Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #17

dependabot · 2023-03-15T21:45:42Z

Bumps activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri. These dependencies needed to be updated together.
Updates activesupport from 2.3.8 to 7.0.4.3

Release notes

Sourced from activesupport's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 7.0.4.3 (March 13, 2023)

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Rails 7.0.4.2 (January 24, 2023)

No changes.

Rails 7.0.4.1 (January 17, 2023)

Avoid regex backtracking in Inflector.underscore

[CVE-2023-22796]

Rails 7.0.4 (September 09, 2022)

Redis cache store is now compatible with redis-rb 5.0.

Jean Boussier

Fix NoMethodError on custom ActiveSupport::Deprecation behavior.

ActiveSupport::Deprecation.behavior= was supposed to accept any object that responds to call, but in fact its internal implementation assumed that this object could respond to arity, so it was restricted to only Proc objects.

This change removes this arity restriction of custom behaviors.

Ryo Nakamura

Rails 7.0.3.1 (July 12, 2022)

No changes.

Rails 7.0.3 (May 09, 2022)

No changes.

Rails 7.0.2.4 (April 26, 2022)

Fix and add protections for XSS in ActionView::Helpers and ERB::Util.

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
3468503 Implement SafeBuffer#bytesplice
7c70791 Version 7.0.4.2
23e0345 Version 7.0.4.1
2164d4f Avoid regex backtracking in Inflector.underscore
8015c2c Version 7.0.4
ff27758 Revert "Merge pull request #44695 from Edouard-chin/ec-tagger-logger-broadcast"
4a1f224 Merge pull request #45882 from rails/short-inspect-on-test-case
a3bd3b5 Backport Redis 5.0 compatibility
67f37ac Fix flaky tests for RedisCacheStore
Additional commits viewable in compare view

Updates rails from 2.3.8 to 7.0.4.3

Release notes

Sourced from rails's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
73009ea Ignore certain data-* attributes in rails-ujs when element is contenteditable
3468503 Implement SafeBuffer#bytesplice
7c70791 Version 7.0.4.2
1d6de16 Merge pull request #47087 from jhawthorn/cookie_domain
23e0345 Version 7.0.4.1
d7aba06 Make sanitize_as_sql_comment more strict
8d82687 Avoid regex backtracking on If-None-Match header
2164d4f Avoid regex backtracking in Inflector.underscore
cd46b0e Use string#split instead of regex for domain parts
Additional commits viewable in compare view

Updates actionmailer from 2.3.8 to 7.0.4.3

Release notes

Sourced from actionmailer's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from actionmailer's changelog.

Rails 7.0.4.3 (March 13, 2023)

No changes.

Rails 7.0.4.2 (January 24, 2023)

No changes.

Rails 7.0.4.1 (January 17, 2023)

No changes.

Rails 7.0.4 (September 09, 2022)

No changes.

Rails 7.0.3.1 (July 12, 2022)

No changes.

Rails 7.0.3 (May 09, 2022)

No changes.

Rails 7.0.2.4 (April 26, 2022)

No changes.

Rails 7.0.2.3 (March 08, 2022)

No changes.

Rails 7.0.2.2 (February 11, 2022)

No changes.

Rails 7.0.2.1 (February 11, 2022)

No changes.

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
7c70791 Version 7.0.4.2
23e0345 Version 7.0.4.1
8015c2c Version 7.0.4
04972d9 Preparing for 7.0.3.1 release
0c68c1f updating version and changelog
3872bc0 Preparing for 7.0.3 release
ae98f49 Merge pull request #44777 from jean-francois-labbe/main
c204039 Merge branch '7-0-sec' into 7-0-stable
3520cc7 Preparing for 7.0.2.4 release
Additional commits viewable in compare view

Updates actionpack from 2.3.8 to 7.0.4.3

Release notes

Sourced from actionpack's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 7.0.4.3 (March 13, 2023)

No changes.

Rails 7.0.4.2 (January 24, 2023)

Fix domain: :all for two letter TLD

This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Rails 7.0.4.1 (January 17, 2023)

Fix sec issue with _url_host_allowed?

Disallow certain strings from _url_host_allowed? to avoid a redirect to malicious sites.

[CVE-2023-22797]

Avoid regex backtracking on If-None-Match header

[CVE-2023-22795]

Use string#split instead of regex for domain parts

[CVE-2023-22792]

Rails 7.0.4 (September 09, 2022)

Prevent ActionDispatch::ServerTiming from overwriting existing values in Server-Timing.

Previously, if another middleware down the chain set Server-Timing header, it would overwritten by ActionDispatch::ServerTiming.

Jakub Malinowski

Rails 7.0.3.1 (July 12, 2022)

No changes.

Rails 7.0.3 (May 09, 2022)

Allow relative redirects when raise_on_open_redirects is enabled.

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
7c70791 Version 7.0.4.2
1d6de16 Merge pull request #47087 from jhawthorn/cookie_domain
23e0345 Version 7.0.4.1
8d82687 Avoid regex backtracking on If-None-Match header
cd46b0e Use string#split instead of regex for domain parts
e50e26d Fix sec issue with _url_host_allowed?
8015c2c Version 7.0.4
f3c345e Merge pull request #45964 from jhawthorn/server_timing_safety
4d25c64 Merge pull request #45221 from jhawthorn/ac_params_eql_fix
Additional commits viewable in compare view

Updates activerecord from 2.3.8 to 7.0.4.3

Release notes

Sourced from activerecord's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 7.0.4.3 (March 13, 2023)

No changes.

Rails 7.0.4.2 (January 24, 2023)

No changes.

Rails 7.0.4.1 (January 17, 2023)

Make sanitize_as_sql_comment more strict

Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

This also clarifies in the documentation of annotate that it should not be provided user input.

[CVE-2023-22794]

Added integer width check to PostgreSQL::Quoting

Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

[CVE-2022-44566]

Rails 7.0.4 (September 09, 2022)

Symbol is allowed by default for YAML columns

Étienne Barrié

Fix ActiveRecord::Store to serialize as a regular Hash

Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
7c70791 Version 7.0.4.2
23e0345 Version 7.0.4.1
d7aba06 Make sanitize_as_sql_comment more strict
82bcdc0 Added integer width check to PostgreSQL::Quoting
8015c2c Version 7.0.4
4d9b4b4 Merge pull request #45872 from the-spectator/correct_hwia_encoding
c5a407d Linkify code references [ci-skip]
e874cf5 Fix typos [ci-skip]
fb09b1b Don't handle this change for legacy_connection_handling
Additional commits viewable in compare view

Updates activeresource from 2.3.8 to 6.0.0

Release notes

Sourced from activeresource's releases.

6.0.0

Breaking changes

Drop support to Ruby < 2.6 and Rails < 6.0

What's Changed

Create PreconditionFailed (412) exception by @bbraschi in rails/activeresource#302

Adds TooManyRequests (429) exception by @bradleypriest in rails/activeresource#304

Fix active job serializer railtie by @gmcgibbon in rails/activeresource#310

Fix Rails 6.1 compatibility by @casperisfine in rails/activeresource#335

Set frozen_string_literal: true in the generated code by @casperisfine in rails/activeresource#336

Stop using the deprecated URI.parser by @casperisfine in rails/activeresource#338

Fix the missed URI.parser references by @casperisfine in rails/activeresource#339

Fix find_every instantiating records from symbol and string without prefix_options by @ivan05almeida in rails/activeresource#348

Add support to set bearer token connection through Base class by @ivan05almeida in rails/activeresource#345

Fixed multi-threading race condition issue by @marisveide in rails/activeresource#349

Fixed ActiveResource::ConnectionError#to_s to return a message which … by @faultier92 in rails/activeresource#353

Stop requiring the useless and deprecated core_ext/uri by @casperisfine in rails/activeresource#366

Changing headers on base class doesn't change them in subclasses by @adrien-k in rails/activeresource#359

New Contributors

@bbraschi made their first contribution in rails/activeresource#302

@maurcarvalho made their first contribution in rails/activeresource#307

@bradleypriest made their first contribution in rails/activeresource#304

@pilaf made their first contribution in rails/activeresource#315

@eitoball made their first contribution in rails/activeresource#306

@okuramasafumi made their first contribution in rails/activeresource#320

@larouxn made their first contribution in rails/activeresource#321

@maria-kravtsova made their first contribution in rails/activeresource#323

@casperisfine made their first contribution in rails/activeresource#335

@ivan05almeida made their first contribution in rails/activeresource#348

@marisveide made their first contribution in rails/activeresource#349

@faultier92 made their first contribution in rails/activeresource#353

@luk4s made their first contribution in rails/activeresource#356

@jbampton made their first contribution in rails/activeresource#357

@filabreu made their first contribution in rails/activeresource#364

@aclemons made their first contribution in rails/activeresource#367

@obahareth made their first contribution in rails/activeresource#373

@adrien-k made their first contribution in rails/activeresource#359

Full Changelog: rails/activeresource@v5.1.1...v6.0.0

5.1.0

Improve support of Active Resource objects inside fibers.

Add support to Active Model Serializers.

Fix error when trying to parse nil as a JSON response.

... (truncated)

Commits

See full diff in compare view

Updates rack from 1.1.0 to 2.2.6.4

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[Unreleased]

SPEC Changes

rack.input is now optional. (#1997, [@ioquatix])

Changed

rack.input is now optional, and if missing, will raise an error. Use this to fail on multipart parsing a request without an input body. (#2018, [@ioquatix])

Introduce module Rack::BadRequest which is included in multipart and query parser errors. (#2019, [@ioquatix])

MIME type for JavaScript files (.js) changed from application/javascript to text/javascript (1bd0f15)

Add .mjs MIME type (#2057, [@axilleas])

[3.0.4.1] - 2023-01-17

[CVE-2022-44571] Fix ReDoS vulnerability in multipart parser

[CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges

[CVE-2022-44572] Forbid control characters in attributes (also ReDoS)

[3.0.4] - 2023-01-17

Rack::Request#POST should consistently raise errors. Cache errors that occur when invoking Rack::Request#POST so they can be raised again later. (#2010, [@ioquatix])

Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH. (#2007, @byroot)

Extend Rack::MethodOverride to handle QueryParser::ParamsTooDeepError error. (#2006, @byroot)

[3.0.3] - 2022-12-27

Fixed

Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @weizheheng)

[3.0.2] -2022-12-05

Fixed

Utils.build_nested_query URL-encodes nested field names including the square brackets.

Allow Rack::Response to pass through streaming bodies. (#1993, [@ioquatix])

[3.0.1] - 2022-11-18

Fixed

MethodOverride does not look for an override if a request does not include form/parseable data.

Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call and to_path, forwarding to the body. (#1981, [@ioquatix])

[3.0.0] - 2022-09-06

... (truncated)

Commits

27addc7 bump version
ee7919e Avoid ReDoS problem
d6b5b2b bump version
9aac375 Limit all multipart parts, not just files
2606ac5 bumping version
f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges
20bc90c bump version
3677f17 Update changelog
ee25ab9 Fix ReDoS vulnerability in multipart parser
19e49f0 Forbid control characters in attributes
Additional commits viewable in compare view

Updates rake from 0.8.7 to 13.0.6

Release notes

Sourced from rake's releases.

rake-10.1.1

Full Changelog: ruby/rake@rake-10.1.0.beta.3...rake-10.1.1

rake-10.1.0

Full Changelog: ruby/rake@rake-10.0.4...rake-10.1.0

rake-10.1.0.beta.3

Full Changelog: ruby/rake@rake-10.1.0.beta.2...rake-10.1.0.beta.3

rake-10.1.0.beta.2

Full Changelog: ruby/rake@rake-10.1.0.beta.1...rake-10.1.0.beta.2

rake-10.1.0.beta.1

Full Changelog: ruby/rake@rake-10.0.4...rake-10.1.0.beta.1

rake-10.0.4

Full Changelog: ruby/rake@rake-10.0.3...rake-10.0.4

rake-10.0.3

Full Changelog: ruby/rake@rake-10.0.2...rake-10.0.3

rake-10.0.2

Full Changelog: ruby/rake@rake-10.0.1...rake-10.0.2

rake-10.0.1

Full Changelog: ruby/rake@rake-10.0.0.beta.2...rake-10.0.1

rake-10.0.0

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-10.0.0

rake-10.0.0.beta.2

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-10.0.0.beta.2

rake-0.9.6

Full Changelog: ruby/rake@rake-0.9.5...rake-0.9.6

rake-0.9.5

Full Changelog: ruby/rake@rake-0.9.4...rake-0.9.5

rake-0.9.4

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-0.9.4

rake-0.9.3

Full Changelog: ruby/rake@rake-0.9.2...rake-0.9.3

rake-0.9.3.beta.3

Full Changelog: ruby/rake@rake-0.9.3.beta.2...rake-0.9.3.beta.3

rake-0.9.3.beta.2

Full Changelog: ruby/rake@rake-0.9.3.beta.1...rake-0.9.3.beta.2

... (truncated)

Changelog

Sourced from rake's changelog.

=== 13.0.6

Additional fix for #389 Pull request #390 by hsbt

=== 13.0.5

Fixed the regression of #388 Pull request #389 by hsbt

=== 13.0.4

Fix rake test loader swallowing useful error information. Pull request #367 by deivid-rodriguez

Add -C/--directory option the same as GNU make. Pull request #376 by nobu

=== 13.0.3

Fix breaking change of execution order on TestTask. Pull request #368 by ysakasin

=== 13.0.2

==== Enhancements

Fix tests to work with current FileUtils Pull Request #358 by jeremyevans

Simplify default rake test loader Pull Request #357 by deivid-rodriguez

Update rdoc Pull Request #366 by bahasalien

Update broken links to rake articles from Avdi in README Pull Request #360 by svl7

=== 13.0.1

==== Bug fixes

Fixed bug: Reenabled task raises previous exception on second invokation Pull Request #271 by thorsteneckel

Fix an incorrectly resolved arg pattern Pull Request #327 by mjbellantoni

=== 13.0.0

==== Enhancements

Follows recent changes on keyword arguments in ruby 2.7. Pull Request #326 by nobu

... (truncated)

Commits

5c60da8 Bump up Rake-13.0.6
73d4099 Merge pull request #390 from ruby/fix-388-again
63aacb6 Added Rake namespace explicitly
29a3949 Bump version to v13.0.5
3a95f4c Merge pull request #389 from ruby/fix-388
85c55b4 Fixed the regression of #388
72ac796 History for rake-13.0.4
b20de78 Bump version to 13.0.4
a07e637 Merge pull request #386 from ruby/cleanup
0acc575 Use require_relative to specify release version
Additional commits viewable in compare view

Updates feedzirra from 0.0.24 to 0.8.0

Changelog

Sourced from feedzirra's changelog.

Feedjira Changelog

3.2.2

Fix time handling again usec is not a timezone

Update rubocop * drop official support for eol Ruby

3.2.1

Fix time handling in ruby 3.1

Atom feeds now have an icon field via feedjira/feedjira#452 (@jswanner)

3.2.0

Atom feed_url no longer falls back to url via feedjira/feedjira#451 (@frederfred)

Atom feeds now have an icon field via feedjira/feedjira#452 (@jswanner)

3.1.2

Enhancements

Alias managingEditor as managing_editor #443[] ([@DominikAlberski][])

Add support for the a10 namespace used in RSS 2.0 feeds generated by .NET applications. Currently a10:link, a10:updated, a10:content and a10:name are supported. #440[] ([@knu][])

#440: feedjira/feedjira#440 #443: feedjira/feedjira#443

3.1.1

Enhancements

Fix warnings in Ruby 2.7 #434[] ([@sferik][])

General

Test on Ruby 2.5, 2.6 and 2.7 #435[] ([@HParker][])

#434: feedjira/feedjira#434 #435: feedjira/feedjira#435

3.1.0

Breaking Changes

title of Atom entry classes always return a plain text even in case the entry has a title of the HTML or XML type. #423[] ([@knu][])

Enhancements

raw_title and title_type are added to Atom entry classes. #423[] ([@knu][])

AtomGoogleAlerts is now a supported parser #424[] ([@knu][])

... (truncated)

Commits

5ca1a2c Deprecate Feedzirra, use Feedjira instead
18832a8 Update CHANGELOG for 0.7.1
35baab5 Bump version for 0.7.1
293b49a be a new entry if feed not have entry id and only difference is a url
6e075a8 Update CHANGELOG for 0.7.0
0f863b1 Bump version for 0.7.0
e614278 Bugfix for parsing dates that are ISO 8601 with milliseconds
d552496 On failure callbacks get curl and error as args
260a979 Move call_on_failure to private method
801b978 Fix tests for #194
Additional commits viewable in compare view

Updates builder from 2.1.2 to 3.2.4

Changelog

Sourced from builder's changelog.

= Change Log

== Version 3.2.0

Ruby 2.0 compatibility changes.

Allow single quoted attributes.

== Version 3.1.0

Included the to_xs arity patch needed for weird Rails compatibility issue.

Escaping newlines in attributes now.

Allow method caching

== Version 3.0.0

Ruby 1.9 compatiblity issues.

== Version 2.2.0

Applied patch from Thijs van der Vossen to allow UTF-8 encoded output when the encoding is UTF-8 and $KCODE is UTF8.

Commits

See full diff in compare view

Updates loofah from 0.4.7 to 2.19.1

Release notes

Sourced from loofah's releases.

2.19.1 / 2022-12-13

Security

Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.

Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.

Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

Allow CSS property aspect-ratio. [#236] (Thanks, @louim!)

2.17.0 / 2022-04-28

Features

Allow ARIA attributes. [#232, #233] (Thanks, @nick-desteffen!)

2.16.0 / 2022-04-01

Features

Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @nick-desteffen!)

2.15.0 / 2022-03-14

Features

Expand set of allowed protocols to include sms:. [#228] (Thanks, @brendon!)

2.14.0 / 2022-02-11

Features

The #to_text method on Loofah::HTML::{Document,DocumentFragment} replaces <br> line break elements with a newline. [#225]

... (truncated)

Changelog

Sourced from loofah's changelog.

2.19.1 / 2022-12-13

Security

Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.

Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.

Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

Allow CSS property aspect-ratio. [#236] (Thanks, @louim!)

2.17.0 / 2022-04-28

Features

Allow ARIA attributes. [#232, #233] (Thanks, @nick-desteffen!)

2.16.0 / 2022-04-01

Features

Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @nick-desteffen!)

2.15.0 / 2022-03-14

Features

Expand set of allowed protocols to include sms:. [#228] (Thanks, @brendon!)

2.14.0 / 2022-02-11

Features

The #to_text method on Loofah::HTML::{Document,DocumentFragment} replaces <br> line break elements with a newline. [#225]

... (truncated)

Commits

3f88063 version bump to v2.19.1
9a8dadb docs: preserve the context and decision record
86f7f63 fix: replace recursive approach to cdata with escaping solution
415677f fix: do not allow "image/svg+xml" in data URIs
84ca20c refactor: extract scrub_uri_attribute for downstream use
47a835a ci: pin psych to v4 until v5 builds properly on CI
a6e0a1a fix: replace slow regex attribute check with crass parser
ea853aa Merge pull request #247 from flavorjones/flavorjones-downstream-test-rhs
e1f2a4b ci: test downstream rails-html-sanitizer
79d65a0 Merge pull request #245 from flavorjones/flavorjones-fix-ruby-2.5-ci
Additional commits viewable in compare view

Updates sax-machine from 0.0.15 to 1.3.2

Changelog

Sourced from sax-machine's changelog.

1.3.2

Compatibility with Oga 0.3

1.3.1

Allow default value to be false [#66]

Support adding class to an attribute [#68]

Adjust Ox handler to skip empty text/cdata values

1.3.0

Improve block modifiers to support all config options

Make block modifiers run in instance context

Make all handlers support IO as a input

1.2.0

Add support for blocks as value modifiers [#61]

1.1.1

Fix Nokogiri autoloading [#60]

1.1.0

Option to use Oga as a SAX handler

1.0.3

Remove missed nokogiri reference [#54]

Add support for Symbol data type conversion [#57]

Add specs for multiple elements with the same alias [#53]

Various code and documentation enhancements

1.0.2

Make sure SAXConfig getters do not modify internal vars. Prevent race conditions

1.0.1

Improve normalize_name performance

1.0.0

Make nokogiri dependency optional

Add :default argument for elements [#51]

0.3.0

... (truncated)

Commits

See full diff in compare view

Updates nokogiri from 1.4.3.1 to 1.14.2

Release notes

Sourced from nokogiri's releases.

1.14.2 / 2023-02-13

Fixed

Calling NodeSet#to_html on an empty node set no longer raises an encoding-related exception. This bug was introduced in v1.14.0 while fixing #2649. [#2784]

sha256 checksums:

966acf4f6c1fba10518f86498141cf44265564ac5a65dcc8496b65f8c354f776  nokogiri-1.14.2-aarch64-linux.gem
8a3a35cadae4a800ddc0b967394257343d62196d9d059b54e38cf067981db428  nokogiri-1.14.2-arm-linux.gem
81404cd014ecb597725c3847523c2ee365191a968d0b5f7d857e03f388c57631  nokogiri-1.14.2-arm64-darwin.gem
0a39222af14e75eb0243e8d969345e03b90c0e02b0f33c61f1ebb6ae53538bb5  nokogiri-1.14.2-java.gem
62a18f9213a0ceeaf563d1bc7ccfd93273323c4356ded58a5617c59bc4635bc5  nokogiri-1.14.2-x64-mingw-ucrt.gem
54f6ac2c15a7a88f431bb5e23f4616aa8fc97a92eb63336bcf65b7050f2d3be0  nokogiri-1.14.2-x64-mingw32.gem
c42fa0856f01f901954898e28c3c2b4dce0e843056b1b126f441d06e887e1b77  nokogiri-1.14.2-x86-linux.gem
f940d9c8e47b0f19875465376f2d1c8911bc9489ac9a48c124579819dc4a7f19  nokogiri-1.14.2-x86-mingw32.gem
2508978f5ca28944919973f6300f0a7355fbe72604ab6a6913f1630be1030265  nokogiri-1.14.2-x86_64-darwin.gem
bc6405e1f3ddac6e401f82d775f1c0c24c6e58c371b3fadaca0596d5d511e476  nokogiri-1.14.2-x86_64-linux.gem
c765a74aac6cf430a710bb0b6038b8ee11f177393cd6ae8dadc7a44a6e2658b6  nokogiri-1.14.2.gem

1.14.1 / 2023-01-30

Fixed

Serializing documents now works again with pseudo-IO objects that don't support IO's encoding API (like rubyzip's Zip::OutputStream). This was a regression in v1.14.0 due to the fix for #752 in #2434, and was not completely fixed by #2753. [#2773]
[CRuby] Address compiler warnings about void* casting and old-style C function definitions.

sha256 checksums:

99594e8b94f576644ac640a223d74c79e840218948e963aa635f0254927bff10  nokogiri-1.14.1-aarch64-linux.gem
1dc9b7821e1fa1f3fda40659662e51a4b3692acc4ee6342ee34a6a537fc1d5d8  nokogiri-1.14.1-arm-linux.gem
1a693df86da8c4c97b01d614470f9c3e10b9c755de8803fbfcfffe0f9dff522a  nokogiri-1.14.1-arm64-darwin.gem
c1f87a8f7bc56028deb2aecbb29e9b318405f7c468b29047aede78b41bc735a2  nokogiri-1.14.1-java.gem
2463a1ae0be5f06a10f3f3b374c2b743bff6280db993d488511a19bb7bc7cb7c  nokogiri-1.14.1-x64-mingw-ucrt.gem
f3a2b0ceedf51d776b39dc759ce191a4df842d7d4f5900c64f33d4753db39877  nokogiri-1.14.1-x64-mingw32.gem
f395d6c28c822b0877cfb0c71781f05243c034b4823359ab25b3288a73b9fc82  nokogiri-1.14.1-x86-linux.gem
be34b32fe74e82bffca5b1f3df8727c8fdc828762b6dddab53a11cd8f8515785  nokogiri-1.14.1-x86-mingw32.gem
9b14091f77086c4f0f09451ba3acd1b5f7e0076fb34fc536682170fa9f1a5074  nokogiri-1.14.1-x86_64-darwin.gem
21d234c51582b292e2e1e02e6c30eea9188894348985d6910aa8e993749c0aff  nokogiri-1.14.1-x86_64-linux.gem
b2db3af7769c29cd77d5f39cd3d0b65ab10975bdecf04be71d683f9c9abe2663  nokogiri-1.14.1.gem

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.14.2 / 2023-02-13

Fixed

Calling NodeSet#to_html on an empty node set no longer raises an encoding-related exception. This bug was introduced in v1.14.0 while fixing #2649. [#2784]

1.14.1 / 2023-01-30

Fixed

Serializing documents now works again with pseudo-IO objects that don't support IO's encoding API (like rubyzip's Zip::OutputStream). This was a regression in v1.14.0 due to the fix for #752 in #2434, and was not completely fixed by #2753. [#2773]

[CRuby] Address compiler warnings about void* casting and old-style C function definitions.

1.14.0 / 2023-01-12

Notable Changes

Ruby

This release introduces native gem support for Ruby 3.2. (Also see "Technical note" under "Changed" below.)

This release ends support for:

Ruby 2.6, for which upstream support ended 2022-04-12.

JRuby 9.3, which is not fully compatible with Ruby 2.7+

Faster, more reliable installation: Native Gem for aarch64-linux (aka linux/arm64/v8)

This version of Nokogiri ships official native gem support for the aarch64-linux platform, which should support AWS Graviton and other ARM64 Linux platforms. Please note that glibc >= 2.29 is required for aarch64-linux systems, see

…tiveresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri Bumps [activesupport](https://github.com/rails/rails), [rails](https://github.com/rails/rails), [actionmailer](https://github.com/rails/rails), [actionpack](https://github.com/rails/rails), [activerecord](https://github.com/rails/rails), [activeresource](https://github.com/rails/activeresource), [rack](https://github.com/rack/rack), [rake](https://github.com/ruby/rake), [feedzirra](https://github.com/pauldix/feedzirra), [builder](https://github.com/jimweirich/builder), [loofah](https://github.com/flavorjones/loofah), [sax-machine](https://github.com/pauldix/sax-machine) and [nokogiri](https://github.com/sparklemotion/nokogiri). These dependencies needed to be updated together. Updates `activesupport` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/activesupport/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `rails` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `actionmailer` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/actionmailer/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `actionpack` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/actionpack/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `activerecord` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/activerecord/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `activeresource` from 2.3.8 to 6.0.0 - [Release notes](https://github.com/rails/activeresource/releases) - [Commits](https://github.com/rails/activeresource/commits/v6.0.0) Updates `rack` from 1.1.0 to 2.2.6.4 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@1.1...v2.2.6.4) Updates `rake` from 0.8.7 to 13.0.6 - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](ruby/rake@rake-0.8.7...v13.0.6) Updates `feedzirra` from 0.0.24 to 0.8.0 - [Release notes](https://github.com/pauldix/feedzirra/releases) - [Changelog](https://github.com/feedjira/feedjira/blob/main/CHANGELOG.md) - [Commits](feedjira/feedjira@v0.0.24...v0.8.0) Updates `builder` from 2.1.2 to 3.2.4 - [Release notes](https://github.com/jimweirich/builder/releases) - [Changelog](https://github.com/jimweirich/builder/blob/master/CHANGES) - [Commits](https://github.com/jimweirich/builder/commits) Updates `loofah` from 0.4.7 to 2.19.1 - [Release notes](https://github.com/flavorjones/loofah/releases) - [Changelog](https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md) - [Commits](flavorjones/loofah@v0.4.7...v2.19.1) Updates `sax-machine` from 0.0.15 to 1.3.2 - [Release notes](https://github.com/pauldix/sax-machine/releases) - [Changelog](https://github.com/pauldix/sax-machine/blob/master/HISTORY.md) - [Commits](https://github.com/pauldix/sax-machine/commits/v1.3.2) Updates `nokogiri` from 1.4.3.1 to 1.14.2 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@REL_1.4.3.1...v1.14.2) --- updated-dependencies: - dependency-name: activesupport dependency-type: direct:production - dependency-name: rails dependency-type: direct:production - dependency-name: actionmailer dependency-type: direct:production - dependency-name: actionpack dependency-type: direct:production - dependency-name: activerecord dependency-type: direct:production - dependency-name: activeresource dependency-type: direct:production - dependency-name: rack dependency-type: direct:production - dependency-name: rake dependency-type: direct:production - dependency-name: feedzirra dependency-type: direct:production - dependency-name: builder dependency-type: direct:production - dependency-name: loofah dependency-type: direct:production - dependency-name: sax-machine dependency-type: direct:production - dependency-name: nokogiri dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2023-04-14T17:21:15Z

Superseded by #19.

dependabot bot added the dependencies Pull requests that update a dependency file label Mar 15, 2023

dependabot bot mentioned this pull request Mar 15, 2023

Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #16

Closed

dependabot bot closed this Apr 14, 2023

dependabot bot deleted the dependabot/bundler/activesupport-and-rails-and-actionmailer-and-actionpack-and-activerecord-and-activeresource-and-rack-and-rake-and-feedzirra-and-builder-and-loofah-and-sax-machine-and-nokogiri-7.0.4.3 branch April 14, 2023 17:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #17

Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #17

Uh oh!

dependabot bot commented on behalf of github Mar 15, 2023

Uh oh!

dependabot bot commented on behalf of github Apr 14, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #17

Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #17

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 15, 2023

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

Rails 7.0.3.1 (July 12, 2022)

Rails 7.0.3 (May 09, 2022)

Rails 7.0.2.4 (April 26, 2022)

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

Rails 7.0.3.1 (July 12, 2022)

Rails 7.0.3 (May 09, 2022)

Rails 7.0.2.4 (April 26, 2022)

Rails 7.0.2.3 (March 08, 2022)

Rails 7.0.2.2 (February 11, 2022)

Rails 7.0.2.1 (February 11, 2022)

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

Rails 7.0.3.1 (July 12, 2022)

Rails 7.0.3 (May 09, 2022)

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

6.0.0

Breaking changes

What's Changed