dependabot[bot] opened a new pull request, #251: URL: https://github.com/apache/distributedlog/pull/251
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.8.2 to 1.8.5. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md";>nokogiri's changelog</a>.</em></p> <blockquote> <h2>1.8.5 / 2018-10-04</h2> <h3>Security</h3> <p>[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404 and CVE-2018-14567. Full details are available in <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1785";>#1785</a>. Note that these patches are not yet (as of 2018-10-04) in an upstream release of libxml2.</p> <h3>Fixed</h3> <ul> <li>[MRI] Fix regression in installation when building against system libraries, where some systems would not be able to find libxml2 or libxslt when present. (Regression introduced in v1.8.3.) [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1722";>#1722</a>]</li> <li>[JRuby] Fix node reparenting when the destination doc is empty. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1773";>#1773</a>]</li> </ul> <h2>1.8.4 / 2018-07-03</h2> <h3>Fixed</h3> <ul> <li>[MRI] Fix memory leak when creating nodes with namespaces. (Introduced in v1.5.7) [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1771";>#1771</a>]</li> </ul> <h2>1.8.3 / 2018-06-16</h2> <h3>Security</h3> <p>[MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here:</p> <blockquote> <p><a href="https://github.com/GNOME/libxml2/commit/960f0e2";>https://github.com/GNOME/libxml2/commit/960f0e2</a></p> </blockquote> <p>and more information is available about this commit and its impact here:</p> <blockquote> <p><a href="https://github-redirect.dependabot.com/flavorjones/loofah/issues/144";>flavorjones/loofah#144</a></p> </blockquote> <p>This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities.</p> <p>If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here:</p> <blockquote> <p><a href="https://bugzilla.gnome.org/show_bug.cgi?id=769760";>https://bugzilla.gnome.org/show_bug.cgi?id=769760</a></p> </blockquote> <h3>More Security</h3> <p>[MRI] Vendored libxml2 upgraded to v2.9.8 which addresses CVE-2016-9318 [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1582";>#1582</a>].</p> <h3>Dependencies</h3> <ul> <li>[MRI] libxml2 is updated from 2.9.7 to 2.9.8</li> </ul> <h3>Added</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e28fa4bb2ed6844c3c63f58062d034e7b99fc90c";><code>e28fa4b</code></a> version bump to v1.8.5</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/712edef8a8c7fa593e09517891d336758af42cba";><code>712edef</code></a> update changelog</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/7feb4c167a9ae1ba4e87923597ba7e7b309b1713";><code>7feb4c1</code></a> Merge branch 'fix-1773'</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/7cc6cf6a74bd718b46182f0e646b63ff0a00f728";><code>7cc6cf6</code></a> Organize imports in XmlNode.java.</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/169744261c5c023dff40de0811a826ad4d1fcc05";><code>1697442</code></a> Allow reparenting nodes to be a child of an empty document.</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/7b8cd0f5b15a926e92c869b450dd6f71cdd17b61";><code>7b8cd0f</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1786";>#1786</a> from sparklemotion/1785-canonical-usns</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/5bff4bb3f1692069c617f4333b2ccc5570f0f414";><code>5bff4bb</code></a> pull in upstream libxml2 patches</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/c232226448a44bb81220d3750a6453a0aef88fb1";><code>c232226</code></a> changelog</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/862b88f39264b7b5e223a63e3d4d0eeade4db9ff";><code>862b88f</code></a> changelog</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/b3750eb71e101287aa0e7a231232222c7213b3f3";><code>b3750eb</code></a> remove <code>-Wextra</code> CFLAG</li> <li>Additional commits viewable in <a href="https://github.com/sparklemotion/nokogiri/compare/v1.8.2...v1.8.5";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/distributedlog/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
