don't exclude the Factory zone in ZoneinfoDataSource.Fix TimezoneProxy UnknownTimezone exception.use a more concise syntax and avoid unnecessary objectsRemove jruby-19mode.Update copyright years.Remove :rbx section.Test on Ruby versions supported in v1.2.x.Disable test when Encoding is not available (Ruby < 1.9).Rename the first_offset variable to indicate that it contains an index.Add a test for invalid zoneinfo files with no offsets.Improved algorithm for deriving the utc_offset for zoneinfo files.Don't return binary Strings in Timezone#friendly_identifier.Compatibility with Ruby 2.3's frozen string literals.freeze some strings that are created regularlySupport changes to tar execution in Rake 10.4.Update to the latest version of gem-public_cert.pem from master.Update to the latest version of .travis.yml from master.Replace expired gem signing certificate.🆕 concurrent-ruby (added, 1.1.5)
🆕 crass (added, 1.0.5)
🆕 mini_mime (added, 1.0.2)
🆕 mini_portile2 (added, 2.4.0)
🗑️ mini_portile (removed)
👉 No CI detected
You don't seem to have any Continuous Integration service set up!
Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.
This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:
depfu/.Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands