Update dependency rexml to v3.3.9 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
rexml (changelog)	3.3.6 -> 3.3.9

GitHub Vulnerability Alerts

CVE-2024-49761

Impact

The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x...;).

This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. Note that Ruby 3.1 will reach EOL on 2025-03.

Patches

The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

Workarounds

Use Ruby 3.2 or later instead of Ruby 3.1.

References

• https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/: An announce on www.ruby-lang.org

---

Release Notes

ruby/rexml (rexml)

v3.3.9: REXML 3.3.9 - 2024-10-24

Compare Source

Improvements

• Improved performance.
  • GH-210
  • Patch by NAITOH Jun.

Fixes

• Fixed a parse bug for text only invalid XML.

  • GH-215
  • Patch by NAITOH Jun.

• Fixed a parse bug that &#​0x...; is accepted as a character
  reference.

Thanks

• NAITOH Jun

v3.3.8: REXML 3.3.8 - 2024-09-29

Compare Source

Improvements

• SAX2: Improve parse performance.
  • GH-207
  • Patch by NAITOH Jun.

Fixes

• Fixed a bug that unexpected attribute namespace conflict error for
  the predefined "xml" namespace is reported.
  • GH-208
  • Patch by KITAITI Makoto

Thanks

• NAITOH Jun

• KITAITI Makoto

v3.3.7: REXML 3.3.7 - 2024-09-04

Compare Source

Improvements

• Added local entity expansion limit methods

  • GH-192
  • GH-202
  • Reported by takuya kodama.
  • Patch by NAITOH Jun.

• Removed explicit strscan dependency

  • GH-204
  • Patch by Bo Anderson.

Thanks

• takuya kodama

• NAITOH Jun

• Bo Anderson

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.