Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] Update html-proofer 5.0.3 → 5.0.9 (patch) #292

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🚨 [security] Update html-proofer 5.0.3 → 5.0.9 (patch) #292

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented May 14, 2024

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ html-proofer (5.0.3 → 5.0.9) · Repo · Changelog

Release Notes

5.0.9

What's Changed

  • Bump actions/checkout from 3 to 4 by @dependabot in #805
  • [skip test] Release v5.0.9 by @github-actions in #838

New Contributors

  • @github-actions made their first contribution in #838

Full Changelog: v5.0.8...v5.0.9

5.0.8

Full Changelog: v5.0.6...v5.0.8

5.0.7

What's Changed

Full Changelog: v5.0.6...v5.0.7

5.0.6

What's Changed

Full Changelog: v5.0.5...v5.0.6

5.0.5

What's Changed

Full Changelog: v5.0.4...v5.0.5

5.0.4

What's Changed

Full Changelog: v5.0.3...v5.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ addressable (indirect, 2.8.1 → 2.8.6) · Repo · Changelog

Release Notes

2.8.6 (from changelog)

  • Memoize regexps for common character classes (#524)

2.8.5 (from changelog)

  • Fix thread safety issue with encoding tables (#515)
  • Define URI::NONE as a module to avoid serialization issues (#509)
  • Fix YAML serialization (#508)

2.8.4 (from changelog)

  • Restore Addressable::IDNA.unicode_normalize_kc as a deprecated method (#504)

2.8.3 (from changelog)

  • Fix template expand level 2 hash support for non-string objects (#499, #498)

2.8.2 (from changelog)

  • Improve cache hits and JIT friendliness (#486)
  • Improve code style and test coverage (#482)
  • Ensure reset of deferred validation (#481)
  • Resolve normalization differences between IDNA::Native and IDNA::Pure (#408, #492)
  • Remove redundant colon in Addressable::URI::CharacterClasses::AUTHORITY regex (#438) (accidentally reverted by #449 merge but added back in #492)

Does any of this look wrong? Please let us know.

↗️ async (indirect, 2.3.0 → 2.11.0) · Repo

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ console (indirect, 1.16.2 → 1.25.2) · Repo

Release Notes

1.22.0

What's Changed

  • Introduce new "Safe" JSON serialization implementation. by @ioquatix in #48

Full Changelog: v1.21.0...v1.22.0

1.20.0

What's Changed

  • Modernize gem. by @ioquatix in #45
  • Encode serialized output to avoid encoding errors. by @ioquatix in #44
  • This release drops support for Ruby 2.7.

Full Changelog: v1.19.0...v1.20.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ffi (indirect, 1.15.5 → 1.16.3) · Repo · Changelog

Release Notes

1.16.3 (from changelog)

Fixed:

  • Fix gcc error when building on CentOS 7. #1052
  • Avoid trying to store new DataConverter type in frozen TypeDefs hash. #1057

1.16.2 (from changelog)

Fixed:

  • Handle null pointer crash after fork. #1051

1.16.1 (from changelog)

Fixed:

  • Fix compiling the builtin libffi. #1049

1.16.0 (from changelog)

Fixed:

  • Fix an issue with signed bitmasks when using flags on the most significant bit. #949
  • Fix FFI::Pointer#initialize using NUM2LL instead of NUM2ULL.
  • Fix FFI::Type#inspect to properly display the constant name. #1002
  • Use libffi closure allocations on hppa-Linux. #1017 Previously they would segfault.
  • Fix class name of Symbol#inspect.
  • Fix MSVC support of libtest. #1028
  • Fix attach_function of functions ending in ? or ! #971

Added:

  • Convert all C-based classes to TypedData and use write barriers. #994, #995, #996, #997, #998, #999, #1000, #1001, #1003, #1004, #1005, #1006, #1007, #1008, #1009, #1010, #1011, #1012 This results in less pressure on the garbage collector, since the objects can be promoted to the old generation, which means they only get marked on major GC.
  • Implement ObjectSpace.memsize_of() of all C-based classes.
  • Make FFI Ractor compatible. #1023 Modules extended per extend FFI::Library need to be frozen in order to be used by non-main Ractors. This can be done by calling freeze below of all C interface definitions.
    • In a Ractor it's possible to:
      • load DLLs and call its functions, access its global variables
      • use builtin typedefs
      • use and modify ractor local typedefs
      • define callbacks
      • receive async callbacks from non-ruby threads
      • use frozen FFI::Library based modules with all attributes (enums, structs, typedefs, functions, callbacks)
      • invoke frozen functions and callbacks defined in the main Ractor
      • use FFI::Struct definitions from the main Ractor
    • In a Ractor it's impossible to:
      • create new FFI::Library based modules
      • create new FFI::Struct definitions
      • use custom global typedefs
      • use non-frozen FFI::Library based modules
  • Allow type retrieval of attached functions+variables. #1023
  • Make FFI classes GC.compact friendly. #1021
  • Update libffi and disable custom trampoline when using libffi closure allocation. #1020 This is because libffi changed the way how closures are allocated to static trampolines.
  • Add types.conf for loongarch64-linux. #943
  • Add types.conf for sw_64-linux (Shen Wei 64-bit, based on Alpha). #1018
  • Add support for aarch64-windows. #1035
  • Windows: Update LoadLibrary error message to include error code. #1026
  • Allow private release method for FFI::ManagedStruct and FFI::AutoPointer. #1029
  • Add support for passing ABI version to FFI.map_library_name. #963 This adds the new class FFI::LibraryPath .
  • Add support for ruby-3.2 to windows binary gem. #1047
  • Enable debug symbols for rake compile builds to ease debugging. #1048

Removed:

  • Remove allocator of AbstractMemory. #1013 This disables AbstractMemory.new, which has no practical use.
  • Remove unused FFI::SizeTypes. #1022

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ fiber-local (indirect, 1.0.0 → 1.1.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ io-event (indirect, 1.1.4 → 1.5.1) · Repo

Release Notes

1.4.3

What's Changed

Full Changelog: v1.4.2...v1.4.3

1.4.0

What's Changed

  • Ruby 3.3 updates (dropped support for Ruby 3.0) by @ioquatix in #85

Full Changelog: v1.3.3...v1.4.0

1.3.2

What's Changed

  • Ensure that every io_uring_get_sqe is used correctly. by @ioquatix in #80
  • Add tests for cancellation and update pure Ruby implementation. by @ioquatix in #79

Full Changelog: v1.3.1...v1.3.2

1.3.1

What's Changed

Full Changelog: v1.3.0...v1.3.1

1.3.0

What's Changed

  • Rename data -> selector. by @ioquatix in #67
  • Spurious wakeups by @ioquatix in #66
  • Don't use EPOLLONESHOT for the wakeup event. by @Math2 in #68
  • Failing test case for waiting on a reused FD. by @Math2 in #69
  • Always re-register epoll descriptor. by @ioquatix in #71
  • Fix potential race conditions in io_uring backend. by @ioquatix in #70
  • NetBSD/OpenBSD compatibility for KQueue selector, some FreeBSD fixes by @Math2 in #72
  • Introduce correct support for compacting GC. by @ioquatix in #73
  • Fix external tests by @ioquatix in #75
  • Add more external tests. by @ioquatix in #74
  • Run coverage tests on more Ruby versions. by @ioquatix in #76

Full Changelog: v1.2.3...v1.3.0

1.2.0

What's Changed

  • Native improvements by @ioquatix in #56
  • Minor compiler warnings fixed.
  • Add support for epoll_pwait2.

Full Changelog: v1.1.7...v1.2.0

1.1.7

What's Changed

  • Introduce cancellation support for asynchronous io_read and io_write operations. by @ioquatix in #55

Full Changelog: v1.1.6...v1.1.7

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.13.10 → 1.16.5) · Repo · Changelog

Security Advisories 🚨

🚨 Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

Summary

Nokogiri v1.16.5 upgrades its dependency libxml2 to 2.12.7 from 2.12.6.

libxml2 v2.12.7 addresses CVE-2024-34459:

Impact

There is no impact to Nokogiri users because the issue is present only in libxml2's xmllint tool which Nokogiri does not provide or expose.

Timeline

  • 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced
  • 2024-05-13 08:30 EDT, nokogiri maintainers begin triage
  • 2024-05-13 10:05 EDT, nokogiri v1.16.5 is released and this GHSA made public

🚨 Use-after-free in libxml2 via Nokogiri::XML::Reader

Summary

Nokogiri upgrades its dependency libxml2 as follows:

  • v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
  • v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062

Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
the packaged libraries are being used. If you've overridden defaults at installation time to use
system libraries instead of packaged libraries, you should instead pay attention to your distro's
libxml2 release announcements.

JRuby users are not affected.

Severity

The Nokogiri maintainers have evaluated this as Moderate.

Impact

From the CVE description, this issue applies to the xmlTextReader module (which underlies
Nokogiri::XML::Reader):

When using the XML Reader interface with DTD validation and XInclude expansion enabled,
processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Mitigation

Upgrade to Nokogiri ~> 1.15.6 or >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
and link Nokogiri against patched external libxml2 libraries which will also address these same
issues.

🚨 Use-after-free in libxml2 via Nokogiri::XML::Reader

Summary

Nokogiri upgrades its dependency libxml2 as follows:

  • v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
  • v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062

Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if
the packaged libraries are being used. If you've overridden defaults at installation time to use
system libraries instead of packaged libraries, you should instead pay attention to your distro's
libxml2 release announcements.

JRuby users are not affected.

Severity

The Nokogiri maintainers have evaluated this as Moderate.

Impact

From the CVE description, this issue applies to the xmlTextReader module (which underlies
Nokogiri::XML::Reader):

When using the XML Reader interface with DTD validation and XInclude expansion enabled,
processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Mitigation

Upgrade to Nokogiri ~> 1.15.6 or >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
and link Nokogiri against patched external libxml2 libraries which will also address these same
issues.

🚨 Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

Summary

Nokogiri upgrades its dependency libxml2 as follows:

  • Nokogiri v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
  • Nokogiri v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

JRuby users are not affected.

Mitigation

Upgrade to Nokogiri ~> 1.15.6 or >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
and link Nokogiri against patched external libxml2 libraries which will also address these same
issues.

Impact

From the CVE description, this issue applies to the xmlTextReader module (which underlies Nokogiri::XML::Reader):

When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Timeline

  • 2024-02-04 10:35 EST - this GHSA is drafted without complete details about when the upstream issue was introduced; a request is made of libxml2 maintainers for more detailed information
  • 2024-02-04 10:48 EST - updated GHSA to reflect libxml2 maintainers' confirmation of affected versions
  • 2024-02-04 11:54 EST - v1.16.2 published, this GHSA made public
  • 2024-02-05 10:18 EST - updated with MITRE link to the CVE information, and updated "Impact" section
  • 2024-03-16 09:03 EDT - v1.15.6 published (see discussion at #3146), updated mitigation information
  • 2024-03-18 22:12 EDT - update "affected products" range with v1.15.6 information

🚨 Nokogiri update packaged libxml2 to v2.12.5 to resolve CVE-2024-25062

Summary

Nokogiri upgrades its dependency libxml2 as follows:

  • Nokogiri v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
  • Nokogiri v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

Please note that this advisory only applies to the CRuby implementation of Nokogiri, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

JRuby users are not affected.

Mitigation

Upgrade to Nokogiri ~> 1.15.6 or >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile
and link Nokogiri against patched external libxml2 libraries which will also address these same
issues.

Impact

From the CVE description, this issue applies to the xmlTextReader module (which underlies Nokogiri::XML::Reader):

When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free.

Timeline

  • 2024-02-04 10:35 EST - this GHSA is drafted without complete details about when the upstream issue was introduced; a request is made of libxml2 maintainers for more detailed information
  • 2024-02-04 10:48 EST - updated GHSA to reflect libxml2 maintainers' confirmation of affected versions
  • 2024-02-04 11:54 EST - v1.16.2 published, this GHSA made public
  • 2024-02-05 10:18 EST - updated with MITRE link to the CVE information, and updated "Impact" section
  • 2024-03-16 09:03 EDT - v1.15.6 published (see discussion at #3146), updated mitigation information
  • 2024-03-18 22:12 EDT - update "affected products" range with v1.15.6 information

🚨 Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs

Summary

Nokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to v2.10.4 from v2.10.3.

libxml2 v2.10.4 addresses the following known vulnerabilities:

  • CVE-2023-29469: Hashing of empty dict strings isn't deterministic
  • CVE-2023-28484: Fix null deref in xmlSchemaFixupComplexType
  • Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.14.3, and only if the packaged libraries are being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

Mitigation

Upgrade to Nokogiri >= 1.14.3.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 >= 2.10.4 which will also address these same issues.

Impact

No public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.

The commits can be examined at:

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ public_suffix (indirect, 5.0.1 → 5.0.5) · Repo · Changelog

Release Notes

5.0.5 (from changelog)

Changed

  • Updated definitions.

5.0.4 (from changelog)

Changed

5.0.3 (from changelog)

Fixed

  • Fixed automated release workflow.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ racc (indirect, 1.6.1 → 1.7.3) · Repo · Changelog

Release Notes

1.7.3

What's Changed

Full Changelog: v1.7.2...v1.7.3

1.7.2

What's Changed

New Contributors

Full Changelog: v1.7.1...v1.7.2

1.7.1

What's Changed

  • Use released version of test-unit-ruby-core by @hsbt in #220
  • Fix place to specify rake-compiler version by @nobu in #223
  • Embedded path by @nobu in #221

Full Changelog: v1.7.0...v1.7.1

1.7.0

What's Changed

New Contributors

Full Changelog: v1.6.2...v1.7.0

1.6.2

What's Changed

Full Changelog: v1.6.1...v1.6.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ typhoeus (indirect, 1.4.0 → 1.4.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ zeitwerk (indirect, 2.6.6 → 2.6.14) · Repo · Changelog

Release Notes

2.6.13 (from changelog)

  • There is a new experimental null inflector that simply returns its input unchanged:

    loader.inflector = Zeitwerk::NullInflector.new

    Projects using this inflector are expected to define their constants in files and directories with names exactly matching them:

    User.rb       -> User
HTMLParser.rb -> HTMLParser
Admin/Role.rb -> Admin::Role

    Please see its documentation for further details.

  • Documentation improvements.

2.6.12 (from changelog)

  • Maintenance release with some internal polishing.

2.6.11 (from changelog)

  • Let on_load callbacks for implicit namespaces autoload other implicit namespaces.

2.6.10 (from changelog)

  • Improve validation of the values returned by the inflector's camelize.

2.6.9 (from changelog)

  • Given a path as a string or Pathname object, Zeitwerk::Loader#cpath_expected_at returns a string with the corresponding expected constant path.

    Some examples, assuming that app/models is a root directory:

    loader.cpath_expected_at("app/models")                  # => "Object"
loader.cpath_expected_at("app/models/user.rb")          # => "User"
loader.cpath_expected_at("app/models/hotel")            # => "Hotel"
loader.cpath_expected_at("app/models/hotel/billing.rb") # => "Hotel::Billing"

    This method returns nil for some input like ignored files, and may raise errors too. Please check its documentation for further details.

  • Zeitwerk::Loader#load_file raises with a more informative error if given a hidden file or directory.

  • Zeitwerk::Loader#eager_load_dir does nothing if the argument is a hidden file or directory. This is coherent with its existing behavior for eager load exclusions and ignored paths. Before, that kind of argument would result in a non-deliberate NameError.

  • Documentation improvements.

2.6.8 (from changelog)

  • The new Zeitwerk::Loader.for_gem_extension gives you a loader configured according to the conventions of a gem extension.

    Please check its documentation for further details.

2.6.7 (from changelog)

  • Reset module state on Zeitwerk::NameError.

    If an autoload is triggered, the file is loaded successfully, but the expected constant does not get defined, Ruby resets the state of the module. In particular, autoload? returns nil for that constant name, and constants does not include the constant name (starting with Ruby 3.1).

    Zeitwerk is more strict, not defining the expected constant is an error condition and the loader raises Zeitwerk::NameError. But this happens during the require call and the exception prevents Ruby from doing that cleanup.

    With this change, the parent module is left in a state that makes more sense and is consistent with what Ruby does.

  • A message is logged if an autoload did not define the expected constant.

    When that happens, Zeitwerk::NameError is raised and you normally see the exception. But if the error is shallowed, and you are inspecting the logs to investigate something, this new message may be helpful.

  • By default, Zeitwerk::Loader#dirs filters ignored root directories out. Please, pass ignored: true if you want them included.

    It is very strange to configure a root directory and also ignore it, the edge case is supported only for completeness. However, in that case, client code listing root directories rarely needs the ignored ones.

  • Documentation improvements.

  • Enforcement of private interfaces continues with another gradual patch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 Ascii85 (added, 1.1.1)

🆕 afm (added, 0.2.2)

🆕 bigdecimal (added, 3.1.8)

🆕 fiber-annotation (added, 0.2.0)

🆕 fiber-storage (added, 0.1.0)

🆕 hashery (added, 2.1.2)

🆕 json (added, 2.7.2)

🆕 pdf-reader (added, 2.12.0)

🆕 ruby-rc4 (added, 0.1.5)

🆕 ttfunk (added, 1.8.0)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label May 14, 2024
@depfu depfu bot mentioned this pull request May 14, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants