Bump the bundler group across 3 directories with 2 updates

[dependabot]

Bumps the bundler group with 2 updates in the /humans-in-the-loop-files/scribe-hitl/loop_1 directory: puma and nokogiri.
Bumps the bundler group with 2 updates in the /humans-in-the-loop-files/scribe-hitl/loop_2 directory: puma and nokogiri.
Bumps the bundler group with 2 updates in the /humans-in-the-loop-files/scribe-hitl/loop_3 directory: puma and nokogiri.

Updates puma from 3.12.6 to 5.6.8

Release notes

Sourced from puma's releases.

5.6.7

Security Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.5 / 2022-08-23

• Bugfixes
  • NullIO#closed should return false (#2883)
  • Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)
  • [jruby] Fix TLS verification hang (#2890, #2729)
  • extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)
  • MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)
  • Fix rack.after_reply exceptions breaking connections (#2861, #2856)
  • Escape SSL cert and filenames (#2855)
  • Fail hard if SSL certs or keys are invalid (#2848)
  • Fail hard if SSL certs or keys cannot be read by user (#2847)
  • Fix build with Opaque DH in LibreSSL 3.5. (#2838)
  • Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)
  • Fix Puma::StateFile#load incompatibility (#2810)

5.6.4

• Security
  • Close several HTTP Request Smuggling exploits (CVE-2022-24790)

The 5.6.3 release was a mistake (released the wrong branch), 5.6.4 is correct.

5.6.2 / 2022-02-11

• Bugfix/Security
  • Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1

Bugfixes

• Reverted a commit which appeared to be causing occasional blank header values (see issue #2808) (#2809)

Full Changelog: puma/puma@v5.6.0...v5.6.1

5.6.0 - Birdie's Version

Maintainer @​nateberkopec had a daughter, nicknamed Birdie:

5.6.0 / 2022-01-25

• Features
  • Support localhost integration in ssl_bind (#2764, #2708)
  • Allow backlog parameter to be set with ssl_bind DSL (#2780)
  • Remove yaml (psych) requirement in StateFile (#2784)
  • Allow culling of oldest workers, previously was only youngest (#2773, #2794)
  • Add worker_check_interval configuration option (#2759)

... (truncated)

Changelog

Sourced from puma's changelog.

5.6.8 / 2024-01-08

• Security
  • Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

5.6.7 / 2023-08-18

• Security
  • Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.6 / 2023-06-21

• Bugfix
  • Prevent loading with rack 3 (#3166)

5.6.5 / 2022-08-23

• Feature

  • Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)

• Bugfixes

  • NullIO#closed should return false (#2883)
  • [jruby] Fix TLS verification hang (#2890, #2729)
  • extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)
  • MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)
  • Fix rack.after_reply exceptions breaking connections (#2861, #2856)
  • Escape SSL cert and filenames (#2855)
  • Fail hard if SSL certs or keys are invalid (#2848)
  • Fail hard if SSL certs or keys cannot be read by user (#2847)
  • Fix build with Opaque DH in LibreSSL 3.5. (#2838)
  • Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)
  • Fix Puma::StateFile#load incompatibility (#2810)

5.6.4 / 2022-03-30

• Security
  • Close several HTTP Request Smuggling exploits (CVE-2022-24790)

5.6.2 / 2022-02-11

• Bugfix/Security
  • Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1 / 2022-01-26

• Bugfixes
  • Reverted a commit which appeared to be causing occasional blank header values (#2809)

5.6.0 / 2022-01-25

... (truncated)

Commits

• 1293573 5.6.8
• bbb880f Merge pull request from GHSA-c2f4-cvqm-65w2
• 78393bf 5.6.7
• 7405a21 Merge pull request from GHSA-68xg-gqqm-vgj8
• d33424b 5.6.7 release note [ci skip]
• f8c7b23 5.6.6
• 08af1b5 5.6.6 release note
• 6dac5d9 Prevent loading with rack 3 (#3166)
• 0892558 Fix and update 5-6-stable CI, two backports (#3167)
• 3a6ea4f Release note fix for 5.6.5
• Additional commits viewable in compare view

Updates nokogiri from 1.9.1 to 1.12.5

Release notes

Sourced from nokogiri's releases.

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. [#2324]

---

SHA256 checksums:

36bfa3a07aced069b3f3c9b39d9fb62cb0728d284d02b079404cd55780beaeff  nokogiri-1.12.5-arm64-darwin.gem
16b1a9ddbb70a9c998462912a5972097cbc79c3e01eb373906886ef8a469f589  nokogiri-1.12.5-java.gem
218dcc6edd1b49cc6244b5f88afb978739bb2f3f166c271557fe5f51e4bc713c  nokogiri-1.12.5-x64-mingw32.gem
e33bb919d64c16d931a5f26dc880969e587d225cfa97e6b56e790fb52179f527  nokogiri-1.12.5-x86-linux.gem
e13c2ed011b8346fbd589e96fe3542d763158bc2c7ad0f4f55f6d801afd1d9ff  nokogiri-1.12.5-x86-mingw32.gem
1ed64f7db7c1414b87fce28029f2a10128611d2037e0871ba298d00f9a00edd6  nokogiri-1.12.5-x86_64-darwin.gem
0868c8d0a147904d4dedaaa05af5f06656f2d3c67e4432601718559bf69d6cea  nokogiri-1.12.5-x86_64-linux.gem
2b20905942acc580697c8c496d0d1672ab617facb9d30d156b3c7676e67902ec  nokogiri-1.12.5.gem

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. #2324

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

However, recognizing that we want Builder-created children to inherit namespaces, Builder now will set namespace_inheritance=true on the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored.

Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so:

Nokogiri::XML::Builder.new(namespace_inheritance: false)

See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage.

Downstream gem maintainers

Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance:

... (truncated)

Commits

• 47f6a46 version bump to v1.12.5
• 2a0ac88 update CHANGELOG
• 6b60637 Merge pull request #2329 from sparklemotion/flavorjones-GHSA-2rr5-8q37-2w7h_1...
• 4bd943c fix(jruby): SAX parser uses an entity resolver
• f943ee4 refactor(jruby): handle errors more consistently
• 2790122 format: test files
• 01e1618 Merge pull request #2327 from sparklemotion/2324-xhtml-self-closing-tags_v1.12.x
• a0180c7 fix: HTML4::Document.to_xhtml self-closing tags
• 564ac17 release v1.12.4
• 4d5754b backport #2320
• Additional commits viewable in compare view

Updates puma from 3.12.6 to 5.6.8

Release notes

Sourced from puma's releases.

5.6.7

Security Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.5 / 2022-08-23

• Bugfixes
  • NullIO#closed should return false (#2883)
  • Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)
  • [jruby] Fix TLS verification hang (#2890, #2729)
  • extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)
  • MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)
  • Fix rack.after_reply exceptions breaking connections (#2861, #2856)
  • Escape SSL cert and filenames (#2855)
  • Fail hard if SSL certs or keys are invalid (#2848)
  • Fail hard if SSL certs or keys cannot be read by user (#2847)
  • Fix build with Opaque DH in LibreSSL 3.5. (#2838)
  • Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)
  • Fix Puma::StateFile#load incompatibility (#2810)

5.6.4

• Security
  • Close several HTTP Request Smuggling exploits (CVE-2022-24790)

The 5.6.3 release was a mistake (released the wrong branch), 5.6.4 is correct.

5.6.2 / 2022-02-11

• Bugfix/Security
  • Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1

Bugfixes

• Reverted a commit which appeared to be causing occasional blank header values (see issue #2808) (#2809)

Full Changelog: puma/puma@v5.6.0...v5.6.1

5.6.0 - Birdie's Version

Maintainer @​nateberkopec had a daughter, nicknamed Birdie:

5.6.0 / 2022-01-25

• Features
  • Support localhost integration in ssl_bind (#2764, #2708)
  • Allow backlog parameter to be set with ssl_bind DSL (#2780)
  • Remove yaml (psych) requirement in StateFile (#2784)
  • Allow culling of oldest workers, previously was only youngest (#2773, #2794)
  • Add worker_check_interval configuration option (#2759)

... (truncated)

Changelog

Sourced from puma's changelog.

5.6.8 / 2024-01-08

• Security
  • Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

5.6.7 / 2023-08-18

• Security
  • Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.6 / 2023-06-21

• Bugfix
  • Prevent loading with rack 3 (#3166)

5.6.5 / 2022-08-23

• Feature

  • Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)

• Bugfixes

  • NullIO#closed should return false (#2883)
  • [jruby] Fix TLS verification hang (#2890, #2729)
  • extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)
  • MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)
  • Fix rack.after_reply exceptions breaking connections (#2861, #2856)
  • Escape SSL cert and filenames (#2855)
  • Fail hard if SSL certs or keys are invalid (#2848)
  • Fail hard if SSL certs or keys cannot be read by user (#2847)
  • Fix build with Opaque DH in LibreSSL 3.5. (#2838)
  • Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)
  • Fix Puma::StateFile#load incompatibility (#2810)

5.6.4 / 2022-03-30

• Security
  • Close several HTTP Request Smuggling exploits (CVE-2022-24790)

5.6.2 / 2022-02-11

• Bugfix/Security
  • Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1 / 2022-01-26

• Bugfixes
  • Reverted a commit which appeared to be causing occasional blank header values (#2809)

5.6.0 / 2022-01-25

... (truncated)

Commits

• 1293573 5.6.8
• bbb880f Merge pull request from GHSA-c2f4-cvqm-65w2
• 78393bf 5.6.7
• 7405a21 Merge pull request from GHSA-68xg-gqqm-vgj8
• d33424b 5.6.7 release note [ci skip]
• f8c7b23 5.6.6
• 08af1b5 5.6.6 release note
• 6dac5d9 Prevent loading with rack 3 (#3166)
• 0892558 Fix and update 5-6-stable CI, two backports (#3167)
• 3a6ea4f Release note fix for 5.6.5
• Additional commits viewable in compare view

Updates nokogiri from 1.9.1 to 1.12.5

Release notes

Sourced from nokogiri's releases.

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. [#2324]

---

SHA256 checksums:

36bfa3a07aced069b3f3c9b39d9fb62cb0728d284d02b079404cd55780beaeff  nokogiri-1.12.5-arm64-darwin.gem
16b1a9ddbb70a9c998462912a5972097cbc79c3e01eb373906886ef8a469f589  nokogiri-1.12.5-java.gem
218dcc6edd1b49cc6244b5f88afb978739bb2f3f166c271557fe5f51e4bc713c  nokogiri-1.12.5-x64-mingw32.gem
e33bb919d64c16d931a5f26dc880969e587d225cfa97e6b56e790fb52179f527  nokogiri-1.12.5-x86-linux.gem
e13c2ed011b8346fbd589e96fe3542d763158bc2c7ad0f4f55f6d801afd1d9ff  nokogiri-1.12.5-x86-mingw32.gem
1ed64f7db7c1414b87fce28029f2a10128611d2037e0871ba298d00f9a00edd6  nokogiri-1.12.5-x86_64-darwin.gem
0868c8d0a147904d4dedaaa05af5f06656f2d3c67e4432601718559bf69d6cea  nokogiri-1.12.5-x86_64-linux.gem
2b20905942acc580697c8c496d0d1672ab617facb9d30d156b3c7676e67902ec  nokogiri-1.12.5.gem

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. #2324

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

However, recognizing that we want Builder-created children to inherit namespaces, Builder now will set namespace_inheritance=true on the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored.

Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so:

Nokogiri::XML::Builder.new(namespace_inheritance: false)

See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage.

Downstream gem maintainers

Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance:

... (truncated)

Commits

• 47f6a46 version bump to v1.12.5
• 2a0ac88 update CHANGELOG
• 6b60637 Merge pull request #2329 from sparklemotion/flavorjones-GHSA-2rr5-8q37-2w7h_1...
• 4bd943c fix(jruby): SAX parser uses an entity resolver
• f943ee4 refactor(jruby): handle errors more consistently
• 2790122 format: test files
• 01e1618 Merge pull request #2327 from sparklemotion/2324-xhtml-self-closing-tags_v1.12.x
• a0180c7 fix: HTML4::Document.to_xhtml self-closing tags
• 564ac17 release v1.12.4
• 4d5754b backport #2320
• Additional commits viewable in compare view

Updates puma from 3.12.6 to 5.6.8

Release notes

Sourced from puma's releases.

5.6.7

Security Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.5 / 2022-08-23

• Bugfixes
  • NullIO#closed should return false (#2883)
  • Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)
  • [jruby] Fix TLS verification hang (#2890, #2729)
  • extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)
  • MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)
  • Fix rack.after_reply exceptions breaking connections (#2861, #2856)
  • Escape SSL cert and filenames (#2855)
  • Fail hard if SSL certs or keys are invalid (#2848)
  • Fail hard if SSL certs or keys cannot be read by user (#2847)
  • Fix build with Opaque DH in LibreSSL 3.5. (#2838)
  • Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)
  • Fix Puma::StateFile#load incompatibility (#2810)

5.6.4

• Security
  • Close several HTTP Request Smuggling exploits (CVE-2022-24790)

The 5.6.3 release was a mistake (released the wrong branch), 5.6.4 is correct.

5.6.2 / 2022-02-11

• Bugfix/Security
  • Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1

Bugfixes

• Reverted a commit which appeared to be causing occasional blank header values (see issue #2808) (#2809)

Full Changelog: puma/puma@v5.6.0...v5.6.1

5.6.0 - Birdie's Version

Maintainer @​nateberkopec had a daughter, nicknamed Birdie:

5.6.0 / 2022-01-25

• Features
  • Support localhost integration in ssl_bind (#2764, #2708)
  • Allow backlog parameter to be set with ssl_bind DSL (#2780)
  • Remove yaml (psych) requirement in StateFile (#2784)
  • Allow culling of oldest workers, previously was only youngest (#2773, #2794)
  • Add worker_check_interval configuration option (#2759)

... (truncated)

Changelog

Sourced from puma's changelog.

5.6.8 / 2024-01-08

• Security
  • Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

5.6.7 / 2023-08-18

• Security
  • Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.6 / 2023-06-21

• Bugfix
  • Prevent loading with rack 3 (#3166)

5.6.5 / 2022-08-23

• Feature

  • Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)

• Bugfixes

  • NullIO#closed should return false (#2883)
  • [jruby] Fix TLS verification hang (#2890, #2729)
  • extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)
  • MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)
  • Fix rack.after_reply exceptions breaking connections (#2861, #2856)
  • Escape SSL cert and filenames (#2855)
  • Fail hard if SSL certs or keys are invalid (#2848)
  • Fail hard if SSL certs or keys cannot be read by user (#2847)
  • Fix build with Opaque DH in LibreSSL 3.5. (#2838)
  • Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)
  • Fix Puma::StateFile#load incompatibility (#2810)

5.6.4 / 2022-03-30

• Security
  • Close several HTTP Request Smuggling exploits (CVE-2022-24790)

5.6.2 / 2022-02-11

• Bugfix/Security
  • Response body will always be closed. (GHSA-rmj8-8hhh-gv5h, related to #2809)

5.6.1 / 2022-01-26

• Bugfixes
  • Reverted a commit which appeared to be causing occasional blank header values (#2809)

5.6.0 / 2022-01-25

... (truncated)

Commits

• 1293573 5.6.8
• bbb880f Merge pull request from GHSA-c2f4-cvqm-65w2
• 78393bf 5.6.7
• 7405a21 Merge pull request from GHSA-68xg-gqqm-vgj8
• d33424b 5.6.7 release note [ci skip]
• f8c7b23 5.6.6
• 08af1b5 5.6.6 release note
• 6dac5d9 Prevent loading with rack 3 (#3166)
• 0892558 Fix and update 5-6-stable CI, two backports (#3167)
• 3a6ea4f Release note fix for 5.6.5
• Additional commits viewable in compare view

Updates nokogiri from 1.9.1 to 1.12.5

Release notes

Sourced from nokogiri's releases.

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. [#2324]

---

SHA256 checksums:

36bfa3a07aced069b3f3c9b39d9fb62cb0728d284d02b079404cd55780beaeff  nokogiri-1.12.5-arm64-darwin.gem
16b1a9ddbb70a9c998462912a5972097cbc79c3e01eb373906886ef8a469f589  nokogiri-1.12.5-java.gem
218dcc6edd1b49cc6244b5f88afb978739bb2f3f166c271557fe5f51e4bc713c  nokogiri-1.12.5-x64-mingw32.gem
e33bb919d64c16d931a5f26dc880969e587d225cfa97e6b56e790fb52179f527  nokogiri-1.12.5-x86-linux.gem
e13c2ed011b8346fbd589e96fe3542d763158bc2c7ad0f4f55f6d801afd1d9ff  nokogiri-1.12.5-x86-mingw32.gem
1ed64f7db7c1414b87fce28029f2a10128611d2037e0871ba298d00f9a00edd6  nokogiri-1.12.5-x86_64-darwin.gem
0868c8d0a147904d4dedaaa05af5f06656f2d3c67e4432601718559bf69d6cea  nokogiri-1.12.5-x86_64-linux.gem
2b20905942acc580697c8c496d0d1672ab617facb9d30d156b3c7676e67902ec  nokogiri-1.12.5.gem

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. #2324

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

However, recognizing that we want Builder-created children to inherit namespaces, Builder now will set namespace_inheritance=true on the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored.

Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so:

Nokogiri::XML::Builder.new(namespace_inheritance: false)

See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage.

Downstream gem maintainers

Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance:

... (truncated)

Commits

• 47f6a46 version bump to v1.12.5
• 2a0ac88 update CHANGELOG
• 6b60637 Merge pull request #2329 from sparklemotion/flavorjones-GHSA-2rr5-8q37-2w7h_1...
• 4bd943c fix(jruby): SAX parser uses an entity resolver
• f943ee4 refactor(jruby): handle errors more consistently
• 2790122 format: test files
• 01e1618 Merge pull request #2327 from sparklemotion/2324-xhtml-self-closing-tags_v1.12.x
• a0180c7 fix: HTML4::Document.to_xhtml self-closing tags
• 564ac17 release v1.12.4
• 4d5754b backport #2320
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Superseded by #95.

[dependabot]

Superseded by #95.