Changelog for
ruby3.3-rubygem-nokogiri-1.16.7-lp155.201.14.x86_64.rpm :
* Tue Jul 30 2024 Marcus Rueckert
- 1.16.7: - update intree libxml2 copy (unused in our build)- 1.16.6: - update intree libxml2 copy (unused in our build) - update intree zlib copy (unused in our build) - [CRuby] `XML::Reader` sets the `AATTencoding` instance variable during reading if it is not passed into the initializer. Previously, it would remain `nil`. The behavior of `Reader#encoding` has not changed. This works around changes to how libxml2 reports the encoding used in v2.12.6. - [CRuby] `XML::Reader` defaults the encoding to UTF-8 if it\'s not specified in either the document or as a method parameter. Previously non-ASCII characters were serialized as NCRs in this case. [#2891] (AATTflavorjones) - [CRuby] Restored support for compilation by GCC versions earlier than 4.6, which was broken in v1.15.0 (540e9aee). [#3090] (AATTadfoster-r7) - [CRuby] Patched upstream libxml2 to allow parsing HTML5 in the context of a namespaced node (e.g., foreign content like MathML). [#3112, #3116] (AATTflavorjones) - [CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when the maximum tree depth limit is hit. [#3098, #3100] (AATTstevecheckoway)- Drop gcc14-allow-incompatible-pointer-types-for-now.patch- Added gcc14-allow-incompatible-pointer-types-for-now.patch: gcc 14 errors out on incompatible pointer types Allow those until https://github.com/sparklemotion/nokogiri/issues/3295 is fixed- Added only-complain-about-version-diff-if-it-is-older.patch boo#1202053 boo#1213999 boo#1203728- limit ruby versions to 3.x- 1.16.0: This release introduces native gem support for Ruby 3.3. This release ends support for Ruby 2.7, for which [upstream support ended 2023-03-31](https://www.ruby-lang.org/en/downloads/branches/). [#]### Pattern matching This version marks _official support_ for the pattern matching API in `XML::Attr`, `XML::Document`, `XML::DocumentFragment`, `XML::Namespace`, `XML::Node`, and `XML::NodeSet` (and their subclasses), originally introduced as an experimental feature in v1.14.0. (AATTflavorjones) Documentation on what can be matched: - 1.15.5: [#]# 1.15.5 / 2023-11-17 [#]## Dependencies - Bump mini_portile2 version in the spec- 1.15.4: [#]# 1.15.4 / 2023-08-11 [#]## Dependencies ` [[whatwg/html#3410](https://github.com/whatwg/html/issues/3410), [whatwg/html#9124](https://github.com/whatwg/html/pull/9124)] - Buildrequire openssl gem to fix building with Ruby 3.0- updated to version 1.15.4 see installed CHANGES.md- updated to version 1.15.2 see installed CHANGES.md- cleanup ruby version restrictions- updated to version 1.14.3 see installed CHANGES.md- updated to version 1.14.2 see installed CHANGES.md- updated to version 1.13.9 see installed CHANGES.md- updated to version 1.13.9 see installed CHANGES.md- updated to version 1.13.8 see installed CHANGES.md- Also build ruby 3.1 for 15.x- updated to version 1.13.6 [#]# 1.13.6 / 2022-05-08 [#]## Security - updated to version 1.13.4 - Security - Address CVE-2022-24836, a regular expression denial-of-service vulnerability. See GHSA-crjr-9rc5-ghw8 for more information. - [CRuby] Vendored zlib is updated to address CVE-2018-25032. See GHSA-v6gp-9mmm-c6p5 for more information. - [JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated to address CVE-2022-23437. See GHSA-xxx9-3xcr-gjj3 for more information. - [JRuby] Vendored nekohtml (org.cyberneko.html) is updated to address CVE-2022-24839. See GHSA-gx8x-g87m-h5q6 for more information. - Dependencies - [CRuby] Vendored zlib is updated from 1.2.11 to 1.2.12. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.) - [JRuby] Vendored Xerces-J (xerces:xercesImpl) is updated from 2.12.0 to 2.12.2. - [JRuby] Vendored nekohtml (org.cyberneko.html) is updated from a fork of 1.9.21 to 1.9.22.noko2. This fork is now publicly developed at https://github.com/sparklemotion/nekohtml- use mini_portile2 2.8 required by version 1.13.3- updated to version 1.13.3 [#]## Fixed - fix ruby versions for the leap build- Update to 1.13.1 - Fixed - Fix Nokogiri::XSLT.quote_params regression in v1.13.0 that raised an exception when non-string stylesheet parameters were passed. Non-string parameters (e.g., integers and symbols) are now explicitly supported and both keys and values will be stringified with #to_s. [#2418] - Fix CSS selector query regression in v1.13.0 that raised an Nokogiri::XML::XPath::SyntaxError when parsing XPath attributes mixed into the CSS query. Although this mash-up of XPath and CSS syntax previously worked unintentionally, it is now an officially supported feature and is documented as such. [#2419]- Changes from 1.13.0 - This release ends support for: - Ruby 2.5, for which official support ended 2021-03-31. - JRuby 9.2, which is a Ruby 2.5-compatible release. - Faster, more reliable installation: Native Gem for ARM64 Linux - This version of Nokogiri ships experimental native gem support for the aarch64-linux platform, which should support AWS Graviton and other ARM Linux platforms. We don\'t yet have CI running for this platform, and so we\'re interested in hearing back from y\'all whether this is working, and what problems you\'re seeing. Please send us feedback here: Feedback: Have you used the aarch64-linux native gem? - Publishing - This version of Nokogiri opts-in to the \"MFA required to publish\" setting on Rubygems.org. This and all future Nokogiri gem files must be published to Rubygems by an account with multi-factor authentication enabled. This should provide some additional protection against supply-chain attacks. A related discussion about Trust exists at #2357 in which I invite you to participate if you have feelings or opinions on this topic. - Dependencies - [CRuby] Vendored libiconv is updated from 1.15 to 1.16. (Note that libiconv is only redistributed in the native windows and native darwin gems, see LICENSE-DEPENDENCIES.md for more information.) [#2206] - [CRuby] Upgrade mini_portile2 dependency from ~> 2.6.1 to ~> 2.7.0. (\"ruby\" platform gem only.) - Improved - {XML,HTML4}::DocumentFragment constructors all now take an optional parse options parameter or block (similar to Document constructors). [#1692] (Thanks, AATTJackMc!) - Nokogiri::CSS.xpath_for allows an XPathVisitor to be injected, for finer-grained control over how CSS queries are translated into XPath. - [CRuby] XML::Reader#encoding will return the encoding detected by the parser when it\'s not passed to the constructor. [#980] - [CRuby] Handle abruptly-closed HTML comments as recommended by WHATWG. (Thanks to tehryanx for reporting!) - [CRuby] Node#line is no longer capped at 65535. libxml v2.9.0 and later support a new parse option, exposed as Nokogiri::XML::ParseOptions::PARSE_BIG_LINES, which is turned on by default in ParseOptions::DEFAULT_{XML,XSLT,HTML,SCHEMA} (Note that JRuby already supported large line numbers.) [#1764, #1493, #1617, #1505, #1003, #533] - [CRuby] If a cycle is introduced when reparenting a node (i.e., the node becomes its own ancestor), a RuntimeError is raised. libxml2 does no checking for this, which means cycles would otherwise result in infinite loops on subsequent operations. (Note that JRuby already did this.) [#1912] - [CRuby] Source builds will download zlib and libiconv via HTTPS. (\"ruby\" platform gem only.) [#2391] (Thanks, AATTjmartin-r7!) - [JRuby] Node#line behavior has been modified to return the line number of the node in the final DOM structure. This behavior is different from CRuby, which returns the node\'s position in the input string. Ideally the two implementations would be the same, but at least is now officially documented and tested. The real-world impact of this change is that the value returned in JRuby is greater by 1 to account for the XML prolog in the output. [#2380] (Thanks, AATTdabdine!) - Fixed - CSS queries on HTML5 documents now correctly match foreign elements (SVG, MathML) when namespaces are not specified in the query. [#2376] - XML::Builder blocks restore context properly when exceptions are raised. [#2372] (Thanks, AATTric2b and AATTrinthedev!) - The Nokogiri::CSS::Parser cache now uses the XPathVisitor configuration as part of the cache key, preventing incorrect cache results from being returned when multiple XPathVisitor options are being used. - Error recovery from in-context parsing (e.g., Node#parse) now always uses the correct DocumentFragment class. Previously Nokogiri::HTML4::DocumentFragment was always used, even for XML documents. [#1158] - DocumentFragment#> now works properly, matching a CSS selector against only the fragment roots. [#1857] - XML::DocumentFragment#errors now correctly contains any parsing errors encountered. Previously this was always empty. (Note that HTML::DocumentFragment#errors already did this.) - [CRuby] Fix memory leak in Document#canonicalize when inclusive namespaces are passed in. [#2345] - [CRuby] Fix memory leak in Document#canonicalize when an argument type error is raised. [#2345] - [CRuby] Fix memory leak in EncodingHandler where iconv handlers were not being cleaned up. [#2345] - [CRuby] Fix memory leak in XPath custom handlers where string arguments were not being cleaned up. [#2345] - [CRuby] Fix memory leak in Reader#base_uri where the string returned by libxml2 was not freed. [#2347] - [JRuby] Deleting a Namespace from a NodeSet no longer modifies the href to be the default namespace URL. - [JRuby] Fix XHTML formatting of closing tags for non-container elements. [#2355] - Deprecated - Passing a Nokogiri::XML::Node as the second parameter to Node.new is deprecated and will generate a warning. This parameter should be a kind of Nokogiri::XML::Document. This will become an error in a future version of Nokogiri. [#975] - Nokogiri::CSS::Parser, Nokogiri::CSS::Tokenizer, and Nokogiri::CSS::Node are now internal-only APIs that are no longer documented, and should not be considered stable. With the introduction of XPathVisitor injection into Nokogiri::CSS.xpath_for there should be no reason to rely on these internal APIs. - CSS-to-XPath utility classes Nokogiri::CSS::XPathVisitorAlwaysUseBuiltins and XPathVisitorOptimallyUseBuiltins are deprecated. Prefer Nokogiri::CSS::XPathVisitor with appropriate constructor arguments. These classes will be removed in a future version of Nokogiri.- make it build with newer mini_portile2 versions- make sure we also patch the required mini_portile2 version in the build tool- updated to version 1.12.5 [#]# 1.12.5 / 2021-09-27 [#]## Security [JRuby] Address CVE-2021-41098 ([GHSA-2rr5-8q37-2w7h](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h)). In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers\' behavior. CRuby users are not affected by this CVE. [#]## Fixed - updated to version 1.12.3 [#]## Fixed updated to version 1.11.7 no changelog found- updated to version 1.11.6 [#]# 1.11.6 / 2021-05-26 [#]## Fixed - updated to version 1.11.3 [#]## Fixed - updated to version 1.11.2 see CHANGELOG.md- updated to version 1.11.1 see CHANGELOG.md- Update to version 1.11.0 https://nokogiri.org/CHANGELOG.html#v1110-2021-01-03- updated to version 1.10.10 - Switch to the proper directory so it actually finds the patched gem.- add fix so we no longer need mini_portile2. This is only needed when not building against system libraries (boo#1171881) https://github.com/sparklemotion/nokogiri/issues/2033- updated to version 1.10.9 [#] Fixed - update to 1.10.8 [MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.- updated to version 1.10.7 [#]## Bug - updated to version 1.10.5 [#]## Dependencies - updated to version 1.10.4 (CVE-2019-5477) A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby\'s `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being passed untrusted user input. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. This CVE\'s public notice is https://github.com/sparklemotion/nokogiri/issues/1915- updated to version 1.10.3 - [MRI] Pulled in upstream patch from libxslt that addresses CVE-2019-11068. Full details are available in #1892. Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt.- updated to version 1.10.2 no changelog found- rb_build_ruby_abi needs to be rb_build_ruby_abis- use rb_build_ruby_abi instead of rb_default_ruby_abi- limit to ruby 2.5 and above- updated to version 1.9.1 CHANGELOG.md removed upstream
