🚨 [security] Update nokogiri 1.15.4 → 1.16.2 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ nokogiri (indirect, 1.15.4 → 1.16.2) · Repo · Changelog

Security Advisories 🚨

🚨 Improper Handling of Unexpected Data Type in Nokogiri

Summary

Nokogiri v1.16.2 upgrades the version of its dependency libxml2 to v2.12.5.

libxml2 v2.12.5 addresses the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970

Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.16.2, and only if the packaged libraries are being used. If
you've overridden defaults at installation time to use system libraries
instead of packaged libraries, you should instead pay attention to your
distro's libxml2 release announcements.

Severity

The Nokogiri maintainers have evaluated this as Moderate.

Mitigation

Upgrade to Nokogiri >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated
mitigation: compile and link Nokogiri against external libraries libxml2 >=
2.12.5 which will also address these same issues.

JRuby users are not affected.

Workarounds

Release Notes

1.16.2

v1.16.2 / 2024-02-04

Security

• [CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.5 from v2.12.4. (@flavorjones)

---

sha256 checksums:

69ba15d2a2498324489ed63850997f0b8f684260114ea81116d3082f16551d2d  nokogiri-1.16.2-aarch64-linux.gem
6a05ce42e3587a40cf8936ece0beaa5d32922254215d2e8cf9ad40588bb42e57  nokogiri-1.16.2-arm-linux.gem
c957226c8e36b31be6a3afb8602e2128282bf8b40ea51016c4cd21aa2608d3f8  nokogiri-1.16.2-arm64-darwin.gem
122652bfc338cd8a54a692ac035e245e41fd3b8283299202ca26e7a7d50db310  nokogiri-1.16.2-java.gem
7344b5072ca69fc5bedb61cb01a3b765b93a27aae5a2a845c2ba7200e4345074  nokogiri-1.16.2-x64-mingw-ucrt.gem
a2a5e184a424111a0d5b77947986484920ad708009c667f061e8d02035c562dd  nokogiri-1.16.2-x64-mingw32.gem
833efddeb51a6c2c9f6356295623c2b2e0d50050d468695c59bd929162953323  nokogiri-1.16.2-x86-linux.gem
e67fc0418dffaff9dc8b1dc65f0605282c3fee9488832d0223b620b4319e0b53  nokogiri-1.16.2-x86-mingw32.gem
5def799e5f139f21a79d7cf71172313a7b6fb0e4b2a31ab9bd5d4ad305994539  nokogiri-1.16.2-x86_64-darwin.gem
5b146240ac6ec6c40fd4367623e74442bca45a542bd3282b1d4d18b07b8e5dfe  nokogiri-1.16.2-x86_64-linux.gem
68922ee5cde27497d995c46f2821957bae961947644eed2822d173daf7567f9c  nokogiri-1.16.2.gem

1.16.1

v1.16.1 / 2024-02-03

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.4 from v2.12.3. (@flavorjones)

Fixed

• [CRuby] XML::Reader defaults the encoding to UTF-8 if it's not specified in either the document or as a method parameter. Previously non-ASCII characters were serialized as NCRs in this case. [#2891] (@flavorjones)
• [CRuby] Restored support for compilation by GCC versions earlier than 4.6, which was broken in v1.15.0 (540e9ae). [#3090] (@adfoster-r7)
• [CRuby] Patched upstream libxml2 to allow parsing HTML5 in the context of a namespaced node (e.g., foreign content like MathML). [#3112, #3116] (@flavorjones)
• [CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when the maximum tree depth limit is hit. [#3098, #3100] (@stevecheckoway)

---

sha256 checksums:

a541f35e5b9798a0c97300f9ee18f4217da2a2945a6d5499e4123b9018f9cafc  nokogiri-1.16.1-aarch64-linux.gem
6b82affd195000ab2f9c36cc08744ec2d2fcf6d8da88d59a2db67e83211f7c69  nokogiri-1.16.1-arm-linux.gem
487f0072c154b8a8fd12716f746beee9fb7cea1d62773471bb2951e540f3798a  nokogiri-1.16.1-arm64-darwin.gem
d45378ce34b8d2cfac2428cebb0e21ace4d9c97e76c565ba2e8cec041df02afb  nokogiri-1.16.1-java.gem
d50359f604e650e47365baa8af231b587080ffa7bb84ffca836f34f8c06ae10d  nokogiri-1.16.1-x64-mingw-ucrt.gem
5b656174e77db8f97ee2cc45c4f1476c8262797b577e8fc8abf458beefd4372c  nokogiri-1.16.1-x64-mingw32.gem
c6ba741e41b73a75cdefbf3733101c66a93eb041cab22ba3472a6c548f5b20d7  nokogiri-1.16.1-x86-linux.gem
e37439f5ce9bf91f3797420f8a1e1502ebc3654c3ca4eca80a0b2707235c9326  nokogiri-1.16.1-x86-mingw32.gem
380c94bd8a7fbdee4633db117e5c1ef04cafd35e0dbbdb20eb9224631fe0dc49  nokogiri-1.16.1-x86_64-darwin.gem
cf43557ea7eed0e9f9ed90837a27e1dbfb7fd56d65eb806955965e02231bed3e  nokogiri-1.16.1-x86_64-linux.gem
304db173d8a87afc63f1e1702a671d9eb9e4a30974b297ccca604f6cfd3ed2a7  nokogiri-1.16.1.gem

1.16.0

v1.16.0 / 2023-12-27

Notable Changes

Ruby

This release introduces native gem support for Ruby 3.3.

This release ends support for Ruby 2.7, for which upstream support ended 2023-03-31.

Pattern matching

This version marks official support for the pattern matching API in XML::Attr, XML::Document, XML::DocumentFragment, XML::Namespace, XML::Node, and XML::NodeSet (and their subclasses), originally introduced as an experimental feature in v1.14.0. (@flavorjones)

Documentation on what can be matched:

• XML::Attr#deconstruct_keys
• XML::Document#deconstruct_keys
• XML::Namespace#deconstruct_keys
• XML::Node#deconstruct_keys
• XML::DocumentFragment#deconstruct
• XML::NodeSet#deconstruct

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.3 from v2.11.6. (@flavorjones)
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.0
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.1
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.2
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.3

Fixed

• CSS nth pseudo-classes now handle spaces, e.g. "2n + 1". [#3018] (@fusion2004)
• [CRuby] libgumbo no longer leaks memory when an incomplete tag is abandoned by the HTML5 parser. [#3036] (@flavorjones)

Removed

• Removed Nokogiri::HTML5.get which was deprecated in v1.12.0. [#2278] (@flavorjones)
• Removed the CSS-to-XPath utility modules XPathVisitorAlwaysUseBuiltins and XPathVisitorOptimallyUseBuiltins, which were deprecated in v1.13.0 in favor of XPathVisitor constructor args. [#2403] (@flavorjones)
• Removed XML::Reader#attribute_nodes which was deprecated in v1.13.8 in favor of #attribute_hash. [#2598, #2599] (@flavorjones)
• [CRuby] Removed the libxml/libxml2_path key from VersionInfo, used in the past for third-party library integration, in favor of the nokogiri/cppflags and nokogiri/ldflags keys. Please note that third-party library integration is not fully supported and may be deprecated soon, see #2746 for more context. [#2143] (@flavorjones)

Thank you!

The following people and organizations were kind enough to sponsor @flavorjones or the Nokogiri project during the development of v1.16.0:

• Götz Görisch @GoetzGoerisch
• Airbnb @airbnb
• Maxime Gauthier @biximilien
• Renuo AG @renuo
• YOSHIDA Katsuhiko @kyoshidajp
• Homebrew @Homebrew
• Hiroshi SHIBATA @hsbt
• @zzak
• Evil Martians @evilmartians
• Ajaya Agrawalla @ajaya
• Modern Treasury @Modern-Treasury
• Danilo Lessa Bernardineli @danlessa
• matt marques @mestre-dos-magos
• Quan Nguyen @qu8n
• Harry Lascelles @hlascelles
• Oleksandr Tyshchenko @altivi
• Prowly @prowlycom
• Better Stack Community @betterstack-community
• Sentry @getsentry
• Codecov @codecov
• Typesense @typesense
• Roy Boivin II @Yabbo
• Frank Groeneveld @frenkel

We'd also like to thank @github who donate a ton of compute time for our CI pipelines!

---

sha256 checksums:

8cd981dfd4bea4f519ceebb885cf3b422b71c059d841c039d327e73b19247f53  nokogiri-1.16.0-aarch64-linux.gem
c68d861155c40777eee3eb4efbb375d665c8c889cebd5cd1ba32f30a8aac6c21  nokogiri-1.16.0-arm-linux.gem
10c08f246085709790ea628b5fa031cf23dadd843e173711b335ba6287b59d0a  nokogiri-1.16.0-arm64-darwin.gem
f76f2dc353993862d07eccfc5561e373e8058d62e265bae9bcf4f4793c35c9e2  nokogiri-1.16.0-java.gem
5c59792f7f5f8a76e17a87b89b9057544853a6f713b692a75b7f8895a854b74f  nokogiri-1.16.0-x64-mingw-ucrt.gem
286950458a58bdf09bb3a800ac16f0aa361aa9a6c9a63bcd71e98e3c34d314a8  nokogiri-1.16.0-x64-mingw32.gem
159107da8a35f1fc22ee5b78d70da9bda4098a3771a29beac3f727cafd5041cb  nokogiri-1.16.0-x86-linux.gem
27d3d96f53b3fa1da9c4d9d69fffadc34abf7350a8e22be61a7483f15f065438  nokogiri-1.16.0-x86-mingw32.gem
237aa89b9ef6b8e014f197167677926ebc4bdb9cafb2b101399d8001fda4fa43  nokogiri-1.16.0-x86_64-darwin.gem
6f55093bb47e75d412138f4b9462f960d3aad96cb6b43dbe9a3de62c2d31a742  nokogiri-1.16.0-x86_64-linux.gem
341388184e975d091e6e38ce3f3b3388bfb7e4ac3d790efd8e39124844040bd1  nokogiri-1.16.0.gem

1.15.5

1.15.5 / 2023-11-17

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.6 from v2.11.5. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.6
• [CRuby] Vendored libxslt is updated to v1.1.39 from v1.1.38. For details please see https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.39

---

sha256 checksums:

6dfa1d9837ddb233e234d56e244560ab1bc545d3d1744478060e18691f44ded7  nokogiri-1.15.5-aarch64-linux.gem
e3ac6608c6e1714bc11ff04e29a43fedf4cac2aea1bd88256cc3b927c06f347f  nokogiri-1.15.5-arm-linux.gem
4d7b15d53c0397d131376a19875aa97dd1c8b404c2c03bd2171f9b77e9592d40  nokogiri-1.15.5-arm64-darwin.gem
5f87e71aaeb4f7479b94698737a0aacea77836b4805c7433b655e9565bd56cfe  nokogiri-1.15.5-java.gem
7612be800909ae51e0a7cfbe1f768757857a9ff0339686814ca67d9bae271ca2  nokogiri-1.15.5-x64-mingw-ucrt.gem
28fd78d98e12005fe017db5ceccb74b2497f30582e6e26a3344200625fe46aae  nokogiri-1.15.5-x64-mingw32.gem
0d1b564d7f148a6766380966bb48b23afa72c72c992c69c71d21acd4a7f5c0e4  nokogiri-1.15.5-x86-linux.gem
d27dbf44c19b83e570e65b660a8a921441d1e8b6063ab1b985b516f78e0a2854  nokogiri-1.15.5-x86-mingw32.gem
10bafa54935f68aebd23235cb0fc7dfb8f6f5e52131379484771247eb3a0cc70  nokogiri-1.15.5-x86_64-darwin.gem
c5d9453cc155dc15f08ac699cc1293fd994ec6cfacec48e67653aa95ee946adf  nokogiri-1.15.5-x86_64-linux.gem
22448ca35dbcbdcec60dbe25ccf452b685a5436c28f21b2fec2e20917aba9100  nokogiri-1.15.5.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #355.