dependabot[bot] opened a new pull request, #5406: URL: https://github.com/apache/calcite/pull/5406
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.19.4 to 1.19.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/releases";>nokogiri's releases</a>.</em></p> <blockquote> <h2>v1.19.5 / 2026-11-01</h2> <h3>Security</h3> <ul> <li>[CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via <code>Node#[]=</code> or <code>Node#lang=</code> while Ruby objects still reference the attribute's children. See <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w";>GHSA-3w22-6jfg-527w</a> for more information.</li> <li>[CRuby] (Low) The HTML5 serializer now escapes text inside <code>noscript</code> unless the document was parsed with <code>parse_noscript_content_as_text: true</code>, preventing a mutation XSS in applications that allow <code>noscript</code> in sanitized HTML. A fragment now parses <code>noscript</code> content the same way as its document, and raises <code>ArgumentError</code> if given a conflicting <code>parse_noscript_content_as_text:</code> value. Comments and raw-text elements inside <code>noscript</code> are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow <code>noscript</code> should parse with <code>parse_noscript_content_as_text: true</code> or remove <code>noscript</code> elements. See <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4";>GHSA-4p39-36wj-23h4</a> for more information.</li> <li>[JRuby] (Low) <code>NONET</code> now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as <code>127.1</code>, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with <code>DTDLOAD</code> or <code>NOENT</code>, potentially enabling SSRF. See <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm";>GHSA-v995-44v6-5fqm</a> for more information.</li> </ul> <h3>Improved</h3> <ul> <li>[CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3393";>#3393</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Improved XPath argument marshalling performance by using <code>ALLOCV_N</code> instead of <code>rb_gc_register_address</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3648";>#3648</a>) <a href="https://github.com/jhawthorn";><code>@jhawthorn</code></a></li> </ul> <h3>Fixed</h3> <ul> <li><code>Node#namespace=</code> now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from <code>Node#namespace_definitions</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3459";>#3459</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3462";>#3462</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li><code>XML::Reader</code> is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3694";>#3694</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li><code>Node#namespace = false</code> now raises <code>TypeError</code>. Previously it crashed the process on CRuby and raised <code>ClassCastException</code> on JRuby. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3719";>#3719</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li><code>XML::XPathContext.new</code> and <code>XML::XPathContext#node=</code> raise <code>TypeError</code> when the argument is not a <code>Node</code>. Previously, on CRuby, most such arguments crashed the process. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3720";>#3720</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>CSS <code>an+b</code> selectors with a zero or negative step now follow the Selectors spec: <code>:nth-child(0n+3)</code> matches only the third element (previously nothing), <code>0n-1</code> matches nothing instead of raising <code>ZeroDivisionError</code>, and <code>-n+0</code> / <code>-2n</code> match nothing instead of every (or every other) element. <a href="https://github.com/afurm";><code>@afurm</code></a></li> <li>CSS <code>#id</code>, <code>.class</code> and attribute selectors whose value contains a quote character, such as <code>#it\'s</code> or <code>[a=\'b\']</code>, now match that value. Previously they raised <code>Nokogiri::XML::XPath::SyntaxError</code> or generated an XPath query with a different meaning. An <code>#id</code> selector containing an escaped newline no longer drops the text after it. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3724";>#3724</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3727";>#3727</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>CSS <code>:contains()</code> arguments, custom pseudo-class string arguments, and element names containing a CSS escape, such as <code>p:contains('it\'s')</code> or <code>a\-b</code>, now match. Previously they raised <code>Nokogiri::XML::XPath::SyntaxError</code>. An element name that is not an XML name after unescaping, such as <code>a\!b</code>, raises <code>Nokogiri::CSS::SyntaxError</code>, except as an unprefixed name in an HTML5 document, where it matches by local name. In ids, classes, attribute values, element names and string arguments, an escape for U+0000, a surrogate, or a code point above U+10FFFF now decodes to U+FFFD, and a vertical tab after a hexadecimal escape is no longer dropped, as <a href="https://www.w3.org/TR/css-syntax-3/#consume-escaped-code-point";>CSS Syntax Level 3</a> requires. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3728";>#3728</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3729";>#3729</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>CSS attribute names containing a CSS escape, such as <code>[a\-b]</code>, now match. Previously they raised <code>Nokogiri::XML::XPath::SyntaxError</code>. An unprefixed attribute name that cannot be written as an XPath name test after unescaping, such as <code>[\@click]</code> or <code>[\:class]</code>, matches an attribute with that exact name in no namespace. The HTML parsers create such attributes. A prefixed one, such as <code>[x|a\!b]</code>, raises <code>Nokogiri::CSS::SyntaxError</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3732";>#3732</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3735";>#3735</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] The HTML5 serializer escapes <code><</code> and <code>></code> in attribute values as <code>&lt;</code> and <code>&gt;</code>, following <a href="https://redirect.github.com/whatwg/html/pull/6362";>whatwg/html#6362</a>. Previously they were written literally. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3529";>#3529</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3741";>#3741</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Reparenting removes a node's declaration of a prefix that the new parent binds to the same URI. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3462";>#3462</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Builder now correctly builds namespaced nodes that define their own namespace when that ns prefix collides with one defined by the parent (or another ancestor). (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3458";>#3458</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3461";>#3461</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>Reader.outer_xml</code> and <code>.inner_xml</code> properly capture syntax errors. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3558";>#3558</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XML::SAX::PushParser</code> and <code>HTML4::SAX::PushParser</code> keep parsing correctly after GC compaction relocates their SAX parser. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3665";>#3665</a>) <a href="https://github.com/zanker";><code>@zanker</code></a></li> <li>[CRuby] <code>XML::Reader</code> keeps reading correctly when GC compaction runs. Previously, compaction could move the IO or String the reader was created from, and the reader then crashed or parsed the wrong bytes. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3666";>#3666</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3668";>#3668</a>) <a href="https://github.com/zanker";><code>@zanker</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> calls custom XSLT extension functions correctly when GC compaction runs. Previously, after compaction moved a stylesheet that uses an extension module, a later transform raised an exception or crashed. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3667";>#3667</a>) <a href="https://github.com/jeremy";><code>@jeremy</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> passes the correct params when GC compaction runs while it converts a param with <code>#to_str</code>. Previously, compaction could move the bytes of earlier short params, and the transform raised <code>RuntimeError</code> or silently left a param empty. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3670";>#3670</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XML::SAX::ParserContext.io</code> and <code>HTML4::SAX::ParserContext.io</code> keep parsing correctly after GC compaction relocates the IO. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3669";>#3669</a>) <a href="https://github.com/zanker";><code>@zanker</code></a></li> <li>[CRuby] <code>Document#canonicalize</code> passes the correct inclusive namespace prefixes when it converts a prefix with <code>#to_str</code>, and when GC compaction runs during canonicalization. Previously, libxml2 could read freed or moved memory, and the output lost namespaces or Ruby crashed. Raising on a prefix with a null byte also no longer leaks memory. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3714";>#3714</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3750";>#3750</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> calls custom XSLT extension functions correctly when GC compaction runs during the transform. Previously, compaction could move an extension handler instance, and a later call to one of its functions raised an exception or crashed. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3748";>#3748</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> calls custom XSLT extension functions correctly after an extension function runs another transform with the same stylesheet, or while another thread does. Previously, the inner or concurrent transform released extension handler instances that the other transform still used, and GC could free them. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3748";>#3748</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XML::Reader.from_memory</code> accepts an object that responds to <code>to_str</code>. Previously, it could raise <code>Nokogiri::XML::SyntaxError</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3694";>#3694</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XPathContext#evaluate</code> no longer leaks memory when a custom XPath function handler raises an exception. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3715";>#3715</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/1610";>#1610</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] When a custom XPath function handler raises an exception, <code>XPathContext#evaluate</code> now resets libxml2's error handlers and unregisters the custom function lookup. Previously, libxml2 could keep references to garbage-collected Ruby objects. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3715";>#3715</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby MacOS] Fixed an issue handling SIGINT during HTML5 parsing. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3528";>#3528</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3535";>#3535</a>) <a href="https://github.com/stevecheckoway";><code>@stevecheckoway</code></a></li> <li>[CRuby] gumbo: <code>gumbo_parse_with_options</code> no longer crashes when <code>stop_on_first_error</code> is set and the parse ends on an unknown end tag in a fragment context. This is a C API path; it is not reachable from Ruby, because Nokogiri never sets <code>stop_on_first_error</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3672";>#3672</a>) <a href="https://github.com/jeremy";><code>@jeremy</code></a></li> <li>[JRuby] Fixed multiple issues with <code>Node#namespace_definitions</code> so that it now behaves identically to CRuby. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/2543";>#2543</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3460";>#3460</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] HTML5 fragment parsing raises <code>TypeError</code> when the context node or one of its ancestors is an element whose <code>name</code> returns something other than a <code>String</code>. Previously this could crash the process. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3740";>#3740</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] HTML5 parsing no longer leaks memory when a comment follows <code></body></code> and a <code><frameset></code> start tag follows the comment. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3744";>#3744</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] An XSLT extension function that raises an exception no longer leaks memory or leaves behind a stale libxml2 error handler, which could write into a freed Ruby object. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3718";>#3718</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3721";>#3721</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] When an IO's <code>read</code> raises an exception that is not a <code>StandardError</code>, such as <code>Interrupt</code> or <code>Timeout::ExitException</code>, parsing with <code>XML::Document</code>, <code>HTML4::Document</code> or <code>XML::Reader</code> no longer leaks memory or leaves behind a stale libxml2 error handler. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3718";>#3718</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3721";>#3721</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Nokogiri compiles on 64-bit Windows with Ruby 4.1, which stores String and Array lengths in the new <code>rb_len_t</code> type. Previously compilation failed with an incompatible pointer type error in <code>xml_node_set.c</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3711";>#3711</a>) <a href="https://github.com/larskanis";><code>@larskanis</code></a></li> <li>[CRuby] <code>Node#line=</code> now raises <code>NoMethodError</code> on <code>Document</code>, <code>DTD</code>, <code>Attr</code>, <code>ElementDecl</code>, <code>AttributeDecl</code> and <code>EntityDecl</code>, as <code>#line</code> already does on all of them except <code>Attr</code>. Previously it wrote past the end of the node's memory or overwrote an unrelated field, which could crash the process. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3737";>#3737</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3738";>#3738</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[JRuby] <code>Document#create_element</code> and <code>Node.new</code> no longer set the namespace to the document's default namespace. The namespace must be set explicitly with <code>namespace=</code> or by parenting the node. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3457";>#3457</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3463";>#3463</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md";>nokogiri's changelog</a>.</em></p> <blockquote> <h2>v1.19.5 / 2026-11-01</h2> <h3>Security</h3> <ul> <li>[CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via <code>Node#[]=</code> or <code>Node#lang=</code> while Ruby objects still reference the attribute's children. See <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w";>GHSA-3w22-6jfg-527w</a> for more information.</li> <li>[CRuby] (Low) The HTML5 serializer now escapes text inside <code>noscript</code> unless the document was parsed with <code>parse_noscript_content_as_text: true</code>, preventing a mutation XSS in applications that allow <code>noscript</code> in sanitized HTML. A fragment now parses <code>noscript</code> content the same way as its document, and raises <code>ArgumentError</code> if given a conflicting <code>parse_noscript_content_as_text:</code> value. Comments and raw-text elements inside <code>noscript</code> are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow <code>noscript</code> should parse with <code>parse_noscript_content_as_text: true</code> or remove <code>noscript</code> elements. See <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4";>GHSA-4p39-36wj-23h4</a> for more information.</li> <li>[JRuby] (Low) <code>NONET</code> now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as <code>127.1</code>, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with <code>DTDLOAD</code> or <code>NOENT</code>, potentially enabling SSRF. See <a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm";>GHSA-v995-44v6-5fqm</a> for more information.</li> </ul> <h3>Improved</h3> <ul> <li>[CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3393";>#3393</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Improved XPath argument marshalling performance by using <code>ALLOCV_N</code> instead of <code>rb_gc_register_address</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3648";>#3648</a>) <a href="https://github.com/jhawthorn";><code>@jhawthorn</code></a></li> </ul> <h3>Fixed</h3> <ul> <li><code>Node#namespace=</code> now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from <code>Node#namespace_definitions</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3459";>#3459</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3462";>#3462</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li><code>XML::Reader</code> is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3694";>#3694</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li><code>Node#namespace = false</code> now raises <code>TypeError</code>. Previously it crashed the process on CRuby and raised <code>ClassCastException</code> on JRuby. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3719";>#3719</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li><code>XML::XPathContext.new</code> and <code>XML::XPathContext#node=</code> raise <code>TypeError</code> when the argument is not a <code>Node</code>. Previously, on CRuby, most such arguments crashed the process. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3720";>#3720</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>CSS <code>an+b</code> selectors with a zero or negative step now follow the Selectors spec: <code>:nth-child(0n+3)</code> matches only the third element (previously nothing), <code>0n-1</code> matches nothing instead of raising <code>ZeroDivisionError</code>, and <code>-n+0</code> / <code>-2n</code> match nothing instead of every (or every other) element. <a href="https://github.com/afurm";><code>@afurm</code></a></li> <li>CSS <code>#id</code>, <code>.class</code> and attribute selectors whose value contains a quote character, such as <code>#it\'s</code> or <code>[a=\'b\']</code>, now match that value. Previously they raised <code>Nokogiri::XML::XPath::SyntaxError</code> or generated an XPath query with a different meaning. An <code>#id</code> selector containing an escaped newline no longer drops the text after it. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3724";>#3724</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3727";>#3727</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>CSS <code>:contains()</code> arguments, custom pseudo-class string arguments, and element names containing a CSS escape, such as <code>p:contains('it\'s')</code> or <code>a\-b</code>, now match. Previously they raised <code>Nokogiri::XML::XPath::SyntaxError</code>. An element name that is not an XML name after unescaping, such as <code>a\!b</code>, raises <code>Nokogiri::CSS::SyntaxError</code>, except as an unprefixed name in an HTML5 document, where it matches by local name. In ids, classes, attribute values, element names and string arguments, an escape for U+0000, a surrogate, or a code point above U+10FFFF now decodes to U+FFFD, and a vertical tab after a hexadecimal escape is no longer dropped, as <a href="https://www.w3.org/TR/css-syntax-3/#consume-escaped-code-point";>CSS Syntax Level 3</a> requires. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3728";>#3728</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3729";>#3729</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>CSS attribute names containing a CSS escape, such as <code>[a\-b]</code>, now match. Previously they raised <code>Nokogiri::XML::XPath::SyntaxError</code>. An unprefixed attribute name that cannot be written as an XPath name test after unescaping, such as <code>[\@click]</code> or <code>[\:class]</code>, matches an attribute with that exact name in no namespace. The HTML parsers create such attributes. A prefixed one, such as <code>[x|a\!b]</code>, raises <code>Nokogiri::CSS::SyntaxError</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3732";>#3732</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3735";>#3735</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] The HTML5 serializer escapes <code><</code> and <code>></code> in attribute values as <code>&lt;</code> and <code>&gt;</code>, following <a href="https://redirect.github.com/whatwg/html/pull/6362";>whatwg/html#6362</a>. Previously they were written literally. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3529";>#3529</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3741";>#3741</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Reparenting removes a node's declaration of a prefix that the new parent binds to the same URI. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3462";>#3462</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Builder now correctly builds namespaced nodes that define their own namespace when that ns prefix collides with one defined by the parent (or another ancestor). (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3458";>#3458</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3461";>#3461</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>Reader.outer_xml</code> and <code>.inner_xml</code> properly capture syntax errors. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3558";>#3558</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XML::SAX::PushParser</code> and <code>HTML4::SAX::PushParser</code> keep parsing correctly after GC compaction relocates their SAX parser. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3665";>#3665</a>) <a href="https://github.com/zanker";><code>@zanker</code></a></li> <li>[CRuby] <code>XML::Reader</code> keeps reading correctly when GC compaction runs. Previously, compaction could move the IO or String the reader was created from, and the reader then crashed or parsed the wrong bytes. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3666";>#3666</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3668";>#3668</a>) <a href="https://github.com/zanker";><code>@zanker</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> calls custom XSLT extension functions correctly when GC compaction runs. Previously, after compaction moved a stylesheet that uses an extension module, a later transform raised an exception or crashed. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3667";>#3667</a>) <a href="https://github.com/jeremy";><code>@jeremy</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> passes the correct params when GC compaction runs while it converts a param with <code>#to_str</code>. Previously, compaction could move the bytes of earlier short params, and the transform raised <code>RuntimeError</code> or silently left a param empty. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3670";>#3670</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XML::SAX::ParserContext.io</code> and <code>HTML4::SAX::ParserContext.io</code> keep parsing correctly after GC compaction relocates the IO. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3669";>#3669</a>) <a href="https://github.com/zanker";><code>@zanker</code></a></li> <li>[CRuby] <code>Document#canonicalize</code> passes the correct inclusive namespace prefixes when it converts a prefix with <code>#to_str</code>, and when GC compaction runs during canonicalization. Previously, libxml2 could read freed or moved memory, and the output lost namespaces or Ruby crashed. Raising on a prefix with a null byte also no longer leaks memory. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3714";>#3714</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3750";>#3750</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> calls custom XSLT extension functions correctly when GC compaction runs during the transform. Previously, compaction could move an extension handler instance, and a later call to one of its functions raised an exception or crashed. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3748";>#3748</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XSLT::Stylesheet#transform</code> calls custom XSLT extension functions correctly after an extension function runs another transform with the same stylesheet, or while another thread does. Previously, the inner or concurrent transform released extension handler instances that the other transform still used, and GC could free them. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3748";>#3748</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XML::Reader.from_memory</code> accepts an object that responds to <code>to_str</code>. Previously, it could raise <code>Nokogiri::XML::SyntaxError</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3694";>#3694</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] <code>XPathContext#evaluate</code> no longer leaks memory when a custom XPath function handler raises an exception. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3715";>#3715</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/1610";>#1610</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] When a custom XPath function handler raises an exception, <code>XPathContext#evaluate</code> now resets libxml2's error handlers and unregisters the custom function lookup. Previously, libxml2 could keep references to garbage-collected Ruby objects. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3715";>#3715</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby MacOS] Fixed an issue handling SIGINT during HTML5 parsing. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3528";>#3528</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3535";>#3535</a>) <a href="https://github.com/stevecheckoway";><code>@stevecheckoway</code></a></li> <li>[CRuby] gumbo: <code>gumbo_parse_with_options</code> no longer crashes when <code>stop_on_first_error</code> is set and the parse ends on an unknown end tag in a fragment context. This is a C API path; it is not reachable from Ruby, because Nokogiri never sets <code>stop_on_first_error</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3672";>#3672</a>) <a href="https://github.com/jeremy";><code>@jeremy</code></a></li> <li>[JRuby] Fixed multiple issues with <code>Node#namespace_definitions</code> so that it now behaves identically to CRuby. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/2543";>#2543</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3460";>#3460</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] HTML5 fragment parsing raises <code>TypeError</code> when the context node or one of its ancestors is an element whose <code>name</code> returns something other than a <code>String</code>. Previously this could crash the process. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3740";>#3740</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] HTML5 parsing no longer leaks memory when a comment follows <code></body></code> and a <code><frameset></code> start tag follows the comment. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3744";>#3744</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] An XSLT extension function that raises an exception no longer leaks memory or leaves behind a stale libxml2 error handler, which could write into a freed Ruby object. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3718";>#3718</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3721";>#3721</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] When an IO's <code>read</code> raises an exception that is not a <code>StandardError</code>, such as <code>Interrupt</code> or <code>Timeout::ExitException</code>, parsing with <code>XML::Document</code>, <code>HTML4::Document</code> or <code>XML::Reader</code> no longer leaks memory or leaves behind a stale libxml2 error handler. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3718";>#3718</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3721";>#3721</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[CRuby] Nokogiri compiles on 64-bit Windows with Ruby 4.1, which stores String and Array lengths in the new <code>rb_len_t</code> type. Previously compilation failed with an incompatible pointer type error in <code>xml_node_set.c</code>. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3711";>#3711</a>) <a href="https://github.com/larskanis";><code>@larskanis</code></a></li> <li>[CRuby] <code>Node#line=</code> now raises <code>NoMethodError</code> on <code>Document</code>, <code>DTD</code>, <code>Attr</code>, <code>ElementDecl</code>, <code>AttributeDecl</code> and <code>EntityDecl</code>, as <code>#line</code> already does on all of them except <code>Attr</code>. Previously it wrote past the end of the node's memory or overwrote an unrelated field, which could crash the process. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3737";>#3737</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3738";>#3738</a>) <a href="https://github.com/Priyank-gouda678";><code>@Priyank-gouda678</code></a> <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> <li>[JRuby] <code>Document#create_element</code> and <code>Node.new</code> no longer set the namespace to the document's default namespace. The namespace must be set explicitly with <code>namespace=</code> or by parenting the node. (<a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3457";>#3457</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3463";>#3463</a>) <a href="https://github.com/flavorjones";><code>@flavorjones</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sparklemotion/nokogiri/commit/724ef475332fb7378111e8e30d14eda6cdf33b1e";><code>724ef47</code></a> version bump to v1.19.5</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/60e801b45db07600af74c8a5fde103cf5891fd23";><code>60e801b</code></a> Merge pull request <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3752";>#3752</a> from sparklemotion/card-931-v1-19-5-backport</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/ce1a1382b1c87d7652ee9b59c65be52fd34c1108";><code>ce1a138</code></a> ci: bump ruby/setup-ruby to v1.335.0</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/3254e40df27013d1b402f4a287a70014bbd0fec8";><code>3254e40</code></a> test: skip compaction tests before Ruby 3.3 to fix OOM in Ruby 3.2 CI jobs (#...</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/729d578392a06868ebe96c19fa9e19ced1cbeaa5";><code>729d578</code></a> style(rubocop): Lint/Void in entity reference test</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e62615f96a1ba2a34600e28faed39d338165a8c9";><code>e62615f</code></a> doc: add the v1.19.5 Security CHANGELOG entries</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/97f41b65f4ee0cac859b87f0b26d2648c4806cb8";><code>97f41b6</code></a> fix: JRuby <code>NONET</code> bypass in external entity resolution</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/c6c0bffbdcd194694995acafeeed27326b0805f8";><code>c6c0bff</code></a> fix(html5): escape <code>noscript</code> text when scripting is disabled</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/feaed3c8c9bd9d81d064d4ca09b16044cd705d6f";><code>feaed3c</code></a> fix(CRuby): avoid UAF when replacing an attribute value</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/3ea6023681faaa4a880eb160e915105ecd4da655";><code>3ea6023</code></a> doc: fix up CHANGELOG after cherry-picking <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3393";>#3393</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3460";>#3460</a>, <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3535";>#3535</a> and <a href="https://redirect.github.com/sparklemotion/nokogiri/issues/3648";>#3648</a></li> <li>Additional commits viewable in <a href="https://github.com/sparklemotion/nokogiri/compare/v1.19.4...v1.19.5";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/calcite/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
