Skip to content

Bump nokogiri, maremma and faraday #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump nokogiri, maremma and faraday #52

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 1, 2022 •
edited
Loading

Bumps nokogiri, maremma and faraday. These dependencies needed to be updated together.
Updates nokogiri from 1.10.10 to 1.13.9

Release notes

Sourced from nokogiri's releases.

1.13.9 / 2022-10-18

Security

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.
  • [CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.
  • [CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

  • [CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @​eightbitraptor and @​peterzhu2118!)
  • [CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

sha256 checksums:

9b69829561d30c4461ea803baeaf3460e8b145cff7a26ce397119577a4083a02  nokogiri-1.13.9-aarch64-linux.gem
e76ebb4b7b2e02c72b2d1541289f8b0679fb5984867cf199d89b8ef485764956  nokogiri-1.13.9-arm64-darwin.gem
15bae7d08bddeaa898d8e3f558723300137c26a2dc2632a1f89c8574c4467165  nokogiri-1.13.9-java.gem
f6a1dbc7229184357f3129503530af73cc59ceba4932c700a458a561edbe04b9  nokogiri-1.13.9-x64-mingw-ucrt.gem
36d935d799baa4dc488024f71881ff0bc8b172cecdfc54781169c40ec02cbdb3  nokogiri-1.13.9-x64-mingw32.gem
ebaf82aa9a11b8fafb67873d19ee48efb565040f04c898cdce8ca0cd53ff1a12  nokogiri-1.13.9-x86-linux.gem
11789a2a11b28bc028ee111f23311461104d8c4468d5b901ab7536b282504154  nokogiri-1.13.9-x86-mingw32.gem
01830e1646803ff91c0fe94bc768ff40082c6de8cfa563dafd01b3f7d5f9d795  nokogiri-1.13.9-x86_64-darwin.gem
8e93b8adec22958013799c8690d81c2cdf8a90b6f6e8150ab22e11895844d781  nokogiri-1.13.9-x86_64-linux.gem
96f37c1baf0234d3ae54c2c89aef7220d4a8a1b03d2675ff7723565b0a095531  nokogiri-1.13.9.gem

1.13.8 / 2022-07-23

Deprecated

  • XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

  • XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.13.9 / 2022-10-18

Security

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.10.3 from v2.9.14.
  • [CRuby] Vendored libxslt is updated to v1.1.37 from v1.1.35.
  • [CRuby] Vendored zlib is updated from 1.2.12 to 1.2.13. (See LICENSE-DEPENDENCIES.md for details on which packages redistribute this library.)

Fixed

  • [CRuby] Nokogiri::XML::Namespace objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2658] (Thanks, @​eightbitraptor and @​peterzhu2118!)
  • [CRuby] Document#remove_namespaces! now defers freeing the underlying xmlNs struct until the Document is GCed. Previously, maintaining a reference to a Namespace object that was removed in this way could lead to a segfault. [#2658]

1.13.8 / 2022-07-23

Deprecated

  • XML::Reader#attribute_nodes is deprecated due to incompatibility between libxml2's xmlReader memory semantics and Ruby's garbage collector. Although this method continues to exist for backwards compatibility, it is unsafe to call and may segfault. This method will be removed in a future version of Nokogiri, and callers should use #attribute_hash instead. [#2598]

Improvements

  • XML::Reader#attribute_hash is a new method to safely retrieve the attributes of a node from XML::Reader. [#2598, #2599]

Fixed

  • [CRuby] Calling XML::Reader#attributes is now safe to call. In Nokogiri <= 1.13.7 this method may segfault. [#2598, #2599]

1.13.7 / 2022-07-12

Fixed

XML::Node objects, when compacted, update their internal struct's reference to the Ruby object wrapper. Previously, with GC compaction enabled, a segmentation fault was possible after compaction was triggered. [#2578] (Thanks, @​eightbitraptor!)

1.13.6 / 2022-05-08

Security

  • [CRuby] Address CVE-2022-29181, improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information.

... (truncated)

Commits
  • 897759c version bump to v1.13.9
  • aeb1ac3 doc: update CHANGELOG
  • c663e49 Merge pull request #2671 from sparklemotion/flavorjones-update-zlib-1.2.13_v1...
  • 212e07d ext: hack to cross-compile zlib v1.2.13 on darwin
  • 76dbc8c dep: update zlib to v1.2.13
  • 24e3a9c doc: update CHANGELOG
  • 4db3b4d Merge pull request #2668 from sparklemotion/flavorjones-namespace-scopes-comp...
  • 73d73d6 fix: Document#remove_namespaces! use-after-free bug
  • 5f58b34 fix: namespace nodes behave properly when compacted
  • b08a858 test: repro namespace_scopes compaction issue
  • Additional commits viewable in compare view

Updates maremma from 4.7 to 4.9.8

Release notes

Sourced from maremma's releases.

4.9.8

What's Changed

New Contributors

Full Changelog: datacite/maremma@4.9.7...4.9.8

4.9.7

What's Changed

Full Changelog: datacite/maremma@4.9.6...4.9.7

4.9.6

What's Changed

New Contributors

Full Changelog: datacite/maremma@4.9.5...4.9.6

4.9.5

No release notes provided.

4.9.4

No release notes provided.

4.9.3

No release notes provided.

4.9.2

No release notes provided.

4.9.1

No release notes provided.

4.9

No release notes provided.

4.7.3

No release notes provided.

Changelog

Sourced from maremma's changelog.

4.9.8 (2022-05-24)

Full Changelog

Merged pull requests:

4.9.7 (2022-01-04)

Full Changelog

Merged pull requests:

4.9.6 (2021-10-28)

Full Changelog

Merged pull requests:

  • Add option to skip the encoding of the response body. #16 (jrhoads)

4.9.5 (2021-07-20)

Full Changelog

4.9.4 (2021-06-07)

Full Changelog

4.9.3 (2021-06-07)

Full Changelog

4.9.2 (2021-06-07)

Full Changelog

4.9.1 (2021-06-06)

Full Changelog

4.9 (2021-06-06)

Full Changelog

4.7.4 (2021-03-26)

... (truncated)

Commits
  • 8a7fefd Update version.rb
  • de53935 Updated CHANGELOG.md
  • b1ba78d Merge pull request #22 from datacite/dependabot/bundler/nokogiri-1.13.6
  • 6848453 Update nokogiri requirement from >= 1.11.2, < 1.13.0 to >= 1.11.2, < 1.14.0
  • 288ebb0 Merge pull request #18 from front-matter/master
  • baa4a2b Update version.rb
  • 4747608 Updated CHANGELOG.md
  • 6d5d25f Updated CHANGELOG.md
  • 7f6e121 Merge pull request #15 from datacite/dependabot/bundler/nokogiri-1.12.5
  • 0812300 Merge branch 'dependabot/bundler/nokogiri-1.12.5' of github.com:datacite/mare...
  • Additional commits viewable in compare view

Updates faraday from 0.17.0 to 0.17.6

Release notes

Sourced from faraday's releases.

v0.17.6

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v0.17.5...v0.17.6

v0.17.5

Changes:

Full Changelog: lostisland/faraday@v0.17.4...v0.17.5

v0.17.4

Fixes

v0.17.3

This is the last release before v1.0! When you're ready to upgrade, run your app with FARADAY_DEPRECATE=warn and check out the Upgrading guide.

Fixes:

Misc:

Faraday v0.17.1

Final release before Faraday v1.0, with important fixes for Ruby 2.7.

Fixes:

  • RaiseError response middleware raises exception if HTTP client returns a nil status. (#1042)

Misc:

  • Fix Ruby 2.7 warnings (#1009)
  • Add Faraday::Deprecate to warn about upcoming v1.0 changes. (#1054, #1059,

... (truncated)

Changelog

Sourced from faraday's changelog.

Faraday Changelog

The changelog has moved!

This file is not being updated anymore. Instead, please check the Releases page.

2.2.0 (2022-02-03)

  • Reintroduce the possibility to register middleware with symbols, strings or procs in #1391

2.1.0 (2022-01-15)

2.0.1 (2022-01-05)

2.0.0 (2022-01-04)

The next major release is here, and it comes almost 2 years after the release of v1.0!

This release changes the way you use Faraday and embraces a new paradigm of Faraday as an ecosystem, rather than a library.

What does that mean? It means that Faraday is less of a bundled tool and more of a framework for the community to build on top of.

As a result, all adapters and some middleware have moved out and are now shipped as standalone gems 🙌!

But this doesn't mean that upgrading from Faraday 1.x to Faraday 2.0 should be hard, in fact we've listed everything you need to do in the UPGRADING.md doc.

Moreover, we've setup a new awesome-faraday repository that will showcase a curated list of adapters and middleware 😎.

This release was the result of the efforts of the core team and all the contributors, new and old, that have helped achieve this milestone 👏.

What's Changed

... (truncated)

Commits

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
Bump nokogiri, maremma and faraday
2b726f3 
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri), [maremma](https://github.com/datacite/maremma) and [faraday](https://github.com/lostisland/faraday). These dependencies needed to be updated together.

Updates `nokogiri` from 1.10.10 to 1.13.9
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.10.10...v1.13.9)

Updates `maremma` from 4.7 to 4.9.8
- [Release notes](https://github.com/datacite/maremma/releases)
- [Changelog](https://github.com/datacite/maremma/blob/master/CHANGELOG.md)
- [Commits](datacite/maremma@4.7...4.9.8)

Updates `faraday` from 0.17.0 to 0.17.6
- [Release notes](https://github.com/lostisland/faraday/releases)
- [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md)
- [Commits](lostisland/faraday@v0.17.0...v0.17.6)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: direct:production
- dependency-name: maremma
  dependency-type: direct:production
- dependency-name: faraday
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant