Changelog for ruby3.1-rubygem-nokogiri-1.13.9-3.14.i586.rpm :

* Fri Oct 28 2022 Stephan Kulow updated to version 1.13.9 see installed CHANGES.md
* Thu Aug 04 2022 Stephan Kulow updated to version 1.13.8 see installed CHANGES.md
* Mon May 30 2022 Marcus Rueckert - Also build ruby 3.1 for 15.x
* Sun May 15 2022 Manuel Schnitzer - updated to version 1.13.6 [#]# 1.13.6 / 2022-05-08 [#]## Security
* [CRuby] Address [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181), improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See [GHSA-xh29-r2w5-wx8m](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m) for more information. [#]## Improvements
* `{HTML4,XML}::SAX::{Parser,ParserContext}` constructor methods now raise `TypeError` instead of segfaulting when an incorrect type is passed. [#]# 1.13.5 / 2022-05-04 [#]## Security
* [CRuby] Vendored libxml2 is updated to address [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824). See [GHSA-cgx6-hpwq-fhv5](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-cgx6-hpwq-fhv5) for more information. [#]## Dependencies
* [CRuby] Vendored libxml2 is updated from v2.9.13 to [v2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14). [#]## Improvements
* [CRuby] The libxml2 HTML parser no longer exhibits quadratic behavior when recovering some broken markup related to start-of-tag and bare `<` characters. [#]## Changed
* [CRuby] The libxml2 HTML parser in v2.9.14 recovers from some broken markup differently. Notably, the XML CDATA escape sequence `* Tue Apr 12 2022 Marcus Rueckert - updated to version 1.13.4 - Security - Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information. - [CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information. - [JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information. - [JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information. - Dependencies - [CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.) - [JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2. - [JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml
* Thu Mar 10 2022 Manuel Schnitzer - use mini_portile2 2.8 required by version 1.13.3
* Thu Mar 10 2022 Manuel Schnitzer - updated to version 1.13.3 [#]## Fixed
* [CRuby] Revert a HTML4 parser bug in libxml 2.9.13 (introduced in Nokogiri v1.13.2). The bug causes libxml2\'s HTML4 parser to fail to recover when encountering a bare `<` character in some contexts. This version of Nokogiri restores the earlier behavior, which is to recover from the parse error and treat the `<` as normal character data (which will be serialized as `<` in a text node). The bug (and the fix) is only relevant when the `RECOVER` parse option is set, as it is by default. [[#2461](https://github.com/sparklemotion/nokogiri/issues/2461)] [#]# 1.13.2 / 2022-02-21 [#]## Security
* [CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. This update addresses [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308).
* [CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. This update addresses [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560). Please see [GHSA-fq42-c5rg-92c2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2) for more information about these CVEs. [#]## Dependencies
* [CRuby] Vendored libxml2 is updated from 2.9.12 to 2.9.13. Full changelog is available at https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news
* [CRuby] Vendored libxslt is updated from 1.1.34 to 1.1.35. Full changelog is available at https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news
* Thu Jan 27 2022 Marcus Rueckert - fix ruby versions for the leap build
* Tue Jan 25 2022 Marcus Rueckert - Update to 1.13.1 - Fixed - Fix Nokogiri::XSLT.quote_params regression in v1.13.0 that raised an exception when non-string stylesheet parameters were passed. Non-string parameters (e.g., integers and symbols) are now explicitly supported and both keys and values will be stringified with #to_s. [#2418] - Fix CSS selector query regression in v1.13.0 that raised an Nokogiri::XML::XPath::SyntaxError when parsing XPath attributes mixed into the CSS query. Although this mash-up of XPath and CSS syntax previously worked unintentionally, it is now an officially supported feature and is documented as such. [#2419]- Changes from 1.13.0 - This release ends support for: - Ruby 2.5, for which official support ended 2021-03-31. - JRuby 9.2, which is a Ruby 2.5-compatible release. - Faster, more reliable installation: Native Gem for ARM64 Linux - This version of Nokogiri ships experimental native gem support for the aarch64-linux platform, which should support AWS Graviton and other ARM Linux platforms. We don\'t yet have CI running for this platform, and so we\'re interested in hearing back from y\'all whether this is working, and what problems you\'re seeing. Please send us feedback here: Feedback: Have you used the aarch64-linux native gem? - Publishing - This version of Nokogiri opts-in to the \"MFA required to publish\" setting on Rubygems.org. This and all future Nokogiri gem files must be published to Rubygems by an account with multi-factor authentication enabled. This should provide some additional protection against supply-chain attacks. A related discussion about Trust exists at #2357 in which I invite you to participate if you have feelings or opinions on this topic. - Dependencies - [CRuby] Vendored libiconv is updated from 1.15 to 1.16. (Note that libiconv is only redistributed in the native windows and native darwin gems, see LICENSE-DEPENDENCIES.md for more information.) [#2206] - [CRuby] Upgrade mini_portile2 dependency from ~> 2.6.1 to ~> 2.7.0. (\"ruby\" platform gem only.) - Improved - {XML,HTML4}::DocumentFragment constructors all now take an optional parse options parameter or block (similar to Document constructors). [#1692] (Thanks, AATTJackMc!) - Nokogiri::CSS.xpath_for allows an XPathVisitor to be injected, for finer-grained control over how CSS queries are translated into XPath. - [CRuby] XML::Reader#encoding will return the encoding detected by the parser when it\'s not passed to the constructor. [#980] - [CRuby] Handle abruptly-closed HTML comments as recommended by WHATWG. (Thanks to tehryanx for reporting!) - [CRuby] Node#line is no longer capped at 65535. libxml v2.9.0 and later support a new parse option, exposed as Nokogiri::XML::ParseOptions::PARSE_BIG_LINES, which is turned on by default in ParseOptions::DEFAULT_{XML,XSLT,HTML,SCHEMA} (Note that JRuby already supported large line numbers.) [#1764, #1493, #1617, #1505, #1003, #533] - [CRuby] If a cycle is introduced when reparenting a node (i.e., the node becomes its own ancestor), a RuntimeError is raised. libxml2 does no checking for this, which means cycles would otherwise result in infinite loops on subsequent operations. (Note that JRuby already did this.) [#1912] - [CRuby] Source builds will download zlib and libiconv via HTTPS. (\"ruby\" platform gem only.) [#2391] (Thanks, AATTjmartin-r7!) - [JRuby] Node#line behavior has been modified to return the line number of the node in the final DOM structure. This behavior is different from CRuby, which returns the node\'s position in the input string. Ideally the two implementations would be the same, but at least is now officially documented and tested. The real-world impact of this change is that the value returned in JRuby is greater by 1 to account for the XML prolog in the output. [#2380] (Thanks, AATTdabdine!) - Fixed - CSS queries on HTML5 documents now correctly match foreign elements (SVG, MathML) when namespaces are not specified in the query. [#2376] - XML::Builder blocks restore context properly when exceptions are raised. [#2372] (Thanks, AATTric2b and AATTrinthedev!) - The Nokogiri::CSS::Parser cache now uses the XPathVisitor configuration as part of the cache key, preventing incorrect cache results from being returned when multiple XPathVisitor options are being used. - Error recovery from in-context parsing (e.g., Node#parse) now always uses the correct DocumentFragment class. Previously Nokogiri::HTML4::DocumentFragment was always used, even for XML documents. [#1158] - DocumentFragment#> now works properly, matching a CSS selector against only the fragment roots. [#1857] - XML::DocumentFragment#errors now correctly contains any parsing errors encountered. Previously this was always empty. (Note that HTML::DocumentFragment#errors already did this.) - [CRuby] Fix memory leak in Document#canonicalize when inclusive namespaces are passed in. [#2345] - [CRuby] Fix memory leak in Document#canonicalize when an argument type error is raised. [#2345] - [CRuby] Fix memory leak in EncodingHandler where iconv handlers were not being cleaned up. [#2345] - [CRuby] Fix memory leak in XPath custom handlers where string arguments were not being cleaned up. [#2345] - [CRuby] Fix memory leak in Reader#base_uri where the string returned by libxml2 was not freed. [#2347] - [JRuby] Deleting a Namespace from a NodeSet no longer modifies the href to be the default namespace URL. - [JRuby] Fix XHTML formatting of closing tags for non-container elements. [#2355] - Deprecated - Passing a Nokogiri::XML::Node as the second parameter to Node.new is deprecated and will generate a warning. This parameter should be a kind of Nokogiri::XML::Document. This will become an error in a future version of Nokogiri. [#975] - Nokogiri::CSS::Parser, Nokogiri::CSS::Tokenizer, and Nokogiri::CSS::Node are now internal-only APIs that are no longer documented, and should not be considered stable. With the introduction of XPathVisitor injection into Nokogiri::CSS.xpath_for there should be no reason to rely on these internal APIs. - CSS-to-XPath utility classes Nokogiri::CSS::XPathVisitorAlwaysUseBuiltins and XPathVisitorOptimallyUseBuiltins are deprecated. Prefer Nokogiri::CSS::XPathVisitor with appropriate constructor arguments. These classes will be removed in a future version of Nokogiri.
* Tue Jan 25 2022 Marcus Rueckert - make it build with newer mini_portile2 versions- make sure we also patch the required mini_portile2 version in the build tool
* Sat Oct 09 2021 Manuel Schnitzer - updated to version 1.12.5 [#]# 1.12.5 / 2021-09-27 [#]## Security [JRuby] Address CVE-2021-41098 ([GHSA-2rr5-8q37-2w7h](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h)). In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers\' behavior. CRuby users are not affected by this CVE. [#]## Fixed
* [CRuby] `Document#to_xhtml` properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., `

`) instead of a self-closing tag (e.g., `
`) in previous Nokogiri versions. [[#2324](https://github.com/sparklemotion/nokogiri/issues/2324)] [#]# 1.12.4 / 2021-08-29 [#]## Notable fix: Namespace inheritance Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change. This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes. [#]### Compensating Feature in XML::Document This release of Nokogiri introduces a new `Document` boolean attribute, `namespace_inheritance`, which controls whether children should inherit a namespace when they are reparented. `Nokogiri::XML:Document` defaults this attribute to `false` meaning \"do not inherit,\" thereby making explicit the behavior change introduced in v1.12.0. CRuby users who desire the pre-v1.12.0 behavior may set `document.namespace_inheritance = true` before reparenting nodes. See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage. [#]### Fix for XML::Builder However, recognizing that we want `Builder`-created children to inherit namespaces, Builder now will set `namespace_inheritance=true` on the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored. Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so: ``` ruby Nokogiri::XML::Builder.new(namespace_inheritance: false) ``` See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage. [#]### Downstream gem maintainers Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance: ``` ruby Gem::Specification.new do |gem| [#] ... gem.add_runtime_dependency \'nokogiri\', \'!=1.12.3\', \'!=1.12.2\', \'!=1.12.1\', \'!=1.12.0\' [#] ... end ``` [#]## Fixed
* [JRuby] Fix NPE in Schema parsing when an imported resource doesn\'t have a `systemId`. [[#2296](https://github.com/sparklemotion/nokogiri/issues/2296)] (Thanks, [AATTpepijnve](https://github.com/pepijnve)!)
* Wed Aug 25 2021 Manuel Schnitzer - updated to version 1.12.3 [#]## Fixed
* [CRuby] Fix compilation of libgumbo on older systems with versions of GCC that give errors on C99-isms. Affected systems include RHEL6, RHEL7, and SLES12. [[#2302](https://github.com/sparklemotion/nokogiri/issues/2302)] [#]# 1.12.2 / 2021-08-04 [#]## Fixed
* [CRuby] Ensure that C extension files in non-native gem installations are loaded using `require` and rely on `$LOAD_PATH` instead of using `require_relative`. This issue only exists when deleting shared libraries that exist outside the extensions directory, something users occasionally do to conserve disk space. [[#2300](https://github.com/sparklemotion/nokogiri/issues/2300)] [#]# 1.12.1 / 2021-08-03 [#]## Fixed
* [CRuby] Fix compilation of libgumbo on BSD systems by avoiding GNU-isms. [[#2298](https://github.com/sparklemotion/nokogiri/issues/2298)] [#]# 1.12.0 / 2021-08-02 [#]## Notable Addition: HTML5 Support (CRuby only) __HTML5 support__ has been added (to CRuby only) by merging [Nokogumbo](https://github.com/rubys/nokogumbo) into Nokogiri. The Nokogumbo public API has been preserved, so this functionality is available under the `Nokogiri::HTML5` namespace. [[#2204](https://github.com/sparklemotion/nokogiri/issues/2204)] Please note that HTML5 support is not available for JRuby in this version. However, we feel it is important to think about JRuby and we hope to work on this in the future. If you\'re interested in helping with HTML5 support on JRuby, please reach out to the maintainers by commenting on issue [#2227](https://github.com/sparklemotion/nokogiri/issues/2227). Many thanks to Sam Ruby, Steve Checkoway, and Craig Barnes for creating and maintaining Nokogumbo and supporting the Gumbo HTML5 parser. They\'re now Nokogiri core contributors with all the powers and privileges pertaining thereto. 🙌 [#]## Notable Change: `Nokogiri::HTML4` module and namespace `Nokogiri::HTML` has been renamed to `Nokogiri::HTML4`, and `Nokogiri::HTML` is aliased to preserve backwards-compatibility. `Nokogiri::HTML` and `Nokogiri::HTML4` parse methods still use libxml2\'s (or NekoHTML\'s) HTML4 parser in the v1.12 release series. Take special note that if you rely on the class name of an object in your code, objects will now report a class of `Nokogiri::HTML4::Foo` where they previously reported `Nokogiri::HTML::Foo`. Instead of relying on the string returned by `Object#class`, prefer `Class#===` or `Object#is_a?` or `Object#instance_of?`. Future releases of Nokogiri may deprecate `HTML` methods or otherwise change this behavior, so please start using `HTML4` in place of `HTML`. [#]## Added
* [CRuby] `Nokogiri::VERSION_INFO[\"libxslt\"][\"datetime_enabled\"]` is a new boolean value which describes whether libxslt (or, more properly, libexslt) has compiled-in datetime support. This generally going to be `true`, but some distros ship without this support (e.g., some mingw UCRT-based packages, see https://github.com/msys2/MINGW-packages/pull/8957). See [#2272](https://github.com/sparklemotion/nokogiri/issues/2272) for more details. [#]## Changed
* Introduce a new constant, `Nokogiri::XML::ParseOptions::DEFAULT_XSLT`, which adds the libxslt-preferred options of `NOENT | DTDLOAD | DTDATTR | NOCDATA` to `ParseOptions::DEFAULT_XML`.
* `Nokogiri.XSLT` parses stylesheets using `ParseOptions::DEFAULT_XSLT`, which should make some edge-case XSL transformations match libxslt\'s default behavior. [[#1940](https://github.com/sparklemotion/nokogiri/issues/1940)] [#]## Fixed
* [CRuby] Namespaced attributes are handled properly when their parent node is reparented into another document. Previously, the namespace may have gotten dropped. [[#2228](https://github.com/sparklemotion/nokogiri/issues/2228)]
* [CRuby] Reparented nodes no longer inherit their parent\'s namespace. Previously, a node without a namespace was forced to adopt its parent\'s namespace. [[#1712](https://github.com/sparklemotion/nokogiri/issues/1712), [#425](https://github.com/sparklemotion/nokogiri/issues/425)] [#]## Improved
* [CRuby] Speed up (slightly) the compile time of packaged libraries `libiconv`, `libxml2`, and `libxslt` by using autoconf\'s `--disable-dependency-tracking` option. (\"ruby\" platform gem only.) [#]## Deprecated
* Deprecating Nokogumbo\'s `Nokogiri::HTML5.get`. This method will be removed in a future version of Nokogiri. [#]## Dependencies
* [CRuby] Upgrade mini_portile2 dependency from `~> 2.5.0` to `~> 2.6.1`. (\"ruby\" platform gem only.)
* Thu Jun 24 2021 Stephan Kulow updated to version 1.11.7 no changelog found
* Tue Jun 01 2021 Manuel Schnitzer - updated to version 1.11.6 [#]# 1.11.6 / 2021-05-26 [#]## Fixed
* [CRuby] `DocumentFragment#path` now does proper error-checking to handle behavior introduced in libxml > 2.9.10. In v1.11.4 and v1.11.5, calling `DocumentFragment#path` could result in a segfault. [#]# 1.11.5 / 2021-05-19 [#]## Fixed [Windows CRuby] Work around segfault at process exit on Windows when using libxml2 system DLLs. libxml 2.9.12 introduced new behavior to avoid memory leaks when unloading libxml2 shared libraries (see [libxml/!66](https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/66)). Early testing caught this segfault on non-Windows platforms (see [#2059](https://github.com/sparklemotion/nokogiri/issues/2059) and [libxmlAATT956534e](https://gitlab.gnome.org/GNOME/libxml2/-/commit/956534e02ef280795a187c16f6ac04e107f23c5d)) but it was incompletely fixed and is still an issue on Windows platforms that are using system DLLs. We work around this by configuring libxml2 in this situation to use its default memory management functions. Note that if Nokogiri is not on Windows, or is not using shared system libraries, it will will continue to configure libxml2 to use Ruby\'s memory management functions. `Nokogiri::VERSION_INFO[\"libxml\"][\"memory_management\"]` will allow you to verify when the default memory management functions are being used. [[#2241](https://github.com/sparklemotion/nokogiri/issues/2241)] [#]## Added `Nokogiri::VERSION_INFO[\"libxml\"]` now contains the key `\"memory_management\"` to declare whether libxml2 is using its `default` memory management functions, or whether it uses the memory management functions from `ruby`. See above for more details. [#]# 1.11.4 / 2021-05-14 [#]## Security [CRuby] Vendored libxml2 upgraded to v2.9.12 which addresses: - [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) - [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) - [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) - [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) - [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) - [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) Note that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.org/CVE-2021-3516) via `xmllint` is not present in Nokogiri, and [CVE-2020-7595](https://security.archlinux.org/CVE-2020-7595) has been patched in Nokogiri since v1.10.8 (see [#1992](https://github.com/sparklemotion/nokogiri/issues/1992)). Please see [nokogiri/GHSA-7rrm-v45f-jp64 ](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-7rrm-v45f-jp64) or [#2233](https://github.com/sparklemotion/nokogiri/issues/2233) for a more complete analysis of these CVEs and patches. [#]## Dependencies
* [CRuby] vendored libxml2 is updated from 2.9.10 to 2.9.12. (Note that 2.9.11 was skipped because it was superseded by 2.9.12 a few hours after its release.)
* Tue Apr 20 2021 Manuel Schnitzer - updated to version 1.11.3 [#]## Fixed
* [CRuby] Passing non-`Node` objects to `Document#root=` now raises an `ArgumentError` exception. Previously this likely segfaulted. [[#1900](https://github.com/sparklemotion/nokogiri/issues/1900)]
* [JRuby] Passing non-`Node` objects to `Document#root=` now raises an `ArgumentError` exception. Previously this raised a `TypeError` exception.
* [CRuby] arm64/aarch64 systems (like Apple\'s M1) can now compile libxml2 and libxslt from source (though we continue to strongly advise users to install the native gems for the best possible experience)
* Mon Mar 15 2021 Manuel Schnitzer - updated to version 1.11.2 see CHANGELOG.md
* Thu Jan 07 2021 Manuel Schnitzer - updated to version 1.11.1 see CHANGELOG.md
* Mon Jan 04 2021 Marcus Rueckert - Update to version 1.11.0 https://nokogiri.org/CHANGELOG.html#v1110-2021-01-03
* Mon Jul 13 2020 Manuel Schnitzer - updated to version 1.10.10
* Features - [MRI] Cross-built Windows gems now support Ruby 2.7 [#2029]. Note that prior to this release, the v1.11.x prereleases provided this support.
* Mon Jun 08 2020 Marcus Rueckert - Switch to the proper directory so it actually finds the patched gem.
* Mon Jun 08 2020 Marcus Rueckert - add fix so we no longer need mini_portile2. This is only needed when not building against system libraries (boo#1171881) https://github.com/sparklemotion/nokogiri/issues/2033
* Tue Mar 03 2020 Manuel Schnitzer - updated to version 1.10.9 [#] Fixed
* [MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we\'re preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]
* [JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, AATTheadius!)
* Tue Feb 11 2020 Marcus Rueckert - update to 1.10.8 [MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.