Skip to content

chore(deps): bump the dependencies group across 1 directory with 3 updates - #12

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/dependencies-126840432a
Open

chore(deps): bump the dependencies group across 1 directory with 3 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/dependencies-126840432a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the dependencies group with 3 updates in the / directory: nokogiri, html-proofer and rake.

Updates nokogiri from 1.19.0 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem

v1.19.3 / 2026-04-27

Fixed / Security

  • Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
  • [CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.
46b89e5d7b9e844c2ee360794240c6ea2a4e6fa0c5892a4ed487db621224b639  nokogiri-1.19.3-aarch64-linux-gnu.gem
8392dfdcd21be7a94dbbe9ccc138dea01b97b24cb2dc02a114ca98bfb1d9a0b7  nokogiri-1.19.3-aarch64-linux-musl.gem
3919d5ffc334ad778a4a9eb88fda7dcb8b1fb58c8a52ac640c6dcd2f038e774f  nokogiri-1.19.3-arm-linux-gnu.gem
9ce1cb6346bb9c67b1550eb537aa183ead91e4b6eadb2f36ade02d8dd2a79fb6  nokogiri-1.19.3-arm-linux-musl.gem
71b9bd424b1b7abc18b05052a1a3cfd3627abdca62be280854cc411791357e42  nokogiri-1.19.3-arm64-darwin.gem
40ea6ebf5cf2005dae1dee26dd557d3afb41fb6de6c9764aca8cf06fdb841db1  nokogiri-1.19.3-java.gem
8bb7132cad356c879a1286eaabcb5e68326cb2490317984280fbc62f456d506a  nokogiri-1.19.3-x64-mingw-ucrt.gem
</tr></table>

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

v1.19.3 / 2026-04-27

Fixed / Security

  • Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
  • [CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.

v1.19.2 / 2026-03-19

Dependencies

  • [JRuby] Saxon-HE is updated to 12.7, from 9.6.0-4. Saxon-HE is a transitive dependency of nu.validator:jing, and this update addresses CVEs in Saxon-HE's own transitive dependencies JDOM and dom4j. We don't think this warrants a security release, however we're cutting a patch release to help users whose security scanners are flagging this. #3611 @​flavorjones

v1.19.1 / 2026-02-16

Security

Commits
  • 8cfb9da version bump to v1.19.4
  • a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
  • 6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
  • f658a54 fix: JRuby NONET bypass in XML::Schema
  • 39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
  • 04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
  • 7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
  • ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
  • 5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
  • 9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
  • Additional commits viewable in compare view

Updates html-proofer from 5.2.0 to 5.2.3

Release notes

Sourced from html-proofer's releases.

v5.2.3

5.2.3 (2026-10-16)

Bug Fixes

  • Add ruby-json 3 support (de14af9)

Miscellaneous Chores

  • reporter: Escape colons in swapped test URLs (#879)
  • reporter: Avoid live external URLs (#879)
  • Prefix Dependabot commits with a Conventional Commits type (#880)
  • Lint PR titles for Conventional Commits (#880)
  • Run release prep on every push to main (#880)

v5.2.2

What's Changed

Full Changelog: gjtorikian/html-proofer@v5.2.1...v5.2.2

v5.2.1

What's Changed

New Contributors

Full Changelog: gjtorikian/html-proofer@v5.2.0...v5.2.1

Changelog

Sourced from html-proofer's changelog.

5.2.3 (2026-10-16)

Bug Fixes

  • Add ruby-json 3 support (de14af9)

Miscellaneous Chores

  • reporter: Escape colons in swapped test URLs (#879)
  • reporter: Avoid live external URLs (#879)
  • Prefix Dependabot commits with a Conventional Commits type (#880)
  • Lint PR titles for Conventional Commits (#880)
  • Run release prep on every push to main (#880)

[v5.2.2] - 28-07-2026

What's Changed

Full Changelog: gjtorikian/html-proofer@v5.2.1...v5.2.2

[v5.2.1] - 29-03-2026

What's Changed

New Contributors

Full Changelog: gjtorikian/html-proofer@v5.2.0...v5.2.1

Commits
  • 9357d77 [skip test] Release v5.2.3 (#881)
  • de14af9 fix: Add ruby-json 3 support
  • 78d7424 Merge pull request #879 from tsimonq2/json-3
  • a07dfe6 test(reporter): Escape colons in swapped test URLs
  • a096003 test(reporter): Avoid live external URLs
  • b342424 Merge pull request #880 from gjtorikian/ci/conventional-commit-releases
  • 4454ef2 build: Prefix Dependabot commits with a Conventional Commits type
  • f4198fd ci: Lint PR titles for Conventional Commits
  • 9c1b32b ci: Run release prep on every push to main
  • f850b05 Add ruby-json 3 support
  • Additional commits viewable in compare view

Updates rake from 13.3.1 to 13.4.2

Commits
  • 503b8ec v13.4.2
  • 46038e7 Merge pull request #723 from ruby/fix/testopts-preserve-existing-value
  • 604a3d9 Isolate TESTOPTS env in TestRakeTestTask setup/teardown
  • 5886caa Preserve ENV["TESTOPTS"] when verbose is enabled
  • 92193ac v13.4.1
  • b74be0b Merge pull request #721 from ruby/fix/add-options-to-gemspec
  • 829f66d Add lib/rake/options.rb to gemspec
  • 2d55bc4 v13.4.0
  • 1415070 Exclude dependabot updates from release note
  • b3dc948 Merge pull request #713 from pvdb/simplify_standard_system_dir
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels May 27, 2026
@fullstack720dev-gif
fullstack720dev-gif force-pushed the dependabot/bundler/dependencies-126840432a branch from 2a4bf82 to 6f6604a Compare September 27, 2026 04:33
@dependabot dependabot Bot changed the title chore(deps): bump the dependencies group with 3 updates chore(deps): bump the dependencies group across 1 directory with 3 updates Sep 28, 2026
@dependabot
dependabot Bot force-pushed the dependabot/bundler/dependencies-126840432a branch from 6f6604a to 00a51d0 Compare September 28, 2026 14:55
@fullstack720dev-gif
fullstack720dev-gif force-pushed the dependabot/bundler/dependencies-126840432a branch from 00a51d0 to 1945cf7 Compare October 22, 2026 12:06
@dependabot
chore(deps): bump the dependencies group across 1 directory with 3 up…
e366def 
…dates

Bumps the dependencies group with 3 updates in the / directory: [nokogiri](https://github.com/sparklemotion/nokogiri), [html-proofer](https://github.com/gjtorikian/html-proofer) and [rake](https://github.com/ruby/rake).


Updates `nokogiri` from 1.19.0 to 1.19.4
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.0...v1.19.4)

Updates `html-proofer` from 5.2.0 to 5.2.3
- [Release notes](https://github.com/gjtorikian/html-proofer/releases)
- [Changelog](https://github.com/gjtorikian/html-proofer/blob/main/CHANGELOG.md)
- [Commits](gjtorikian/html-proofer@v5.2.0...v5.2.3)

Updates `rake` from 13.3.1 to 13.4.2
- [Release notes](https://github.com/ruby/rake/releases)
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc)
- [Commits](ruby/rake@v13.3.1...v13.4.2)

---
updated-dependencies:
- dependency-name: html-proofer
  dependency-version: 5.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: nokogiri
  dependency-version: 1.19.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: rake
  dependency-version: 13.4.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/dependencies-126840432a branch from 1945cf7 to e366def Compare October 22, 2026 14:53

This branch had an error being deployed

1 failed deployment
Pages Preview — e366def9 Deployed Oct 22, 2026 by dependabot[bot] via build #22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@fullstack720dev-gif