🚨 [security] Update activesupport: 4.2.11.1 → 6.1.7.3 (major)

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we’ve sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we’ll send you a few more. We’ll never open more than seven PRs at the same time so you’re not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ activesupport (indirect, 4.2.11.1 → 6.1.7.3) · Repo · Changelog

Security Advisories 🚨

🚨 Possible XSS Security Vulnerability in SafeBuffer#bytesplice

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

🚨 ReDoS based DoS vulnerability in Active Support’s underscore

There is a possible regular expression based DoS vulnerability in Active
Support. This vulnerability has been assigned the CVE identifier
CVE-2023-22796.

Versions Affected: All
Not affected: None
Fixed Versions: 6.1.7.1, 7.0.4.1

Impact

A specially crafted string passed to the underscore method can cause the
regular expression engine to enter a state of catastrophic backtracking.
This can cause the process to use large amounts of CPU and memory, leading
to a possible DoS vulnerability.

This affects String#underscore, ActiveSupport::Inflector.underscore,
String#titleize, and any other methods using these.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Workarounds

There are no feasible workarounds for this issue.

Users on Ruby 3.2.0 or greater may be able to reduce the impact by
configuring Regexp.timeout.

🚨 Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

data = cache.fetch("demo", raw: true) { untrusted_string }

Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.

In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds

It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.

🚨 Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

data = cache.fetch("demo", raw: true) { untrusted_string }

Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.

In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds

It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ github-pages (200 → 228) · Repo

Release Notes

Too many releases to show here. View the full release notes.

Sorry, we couldn’t find anything useful about this release.

✳️ html-proofer (3.11.1 → 5.0.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ addressable (indirect, 2.7.0 → 2.8.1) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service in Addressable templates

Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption,
leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input,
but nonetheless, no previous security advisory for Addressable has cautioned against doing this.
Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected.

Release Notes

2.8.1 (from changelog)

  • refactor Addressable::URI.normalize_path to address linter offenses (#430)
  • remove redundant colon in Addressable::URI::CharacterClasses::AUTHORITY regex (#438)
  • update gemspec to reflect supported Ruby versions (#466, #464, #463)
  • compatibility w/ public_suffix 5.x (#466, #465, #460)
  • fixes "invalid byte sequence in UTF-8" exception when unencoding URLs containing non UTF-8 characters (#459)
  • Ractor compatibility (#449)
  • use the whole string instead of a single line for template match (#431)
  • force UTF-8 encoding only if needed (#341)

2.8.0 (from changelog)

  • fixes ReDoS vulnerability in Addressable::Template#match
  • no longer replaces + with spaces in queries for non-http(s) schemes
  • fixed encoding ipv6 literals
  • the :compacted flag for normalized_query now dedupes parameters
  • fix broken escape_component alias
  • dropping support for Ruby 2.0 and 2.1
  • adding Ruby 3.0 compatibility for development tasks
  • drop support for rack-mount and remove Addressable::Template#generate
  • performance improvements
  • switch CI/CD to GitHub Actions

Does any of this look wrong? Please let us know.

↗️ commonmarker (indirect, 0.17.13 → 0.23.8) · Repo · Changelog

Security Advisories 🚨

🚨 Several quadratic complexity bugs may lead to denial of service in Commonmarker

Impact

Several quadratic complexity bugs in commonmarker's underlying cmark-gfm
library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

For more information, consult the release notes for version
0.23.0.gfm.7.

Mitigation

Users are advised to upgrade to commonmarker version 0.23.7.

🚨 Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service

Impact

CommonMarker uses cmark-gfm for rendering Github Flavored
Markdown. A polynomial time complexity issue
in cmark-gfm's autolink extension may lead to unbounded resource exhaustion
and subsequent denial of service.

Patches

This vulnerability has been patched in the following CommonMarker release:

  • v0.23.6

Workarounds

Disable use of the autolink extension.

References

https://en.wikipedia.org/wiki/Time_complexity

🚨 Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption

Impact

CommonMarker uses cmark-gfm for rendering Github Flavored Markdown.
An integer overflow in cmark-gfm's table row parsing
may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX
columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.

If affected versions of CommonMarker are used for rendering remote user controlled markdown, this
vulnerability may lead to Remote Code Execution (RCE).

Patches

This vulnerability has been patched in the following CommonMarker release:

  • v0.23.4

Workarounds

The vulnerability exists in the table markdown extensions of cmark-gfm. Disabling any use of the
table extension will prevent this vulnerability from being triggered.

Release Notes

0.23.8

What's Changed

New Contributors

Full Changelog: v0.23.7...v0.23.8

0.23.7

What's Changed

Full Changelog: v0.23.6...v0.23.7

0.23.6

What's Changed

This release includes two updates from the upstream cmark-gfm library, namely:

0.22.0

  • Drop ruby-enum (#140)

0.21.0

  • Add support for tasklist_item_checked=: #116

0.19.0

  • Support tasklists: #94
  • Indicate the context of a parse/render option error: #97

0.18.0

  • Default to being safe: #81

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.1.5 → 1.2.2) · Repo · Changelog

Release Notes

1.2.2

concurrent-ruby 1.2.2:

  • (#993) Fix arguments passed to Concurrent::Map's default_proc.

1.2.1

concurrent-ruby 1.2.1:

  • (#990) Add missing require 'fiber' for FiberLocalVar.
  • (#989) Optimize Concurrent::Map#[] on CRuby by letting the backing Hash handle the default_proc.

1.2.0

concurrent-ruby 1.2.0:

  • (#975) Set the Ruby compatibility version at 2.3
  • (#962) Fix ReentrantReadWriteLock to use the same granularity for locals as for Mutex it uses.
  • (#983) Add FiberLocalVar
  • (#934) concurrent-ruby now supports requiring individual classes (public classes listed in the docs), e.g., require 'concurrent/map'
  • (#976) Let Promises.any_fulfilled_future take an Event
  • Improve documentation of various classes
  • (#972) Remove Rubinius-related code

concurrent-ruby-edge 0.7.0:

  • (#975) Set the Ruby compatibility version at 2.3
  • (#934) concurrent-ruby now supports requiring individual classes (public classes listed in the docs), e.g., require 'concurrent/map'
  • (#972) Remove Rubinius-related code

1.1.10

concurrent-ruby:

  • (#951) Set the Ruby compatibility version at 2.2
  • (#939, #933) The caller_runs fallback policy no longer blocks reads from the job queue by worker threads
  • (#938, #761, #652) You can now explicitly prune_pool a thread pool (Sylvain Joyeux)
  • (#937, #757, #670) We switched the Yahoo stock API for demos to Alpha Vantage (Gustavo Caso)
  • (#932, #931) We changed how SafeTaskExecutor handles local jump errors (Aaron Jensen)
  • (#927) You can use keyword arguments in your initialize when using Async (Matt Larraz)
  • (#926, #639) We removed timeout from TimerTask because it wasn't sound, and now it's a no-op with a warning (Jacob Atzen)
  • (#919) If you double-lock a re-entrant read-write lock, we promote to locked for writing (zp yuan)
  • (#915) monotonic_time now accepts an optional unit parameter, as Ruby's clock_gettime (Jean Boussier)

1.1.9 (from changelog)

concurrent-ruby:

  • (#866) Child promise state not set to :pending immediately after #execute when parent has completed
  • (#905, #872) Fix RubyNonConcurrentPriorityQueue#delete method
  • (2df0337d) Make sure locks are not shared on shared when objects are dup/cloned
  • (#900, #906, #796, #847, #911) Fix Concurrent::Set tread-safety issues on CRuby
  • (#907) Add new ConcurrentMap backend for TruffleRuby

1.1.8 (from changelog)

  • (#885) Fix race condition in TVar for stale reads
  • (#884) RubyThreadLocalVar: Do not iterate over hash which might conflict with new pair addition

1.1.7 (from changelog)

concurrent-ruby:

  • (#879) Consider falsy value on Concurrent::Map#compute_if_absent for fast non-blocking path
  • (#876) Reset Async queue on forking, makes Async fork-safe
  • (#856) Avoid running problematic code in RubyThreadLocalVar on MRI that occasionally results in segfault
  • (#853) Introduce ThreadPoolExecutor without a Queue

1.1.6 (from changelog)

concurrent-ruby:

  • (#841) Concurrent.disable_at_exit_handlers! is no longer needed and was deprecated.
  • (#841) AbstractExecutorService#auto_terminate= was deprecated and has no effect. Set :auto_terminate option instead when executor is initialized.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ dnsruby (indirect, 1.61.3 → 1.61.9) · Repo

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ em-websocket (indirect, 0.5.1 → 0.5.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ ethon (indirect, 0.12.0 → 0.16.0) · Repo · Changelog

Release Notes

0.15.0 (from changelog)

Full Changelog

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ execjs (indirect, 2.7.0 → 2.8.1) · Repo

Release Notes

2.8.1

  • Wait for STDOUT to be flushed before exiting the node runtime

2.8.0

  • Fix Ruby 3.0 compatibility on Windows
  • Undefine console, process and other globals. See #43
  • Removed the RubyRacer runtime as it is no longer maintained and broken on recent rubies.
  • Node runtime look for node before nodejs.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

↗️ faraday (indirect, 0.16.2 → 2.7.4) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ffi (indirect, 1.11.1 → 1.15.5) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ github-pages-health-check (indirect, 1.16.1 → 1.17.9) · Repo

Release Notes

1.17.9

What's Changed

  • Fix IPv6 support (AAAA records validation) in #140

Full Changelog: v1.17.8...v1.17.9

1.17.8

What's Changed

Full Changelog: v1.17.7...v1.17.8

1.17.6

  • Query DNS to Determine Apex Domains

1.17.2

Allows for non-200 requests to satisfy served_by_pages? if the response still looks like it was served by GitHub.

1.17.1

Update Cloudflare IPs.

1.17.0

  • Fix CI which is broken on master #115 (by @kytrinyx)
  • Silence warnings triggered by Ruby 2.7 #116 (by @kytrinyx)
  • Update dependencies to be compatible with Ruby 2.7 #117 (by @kytrinyx)
  • Update dotenv requirement from ~> 1.0 to ~> 2.7 #120 (dependabot)
  • Update gem-release requirement from ~> 0.7 to ~> 2.1 #119 (dependabot)
  • Update webmock requirement from ~> 1.21 to ~> 3.8 #118 (dependabot)
  • Upgrade to Ruby 2.7 & incorporate a Dockerfile #121 (by @parkr & @MarkTiedemann)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 66 commits:

↗️ html-pipeline (indirect, 2.12.0 → 2.14.3) · Repo · Changelog

Release Notes

2.14.0

  • Make Rinku configurable: #335

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 54 commits:

↗️ http_parser.rb (indirect, 0.6.0 → 0.8.0) · Repo

Commits

See the full diff on Github. The new version differs by 53 commits:

↗️ i18n (indirect, 0.9.5 → 1.12.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ jekyll (indirect, 3.8.5 → 3.9.3) · Repo · Changelog

Release Notes

3.9.3

Bug Fixes

  • 3.9.x: Support i18n 1.x (#9269)
  • Backport #8880 for v3.9.x: Support both tzinfo v1 and v2 alongwith
    non-half hour offsets (#9280)

Development Fixes

  • v3.9.x: test under Ruby 3.2 #9272)
  • v3.9.x: fix rdiscount test (#9277)

3.9.2

Bug Fixes

  • Lock http_parser.rb gem to v0.6.x on JRuby (#8943)
  • Backport #8756 for v3.9.x: Respect collections_dir config within include tag (#8795)
  • Backport #8965 for v3.9.x: Fix response header for content served via jekyll serve (#8976)

Development Fixes

  • Update and fix CI for 3.9-stable on Ruby 3.x (#8942)
  • Fix CI for commits to 3.9-stable branch (#8788)

3.9.1

Bug Fixes

  • Backport #8618 for v3.9.x: Update include tag to be more permissive (#8629)

3.9.0

Minor Enhancements

  • Allow use of kramdown v2 (#8322)
  • Add default language for kramdown syntax highlighting (#8325)

3.8.7

Fixes

  • Prevent console warnings with Ruby 2.7 (#7948)

3.8.6

Bug Fixes

  • Update log output for an invalid theme directory (#7734)
  • Memoize SiteDrop#documents to reduce allocations (#7722)
  • Excerpt handling of custom and intermediate tags (#7467)
  • Escape valid special chars in a site's path name (#7573)
  • Revert memoizing Site#docs_to_write and refactor #documents (#7689)
  • Fix broken include_relative usage in excerpt (#7690)
  • Install platform-specific gems as required (3c06609)

Security Fixes

  • Theme gems: ensure directories aren't symlinks (#7424)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ jekyll-avatar (indirect, 0.6.0 → 0.7.0) · Repo · Changelog

Release Notes

0.7.0

What's Changed

  • Update rubocop-jekyll requirement from ~> 0.9.0 to ~> 0.10.0 (#38) @dependabot-preview
  • Cache parsed host url to reduce allocations (#36) @ashmaroli
  • Avoid unnecessary allocations for empty strings (#34) @ashmaroli
  • Allow use and testing with Jekyll 4.0 (#32) @ashmaroli
  • Lint with rubocop-jekyll (#33) @ashmaroli
  • Update rake requirement from ~> 10.0 to ~> 12.3 (#22) @dependabot-preview
  • Fix passing username as variable docs in README.md (#20) @chrismytton
  • update readme (#19) @kenman345

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 29 commits:

↗️ jekyll-commonmark (indirect, 1.3.1 → 1.4.0) · Repo · Changelog

Release Notes

1.4.0

Minor Enhancements

  • Require at least commonmarker-0.22 (#44)
  • Highlight fenced code-block contents with Rouge (#29)

Bug Fixes

  • Refactor away extra abstractions (#53)

Development Fixes

  • DRY begin-rescue-end block with a private helper (#28)
  • Fix failing CI builds (#33)
  • Remove gemspec dependency on Jekyll (#34)
  • Test rendering with invalid configuration (#27)
  • Refactor to improve readability (#37)
  • Set up Continuous Integration via GH Actions (#46)
  • Clean up gemspec (#47)
  • Add workflow to release gem via GH Actions (#54)

Documentation

  • Update README to link to commonmarker (#38)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 42 commits:

↗️ jekyll-commonmark-ghpages (indirect, 0.1.5 → 0.4.0) · Repo

Release Notes

0.2.0

What's Changed

New Contributors

Full Changelog: v0.1.6...v0.2.0

Does any of this look wrong? Please let us know.

Sorry, we couldn’t find anything useful about this release.

↗️ jekyll-feed (indirect, 0.11.0 → 0.15.1) · Repo · Changelog

Release Notes

0.15.1

Bug Fixes

  • MetaTag: when encoding for XML special characters, handle non-string objects (#326)

0.15.0

Minor Enhancements

  • Add support for drafts (#316)

0.14.0

Minor Enhancements

  • add support for categories (#153) (#233)
  • add support for tags (#264)
  • Make posts limit configurable (#314)
  • XML escape the title field of feed_meta (#306)

Bug Fixes

  • Fix feed link when post title contains HTML (#305)

Development Fixes

  • Use Dir to list source files (#309)
  • Require Ruby >=2.4.0 (#307)

0.13.0

Minor Enhancements

  • Excerpt only flag (#287)
  • Add media:content tag (#290)

Development Fixes

  • test: use categories in post (#249)

0.12.1

  • Release: v0.12.0 (#271)

Bug Fixes

  • Re-introduce Ruby 2.3 support and test Jekyll 3.7+ (#272)

0.12.0

  • Allow Jekyll v4 (still alpha)

Development Fixes

  • style: fix offenses in specs (#248)
  • dev: update CI and style settings (#258)
  • Enable testing for Windows platform (#265)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 57 commits:

↗️ jekyll-github-metadata (indirect, 2.12.1 → 2.13.0) · Repo · Changelog

Release Notes

2.13.0

Minor Enhancements

  • Lessen Jekyll dependency (#164)
  • Enable support for topics property (#166)
  • Allow detecting archived or disabled repos (#176)

Bug Fixes

  • Conditionally memoize certain private methods in EditLinkTag (#163)
  • Fix faraday connectionfailed issue (#178)
  • MetadataDrop: don't use instance variable to check mutations (#173)

Documentation Fixes

  • List the fields this repo generates for site.github (#171)
  • Use HTML entities to prevent Liquid from processing this documentation (#172)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 22 commits:

↗️ jekyll-mentions (indirect, 1.4.1 → 1.6.0) · Repo · Changelog

Release Notes

1.6.0

Minor Enhancements

  • Allow configuring base URL in page front matter (#72)
  • Incorporate document data only if it has override (#73)

Development Fixes

  • ci: test against Jekyll 4.0
  • style: target Ruby 2.4
  • ignore vendor/bundle

Bug Fixes

  • Support handling body tag across multiple lines (#70)

1.5.1

Bug Fixes

  • Re-introduce Ruby 2.3 support and test with Jekyll 3.7 and beyond (#69)

1.5.0

Development Fixes

  • Allow Jekyll v4 (still alpha)
  • Drop support for Ruby 2.3
  • chore(deps): rubocop-jekyll 0.3 (#65)
  • Reintroduce style checks (#67)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 25 commits:

↗️ jekyll-optional-front-matter (indirect, 0.3.0 → 0.3.2) · Repo

Release Notes

0.3.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 46 commits:

↗️ jekyll-readme-index (indirect, 0.2.0 → 0.3.0) · Repo

Release Notes

0.3.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 46 commits:

↗️ jekyll-redirect-from (indirect, 0.14.0 → 0.16.0) · Repo · Changelog

Release Notes

0.16.0

Minor Enhancements

  • Allows generation of redirects.json to be disabled (#207)
  • Allow redirects from and for subclasses of page and document (#204)

Bug Fixes

  • Use Hash#key? instead of Hash#keys.any? (#201)

Development Fixes

  • Target Ruby 2.4
  • Stop testing with backwards-compatible site config (#211)

Documentation

  • Simplifies YAML for redirect_to (#185)

0.15.0

Development Fixes

  • chore(deps): rubocop-jekyll 0.3 (#187)

Bug Fixes

  • Allow testing and using with Jekyll 4.x (#196)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 28 commits:

↗️ jekyll-relative-links (indirect, 0.6.0 → 0.6.1) · Repo

Release Notes

0.6.1

Support for Jekyll 4.x

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

↗️ jekyll-remote-theme (indirect, 0.4.0 → 0.4.3) · Repo

Release Notes

0.4.3

0.4.2

Jekyll 4.0 support (#61)

0.4.1

  • Update jekyll requirement from ~> 3.5 to >= 3.5, < 5.0 (#54) @dependabot-preview
  • Require rubyzip to version 1.3.0 or later

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 28 commits:

↗️ jekyll-seo-tag (indirect, 2.5.0 → 2.8.0) · Repo · Changelog

Release Notes

2.8.0

Minor Enhancements

  • Allow to set type for author (#427)
  • Allow setting author.url (#453)
  • Implement Facebook domain verification (#455)
  • Add og:image:alt and twitter:image:alt (#438)
  • Sort JSON-LD data by key (#458)

Bug Fixes

  • Set the default og:type to 'website' (#391)
  • Template: Remove double new line (#454)

Development Fixes

  • Fix typo in source code comment (#449)
  • Set up Continuous Integration via GH Actions (#450)
  • Bump RuboCop to v1.18.x (#452)
  • Add workflow to release gem via GH Actions

2.7.1

Development Fixes

  • refactor: mutate site payload instead of duplicating it (#419)

2.7.0

Minor Enhancements

  • Change pagination message with seo_paginator_message option (#324)
  • Make Twitter Summary Card without having Twitter account (#284)
  • Prefer site.tagline to site.description for page title (#356)
  • Render og:locale meta only when defined explicitly (#388)

Bug Fixes

  • Ensure a single leading @ for twitter usernames (#367)

Development Fixes

  • chore(deps): require Ruby > 2.4.0 EOL
  • test: fix locale specs that use the fallback locale (#360)
  • refactor: Replace read-only empty hash with private constant (#418)
  • refactor: Mutate hash literals instead of duplicating them (#417)
  • refactor: Reduce allocations of instance-agnostic objects (#376)
  • refactor: Memoize #author_hash in SeoTag::AuthorDrop (#342)
  • refactor: simplify conditional in SeoTag::Drop#date_modified (#343)
  • chore(ci): profile seo-tag plugin on a third-party repository (#414)
  • chore(ci): Jekyll v4.0 (#372)
  • chore(ci): test against current stable Ruby 2.5 and 2.7 (#385)
  • style: align with latest jekyll-rubocop (#382)
  • fix: Travis builds for Jekyll 3.x (#415)

Documentation

  • Structured Data Testing Tool is deprecated (#409)
  • Rename Google webmaster tools to Google Search Console (#403)
  • Improve documentation on plugin usage (#399)
  • remove Google+ from example snippet (#358)
  • HTTPS link to https://ogp.me/ (#359)
  • HTTPS links to schema.org (#350)
  • use example.com for example URL (#351)

2.6.1

Development Fixes

  • Test against Jekyll 4.x (#336)

2.6.0

Minor Enhancements

  • Twitter Image and Title (#330)

Bug Fixes

  • Do not cache the drop payload for SeoTag (#306)
  • Update url of schema website (#296)

Development Fixes

  • Relax version constraint on Bundler (#325)
  • chore(ci): Add Ruby 2.6, drop Ruby 2.3 (#326)
  • chore (ci): remove deprecated sudo: false in .travis.yml (#333)
  • Lint Ruby code with rubocop-jekyll gem (#302)
  • chore(deps): bump rubocop-jekyll to v0.4 (#320)
  • chore(deps): bump rubocop-jekyll to v0.3 (#316)
  • Correct RuboCop offenses in spec files (#319)

Documentation

  • Rectify error in Usage documentation (#328)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ jekyll-sitemap (indirect, 1.2.0 → 1.4.0) · Repo · Changelog

Release Notes

1.4.0

Minor Enhancements

  • Avoid overwriting an existing robots.txt (#246)

Bug Fixes

  • Simulate last_modified_at injection by plugin (#256)

1.3.1

Bug Fixes

  • Update plugin metadata and dev environment (#244)

Development Fixes

  • Lock requirement for jekyll-last-modified-at to >= 1.0

1.3.0

  • Allow Jekyll v4 (still alpha)

Documentation

  • Add PDF file exclusion documentation (#213)
  • Correct capitalization of GitHub (#207)

Development Fixes

  • Use Ruby 2.3 and Rubocop 0.55 (#214)
  • chore(deps): rubocop-jekyll-0.3 (#227)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

↗️ jekyll-swiss (indirect, 0.4.0 → 1.0.0) · Repo

Sorry, we couldn’t find anything useful about this release.

↗️ jekyll-theme-architect (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #48

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

↗️ jekyll-theme-cayman (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #133

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 45 commits:

↗️ jekyll-theme-dinky (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #22

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

↗️ jekyll-theme-hacker (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add Google Analytics to head-custom.html to allow easier customization of the GA code #79

0.1.2

  • Allow Jekyll v4
  • Return to home on click page title #47
  • Show full header h1 for smaller displays #49

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 39 commits:

↗️ jekyll-theme-leap-day (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Added styled KBD tag, like in primer theme #47 (thanks, @gebeto)
  • Remove 'auto' from padding since it's not a valid padding #57
  • Add head-custom.html to allow easier customization of the <head> #56

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 34 commits:

↗️ jekyll-theme-merlot (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

Add head-custom.html to allow easier customization of the <head> #10

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

↗️ jekyll-theme-midnight (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add Google Analytics to head-custom.html to allow easier customization of the GA code #37

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

↗️ jekyll-theme-minimal (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #119

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 28 commits:

↗️ jekyll-theme-modernist (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Replace linear_gradient with linear-gradient() CSS function #17
  • Add head-custom.html to allow easier customization of the <head> #16

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 27 commits:

↗️ jekyll-theme-primer (indirect, 0.5.3 → 0.6.0) · Repo

Release Notes

0.6.0

  • Add head-custom.html to allow easier customization of the #61

0.5.4

  • Update Primer CSS
  • Add default layout to post, page, and home layouts
  • Lessen Jekyll dependency

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 40 commits:

↗️ jekyll-theme-slate (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #66
  • Added styled KBD tag, like in primer theme #47 (thanks, @gebeto)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 25 commits:

↗️ jekyll-theme-tactile (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #23
  • Fall back code font-family to monospace #21 (thanks @lkslawek)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ jekyll-theme-time-machine (indirect, 0.1.1 → 0.2.0) · Repo

Release Notes

0.2.0

  • Add head-custom.html to allow easier customization of the <head> #22
  • Added styled KBD tag, like in primer theme #13 (thanks @gebeto)
  • Fix show_downloads #16 (thanks @deargle)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 25 commits:

↗️ jekyll-titles-from-headings (indirect, 0.5.1 → 0.5.3) · Repo

Release Notes

0.5.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 33 commits:

↗️ jemoji (indirect, 0.10.2 → 0.12.0) · Repo · Changelog

Release Notes

0.12.0

Minor Enhancements

  • perf: don't load Gemoji into memory immediately (#106)

Development Fixes

  • deps: Ruby > 2.4 (EOL)
  • ci: test with Ruby 2.7

0.11.1

Bug fix

  • Support handling body tag across multiple lines (#96)

0.11.0

Development fixes

  • Test against Jekyll v4
  • Remove deprecated sudo:false in Travis config

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ kramdown (indirect, 1.17.0 → 2.3.2) · Repo · Changelog

Security Advisories 🚨

🚨 Remote code execution in Kramdown

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters
namespace, and thus arbitrary classes can be instantiated.

🚨 Unintended read access in kramdown gem

The kramdown gem before 2.3.0 for Ruby processes the template option inside
Kramdown documents by default, which allows unintended read access (such as
template="/etc/passwd") or unintended embedded Ruby code execution (such as a
string that begins with template="string://<%= `). NOTE: kramdown is used in
Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

↗️ liquid (indirect, 4.0.0 → 4.0.4) · Repo · Changelog

Release Notes

4.0.3 (from changelog)

Fixed

  • Fix break and continue tags inside included templates in loops (#1072) [Justin Li]

4.0.2 (from changelog)

Changed

  • Add where filter (#1026) [Samuel Doiron]
  • Add ParseTreeVisitor to iterate the Liquid AST (#1025) [Stephen Paul Weber]
  • Improve strip_html performance (#1032) [printercu]

Fixed

  • Add error checking for invalid combinations of inputs to sort, sort_natural, where, uniq, map, compact filters (#1059) [Garland Zhang]
  • Validate the character encoding in url_decode (#1070) [Clayton Smith]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ listen (indirect, 3.1.5 → 3.8.0) · Repo · Changelog

Release Notes

3.8.0

3.7.1

3.7.0

3.6.0

✨ New Features

3.5.1

3.4.0

3.3.4

3.3.3

  • Add project metadata to the gemspec (#519) @orien

3.3.2

3.3.1

3.3.0

✨ New Features

🐛 Bug Fixes

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mini_portile2 (indirect, 2.4.0 → 2.8.1) · Repo · Changelog

Release Notes

2.8.1

2.8.1 / 2022-12-24

Fixed

  • Support applying patches via git apply even when the working directory resembles a git directory. [#119] (Thanks, @h0tw1r3!)

2.8.0

2.8.0 / 2022-02-20

Added

  • Support xz-compressed archives (recognized by an .xz file extension).
  • When downloading a source archive, default open_timeout and read_timeout to 10 seconds, but allow configuration via open_timeout and read_timeout config parameters.

2.7.1

2.7.1 / 2021-10-20

Packaging

A test artifact that has been included in the gem was being flagged by some users' security scanners because it wasn't a real tarball. That artifact has been updated to be a real tarball. [#108]

2.7.0

2.7.0 / 2021-08-31

Added

The commands used for "make", "compile", and "cmake" are configurable via keyword arguments. [#107] (Thanks, @cosmo0920!)

2.6.1

2.6.1 / 2021-05-31

Dependencies

Make net-ftp an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called and net-ftp isn't available; this should only happen in Ruby 3.1 and later.

2.6.0

2.6.0 / 2021-05-31

Added

Recipes may build against a local directory by specifying source_directory instead of files. In
particular, this may be useful for debugging problems with the upstream dependency (e.g., use git bisect in a local clone) or for continuous integration with upstream HEAD.

2.5.3

2.5.3 / 2021-05-31

Make net-ftp an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called and net-ftp isn't available; this should only happen in Ruby 3.1 and later.

2.5.2

2.5.2 / 2021-05-28

Dependencies

Add net-ftp as an explicit dependency to accommodate the upcoming Ruby 3.1 changes that move this and other gems out of the "default" gem set and into the "bundled" gem set. See https://bugs.ruby-lang.org/issues/17873 [#101]

2.5.1

2.5.1 / 2021-04-28

Dependencies

This release ends support for ruby < 2.3.0. If you're on 2.2.x or earlier, we strongly suggest that you find the time to upgrade, because official support for Ruby 2.2 ended on 2018-03-31.

Enhancements

  • MiniPortile.execute now takes an optional :env hash, which is merged into the environment variables for the subprocess. Likely this is only useful for specialized use cases. [#99]
  • Experimental support for cmake-based projects extended to Windows. (Thanks, @larskanis!)

2.5.0

2.5.0 / 2020-02-24

Enhancements

  • When verifying GPG signatures, remove all imported pubkeys from keyring [#90] (Thanks, @hanazuki!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ minima (indirect, 2.5.0 → 2.5.1) · Repo · Changelog

Release Notes

2.5.1

Minor enhancements

  • Allow use and testing with Jekyll 4.x (#398)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ minitest (indirect, 5.12.2 → 5.18.0) · Repo · Changelog

Release Notes

5.18.0 (from changelog)

  • 2 major enhancements:

    • Added assert_pattern & refute_pattern for pattern matching. (flavorjones)

    • Added matching must_pattern_match & wont_pattern_match to minitest/spec.

  • 1 bug fix:

    • Support the new message format of NameError in Ruby 3.3 (mame)

5.17.0 (from changelog)

  • 1 minor enhancement:

    • Refactor setup hooks into a SETUP_METHODS constant. (MSP-Greg)

  • 3 bug fixes:

    • Fix kwargs for Mock calls to delegator. (blowmage)

    • Fix kwargs for expectations. (bobmazanec, blowmage)

    • Remove check for .b method. (tenderlove)

5.16.3 (from changelog)

  • 2 bug fixes:

    • Fixed exception sanitization by removing TypeError restriction on rescue.

    • Use A instead of deprecated TESTOPTS in rake test:slow. (davidstosik)

5.16.2 (from changelog)

  • 4 bug fixes:

    • Added MT_KWARGS_HACK kludge for stub to deal with ruby 2.7 kwargs nastiness. (tsugimoto)

    • In #expect, pop Hash class from args if $MT_KWARGS_HACK. (casperisfine)

    • In above scenario, set expected kwargs (as Objects) based on actual kwargs.

    • Nuke ivars if exception fails to marshal twice (eg better_errors). (irphilli)

5.16.1 (from changelog)

  • 2 bug fixes:

    • Apparently adding real kwarg support to mocks/stubs broke some code. Fixed.

      • Use `MT_KWARGS_HACK=1` to activate the kludgy kwargs support w/ caveats.

    • Clarified some doco wrt the block on #stub.

5.16.0 (from changelog)

  • 2 major enhancements:

    • Added Minitest::TestTask.

    • Dropping ruby 2.2 - 2.5. 2.6 is DTM soon too.

  • 11 minor enhancements:

    • Added –show-skips option to show skips at end of run but not require –verbose. (MSP-Greg)

    • Added Minitest.seed, the random seed used by the run.

    • Calling `srand Minitest.seed` before all shuffles to ensure determinism.

    • Extended #stub to handle kwargs for both block and call args. (SampsonCrowley)

    • Extended Mock#__call to display kwargs.

    • Extended Mock#expect to record kwargs.

    • Extended Mock#method_missing to take kwargs & compare them against expected.

    • Mock#method_missing displays better errors on arity mismatch.

    • Removed minor optimization removing empty suites before run.

    • Simplified test randomization (test order will change even with fixed seed).

    • assert_match now returns the MatchData on success. (Nakilon)

  • 3 bug fixes:

    • (Re)Fixed marshalling of exceptions, neutering them in 2 passes.

    • Fixed more problems with rdoc.

    • Had to patch up mock and stub to deal with <=2.7 kwargs oddities

5.15.0 (from changelog)

  • 1 major enhancement:

    • assert_throws returns the value returned, if any. (volmer)

  • 3 minor enhancements:

    • Added -S <CODES> option to skip reporting of certain types of output

    • Enable Ruby deprecation warnings by default. (casperisfine)

    • Use Etc.nprocessors by default in order to maximize cpu usage. (tonytonyjan)

  • 6 bug fixes:

    • Close then unlink tempfiles on Windows. (nobu)

    • Fixed #skip_until for windows paths. (MSP-Greg)

    • Fixed a bunch of tests for jruby and windows. (MSP-Greg)

    • Fixed marshalling of specs if they error. (tenderlove, jeremyevans, et al)

    • Updated deprecation message for block expectations. (blowmage)

    • Use Kernel.warn directly in expectations in case CUT defines their own warn. (firien)

5.14.4 (from changelog)

  • 1 bug fix:

    • Fixed deprecation warning using stub with methods using keyword arguments. (Nakilon)

5.14.3 (from changelog)

  • 1 bug fix:

    • Bumped require_ruby_version to < 4 (trunk = 3.1).

5.14.2 (from changelog)

  • 1 bug fix:

    • Bumped ruby version to include 3.0 (trunk).

5.14.0 (from changelog)

  • 2 minor enhancements:

    • Block-assertions (eg assert_output) now error if raised inside the block. (casperisfine)

    • Changed assert_raises to only catch Assertion since that covers Skip and friends.

  • 3 bug fixes:

    • Added example for value wrapper with block to Expectations module. (stomar)

    • Fixed use of must/wont_be_within_delta on Expectation instance. (stomar)

    • Renamed UnexpectedError#exception to #error to avoid problems with reraising. (casperisfine)

5.13.0 (from changelog)

  • 9 minor enhancements:

    • Added Minitest::Guard#osx?

    • Added examples to documentation for assert_raises. (lxxxvi)

    • Added expectations #path_must_exist and #path_wont_exist. Not thrilled with the names.

    • Added fail_after(year, month, day, msg) to allow time-bombing after a deadline.

    • Added skip_until(year, month, day, msg) to allow deferring until a deadline.

    • Deprecated Minitest::Guard#maglev?

    • Deprecated Minitest::Guard#rubinius?

    • Finally added assert_path_exists and refute_path_exists. (deivid-rodriguez)

    • Refactored and pulled Assertions#things_to_diff out of #diff. (BurdetteLamar)

  • 3 bug fixes:

    • Fix autorun bug that affects fork exit status in tests. (dylanahsmith/jhawthorn)

    • Improved documentation for _/value/expect, especially for blocks. (svoop)

    • Support new Proc#to_s format. (ko1)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.10.4 → 1.14.2) · Repo · Changelog

Security Advisories 🚨

🚨 Unchecked return value from xmlTextReaderExpand

Summary

Nokogiri 1.13.8, 1.13.9 fails to check the return value from xmlTextReaderExpand in the method Nokogiri::XML::Reader#attribute_hash. This can lead to a null pointer exception when invalid markup is being parsed.

For applications using XML::Reader to parse untrusted inputs, this may potentially be a vector for a denial of service attack.

Mitigation

Upgrade to Nokogiri >= 1.13.10.

Users may be able to search their code for calls to either XML::Reader#attributes or XML::Reader#attribute_hash to determine if they are affected.

Severity

The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.1).

References

Credit

This vulnerability was responsibly reported by @davidwilemski.

🚨 Nokogiri contains libxml Out-of-bounds Write vulnerability

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.

🚨 libxslt Type Confusion vulnerability that affects Nokogiri

In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to xsltNumberFormatDecimal, leading to a read of uninitialized stack data.

Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.

🚨 Improper Handling of Unexpected Data Type in Nokogiri

Summary

Nokogiri < v1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers.
For CRuby users, this may allow specially crafted untrusted inputs to cause illegal
memory access errors (segfault) or reads from unrelated memory.

Severity

The Nokogiri maintainers have evaluated this as High 8.2 (CVSS3.1).

Mitigation

CRuby users should upgrade to Nokogiri >= 1.13.6.

JRuby users are not affected.

Workarounds

To avoid this vulnerability in affected applications, ensure the untrusted input is a
String by calling #to_s or equivalent.

🚨 Integer Overflow or Wraparound in libxml2 affects Nokogiri

Summary

Nokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from
v2.9.13 to v2.9.14.

libxml2 v2.9.14 addresses CVE-2022-29824.
This version also includes several security-related bug fixes for which CVEs were not created,
including a potential double-free, potential memory leaks, and integer-overflow.

Please note that this advisory only applies to the CRuby implementation of Nokogiri
< 1.13.5, and only if the packaged libraries are being used. If you've overridden
defaults at installation time to use system libraries instead of packaged libraries,
you should instead pay attention to your distro's libxml2 and libxslt release announcements.

Mitigation

Upgrade to Nokogiri >= 1.13.5.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation:
compile and link Nokogiri against external libraries libxml2 >= 2.9.14 which will also
address these same issues.

Impact

libxml2 CVE-2022-29824

  • CVSS3 score:
  • Type: Denial of service, information disclosure
  • Description: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
  • Fixed: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24

All versions of libml2 prior to v2.9.14 are affected.

Applications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.

References

🚨 Inefficient Regular Expression Complexity in Nokogiri

Summary

Nokogiri < v1.13.4 contains an inefficient regular expression that is
susceptible to excessive backtracking when attempting to detect encoding
in HTML documents.

Mitigation

Upgrade to Nokogiri >= 1.13.4.

🚨 XML Injection in Xerces Java affects Nokogiri

Summary

Nokogiri v1.13.4 updates the vendored xerces:xercesImpl from 2.12.0 to
2.12.2, which addresses CVE-2022-23437.
That CVE is scored as CVSS 6.5 "Medium" on the NVD record.

Please note that this advisory only applies to the JRuby implementation
of Nokogiri < 1.13.4.

Mitigation

Upgrade to Nokogiri >= v1.13.4.

Impact

CVE-2022-23437 in xerces-J

  • Severity: Medium
  • Type: CWE-91 XML Injection (aka Blind XPath Injection)
  • Description: There's a vulnerability within the Apache Xerces Java
    (XercesJ) XML parser when handling specially crafted XML document payloads.
    This causes, the XercesJ XML parser to wait in an infinite loop, which may
    sometimes consume system resources for prolonged duration. This vulnerability
    is present within XercesJ version 2.12.1 and the previous versions.
  • See also: GHSA-h65f-jvqw-m9fj

🚨 Out-of-bounds Write in zlib affects Nokogiri

Summary

Nokogiri v1.13.4 updates the vendored zlib from 1.2.11
to 1.2.12, which addresses CVE-2018-25032.
That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.

Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.13.4, and only if the packaged version of zlib is being used.
Please see this document
for a complete description of which platform gems vendor zlib. If you've
overridden defaults at installation time to use system libraries instead of
packaged libraries, you should instead pay attention to your distro's zlib
release announcements.

Mitigation

Upgrade to Nokogiri >= v1.13.4.

Impact

CVE-2018-25032 in zlib

  • Severity: High
  • Type: CWE-787
    Out of bounds write
  • Description: zlib before 1.2.12 allows memory corruption when
    deflating (i.e., when compressing) if the input has many distant matches.

🚨 Denial of Service (DoS) in Nokogiri on JRuby

Summary

Nokogiri v1.13.4 updates the vendored org.cyberneko.html library to
1.9.22.noko2 which addresses CVE-2022-24839.
That CVE is rated 7.5 (High Severity).

See GHSA-9849-p7jc-9rmv
for more information.

Please note that this advisory only applies to the JRuby implementation of Nokogiri < 1.13.4.

Mitigation

Upgrade to Nokogiri >= 1.13.4.

Impact

CVE-2022-24839 in nekohtml

  • Severity: High 7.5
  • Type: CWE-400 Uncontrolled Resource Consumption
  • Description: The fork of org.cyberneko.html used by Nokogiri (Rubygem) raises a
    java.lang.OutOfMemoryError exception when parsing ill-formed HTML markup.
  • See also: GHSA-9849-p7jc-9rmv

🚨 Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)

Summary

Nokogiri v1.13.2 upgrades two of its packaged dependencies:

  • vendored libxml2 from v2.9.12 to v2.9.13
  • vendored libxslt from v1.1.34 to v1.1.35

Those library versions address the following upstream CVEs:

  • libxslt: CVE-2021-30560 (CVSS 8.8, High severity)
  • libxml2: CVE-2022-23308 (Unspecified severity, see more information below)

Those library versions also address numerous other issues including performance
improvements, regression fixes, and bug fixes, as well as memory leaks and other
use-after-free issues that were not assigned CVEs.

Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.13.2, and only if the packaged libraries are being used. If you've
overridden defaults at installation time to use system libraries instead of
packaged libraries, you should instead pay attention to your distro's libxml2
and libxslt release announcements.

Mitigation

Upgrade to Nokogiri >= 1.13.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated
mitigation: compile and link an older version Nokogiri against external libraries
libxml2 >= 2.9.13 and libxslt >= 1.1.35, which will also address these same CVEs.

Impact

  • libxslt CVE-2021-30560
  • CVSS3 score: 8.8 (High)

Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c

All versions of libxslt prior to v1.1.35 are affected.

Applications using untrusted XSL stylesheets to transform XML are vulnerable to
a denial-of-service attack and should be upgraded immediately.

libxml2 CVE-2022-23308

The upstream commit and the explanation linked above indicate that an application
may be vulnerable to a denial of service, memory disclosure, or code execution if
it parses an untrusted document with parse options DTDVALID set to true, and NOENT
set to false.

An analysis of these parse options:

  • While NOENT is off by default for Document, DocumentFragment, Reader, and
    Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri
    v1.12.0 and later.
  • DTDVALID is an option that Nokogiri does not set for any operations, and so
    this CVE applies only to applications setting this option explicitly.

It seems reasonable to assume that any application explicitly setting the parse
option DTDVALID when parsing untrusted documents is vulnerable and should be
upgraded immediately.

🚨 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

Severity

The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.)

Impact

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default.

Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:

  • Nokogiri::XML::SAX::Parser
  • Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
  • Nokogiri::XML::SAX::PushParser
  • Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser

Mitigation

JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.

CRuby users are not affected.

🚨 Update packaged dependency libxml2 from 2.9.10 to 2.9.12

Summary

Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:

Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via xmllint is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992).

Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

Mitigation

Upgrade to Nokogiri >= 1.11.4.

Impact

I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.

All information below is sourced from security.archlinux.org, which appears to have the most up-to-date information as of this analysis.

CVE-2019-20388

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2020-7595

This has been patched in Nokogiri since v1.10.8 (see #1992).

CVE-2020-24977

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3516

Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship xmllint.

CVE-2021-3517

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3518

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3537

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3541

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into DTDLOAD which is off by default).

For more details supporting this analysis of this CVE, please visit #2233.

🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability

Description

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.

This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.

Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".

Affected Versions

Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3

Mitigation

There are no known workarounds for affected versions. Upgrade to Nokogiri
1.11.0.rc4 or later.

If, after upgrading to 1.11.0.rc4 or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):

  1. Ensure the input is trusted. Do not enable this option
    for untrusted input.
  2. When invoking the Nokogiri::XML::Schema constructor,
    pass as the second parameter an instance of Nokogiri::XML::ParseOptions with the
    NONET flag turned off.

So if your previous code was:

# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network
# but in v1.11.0.rc4 and later, this call will disallow network access for external resources
schema = Nokogiri::XML::Schema.new(schema)

# in v1.11.0.rc4 and later, the following is equivalent to the code above
# (the second parameter is optional, and this demonstrates its default value)
schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)

Then you can add the second parameter to indicate that the input is trusted by changing it to:

# in v1.11.0.rc3 and earlier, this would raise an ArgumentError
# but in v1.11.0.rc4 and later, this allows resources to be accessed over the network
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)

🚨 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

🚨 Nokogiri gem, via libxslt, is affected by multiple vulnerabilities

Nokogiri v1.10.5 has been released.

This is a security release. It addresses three CVEs in upstream libxml2,
for which details are below.

If you're using your distro's system libraries, rather than Nokogiri's
vendored libraries, there's no security need to upgrade at this time,
though you may want to check with your distro whether they've patched this
(Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses
these vulnerabilities.

Full details about the security update are available in Github Issue
[#1943] #1943.

CVE-2019-13117

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13117.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings
could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This
could allow an attacker to discern whether a byte on the stack contains the
characters A, a, I, i, or 0, or any other character.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/c5eb6cf3aba0af048596106ed839b4ae17ecbcb1

CVE-2019-13118

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-13118.html

Priority: Low

Description: In numbers.c in libxslt 1.1.33, a type holding grouping characters of an
xsl:number instruction was too narrow and an invalid character/length
combination could be passed to xsltNumberFormatDecimal, leading to a read
of uninitialized stack data

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/6ce8de69330783977dd14f6569419489875fb71b

CVE-2019-18197

https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-18197.html

Priority: Medium

Description: In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't
reset under certain circumstances. If the relevant memory area happened to
be freed and reused in a certain way, a bounds check could fail and memory
outside a buffer could be written to, or uninitialized data could be
disclosed.

Patched with commit https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ octokit (indirect, 4.14.0 → 4.25.1) · Repo · Changelog

Security Advisories 🚨

🚨 Octokit gem published with world-writable files

Impact

Versions 4.23.0
and 4.24.0 of the octokit gem
were published containing world-writeable files.

Specifically, the gem was packed
with files having their permissions set to -rw-rw-rw- (i.e. 0666) instead of rw-r--r--
(i.e. 0644). This means everyone who is not the owner (Group and Public) with access
to the instance where this release had been installed could modify the world-writable
files from this gem.

Malicious code already present and running on your machine,
separate from this package, could modify the gem’s files and change its behavior
during runtime.

Patches

Workarounds

Users can use the previous version of the gem v4.22.0.
Alternatively, users can modify the file permissions manually until they are able
to upgrade to the latest version.

Release Notes

4.25.1

  • Stop configuring Faraday's retry middleware twice (@Edouard-chin)
  • Fix various Ruby warnings (e.g. missing parentheses) (@coryf)

4.25.0

✅ NOTE: This remediates A security advisory was published on versions 4.23.0 and 4.24.0 of this gem. You can read more about this in the published security advisory. ✅

DX Improvements

CI Improvements

Updates all build scripts to be more durable and adds details on how to run a manual file integrity check by @nickfloyd in #1446

Housekeeping

  • Drop support for Ruby 1.9.2 in Octokit::Client::Contents#create_contents by @timrogers in #1442

Full Changelog: v4.24.0...v4.25.0

4.24.0

Known issues

Note: This release fixes the issue around autoloading modules causing some modules to not load before use #1428

Code improvements

CI Improvements

  • Adds Code QL analysis to octokit.rb via @nickfloyd

Bug fixes

Full Changelog: v4.23.0...v4.24.0

4.23.0

Code improvements

CI Improvements

Performance improvements

Bug fixes

Documentation

Full Changelog: v4.22.0...v4.23.0

4.22.0

Deprecation Fix

Code Improvements

CI and dependency updates

Documentation

4.21.0

API Support

Error handling

Code clean up

Documentation

4.20.0

API Support

Bug fixes

  • #1309 Paginate outside_collaborators calls @sds
  • #1316 Uses of FaradayMiddleware#on_complete should not be private @tarebyte

Code improvements

Documentation

4.19.0

Code Improvements

API Support

Documentation

CI and dependency updates

4.18.0

Documentation

Preview Header Support

Bug Fixes

4.17.0

Documentation

Preview Header Support

Bug Fixes

4.16.0

New features

Resolve deprecation warnings

  • #1192 Fix deprecation notice for authentication via query parameters @tarebyte

Documentation

Tooling updates

4.15.0

Preview header support
#1114 Adds drafts preview header @andrew
#1132 Update branch protection preview @spikex

New features
#1133 Support for template repositories @EricPickup
#1136 Add method to find team by name @gallexi
#1153 Add method to delete installation @yykamei
#1151 Add method to update pull request review @eric-silverman
#1162 Support for Commit pulls @tgmachina

Improved error handling
#1115 Add BillingIssue error @stmllr
#1106 Add TooLargeContent error @ybiquitous
#1164 Add SAMLProtected error @tarebyte

Resolve deprecation warnings
#1152 Fix version deprecation warning in ci builds @hmharvey
#1154 Fix faraday error subclass @Gasparila

Documentation
#1123 Add option in the pull request state parameter @4geru
#1135 Fix the contributing doc steps @gallexi
#1134 Fix the code example for update branch @rmacklin
#1139 Add assignee params @4geru
#1138 Update link to new collaborators api @shaunakpp
#1129 Add code of conduct @spikex
#1102 Update readme to point directly to v3 api @binhums

Tooling updates
#1142 Migrated to actions @tarebyte

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ public_suffix (indirect, 3.1.1 → 4.0.7) · Repo · Changelog

Release Notes

4.0.7 (from changelog)

Fixes

  • Fixed YARD rake task (GH-179)

Changed

  • Updated definitions.

4.0.6 (from changelog)

Changed

  • Updated definitions.

4.0.5 (from changelog)

Changed

  • Updated definitions.

4.0.4 (from changelog)

Changed

  • Updated definitions.

4.0.3 (from changelog)

Fixed

4.0.2 (from changelog)

Changed

  • Updated definitions.

4.0.1 (from changelog)

  • CHANGED: Updated definitions.

4.0.0 (from changelog)

  • CHANGED: Minimum Ruby version is 2.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 62 commits:

↗️ rainbow (indirect, 3.0.0 → 3.1.1) · Repo · Changelog

Release Notes

3.1.1 (from changelog)

  • fix: Ensure files directive in gemspec adds all files

3.1.0 (from changelog)

  • Bad release: superseded by 3.1.1.
  • added cross_out aka strike
  • hexadecimal color names supported better, see #83
  • gemspec: list files using a Ruby expression, avoiding git

(2020-08-26 was the planned release date, but the real release date is reflected in the heading.)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 29 commits:

↗️ rb-fsevent (indirect, 0.10.3 → 0.11.2) · Repo

Release Notes

0.11.2

  • Avoid modifying string literals #91

0.11.1

  • rescue Errno::EBADF when closing pipe #92

0.11.0

0.10.4

  • Remove bundler development dependency #85

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 14 commits:

↗️ rb-inotify (indirect, 0.10.0 → 0.10.1) · Repo

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ rouge (indirect, 2.2.1 → 3.26.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rubyzip (indirect, 2.0.0 → 2.3.2) · Repo · Changelog

Release Notes

2.3.2 (from changelog)

  • A "dummy" release to warn about breaking changes coming in version 3.0. This updated version uses the Gem post_install_message instead of printing to STDERR.

2.3.1

This is a "dummy" release to warn about breaking changes coming in version 3.0.

2.3.0

  • Fix frozen string literal error #431
  • Set OutputStream.write_buffer's buffer to binmode #439
  • Upgrade rubocop and fix various linting complaints #437 #440

Tooling:

  • Add a bin/console script for development #420
  • Update rake requirement (development dependency only) to fix a security alert.

2.2.0

  • Add support for decompression plugin gems #427

2.1.0

  • Fix (at least partially) the restore_times and restore_permissions options to Zip::File.new #413
    • Previously, neither option did anything, regardless of what it was set to. We have therefore defaulted them to false to preserve the current behavior, for the time being. If you have explicitly set either to true, it will now have an effect.
    • Fix handling of UniversalTime (mtime, atime, ctime) fields. #421
    • Previously, Zip::File did not pass the options to Zip::Entry in some cases. #423
    • Note that restore_times in this release does nothing on Windows and only restores mtime, not atime or ctime.
  • Allow Zip::File.open to take an options hash like Zip::File.new #418
  • Always print warnings with warn, instead of a mix of puts and warn #416
  • Create temporary files in the system temporary directory instead of the directory of the zip file #411
  • Drop unused tmpdir requirement #411

Tooling

  • Move CI to xenial and include jruby on JDK11 #419

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sawyer (indirect, 0.8.2 → 0.9.2) · Repo

Release Notes

0.9.1

What's Changed

  • Specify correct minimal Faraday version by @skryukov in #73

New Contributors

Full Changelog: v0.9.0...v0.9.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 8 commits:

↗️ typhoeus (indirect, 1.3.1 → 1.4.0) · Repo · Changelog

Release Notes

1.4.0 (from changelog)

Full Changelog

1 feature

  • Faraday adapter exceptions namespace compatibility with Faraday v1 (@iMacTia in #616)

3 Others

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

↗️ tzinfo (indirect, 1.2.5 → 2.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 TZInfo relative path traversal vulnerability allows loading of arbitrary files

Impact

Affected versions

  • 0.3.60 and earlier.
  • 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).

Vulnerability

With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and
later and built-in to earlier versions), time zones are defined in Ruby files.
There is one file per time zone. Time zone files are loaded with require on
demand. In the affected versions, TZInfo::Timezone.get fails to validate
time zone identifiers correctly, allowing a new line character within the
identifier. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be
made to load unintended files with require, executing them within the Ruby
process.

For example, with version 1.2.9, you can run the following to load a file with
path /tmp/payload.rb:

TZInfo::Timezone.get(\"foo\
/../../../../../../../../../../../../../../../../tmp/payload\")

The exact number of parent directory traversals needed will vary depending on
the location of the tzinfo-data gem.

TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the
Ruby load path. Versions up to and including 1.2.5 can only be made to load
files from directories within the load path.

This could be exploited in, for example, a Ruby on Rails application using
tzinfo version 1.2.9, that allows file uploads and has a time zone selector
that accepts arbitrary time zone identifiers.
The CVSS score and severity have been set on this basis.

Versions 2.0.0 and later are not vulnerable.

Patches

Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone
identifiers.

Note that version 0.3.61 can still load arbitrary files from the Ruby load
path if their name follows the rules for a valid time zone identifier and the
file has a prefix of tzinfo/definition within a directory in the load path.
For example if /tmp/upload was in the load path, then
TZInfo::Timezone.get('foo') could load a file with path
/tmp/upload/tzinfo/definition/foo.rb. Applications should ensure that
untrusted files are not placed in a directory on the load path.

Workarounds

As a workaround, the time zone identifier can be validated before passing to
TZInfo::Timezone.get by ensuring it matches the regular expression
\\A[A-Za-z0-9+\\-_]+(?:\\/[A-Za-z0-9+\\-_]+)*\\z.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unicode-display_width (indirect, 1.6.0 → 1.8.0) · Repo · Changelog

Release Notes

1.8.0 (from changelog)

  • Unicode 14.0 (last release of 1.x)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 13 commits:

↗️ yell (indirect, 2.2.0 → 2.2.2) · Repo

Sorry, we couldn’t find anything useful about this release.

🆕 Ascii85 (added, 1.1.0)

🆕 afm (added, 0.2.2)

🆕 async (added, 2.4.2)

🆕 console (added, 1.16.2)

🆕 faraday-net_http (added, 3.0.2)

🆕 fiber-local (added, 1.0.0)

🆕 hashery (added, 2.1.2)

🆕 io-event (added, 1.1.7)

🆕 jekyll-include-cache (added, 0.2.1)

🆕 kramdown-parser-gfm (added, 1.1.0)

🆕 pdf-reader (added, 2.11.0)

🆕 racc (added, 1.6.2)

🆕 rexml (added, 3.2.5)

🆕 ruby-rc4 (added, 0.1.5)

🆕 ruby2keywords (_added, 0.0.5)

🆕 simpleidn (added, 0.2.1)

🆕 timers (added, 4.3.5)

🆕 ttfunk (added, 1.7.0)

🆕 unf (added, 0.1.4)

🆕 unf_ext (added, 0.0.8.2)

🆕 zeitwerk (added, 2.6.7)

🗑️ multipart-post (removed)

🗑️ parallel (removed)

🗑️ ruby-enum (removed)

🗑️ ruby_dep (removed)

🗑️ thread_safe (removed)