Update dependency rdoc to v6.6.3.1 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
rdoc (source, changelog)	'6.6.0' -> '6.6.3.1'

GitHub Vulnerability Alerts

CVE-2024-27281

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

• For Ruby 3.0 users: Update to rdoc 6.3.4.1
• For Ruby 3.1 users: Update to rdoc 6.4.1.1
• For Ruby 3.2 users: Update to rdoc 6.5.1.1

You can use gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile.

Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.

---

Release Notes

ruby/rdoc (rdoc)

v6.6.3.1

Compare Source

v6.6.2

Compare Source

What's Changed

• Allow any single-word token upto 2 before C method implementation by @​nobu in https://github.com/ruby/rdoc/pull/1061
• Fix C const comment by @​nobu in https://github.com/ruby/rdoc/pull/1062
• Bump actions/deploy-pages from 2 to 3 by @​dependabot in https://github.com/ruby/rdoc/pull/1063
• Bump actions/configure-pages from 3 to 4 by @​dependabot in https://github.com/ruby/rdoc/pull/1064
• Bump ruby/setup-ruby from 1.161.0 to 1.162.0 by @​dependabot in https://github.com/ruby/rdoc/pull/1065
• Add missing documents by @​nobu in https://github.com/ruby/rdoc/pull/1066

Full Changelog: ruby/rdoc@v6.6.1...v6.6.2

v6.6.1

Compare Source

What's Changed

• Bump ruby/setup-ruby from 1.159.0 to 1.161.0 by @​dependabot in https://github.com/ruby/rdoc/pull/1052
• Fix TIDYLINK after braces (#​1015) by @​nobu in https://github.com/ruby/rdoc/pull/1054
• Fix NoMethodError for tokens_to_s method by @​toshimaru in https://github.com/ruby/rdoc/pull/1055
• Place a space between certain character class letters only by @​nobu in https://github.com/ruby/rdoc/pull/1057
• Re-enable tests with truffleruby-head by @​nobu in https://github.com/ruby/rdoc/pull/1058
• Get rid of Kernel#open by @​nobu in https://github.com/ruby/rdoc/pull/1059
• Markup punctuations need to be separated with a space by @​nobu in https://github.com/ruby/rdoc/pull/1060
• fix: Return empty string when token_stream is nil by @​toshimaru in https://github.com/ruby/rdoc/pull/1056

Full Changelog: ruby/rdoc@v6.6.0...v6.6.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.