🚨 [security] Update nokogiri 1.15.6 → 1.16.3 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ nokogiri (1.15.6 → 1.16.3) · Repo · Changelog

Security Advisories 🚨

🚨 Use-after-free in libxml2 via Nokogiri::XML::Reader

Summary

Nokogiri upgrades its dependency libxml2 as follows:

• v1.15.6 upgrades libxml2 to 2.11.7 from 2.11.6
• v1.16.2 upgrades libxml2 to 2.12.5 from 2.12.4

libxml2 v2.11.7 and v2.12.5 address the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062

• described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
• patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970

Please note that this advisory only applies to the CRuby implementation
of Nokogiri, and only if the packaged libraries are being used. If
you've overridden defaults at installation time to use system libraries
instead of packaged libraries, you should instead pay attention to
your distro's libxml2 release announcements.

JRuby users are not affected.

Severity

The Nokogiri maintainers have evaluated this as Moderate.

Impact

From the CVE description, this issue applies to the xmlTextReader
module (which underlies Nokogiri::XML::Reader):

When using the XML Reader interface with DTD validation and
XInclude expansion enabled, processing crafted XML documents
can lead to an xmlValidatePopElement use-after-free.

Mitigation

Upgrade to Nokogiri ~> 1.15.6 or >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more
complicated mitigation: compile and link Nokogiri against patched
external libxml2 libraries which will also address these same issues.

🚨 Improper Handling of Unexpected Data Type in Nokogiri

Summary

Nokogiri v1.16.2 upgrades the version of its dependency libxml2 to v2.12.5.

libxml2 v2.12.5 addresses the following vulnerability:

CVE-2024-25062 / https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-25062
described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/604
patched by https://gitlab.gnome.org/GNOME/libxml2/-/commit/92721970

Please note that this advisory only applies to the CRuby implementation of
Nokogiri < 1.16.2, and only if the packaged libraries are being used. If
you've overridden defaults at installation time to use system libraries
instead of packaged libraries, you should instead pay attention to your
distro's libxml2 release announcements.

Severity

The Nokogiri maintainers have evaluated this as Moderate.

Mitigation

Upgrade to Nokogiri >= 1.16.2.

Users who are unable to upgrade Nokogiri may also choose a more complicated
mitigation: compile and link Nokogiri against external libraries libxml2 >=
2.12.5 which will also address these same issues.

JRuby users are not affected.

Workarounds

Release Notes

1.16.3

v1.16.3 / 2024-03-15

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.6 from v2.12.5. (@flavorjones)

Changed

• [CRuby] XML::Reader sets the @encoding instance variable during reading if it is not passed into the initializer. Previously, it would remain nil. The behavior of Reader#encoding has not changed. This works around changes to how libxml2 reports the encoding used in v2.12.6.

---

sha256 checksums:

3d806263a0548e5163ff256655d78a87998fa83a5ae256b83c14a1a97731e824  nokogiri-1.16.3-aarch64-linux.gem
cfb923c02bde065005e2521f0a6883c63cf305cb899a9dd4c74897731bb2af1d  nokogiri-1.16.3-arm-linux.gem
5d3268558c002fa493e33076798cfda1df8effbd5363060dc41595cfebb1cf90  nokogiri-1.16.3-arm64-darwin.gem
6bf0918233959c7d5e703061ada0f436544612397475a866aa314071f02bfabb  nokogiri-1.16.3-java.gem
656f163dd287671c3a28157a2e853ee1a36afeb3f4185a78af863f3980efc58d  nokogiri-1.16.3-x64-mingw-ucrt.gem
7330f65cf2f8fa442327112b6515b4988f396d23010d33571714fd2ac0648fb9  nokogiri-1.16.3-x64-mingw32.gem
08d8a369940fa2309379cd8af1e7b3cc702b0115d3ddd197cfa7b33daedfd541  nokogiri-1.16.3-x86-linux.gem
cd26e99fa6388cd73c8892bb99ac98af162fe83c8f71c6473dfeba7aac76bcb9  nokogiri-1.16.3-x86-mingw32.gem
bc22786f4db4c32a5587e3b77a106408148d3bb1602dd0b52c0f5c968c42d17d  nokogiri-1.16.3-x86_64-darwin.gem
47a3330e41b49a100225b6fab490b2dc43410931e01e791886e0c2998412e8cb  nokogiri-1.16.3-x86_64-linux.gem
498aa253ccd5b89a0fa5c4c82b346d22176fc865f4a12ef8da642064d1d3e248  nokogiri-1.16.3.gem

1.16.2

v1.16.2 / 2024-02-04

Security

• [CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.5 from v2.12.4. (@flavorjones)

---

sha256 checksums:

69ba15d2a2498324489ed63850997f0b8f684260114ea81116d3082f16551d2d  nokogiri-1.16.2-aarch64-linux.gem
6a05ce42e3587a40cf8936ece0beaa5d32922254215d2e8cf9ad40588bb42e57  nokogiri-1.16.2-arm-linux.gem
c957226c8e36b31be6a3afb8602e2128282bf8b40ea51016c4cd21aa2608d3f8  nokogiri-1.16.2-arm64-darwin.gem
122652bfc338cd8a54a692ac035e245e41fd3b8283299202ca26e7a7d50db310  nokogiri-1.16.2-java.gem
7344b5072ca69fc5bedb61cb01a3b765b93a27aae5a2a845c2ba7200e4345074  nokogiri-1.16.2-x64-mingw-ucrt.gem
a2a5e184a424111a0d5b77947986484920ad708009c667f061e8d02035c562dd  nokogiri-1.16.2-x64-mingw32.gem
833efddeb51a6c2c9f6356295623c2b2e0d50050d468695c59bd929162953323  nokogiri-1.16.2-x86-linux.gem
e67fc0418dffaff9dc8b1dc65f0605282c3fee9488832d0223b620b4319e0b53  nokogiri-1.16.2-x86-mingw32.gem
5def799e5f139f21a79d7cf71172313a7b6fb0e4b2a31ab9bd5d4ad305994539  nokogiri-1.16.2-x86_64-darwin.gem
5b146240ac6ec6c40fd4367623e74442bca45a542bd3282b1d4d18b07b8e5dfe  nokogiri-1.16.2-x86_64-linux.gem
68922ee5cde27497d995c46f2821957bae961947644eed2822d173daf7567f9c  nokogiri-1.16.2.gem

1.16.1

v1.16.1 / 2024-02-03

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.4 from v2.12.3. (@flavorjones)

Fixed

• [CRuby] XML::Reader defaults the encoding to UTF-8 if it's not specified in either the document or as a method parameter. Previously non-ASCII characters were serialized as NCRs in this case. [#2891] (@flavorjones)
• [CRuby] Restored support for compilation by GCC versions earlier than 4.6, which was broken in v1.15.0 (540e9ae). [#3090] (@adfoster-r7)
• [CRuby] Patched upstream libxml2 to allow parsing HTML5 in the context of a namespaced node (e.g., foreign content like MathML). [#3112, #3116] (@flavorjones)
• [CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when the maximum tree depth limit is hit. [#3098, #3100] (@stevecheckoway)

---

sha256 checksums:

a541f35e5b9798a0c97300f9ee18f4217da2a2945a6d5499e4123b9018f9cafc  nokogiri-1.16.1-aarch64-linux.gem
6b82affd195000ab2f9c36cc08744ec2d2fcf6d8da88d59a2db67e83211f7c69  nokogiri-1.16.1-arm-linux.gem
487f0072c154b8a8fd12716f746beee9fb7cea1d62773471bb2951e540f3798a  nokogiri-1.16.1-arm64-darwin.gem
d45378ce34b8d2cfac2428cebb0e21ace4d9c97e76c565ba2e8cec041df02afb  nokogiri-1.16.1-java.gem
d50359f604e650e47365baa8af231b587080ffa7bb84ffca836f34f8c06ae10d  nokogiri-1.16.1-x64-mingw-ucrt.gem
5b656174e77db8f97ee2cc45c4f1476c8262797b577e8fc8abf458beefd4372c  nokogiri-1.16.1-x64-mingw32.gem
c6ba741e41b73a75cdefbf3733101c66a93eb041cab22ba3472a6c548f5b20d7  nokogiri-1.16.1-x86-linux.gem
e37439f5ce9bf91f3797420f8a1e1502ebc3654c3ca4eca80a0b2707235c9326  nokogiri-1.16.1-x86-mingw32.gem
380c94bd8a7fbdee4633db117e5c1ef04cafd35e0dbbdb20eb9224631fe0dc49  nokogiri-1.16.1-x86_64-darwin.gem
cf43557ea7eed0e9f9ed90837a27e1dbfb7fd56d65eb806955965e02231bed3e  nokogiri-1.16.1-x86_64-linux.gem
304db173d8a87afc63f1e1702a671d9eb9e4a30974b297ccca604f6cfd3ed2a7  nokogiri-1.16.1.gem

1.16.0

v1.16.0 / 2023-12-27

Notable Changes

Ruby

This release introduces native gem support for Ruby 3.3.

This release ends support for Ruby 2.7, for which upstream support ended 2023-03-31.

Pattern matching

This version marks official support for the pattern matching API in XML::Attr, XML::Document, XML::DocumentFragment, XML::Namespace, XML::Node, and XML::NodeSet (and their subclasses), originally introduced as an experimental feature in v1.14.0. (@flavorjones)

Documentation on what can be matched:

• XML::Attr#deconstruct_keys
• XML::Document#deconstruct_keys
• XML::Namespace#deconstruct_keys
• XML::Node#deconstruct_keys
• XML::DocumentFragment#deconstruct
• XML::NodeSet#deconstruct

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.12.3 from v2.11.6. (@flavorjones)
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.0
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.1
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.2
  • https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.3

Fixed

• CSS nth pseudo-classes now handle spaces, e.g. "2n + 1". [#3018] (@fusion2004)
• [CRuby] libgumbo no longer leaks memory when an incomplete tag is abandoned by the HTML5 parser. [#3036] (@flavorjones)

Removed

• Removed Nokogiri::HTML5.get which was deprecated in v1.12.0. [#2278] (@flavorjones)
• Removed the CSS-to-XPath utility modules XPathVisitorAlwaysUseBuiltins and XPathVisitorOptimallyUseBuiltins, which were deprecated in v1.13.0 in favor of XPathVisitor constructor args. [#2403] (@flavorjones)
• Removed XML::Reader#attribute_nodes which was deprecated in v1.13.8 in favor of #attribute_hash. [#2598, #2599] (@flavorjones)
• [CRuby] Removed the libxml/libxml2_path key from VersionInfo, used in the past for third-party library integration, in favor of the nokogiri/cppflags and nokogiri/ldflags keys. Please note that third-party library integration is not fully supported and may be deprecated soon, see #2746 for more context. [#2143] (@flavorjones)

Thank you!

The following people and organizations were kind enough to sponsor @flavorjones or the Nokogiri project during the development of v1.16.0:

• Götz Görisch @GoetzGoerisch
• Airbnb @airbnb
• Maxime Gauthier @biximilien
• Renuo AG @renuo
• YOSHIDA Katsuhiko @kyoshidajp
• Homebrew @Homebrew
• Hiroshi SHIBATA @hsbt
• @zzak
• Evil Martians @evilmartians
• Ajaya Agrawalla @ajaya
• Modern Treasury @Modern-Treasury
• Danilo Lessa Bernardineli @danlessa
• matt marques @mestre-dos-magos
• Quan Nguyen @qu8n
• Harry Lascelles @hlascelles
• Oleksandr Tyshchenko @altivi
• Prowly @prowlycom
• Better Stack Community @betterstack-community
• Sentry @getsentry
• Codecov @codecov
• Typesense @typesense
• Roy Boivin II @Yabbo
• Frank Groeneveld @frenkel

We'd also like to thank @github who donate a ton of compute time for our CI pipelines!

---

sha256 checksums:

8cd981dfd4bea4f519ceebb885cf3b422b71c059d841c039d327e73b19247f53  nokogiri-1.16.0-aarch64-linux.gem
c68d861155c40777eee3eb4efbb375d665c8c889cebd5cd1ba32f30a8aac6c21  nokogiri-1.16.0-arm-linux.gem
10c08f246085709790ea628b5fa031cf23dadd843e173711b335ba6287b59d0a  nokogiri-1.16.0-arm64-darwin.gem
f76f2dc353993862d07eccfc5561e373e8058d62e265bae9bcf4f4793c35c9e2  nokogiri-1.16.0-java.gem
5c59792f7f5f8a76e17a87b89b9057544853a6f713b692a75b7f8895a854b74f  nokogiri-1.16.0-x64-mingw-ucrt.gem
286950458a58bdf09bb3a800ac16f0aa361aa9a6c9a63bcd71e98e3c34d314a8  nokogiri-1.16.0-x64-mingw32.gem
159107da8a35f1fc22ee5b78d70da9bda4098a3771a29beac3f727cafd5041cb  nokogiri-1.16.0-x86-linux.gem
27d3d96f53b3fa1da9c4d9d69fffadc34abf7350a8e22be61a7483f15f065438  nokogiri-1.16.0-x86-mingw32.gem
237aa89b9ef6b8e014f197167677926ebc4bdb9cafb2b101399d8001fda4fa43  nokogiri-1.16.0-x86_64-darwin.gem
6f55093bb47e75d412138f4b9462f960d3aad96cb6b43dbe9a3de62c2d31a742  nokogiri-1.16.0-x86_64-linux.gem
341388184e975d091e6e38ce3f3b3388bfb7e4ac3d790efd8e39124844040bd1  nokogiri-1.16.0.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)