Bump actionpack, rails, feedzirra, activerecord, activeresource, activesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri #19

dependabot · 2023-04-14T17:21:12Z

Bumps actionpack, rails, feedzirra, activerecord, activeresource, activesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri. These dependencies needed to be updated together.
Updates actionpack from 2.3.8 to 7.0.4.3

Release notes

Sourced from actionpack's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 7.0.4.3 (March 13, 2023)

No changes.

Rails 7.0.4.2 (January 24, 2023)

Fix domain: :all for two letter TLD

This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Rails 7.0.4.1 (January 17, 2023)

Fix sec issue with _url_host_allowed?

Disallow certain strings from _url_host_allowed? to avoid a redirect to malicious sites.

[CVE-2023-22797]

Avoid regex backtracking on If-None-Match header

[CVE-2023-22795]

Use string#split instead of regex for domain parts

[CVE-2023-22792]

Rails 7.0.4 (September 09, 2022)

Prevent ActionDispatch::ServerTiming from overwriting existing values in Server-Timing.

Previously, if another middleware down the chain set Server-Timing header, it would overwritten by ActionDispatch::ServerTiming.

Jakub Malinowski

Rails 7.0.3.1 (July 12, 2022)

No changes.

Rails 7.0.3 (May 09, 2022)

Allow relative redirects when raise_on_open_redirects is enabled.

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
7c70791 Version 7.0.4.2
1d6de16 Merge pull request #47087 from jhawthorn/cookie_domain
23e0345 Version 7.0.4.1
8d82687 Avoid regex backtracking on If-None-Match header
cd46b0e Use string#split instead of regex for domain parts
e50e26d Fix sec issue with _url_host_allowed?
8015c2c Version 7.0.4
f3c345e Merge pull request #45964 from jhawthorn/server_timing_safety
4d25c64 Merge pull request #45221 from jhawthorn/ac_params_eql_fix
Additional commits viewable in compare view

Updates rails from 2.3.8 to 7.0.4.3

Release notes

Sourced from rails's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
73009ea Ignore certain data-* attributes in rails-ujs when element is contenteditable
3468503 Implement SafeBuffer#bytesplice
7c70791 Version 7.0.4.2
1d6de16 Merge pull request #47087 from jhawthorn/cookie_domain
23e0345 Version 7.0.4.1
d7aba06 Make sanitize_as_sql_comment more strict
8d82687 Avoid regex backtracking on If-None-Match header
2164d4f Avoid regex backtracking in Inflector.underscore
cd46b0e Use string#split instead of regex for domain parts
Additional commits viewable in compare view

Updates feedzirra from 0.0.24 to 0.8.0

Changelog

Sourced from feedzirra's changelog.

Feedjira Changelog

3.2.2

Fix time handling again usec is not a timezone

Update rubocop * drop official support for eol Ruby

3.2.1

Fix time handling in ruby 3.1

Atom feeds now have an icon field via feedjira/feedjira#452 (@jswanner)

3.2.0

Atom feed_url no longer falls back to url via feedjira/feedjira#451 (@frederfred)

Atom feeds now have an icon field via feedjira/feedjira#452 (@jswanner)

3.1.2

Enhancements

Alias managingEditor as managing_editor #443[] ([@DominikAlberski][])

Add support for the a10 namespace used in RSS 2.0 feeds generated by .NET applications. Currently a10:link, a10:updated, a10:content and a10:name are supported. #440[] ([@knu][])

#440: feedjira/feedjira#440 #443: feedjira/feedjira#443

3.1.1

Enhancements

Fix warnings in Ruby 2.7 #434[] ([@sferik][])

General

Test on Ruby 2.5, 2.6 and 2.7 #435[] ([@HParker][])

#434: feedjira/feedjira#434 #435: feedjira/feedjira#435

3.1.0

Breaking Changes

title of Atom entry classes always return a plain text even in case the entry has a title of the HTML or XML type. #423[] ([@knu][])

Enhancements

raw_title and title_type are added to Atom entry classes. #423[] ([@knu][])

AtomGoogleAlerts is now a supported parser #424[] ([@knu][])

... (truncated)

Commits

5ca1a2c Deprecate Feedzirra, use Feedjira instead
18832a8 Update CHANGELOG for 0.7.1
35baab5 Bump version for 0.7.1
293b49a be a new entry if feed not have entry id and only difference is a url
6e075a8 Update CHANGELOG for 0.7.0
0f863b1 Bump version for 0.7.0
e614278 Bugfix for parsing dates that are ISO 8601 with milliseconds
d552496 On failure callbacks get curl and error as args
260a979 Move call_on_failure to private method
801b978 Fix tests for #194
Additional commits viewable in compare view

Updates activerecord from 2.3.8 to 7.0.4.3

Release notes

Sourced from activerecord's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 7.0.4.3 (March 13, 2023)

No changes.

Rails 7.0.4.2 (January 24, 2023)

No changes.

Rails 7.0.4.1 (January 17, 2023)

Make sanitize_as_sql_comment more strict

Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

This also clarifies in the documentation of annotate that it should not be provided user input.

[CVE-2023-22794]

Added integer width check to PostgreSQL::Quoting

Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

[CVE-2022-44566]

Rails 7.0.4 (September 09, 2022)

Symbol is allowed by default for YAML columns

Étienne Barrié

Fix ActiveRecord::Store to serialize as a regular Hash

Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
7c70791 Version 7.0.4.2
23e0345 Version 7.0.4.1
d7aba06 Make sanitize_as_sql_comment more strict
82bcdc0 Added integer width check to PostgreSQL::Quoting
8015c2c Version 7.0.4
4d9b4b4 Merge pull request #45872 from the-spectator/correct_hwia_encoding
c5a407d Linkify code references [ci-skip]
e874cf5 Fix typos [ci-skip]
fb09b1b Don't handle this change for legacy_connection_handling
Additional commits viewable in compare view

Updates activeresource from 2.3.8 to 6.0.0

Release notes

Sourced from activeresource's releases.

6.0.0

Breaking changes

Drop support to Ruby < 2.6 and Rails < 6.0

What's Changed

Create PreconditionFailed (412) exception by @bbraschi in rails/activeresource#302

Adds TooManyRequests (429) exception by @bradleypriest in rails/activeresource#304

Fix active job serializer railtie by @gmcgibbon in rails/activeresource#310

Fix Rails 6.1 compatibility by @casperisfine in rails/activeresource#335

Set frozen_string_literal: true in the generated code by @casperisfine in rails/activeresource#336

Stop using the deprecated URI.parser by @casperisfine in rails/activeresource#338

Fix the missed URI.parser references by @casperisfine in rails/activeresource#339

Fix find_every instantiating records from symbol and string without prefix_options by @ivan05almeida in rails/activeresource#348

Add support to set bearer token connection through Base class by @ivan05almeida in rails/activeresource#345

Fixed multi-threading race condition issue by @marisveide in rails/activeresource#349

Fixed ActiveResource::ConnectionError#to_s to return a message which … by @faultier92 in rails/activeresource#353

Stop requiring the useless and deprecated core_ext/uri by @casperisfine in rails/activeresource#366

Changing headers on base class doesn't change them in subclasses by @adrien-k in rails/activeresource#359

New Contributors

@bbraschi made their first contribution in rails/activeresource#302

@maurcarvalho made their first contribution in rails/activeresource#307

@bradleypriest made their first contribution in rails/activeresource#304

@pilaf made their first contribution in rails/activeresource#315

@eitoball made their first contribution in rails/activeresource#306

@okuramasafumi made their first contribution in rails/activeresource#320

@larouxn made their first contribution in rails/activeresource#321

@maria-kravtsova made their first contribution in rails/activeresource#323

@casperisfine made their first contribution in rails/activeresource#335

@ivan05almeida made their first contribution in rails/activeresource#348

@marisveide made their first contribution in rails/activeresource#349

@faultier92 made their first contribution in rails/activeresource#353

@luk4s made their first contribution in rails/activeresource#356

@jbampton made their first contribution in rails/activeresource#357

@filabreu made their first contribution in rails/activeresource#364

@aclemons made their first contribution in rails/activeresource#367

@obahareth made their first contribution in rails/activeresource#373

@adrien-k made their first contribution in rails/activeresource#359

Full Changelog: rails/activeresource@v5.1.1...v6.0.0

5.1.0

Improve support of Active Resource objects inside fibers.

Add support to Active Model Serializers.

Fix error when trying to parse nil as a JSON response.

... (truncated)

Commits

See full diff in compare view

Updates activesupport from 2.3.8 to 7.0.4.3

Release notes

Sourced from activesupport's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 7.0.4.3 (March 13, 2023)

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Rails 7.0.4.2 (January 24, 2023)

No changes.

Rails 7.0.4.1 (January 17, 2023)

Avoid regex backtracking in Inflector.underscore

[CVE-2023-22796]

Rails 7.0.4 (September 09, 2022)

Redis cache store is now compatible with redis-rb 5.0.

Jean Boussier

Fix NoMethodError on custom ActiveSupport::Deprecation behavior.

ActiveSupport::Deprecation.behavior= was supposed to accept any object that responds to call, but in fact its internal implementation assumed that this object could respond to arity, so it was restricted to only Proc objects.

This change removes this arity restriction of custom behaviors.

Ryo Nakamura

Rails 7.0.3.1 (July 12, 2022)

No changes.

Rails 7.0.3 (May 09, 2022)

No changes.

Rails 7.0.2.4 (April 26, 2022)

Fix and add protections for XSS in ActionView::Helpers and ERB::Util.

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
3468503 Implement SafeBuffer#bytesplice
7c70791 Version 7.0.4.2
23e0345 Version 7.0.4.1
2164d4f Avoid regex backtracking in Inflector.underscore
8015c2c Version 7.0.4
ff27758 Revert "Merge pull request #44695 from Edouard-chin/ec-tagger-logger-broadcast"
4a1f224 Merge pull request #45882 from rails/short-inspect-on-test-case
a3bd3b5 Backport Redis 5.0 compatibility
67f37ac Fix flaky tests for RedisCacheStore
Additional commits viewable in compare view

Updates rack from 1.1.0 to 2.2.6.4

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

SPEC Changes

rack.input is now optional. (#1997, [@ioquatix])

Changed

rack.input is now optional, and if missing, will raise an error. Use this to fail on multipart parsing a request without an input body. (#2018, [@ioquatix])

Introduce module Rack::BadRequest which is included in multipart and query parser errors. (#2019, [@ioquatix])

MIME type for JavaScript files (.js) changed from application/javascript to text/javascript (1bd0f15)

Add .mjs MIME type (#2057, [@axilleas])

Update MIME types associated to .ttf, .woff, .woff2 and .otf extensions to use mondern font/* types. (#2065, [@davidstosik])

[3.0.7] - 2023-03-16

Make query parameters without = have nil values. (#2059, [@jeremyevans])

[3.0.6.1] - 2023-03-13

[CVE-2023-27539] Avoid ReDoS in header parsing

[3.0.6] - 2023-03-13

Add QueryParser#missing_value for handling missing values + tests. (#2052, [@ioquatix])

[3.0.5] - 2023-03-13

Split form/query parsing into two steps. (#2038, @matthewd)

[3.0.4.2] - 2023-03-02

[CVE-2023-27530] Introduce multipart_total_part_limit to limit total parts

[3.0.4.1] - 2023-01-17

[CVE-2022-44571] Fix ReDoS vulnerability in multipart parser

[CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges

[CVE-2022-44572] Forbid control characters in attributes (also ReDoS)

[3.0.4] - 2023-01-17

Rack::Request#POST should consistently raise errors. Cache errors that occur when invoking Rack::Request#POST so they can be raised again later. (#2010, [@ioquatix])

Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH. (#2007, @byroot)

Extend Rack::MethodOverride to handle QueryParser::ParamsTooDeepError error. (#2006, @byroot)

... (truncated)

Commits

27addc7 bump version
ee7919e Avoid ReDoS problem
d6b5b2b bump version
9aac375 Limit all multipart parts, not just files
2606ac5 bumping version
f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges
20bc90c bump version
3677f17 Update changelog
ee25ab9 Fix ReDoS vulnerability in multipart parser
19e49f0 Forbid control characters in attributes
Additional commits viewable in compare view

Updates actionmailer from 2.3.8 to 7.0.4.3

Release notes

Sourced from actionmailer's releases.

v7.0.4.3

Active Support

Implement SafeBuffer#bytesplice

[CVE-2023-28120]

Active Model

No changes.

Active Record

No changes.

Action View

Ignore certain data-* attributes in rails-ujs when element is contenteditable

[CVE-2023-23913]

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

... (truncated)

Changelog

Sourced from actionmailer's changelog.

Rails 7.0.4.3 (March 13, 2023)

No changes.

Rails 7.0.4.2 (January 24, 2023)

No changes.

Rails 7.0.4.1 (January 17, 2023)

No changes.

Rails 7.0.4 (September 09, 2022)

No changes.

Rails 7.0.3.1 (July 12, 2022)

No changes.

Rails 7.0.3 (May 09, 2022)

No changes.

Rails 7.0.2.4 (April 26, 2022)

No changes.

Rails 7.0.2.3 (March 08, 2022)

No changes.

Rails 7.0.2.2 (February 11, 2022)

No changes.

Rails 7.0.2.1 (February 11, 2022)

No changes.

... (truncated)

Commits

c15ee6e Preparing for 7.0.4.3 release
7c70791 Version 7.0.4.2
23e0345 Version 7.0.4.1
8015c2c Version 7.0.4
04972d9 Preparing for 7.0.3.1 release
0c68c1f updating version and changelog
3872bc0 Preparing for 7.0.3 release
ae98f49 Merge pull request #44777 from jean-francois-labbe/main
c204039 Merge branch '7-0-sec' into 7-0-stable
3520cc7 Preparing for 7.0.2.4 release
Additional commits viewable in compare view

Updates rake from 0.8.7 to 13.0.6

Release notes

Sourced from rake's releases.

rake-10.1.1

Full Changelog: ruby/rake@rake-10.1.0.beta.3...rake-10.1.1

rake-10.1.0

Full Changelog: ruby/rake@rake-10.0.4...rake-10.1.0

rake-10.1.0.beta.3

Full Changelog: ruby/rake@rake-10.1.0.beta.2...rake-10.1.0.beta.3

rake-10.1.0.beta.2

Full Changelog: ruby/rake@rake-10.1.0.beta.1...rake-10.1.0.beta.2

rake-10.1.0.beta.1

Full Changelog: ruby/rake@rake-10.0.4...rake-10.1.0.beta.1

rake-10.0.4

Full Changelog: ruby/rake@rake-10.0.3...rake-10.0.4

rake-10.0.3

Full Changelog: ruby/rake@rake-10.0.2...rake-10.0.3

rake-10.0.2

Full Changelog: ruby/rake@rake-10.0.1...rake-10.0.2

rake-10.0.1

Full Changelog: ruby/rake@rake-10.0.0.beta.2...rake-10.0.1

rake-10.0.0

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-10.0.0

rake-10.0.0.beta.2

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-10.0.0.beta.2

rake-0.9.6

Full Changelog: ruby/rake@rake-0.9.5...rake-0.9.6

rake-0.9.5

Full Changelog: ruby/rake@rake-0.9.4...rake-0.9.5

rake-0.9.4

Full Changelog: ruby/rake@rake-0.9.3.beta.3...rake-0.9.4

rake-0.9.3

Full Changelog: ruby/rake@rake-0.9.2...rake-0.9.3

rake-0.9.3.beta.3

Full Changelog: ruby/rake@rake-0.9.3.beta.2...rake-0.9.3.beta.3

rake-0.9.3.beta.2

Full Changelog: ruby/rake@rake-0.9.3.beta.1...rake-0.9.3.beta.2

... (truncated)

Changelog

Sourced from rake's changelog.

=== 13.0.6

Additional fix for #389 Pull request #390 by hsbt

=== 13.0.5

Fixed the regression of #388 Pull request #389 by hsbt

=== 13.0.4

Fix rake test loader swallowing useful error information. Pull request #367 by deivid-rodriguez

Add -C/--directory option the same as GNU make. Pull request #376 by nobu

=== 13.0.3

Fix breaking change of execution order on TestTask. Pull request #368 by ysakasin

=== 13.0.2

==== Enhancements

Fix tests to work with current FileUtils Pull Request #358 by jeremyevans

Simplify default rake test loader Pull Request #357 by deivid-rodriguez

Update rdoc Pull Request #366 by bahasalien

Update broken links to rake articles from Avdi in README Pull Request #360 by svl7

=== 13.0.1

==== Bug fixes

Fixed bug: Reenabled task raises previous exception on second invokation Pull Request #271 by thorsteneckel

Fix an incorrectly resolved arg pattern Pull Request #327 by mjbellantoni

=== 13.0.0

==== Enhancements

Follows recent changes on keyword arguments in ruby 2.7. Pull Request #326 by nobu

... (truncated)

Commits

5c60da8 Bump up Rake-13.0.6
73d4099 Merge pull request #390 from ruby/fix-388-again
63aacb6 Added Rake namespace explicitly
29a3949 Bump version to v13.0.5
3a95f4c Merge pull request #389 from ruby/fix-388
85c55b4 Fixed the regression of #388
72ac796 History for rake-13.0.4
b20de78 Bump version to 13.0.4
a07e637 Merge pull request #386 from ruby/cleanup
0acc575 Use require_relative to specify release version
Additional commits viewable in compare view

Updates builder from 2.1.2 to 3.2.4

Changelog

Sourced from builder's changelog.

= Change Log

== Version 3.2.0

Ruby 2.0 compatibility changes.

Allow single quoted attributes.

== Version 3.1.0

Included the to_xs arity patch needed for weird Rails compatibility issue.

Escaping newlines in attributes now.

Allow method caching

== Version 3.0.0

Ruby 1.9 compatiblity issues.

== Version 2.2.0

Applied patch from Thijs van der Vossen to allow UTF-8 encoded output when the encoding is UTF-8 and $KCODE is UTF8.

Commits

See full diff in compare view

Updates loofah from 0.4.7 to 2.20.0

Release notes

Sourced from loofah's releases.

2.20.0 / 2023-04-01

Features

Allow SVG attributes color-profile, cursor, filter, marker, and mask. [#246]

Allow SVG elements altGlyph, cursor, feImage, pattern, and tref. [#246]

Allow protocols fax and modem. [#255] (Thanks, @cjba7!)

2.19.1 / 2022-12-13

Security

Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.

Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.

Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

Allow CSS property aspect-ratio. [#236] (Thanks, @louim!)

2.17.0 / 2022-04-28

Features

Allow ARIA attributes. [#232, #233] (Thanks, @nick-desteffen!)

2.16.0 / 2022-04-01

Features

Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @nick-desteffen!)

2.15.0 / 2022-03-14

Features

... (truncated)

Changelog

Sourced from loofah's changelog.

2.20.0 / 2023-04-01

Features

Allow SVG attributes color-profile, cursor, filter, marker, and mask. [#246]

Allow SVG elements altGlyph, cursor, feImage, pattern, and tref. [#246]

Allow protocols fax and modem. [#255] (Thanks, @cjba7!)

2.19.1 / 2022-12-13

Security

Address CVE-2022-23514, inefficient regular expression complexity. See GHSA-486f-hjj9-9vhh for more information.

Address CVE-2022-23515, improper neutralization of data URIs. See GHSA-228g-948r-83gx for more information.

Address CVE-2022-23516, uncontrolled recursion. See GHSA-3x8r-x6xp-q4vm for more information.

2.19.0 / 2022-09-14

Features

Allow SVG 1.0 color keyword names in CSS attributes. These colors are part of the CSS Color Module Level 3 recommendation released 2022-01-18. [#243]

2.18.0 / 2022-05-11

Features

Allow CSS property aspect-ratio. [#236] (Thanks, @louim!)

2.17.0 / 2022-04-28

Features

Allow ARIA attributes. [#232, #233] (Thanks, @nick-desteffen!)

2.16.0 / 2022-04-01

Features

Allow MathML elements menclose and ms, and MathML attributes dir, href, lquote, mathsize, notation, and rquote. [#231] (Thanks, @nick-desteffen!)

2.15.0 / 2022-03-14

Features

... (truncated)

Commits

3d80a4e version bump to v2.20.0
c8211c1 Merge pull request #260 from flavorjones/flavorjones-more-flexible-testing
24dbde5 test: make the generated tests more flexible
6944760 Merge pull request #259 from orien/ruby3.2
f5ab30b CI: add Ruby 3.2 to the test matrix
f8df852 Merge pull request #257 from kyoshidajp/update-checkout-v3
254a1c9 Bump actions/checkout from 2 to 3
01305b6 Merge pull request #255 from cjba7/cjba7-add-fax-to-acceptable-protocols
b0e6f7c doc: update CHANGELOG
ed2c917 Added "fax" and "modem" to acceptable protocols based on rfc2806.
Additional commits viewable in compare view

Updates sax-machine from 0.0.15 to 1.3.2

Changelog

Sourced from sax-machine's changelog.

1.3.2

Compatibility with Oga 0.3

1.3.1

Allow default value to be false [#66]

Support adding class to an attribute [#68]

Adjust Ox handler to skip empty text/cdata values

1.3.0

Improve block modifiers to support all config options

Make block modifiers run in instance context

Make all handlers support IO as a input

1.2.0

Add support for blocks as value modifiers [#61]

1.1.1

Fix Nokogiri autoloading [#60]

1.1.0

Option to use Oga as a SAX handler

1.0.3

Remove missed nokogiri reference [#54]

Add support for Symbol data type conversion [#57]

Add specs for multiple elements with the same alias [#53]

Various code and documentation enhancements

1.0.2

Make sure SAXConfig getters do not modify internal vars. Prevent race conditions

1.0.1

Improve normalize_name performance

1.0.0

Make nokogiri dependency optional

Add :default argument for elements [#51]

0.3.0

... (truncated)

Commits

See full diff in compare view

Updates nokogiri from 1.4.3.1 to 1.14.3

Release notes

Sourced from nokogiri's releases.

1.14.3 / 2023-04-11

Security

[CRuby] Vendored libxml2 is updated to address CVE-2023-29469, CVE-2023-28484, and one other security-related issue. See GHSA-pxvg-2qj5-37jqGHSA-pxvg-2qj5-37jq for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.4 from v2.10.3.

sha256 checksums:

9cc53dd8d92868a0f5bcee44396357a19f95e32d8b9754092622a25bc954c60c  nokogiri-1.14.3-aarch64-linux.gem
320fa1836b8e59e86a804baee534893bcf3b901cc255bbec6d87f3dd3e431610  nokogiri-1.14.3-arm-linux.gem
67dd4ac33a8cf0967c521fa57e5a5422db39da8a9d131aaa2cd53deaa12be4cd  nokogiri-1.14.3-arm64-darwin.gem
13969ec7f41d9cff46fc7707224c55490a519feef7cfea727c6945c5b444caa2  nokogiri-1.14.3-java.gem
9885085249303461ee08f9a9b161d0a570391b8f5be0316b3ac5a6d9a947e1e2  nokogiri-1.14.3-x64-mingw-ucrt.gem
997943d7582a23ad6e7a0abe081d0d40d2c1319a6b2749f9b30fd18037f0c38a  nokogiri-1.14.3-x64-mingw32.gem
58c30b763aebd62dc4222385509d7f83ac398ee520490fadc4b6d7877e29895a  nokogiri-1.14.3-x86-linux.gem
e1d58a5c56c34aab71b00901a969e19bf9f7322ee459b4e9380f433213887c04  nokogiri-1.14.3-x86-mingw32.gem
f0a1ed1460a91fd2daf558357f4c0ceac6d994899da1bf98431aeda301e4dc74  nokogiri-1.14.3-x86_64-darwin.gem
e323a7c654ef846e64582fb6e26f6fed869a96753f8e048ff723e74d8005cb11  nokogiri-1.14.3-x86_64-linux.gem
3b1cee0eb8879e9e25b6dd431be597ca68f20283b0d4f4ca986521fad107dc3a  nokogiri-1.14.3.gem

1.14.2 / 2023-02-13

Fixed

Calling NodeSet#to_html on an empty node set no longer raises an encoding-related exception. This bug was introduced in v1.14.0 while fixing #2649. [#2784]

sha256 checksums:

966acf4f6c1fba10518f86498141cf44265564ac5a65dcc8496b65f8c354f776  nokogiri-1.14.2-aarch64-linux.gem
8a3a35cadae4a800ddc0b967394257343d62196d9d059b54e38cf067981db428  nokogiri-1.14.2-arm-linux.gem
81404cd014ecb597725c3847523c2ee365191a968d0b5f7d857e03f388c57631  nokogiri-1.14.2-arm64-darwin.gem
0a39222af14e75eb0243e8d969345e03b90c0e02b0f33c61f1ebb6ae53538bb5  nokogiri-1.14.2-java.gem
62a18f9213a0ceeaf563d1bc7ccfd93273323c4356ded58a5617c59bc4635bc5  nokogiri-1.14.2-x64-mingw-ucrt.gem
54f6ac2c15a7a88f431bb5e23f4616aa8fc97a92eb63336bcf65b7050f2d3be0  nokogiri-1.14.2-x64-mingw32.gem
c42fa0856f01f901954898e28c3c2b4dce0e843056b1b126f441d06e887e1b77  nokogiri-1.14.2-x86-linux.gem
f940d9c8e47b0f19875465376f2d1c8911bc9489ac9a48c124579819dc4a7f19  nokogiri-1.14.2-x86-mingw32.gem
2508978f5ca28944919973f6300f0a7355fbe72604ab6a6913f1630be1030265  nokogiri-1.14.2-x86_64-darwin.gem
bc6405e1f3ddac6e401f82d775f1c0c24c6e58c371b3fadaca0596d5d511e476  nokogiri-1.14.2-x86_64-linux.gem
</tr></table>

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.14.3 / 2023-04-11

Security

[CRuby] Vendored libxml2 is updated to address CVE-2023-29469, CVE-2023-28484, and one other security-related issue. See GHSA-pxvg-2qj5-37jqGHSA-pxvg-2qj5-37jq for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.10.4 from v2.10.3.

1.14.2 / 2023-02-13

Fixed

Calling NodeSet#to_html on an empty node set no longer raises an encoding-related exception. This bug was introduced in v1.14.0 while fixing #2649. [#2784]

1.14.1 / 2023-01-30

Fixed

Serializing documents now works again with pseudo-IO objects that don't support IO's encoding API (like rubyzip's Zip::OutputStream). This was a regression in v1.14.0 due to the fix for #752 in #2434, and was not completely fixed by #2753. [#2773]

[CRuby] Address compiler warnings about void* casting and old-style C function definitions.

1.14.0 / 2023-01-12

Notable Changes

Ruby

This release ...
Description has been truncated

…vesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri Bumps [actionpack](https://github.com/rails/rails), [rails](https://github.com/rails/rails), [feedzirra](https://github.com/pauldix/feedzirra), [activerecord](https://github.com/rails/rails), [activeresource](https://github.com/rails/activeresource), [activesupport](https://github.com/rails/rails), [rack](https://github.com/rack/rack), [actionmailer](https://github.com/rails/rails), [rake](https://github.com/ruby/rake), [builder](https://github.com/jimweirich/builder), [loofah](https://github.com/flavorjones/loofah), [sax-machine](https://github.com/pauldix/sax-machine) and [nokogiri](https://github.com/sparklemotion/nokogiri). These dependencies needed to be updated together. Updates `actionpack` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/actionpack/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `rails` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `feedzirra` from 0.0.24 to 0.8.0 - [Release notes](https://github.com/pauldix/feedzirra/releases) - [Changelog](https://github.com/feedjira/feedjira/blob/main/CHANGELOG.md) - [Commits](feedjira/feedjira@v0.0.24...v0.8.0) Updates `activerecord` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/activerecord/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `activeresource` from 2.3.8 to 6.0.0 - [Release notes](https://github.com/rails/activeresource/releases) - [Commits](https://github.com/rails/activeresource/commits/v6.0.0) Updates `activesupport` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/activesupport/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `rack` from 1.1.0 to 2.2.6.4 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@1.1...v2.2.6.4) Updates `actionmailer` from 2.3.8 to 7.0.4.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.0.4.3/actionmailer/CHANGELOG.md) - [Commits](rails/rails@v2.3.8...v7.0.4.3) Updates `rake` from 0.8.7 to 13.0.6 - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](ruby/rake@rake-0.8.7...v13.0.6) Updates `builder` from 2.1.2 to 3.2.4 - [Release notes](https://github.com/jimweirich/builder/releases) - [Changelog](https://github.com/jimweirich/builder/blob/master/CHANGES) - [Commits](https://github.com/jimweirich/builder/commits) Updates `loofah` from 0.4.7 to 2.20.0 - [Release notes](https://github.com/flavorjones/loofah/releases) - [Changelog](https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md) - [Commits](flavorjones/loofah@v0.4.7...v2.20.0) Updates `sax-machine` from 0.0.15 to 1.3.2 - [Release notes](https://github.com/pauldix/sax-machine/releases) - [Changelog](https://github.com/pauldix/sax-machine/blob/master/HISTORY.md) - [Commits](https://github.com/pauldix/sax-machine/commits/v1.3.2) Updates `nokogiri` from 1.4.3.1 to 1.14.3 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@REL_1.4.3.1...v1.14.3) --- updated-dependencies: - dependency-name: actionpack dependency-type: direct:production - dependency-name: rails dependency-type: direct:production - dependency-name: feedzirra dependency-type: direct:production - dependency-name: activerecord dependency-type: direct:production - dependency-name: activeresource dependency-type: direct:production - dependency-name: activesupport dependency-type: direct:production - dependency-name: rack dependency-type: direct:production - dependency-name: actionmailer dependency-type: direct:production - dependency-name: rake dependency-type: direct:production - dependency-name: builder dependency-type: direct:production - dependency-name: loofah dependency-type: direct:production - dependency-name: sax-machine dependency-type: direct:production - dependency-name: nokogiri dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Apr 14, 2023

dependabot bot mentioned this pull request Apr 14, 2023

Bump activesupport, rails, actionmailer, actionpack, activerecord, activeresource, rack, rake, feedzirra, builder, loofah, sax-machine and nokogiri #17

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump actionpack, rails, feedzirra, activerecord, activeresource, activesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri #19

Bump actionpack, rails, feedzirra, activerecord, activeresource, activesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri #19

Uh oh!

dependabot bot commented on behalf of github Apr 14, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump actionpack, rails, feedzirra, activerecord, activeresource, activesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri #19

Are you sure you want to change the base?

Bump actionpack, rails, feedzirra, activerecord, activeresource, activesupport, rack, actionmailer, rake, builder, loofah, sax-machine and nokogiri #19

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 14, 2023

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

Rails 7.0.3.1 (July 12, 2022)

Rails 7.0.3 (May 09, 2022)

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Feedjira Changelog

3.2.2

3.2.1

3.2.0

3.1.2

3.1.1

3.1.0

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

6.0.0

Breaking changes

What's Changed

New Contributors

5.1.0

v7.0.4.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.0.4.3 (March 13, 2023)

Rails 7.0.4.2 (January 24, 2023)

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

Rails 7.0.3.1 (July 12, 2022)

Rails 7.0.3 (May 09, 2022)

Rails 7.0.2.4 (April 26, 2022)

Changelog

Unreleased

SPEC Changes

Changed

[3.0.7] - 2023-03-16

[3.0.6.1] - 2023-03-13

[3.0.6] - 2023-03-13

[3.0.5] - 2023-03-13

[3.0.4.2] - 2023-03-02