Update nokogiri: 1.10.2 → 1.10.9 (patch)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ nokogiri (1.10.2 → 1.10.9) · Repo · Changelog

Release Notes

1.10.9

1.10.9 / 2020-03-01

Fixed

• [MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]
• [JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, @headius!)

1.10.8

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7

1.10.7 / 2019-12-03

Bug

• [MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6

1.10.6 / 2019-12-03

Bug

• [MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

1.10.5

1.10.5 / 2019-10-31

Dependencies

• [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10
• [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

1.10.4

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915)

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

This CVE's public notice is #1915

1.10.3

1.10.3 / 2019-04-22

Security Notes

[MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in #1892. Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 40 commits:

• version bump to v1.10.9
• update CHANGELOG
• Change return type to RubyArray
• update CHANGELOG for #1985
• Work around a bug in libxml2
• version bump to v1.10.8
• update CHANGELOG for v1.10.8
• remove patches from the hoe Manifest
• update to use rake-compiler ~1.1.0
• backport libxml2 patch for CVE-2020-7595
• version bump to v1.10.7
• update CHANGELOG
• Fix the patch from #1953 to work with both `git` and `patch`
• Fix typo in generated metadata
• add gem metadata
• version bump to v1.10.6
• update CHANGELOG
• Add a patch to fix libxml2.la's path
• add security note to CHANGELOG
• version bump to v1.10.5
• update CHANGELOG
• dependency: update libxslt to 1.1.34 final
• dependency: update libxml to 2.9.10 final
• add suppressions for ruby 2.7
• update CHANGELOG with correct release date for v1.10.4
• update rake-compiler commands to install bundler
• version bump to v1.10.4
• Merge branch '1915-css-tokenizer-load-file-vulnerability_v1.10.x' into v1.10.x
• update CHANGELOG
• regenerate lexical scanner using rexical 1.0.7
• eliminate `eval` from Builder#initialize
• rufo formatting
• rubocop security scan is run as part of the `test` rake target
• add rubocop as a dev dependency
• adding a temporary pipeline for v1.10.x
• version bump to v1.10.3
• Merge pull request #1898 from sparklemotion/1892-libxslt-patch-for-usn-3947
• Backport libxslt patch for CVE-2019-11068
• Merge branch 'concourse-icons'
• ci: add icons to concourse resources

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #252.