Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri

[dependabot]

Bumps activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri. These dependencies needed to be updated together.
Updates activesupport from 2.3.8 to 7.0.4.2

Release notes

Sourced from activesupport's releases.

v7.0.4.2

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Fix domain: :all for two letter TLD

  This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 7.0.4.2 (January 24, 2023)

• No changes.

Rails 7.0.4.1 (January 17, 2023)

• Avoid regex backtracking in Inflector.underscore

  [CVE-2023-22796]

Rails 7.0.4 (September 09, 2022)

• Redis cache store is now compatible with redis-rb 5.0.

  Jean Boussier

• Fix NoMethodError on custom ActiveSupport::Deprecation behavior.

  ActiveSupport::Deprecation.behavior= was supposed to accept any object that responds to call, but in fact its internal implementation assumed that this object could respond to arity, so it was restricted to only Proc objects.

  This change removes this arity restriction of custom behaviors.

  Ryo Nakamura

Rails 7.0.3.1 (July 12, 2022)

• No changes.

Rails 7.0.3 (May 09, 2022)

• No changes.

Rails 7.0.2.4 (April 26, 2022)

• Fix and add protections for XSS in ActionView::Helpers and ERB::Util.

  Add the method ERB::Util.xml_name_escape to escape dangerous characters in names of tags and names of attributes, following the specification of XML.

  Álvaro Martín Fraguas

Rails 7.0.2.3 (March 08, 2022)

... (truncated)

Commits

• 7c70791 Version 7.0.4.2
• 23e0345 Version 7.0.4.1
• 2164d4f Avoid regex backtracking in Inflector.underscore
• 8015c2c Version 7.0.4
• ff27758 Revert "Merge pull request #44695 from Edouard-chin/ec-tagger-logger-broadcast"
• 4a1f224 Merge pull request #45882 from rails/short-inspect-on-test-case
• a3bd3b5 Backport Redis 5.0 compatibility
• 67f37ac Fix flaky tests for RedisCacheStore
• c520e38 Document AS::Cache::MemCacheStore#write options [ci-skip]
• a74b650 Document AS::Cache::Store#initialize options [ci-skip]
• Additional commits viewable in compare view

Updates rails from 2.3.8 to 7.0.4.2

Release notes

Sourced from rails's releases.

v7.0.4.2

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Fix domain: :all for two letter TLD

  This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

... (truncated)

Commits

• 7c70791 Version 7.0.4.2
• 1d6de16 Merge pull request #47087 from jhawthorn/cookie_domain
• 23e0345 Version 7.0.4.1
• d7aba06 Make sanitize_as_sql_comment more strict
• 8d82687 Avoid regex backtracking on If-None-Match header
• 2164d4f Avoid regex backtracking in Inflector.underscore
• cd46b0e Use string#split instead of regex for domain parts
• e50e26d Fix sec issue with _url_host_allowed?
• 82bcdc0 Added integer width check to PostgreSQL::Quoting
• 8015c2c Version 7.0.4
• Additional commits viewable in compare view

Updates actionmailer from 2.3.8 to 7.0.4.2

Release notes

Sourced from actionmailer's releases.

v7.0.4.2

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Fix domain: :all for two letter TLD

  This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

... (truncated)

Changelog

Sourced from actionmailer's changelog.

Rails 7.0.4.2 (January 24, 2023)

• No changes.

Rails 7.0.4.1 (January 17, 2023)

• No changes.

Rails 7.0.4 (September 09, 2022)

• No changes.

Rails 7.0.3.1 (July 12, 2022)

• No changes.

Rails 7.0.3 (May 09, 2022)

• No changes.

Rails 7.0.2.4 (April 26, 2022)

• No changes.

Rails 7.0.2.3 (March 08, 2022)

• No changes.

Rails 7.0.2.2 (February 11, 2022)

• No changes.

Rails 7.0.2.1 (February 11, 2022)

• No changes.

Rails 7.0.2 (February 08, 2022)

• No changes.

... (truncated)

Commits

• 7c70791 Version 7.0.4.2
• 23e0345 Version 7.0.4.1
• 8015c2c Version 7.0.4
• 04972d9 Preparing for 7.0.3.1 release
• 0c68c1f updating version and changelog
• 3872bc0 Preparing for 7.0.3 release
• ae98f49 Merge pull request #44777 from jean-francois-labbe/main
• c204039 Merge branch '7-0-sec' into 7-0-stable
• 3520cc7 Preparing for 7.0.2.4 release
• f2f7900 updating changelog for release
• Additional commits viewable in compare view

Updates actionpack from 2.3.8 to 7.0.4.2

Release notes

Sourced from actionpack's releases.

v7.0.4.2

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Fix domain: :all for two letter TLD

  This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 7.0.4.2 (January 24, 2023)

• Fix domain: :all for two letter TLD

  This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Rails 7.0.4.1 (January 17, 2023)

• Fix sec issue with _url_host_allowed?

  Disallow certain strings from _url_host_allowed? to avoid a redirect to malicious sites.

  [CVE-2023-22797]

• Avoid regex backtracking on If-None-Match header

  [CVE-2023-22795]

• Use string#split instead of regex for domain parts

  [CVE-2023-22792]

Rails 7.0.4 (September 09, 2022)

• Prevent ActionDispatch::ServerTiming from overwriting existing values in Server-Timing.

  Previously, if another middleware down the chain set Server-Timing header, it would overwritten by ActionDispatch::ServerTiming.

  Jakub Malinowski

Rails 7.0.3.1 (July 12, 2022)

• No changes.

Rails 7.0.3 (May 09, 2022)

• Allow relative redirects when raise_on_open_redirects is enabled.

  Tom Hughes

• Fix authenticate_with_http_basic to allow for missing password.

... (truncated)

Commits

• 7c70791 Version 7.0.4.2
• 1d6de16 Merge pull request #47087 from jhawthorn/cookie_domain
• 23e0345 Version 7.0.4.1
• 8d82687 Avoid regex backtracking on If-None-Match header
• cd46b0e Use string#split instead of regex for domain parts
• e50e26d Fix sec issue with _url_host_allowed?
• 8015c2c Version 7.0.4
• f3c345e Merge pull request #45964 from jhawthorn/server_timing_safety
• 4d25c64 Merge pull request #45221 from jhawthorn/ac_params_eql_fix
• 47cff40 Format inline code [ci-skip]
• Additional commits viewable in compare view

Updates activerecord from 2.3.8 to 7.0.4.2

Release notes

Sourced from activerecord's releases.

v7.0.4.2

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Fix domain: :all for two letter TLD

  This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 7.0.4.2 (January 24, 2023)

• No changes.

Rails 7.0.4.1 (January 17, 2023)

• Make sanitize_as_sql_comment more strict

  Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

  This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

  This also clarifies in the documentation of annotate that it should not be provided user input.

  [CVE-2023-22794]

• Added integer width check to PostgreSQL::Quoting

  Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

  This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

  [CVE-2022-44566]

Rails 7.0.4 (September 09, 2022)

• Symbol is allowed by default for YAML columns

  Étienne Barrié

• Fix ActiveRecord::Store to serialize as a regular Hash

  Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess which is wasteful and cause problem with YAML safe_load.

  Jean Boussier

• Add timestamptz as a time zone aware type for PostgreSQL

... (truncated)

Commits

• 7c70791 Version 7.0.4.2
• 23e0345 Version 7.0.4.1
• d7aba06 Make sanitize_as_sql_comment more strict
• 82bcdc0 Added integer width check to PostgreSQL::Quoting
• 8015c2c Version 7.0.4
• 4d9b4b4 Merge pull request #45872 from the-spectator/correct_hwia_encoding
• c5a407d Linkify code references [ci-skip]
• e874cf5 Fix typos [ci-skip]
• fb09b1b Don't handle this change for legacy_connection_handling
• 0667ba4 Merge pull request #45773 from eileencodes/only-setup-shared-pools-if-we-have...
• Additional commits viewable in compare view

Updates activeresource from 2.3.8 to 6.0.0

Release notes

Sourced from activeresource's releases.

6.0.0

Breaking changes

• Drop support to Ruby < 2.6 and Rails < 6.0

What's Changed

• Create PreconditionFailed (412) exception by @​bbraschi in rails/activeresource#302
• Adds TooManyRequests (429) exception by @​bradleypriest in rails/activeresource#304
• Fix active job serializer railtie by @​gmcgibbon in rails/activeresource#310
• Fix Rails 6.1 compatibility by @​casperisfine in rails/activeresource#335
• Set frozen_string_literal: true in the generated code by @​casperisfine in rails/activeresource#336
• Stop using the deprecated URI.parser by @​casperisfine in rails/activeresource#338
• Fix the missed URI.parser references by @​casperisfine in rails/activeresource#339
• Fix find_every instantiating records from symbol and string without prefix_options by @​ivan05almeida in rails/activeresource#348
• Add support to set bearer token connection through Base class by @​ivan05almeida in rails/activeresource#345
• Fixed multi-threading race condition issue by @​marisveide in rails/activeresource#349
• Fixed ActiveResource::ConnectionError#to_s to return a message which … by @​faultier92 in rails/activeresource#353
• Stop requiring the useless and deprecated core_ext/uri by @​casperisfine in rails/activeresource#366
• Changing headers on base class doesn't change them in subclasses by @​adrien-k in rails/activeresource#359

New Contributors

• @​bbraschi made their first contribution in rails/activeresource#302
• @​maurcarvalho made their first contribution in rails/activeresource#307
• @​bradleypriest made their first contribution in rails/activeresource#304
• @​pilaf made their first contribution in rails/activeresource#315
• @​eitoball made their first contribution in rails/activeresource#306
• @​okuramasafumi made their first contribution in rails/activeresource#320
• @​larouxn made their first contribution in rails/activeresource#321
• @​maria-kravtsova made their first contribution in rails/activeresource#323
• @​casperisfine made their first contribution in rails/activeresource#335
• @​ivan05almeida made their first contribution in rails/activeresource#348
• @​marisveide made their first contribution in rails/activeresource#349
• @​faultier92 made their first contribution in rails/activeresource#353
• @​luk4s made their first contribution in rails/activeresource#356
• @​jbampton made their first contribution in rails/activeresource#357
• @​filabreu made their first contribution in rails/activeresource#364
• @​aclemons made their first contribution in rails/activeresource#367
• @​obahareth made their first contribution in rails/activeresource#373
• @​adrien-k made their first contribution in rails/activeresource#359

Full Changelog: rails/activeresource@v5.1.1...v6.0.0

5.1.0

• Improve support of Active Resource objects inside fibers.

• Add support to Active Model Serializers.

• Fix error when trying to parse nil as a JSON response.

... (truncated)

Commits

• See full diff in compare view

Updates rack from 1.1.0 to 2.2.6.2

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[Unreleased]

SPEC Changes

• rack.input is now optional. (#1997, [@​ioquatix])

Changed

• rack.input is now optional, and if missing, will raise an error. Use this to fail on multipart parsing a request without an input body. (#2018, [@​ioquatix])
• Introduce module Rack::BadRequest which is included in multipart and query parser errors. (#2019, [@​ioquatix])

[3.0.4.1] - 2023-01-17

• [CVE-2022-44571] Fix ReDoS vulnerability in multipart parser
• [CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges
• [CVE-2022-44572] Forbid control characters in attributes (also ReDoS)

[3.0.4] - 2023-01-17

• Rack::Request#POST should consistently raise errors. Cache errors that occur when invoking Rack::Request#POST so they can be raised again later. (#2010, [@​ioquatix])
• Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH. (#2007, @​byroot)
• Extend Rack::MethodOverride to handle QueryParser::ParamsTooDeepError error. (#2006, @​byroot)

[3.0.3] - 2022-12-27

Fixed

• Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @​weizheheng)

[3.0.2] -2022-12-05

Fixed

• Utils.build_nested_query URL-encodes nested field names including the square brackets.
• Allow Rack::Response to pass through streaming bodies. (#1993, [@​ioquatix])

[3.0.1] - 2022-11-18

Fixed

• MethodOverride does not look for an override if a request does not include form/parseable data.
• Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call and to_path, forwarding to the body. (#1981, [@​ioquatix])

[3.0.0] - 2022-09-06

• No changes

... (truncated)

Commits

• 2606ac5 bumping version
• f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges
• 20bc90c bump version
• 3677f17 Update changelog
• ee25ab9 Fix ReDoS vulnerability in multipart parser
• 19e49f0 Forbid control characters in attributes
• ea39e49 Bump patch version.
• c0f9de4 Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2011)
• 8312a2f Remove leading dot to fix compatibility with latest cgi gem. (#1988)
• 2a82c88 Update tests to work on latest Rubies. (#1999)
• Additional commits viewable in compare view

Updates rake from 0.8.7 to 13.0.6

Release notes

Sourced from rake's releases.

rake-10.1.1

Full Changelog: ruby/rake@rake-10.1.0.beta.3...rake-10.1.1

rake-10.1.0

Full Changelog: ruby/rake@rake-10.0.4...rake-10.1.0

rake-10.1.0.beta.3

Full Changelog: ruby/rake@rake-10.1.0.beta.2...rake-10.1.0.beta.3

rake-10.1.0.beta.2

Full Changelog: ruby/rake@rake-10.1.0.beta.1...rake-10.1.0.beta.2

rake-10.1.0.beta.1

Full Changelog: ruby/rake@rake-10.0.4...rake-10.1.0.beta.1

rake-10.0.4

Full Changelog: ruby/rake@rake-10.0.3...rake-10.0.4

rake-10.0.3

Full Changelog: ruby/rake@rake-10.0.2...rake-10.0.3

rake-10.0.2

Full Changelog: ruby/rake@rake-10.0.1...rake-10.0.2

rake-10.0.1

Full Changelog: ruby/rake@rake-10.0.0.beta.2...rake-10.0.1

rake-10.0.0

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-10.0.0

rake-10.0.0.beta.2

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-10.0.0.beta.2

rake-0.9.6

Full Changelog: ruby/rake@rake-0.9.5...rake-0.9.6

rake-0.9.5

Full Changelog: ruby/rake@rake-0.9.4...rake-0.9.5

rake-0.9.4

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-0.9.4

rake-0.9.3

Full Changelog: ruby/rake@rake-0.9.2...rake-0.9.3

rake-0.9.3.beta.3

Full Changelog: ruby/rake@rake-0.9.3.beta.2...rake-0.9.3.beta.3

rake-0.9.3.beta.2

Full Changelog: ruby/rake@rake-0.9.3.beta.1...rake-0.9.3.beta.2

... (truncated)

Changelog

Sourced from rake's changelog.

=== 13.0.6

• Additional fix for #389 Pull request #390 by hsbt

=== 13.0.5

• Fixed the regression of #388 Pull request #389 by hsbt

=== 13.0.4

• Fix rake test loader swallowing useful error information. Pull request #367 by deivid-rodriguez
• Add -C/--directory option the same as GNU make. Pull request #376 by nobu

=== 13.0.3

• Fix breaking change of execution order on TestTask. Pull request #368 by ysakasin

=== 13.0.2

==== Enhancements

• Fix tests to work with current FileUtils Pull Request #358 by jeremyevans
• Simplify default rake test loader Pull Request #357 by deivid-rodriguez
• Update rdoc Pull Request #366 by bahasalien
• Update broken links to rake articles from Avdi in README Pull Request #360 by svl7

=== 13.0.1

==== Bug fixes

• Fixed bug: Reenabled task raises previous exception on second invokation Pull Request #271 by thorsteneckel
• Fix an incorrectly resolved arg pattern Pull Request #327 by mjbellantoni

=== 13.0.0

==== Enhancements

• Follows recent changes on keyword arguments in ruby 2.7. Pull Request #326 by nobu

... (truncated)

Commits

• 5c60da8 Bump up Rake-13.0.6
• 73d4099 Merge pull request #390 from ruby/fix-388-again
• 63aacb6 Added Rake namespace explicitly
• 29a3949 Bump version to v13.0.5
• 3a95f4c Merge pull request #389 from ruby/fix-388
• 85c55b4 Fixed the regression of #388
• 72ac796 History for rake-13.0.4
• b20de78 Bump version to 13.0.4
• a07e637 Merge pull request #386 from ruby/cleanup
• 0acc575 Use require_relative to specify release version
• Additional commits viewable in compare view

Updates feedzirra from 0.0.24 to 0.8.0

Changelog

Sourced from feedzirra's changelog.

Feedjira Changelog

3.2.2

• Fix time handling again usec is not a timezone

• Update rubocop * drop official support for eol Ruby

3.2.1

• Fix time handling in ruby 3.1

• Atom feeds now have an icon field via feedjira/feedjira#452 (@​jswanner)

3.2.0

• Atom feed_url no longer falls back to url via feedjira/feedjira#451 (@​frederfred)

• Atom feeds now have an icon field via feedjira/feedjira#452 (@​jswanner)

3.1.2

• Enhancements
  • Alias managingEditor as managing_editor #443[] ([@​DominikAlberski][])
  • Add support for the a10 namespace used in RSS 2.0 feeds generated by .NET applications. Currently a10:link, a10:updated, a10:content and a10:name are supported. #440[] ([@​knu][])

#440: feedjira/feedjira#440 #443: feedjira/feedjira#443

3.1.1

• Enhancements

  • Fix warnings in Ruby 2.7 #434[] ([@​sferik][])

• General

  • Test on Ruby 2.5, 2.6 and 2.7 #435[] ([@​HParker][])

#434: feedjira/feedjira#434 #435: feedjira/feedjira#435

3.1.0

• Breaking Changes

  • title of Atom entry classes always return a plain text even in case the entry has a title of the HTML or XML type. #423[] ([@​knu][])

• Enhancements

  • raw_title and title_type are added to Atom entry classes. #423[] ([@​knu][])
  • AtomGoogleAlerts is now a supported parser #424[] ([@​knu][])

... (truncated)

Commits

• 5ca1a2c Deprecate Feedzirra, use Feedjira instead
• 18832a8 Update CHANGELOG for 0.7.1
• 35baab5 Bump version for 0.7.1
• 293b49a be a new entry if feed not have entry id and only difference is a url
• 6e075a8 Update CHANGELOG for 0.7.0
• 0f863b1 Bump version for 0.7.0
• e614278 Bugfix for parsing dates that are ISO 8601 with milliseconds
• d552496 On failure callbacks get curl and error as args
• 260a979 Move call_on_failure to private method
• 801b978 Fix tests for #194
• Additional commits viewable in compare view

Updates builder from 2.1.2 to 3.2.4

Changelog

Sourced from builder's changelog.

= Change Log

== Version 3.2.0

• Ruby 2.0 compatibility changes.

• Allow single quoted attributes.

== Version 3.1.0

• Included the to_xs arity patch needed for weird Rails compatibility issue.

• Escaping newlines in attributes now.

• Allow method caching

== Version 3.0.0

• Ruby 1.9 compatiblity issues.

== Version 2.2.0

• Applied patch from Thijs van der Vossen to allow UTF-8 encoded output when the encoding is UTF-8 and $KCODE is UTF8.

Commits

• See full diff in compare view

Updates loofah from 0.4.7 to 2.19.1

Release notes

Sourced from loofah's releases.

2.19.1 / 2022-12-13

Security

• Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.
• Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.
• Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

• Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

• Allow CSS property aspect-ratio. [#236] (Thanks, @​louim!)

2.17.0 / 2022-04-28

Features

• Allow ARIA attributes. [#232, #233] (Thanks, @​nick-desteffen!)

2.16.0 / 2022-04-01

Features

• Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @​nick-desteffen!)

2.15.0 / 2022-03-14

Features

• Expand set of allowed protocols to include sms:. [#228] (Thanks, @​brendon!)

2.14.0 / 2022-02-11

Features

• The #to_text method on Loofah::HTML::{Document,DocumentFragment} replaces <br> line break elements with a newline. [#225]

... (truncated)

Changelog

Sourced from loofah's changelog.

2.19.1 / 2022-12-13

Security

• Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.
• Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.
• Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

• Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

• Allow CSS property aspect-ratio. [#236] (Thanks, @​louim!)

2.17.0 / 2022-04-28

Features

• Allow ARIA attributes. [#232, #233] (Thanks, @​nick-desteffen!)

2.16.0 / 2022-04-01

Features

• Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @​nick-desteffen!)

2.15.0 / 2022-03-14

Features

• Expand set of allowed protocols to include sms:. [#228] (Thanks, @​brendon!)

2.14.0 / 2022-02-11

Features

• The #to_text method on Loofah::HTML::{Document,DocumentFragment} replaces <br> line break elements with a newline. [#225]

... (truncated)

Commits

• 3f88063 version bump to v2.19.1
• 9a8dadb docs: preserve the context and decision record
• 86f7f63 fix: replace recursive approach to cdata with escaping solution
• 415677f fix: do not allow "image/svg+xml" in data URIs
• 84ca20c refactor: extract scrub_uri_attribute for downstream use
• 47a835a ci: pin psych to v4 until v5 builds properly on CI
• a6e0a1a fix: replace slow regex attribute check with crass parser
• ea853aa Merge pull request #247 from flavorjones/flavorjones-downstream-test-rhs
• e1f2a4b ci: test downstream rails-html-sanitizer
• 79d65a0 Merge pull request #245 from flavorjones/flavorjones-fix-ruby-2.5-ci
• Additional commits viewable in compare view

Updates sax-machine from 0.0.15 to 1.3.2

Changelog

Sourced from sax-machine's changelog.

1.3.2

• Compatibility with Oga 0.3

1.3.1

• Allow default value to be false [#66]
• Support adding class to an attribute [#68]
• Adjust Ox handler to skip empty text/cdata values

1.3.0

• Improve block modifiers to support all config options
• Make block modifiers run in instance context
• Make all handlers support IO as a input

1.2.0

• Add support for blocks as value modifiers [#61]

1.1.1

• Fix Nokogiri autoloading [#60]

1.1.0

• Option to use Oga as a SAX handler

1.0.3

• Remove missed nokogiri reference [#54]
• Add support for Symbol data type conversion [#57]
• Add specs for multiple elements with the same alias [#53]
• Various code and documentation enhancements

1.0.2

• Make sure SAXConfig getters do not modify internal vars. Prevent race conditions

1.0.1

• Improve normalize_name performance

1.0.0

• Make nokogiri dependency optional
• Add :default argument for elements [#51]

0.3.0

... (truncated)

Commits

• See full diff in compare view

Updates nokogiri from 1.4.3.1 to 1.14.1

Release notes

Sourced from nokogiri's releases.

1.14.1 / 2023-01-30

Fixed

• Serializing documents now works again with pseudo-IO objects that don't support IO's encoding API (like rubyzip's Zip::OutputStream). This was a regression in v1.14.0 due to the fix for #752 in #2434, and was not completely fixed by #2753. [#2773]
• [CRuby] Address compiler warnings about void* casting and old-style C function definitions.

---

sha256 checksums:

99594e8b94f576644ac640a223d74c79e840218948e963aa635f0254927bff10  nokogiri-1.14.1-aarch64-linux.gem
1dc9b7821e1fa1f3fda40659662e51a4b3692acc4ee6342ee34a6a537fc1d5d8  nokogiri-1.14.1-arm-linux.gem
1a693df86da8c4c97b01d614470f9c3e10b9c755de8803fbfcfffe0f9dff522a  nokogiri-1.14.1-arm64-darwin.gem
c1f87a8f7bc56028deb2aecbb29e9b318405f7c468b29047aede78b41bc735a2  nokogiri-1.14.1-java.gem
2463a1ae0be5f06a10f3f3b374c2b743bff6280db993d488511a19bb7bc7cb7c  nokogiri-1.14.1-x64-mingw-ucrt.gem
f3a2b0ceedf51d776b39dc759ce191a4df842d7d4f5900c64f33d4753db39877  nokogiri-1.14.1-x64-mingw32.gem
f395d6c28c822b0877cfb0c71781f05243c034b4823359ab25b3288a73b9fc82  nokogiri-1.14.1-x86-linux.gem
be34b32fe74e82bffca5b1f3df8727c8fdc828762b6dddab53a11cd8f8515785  nokogiri-1.14.1-x86-mingw32.gem
9b14091f77086c4f0f09451ba3acd1b5f7e0076fb34fc536682170fa9f1a5074  nokogiri-1.14.1-x86_64-darwin.gem
21d234c51582b292e2e1e02e6c30eea9188894348985d6910aa8e993749c0aff  nokogiri-1.14.1-x86_64-linux.gem
b2db3af7769c29cd77d5f39cd3d0b65ab10975bdecf04be71d683f9c9abe2663  nokogiri-1.14.1.gem

1.14.0 / 2023-01-12

Notable Changes

Ruby

This release introduces native gem support for Ruby 3.2. (Also see "Technical note" under "Changed" below.)

This release ends support for:

• Ruby 2.6, for which upstream support ended 2022-04-12.
• JRuby 9.3, which is not fully compatible with Ruby 2.7+

Faster, more reliable installation: Native Gem for aarch64-linux (aka linux/arm64/v8)

This version of Nokogiri ships official native gem support for the aarch64-linux platform, which should support AWS Graviton and other ARM64 Linux platforms. Please note that glibc >= 2.29 is required for aarch64-linux systems, see Supported Platforms for more information.

Faster, more reliable installation: Native Gem for arm-linux (aka linux/arm/v7)

This version of Nokogiri ships experimental native gem support for the arm-linux platform. Please note that glibc >= 2.29 is required for arm-linux systems, see Supported Platforms for more information.

... (truncated)

Changelog

Sourced from

[dependabot]

Superseded by #17.