Sourced from nokogiri's releases.
1.12.5 / 2021-09-27
Security
[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).
In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.
CRuby users are not affected by this CVE.
Fixed
- [CRuby]
Document#to_xhtmlproperly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g.,<br></br>) instead of a self-closing tag (e.g.,<br/>) in previous Nokogiri versions. [https://github.com/facebook/rocksdb/issues/2324]
SHA256 checksums:
36bfa3a07aced069b3f3c9b39d9fb62cb0728d284d02b079404cd55780beaeff nokogiri-1.12.5-arm64-darwin.gem 16b1a9ddbb70a9c998462912a5972097cbc79c3e01eb373906886ef8a469f589 nokogiri-1.12.5-java.gem 218dcc6edd1b49cc6244b5f88afb978739bb2f3f166c271557fe5f51e4bc713c nokogiri-1.12.5-x64-mingw32.gem e33bb919d64c16d931a5f26dc880969e587d225cfa97e6b56e790fb52179f527 nokogiri-1.12.5-x86-linux.gem e13c2ed011b8346fbd589e96fe3542d763158bc2c7ad0f4f55f6d801afd1d9ff nokogiri-1.12.5-x86-mingw32.gem 1ed64f7db7c1414b87fce28029f2a10128611d2037e0871ba298d00f9a00edd6 nokogiri-1.12.5-x86_64-darwin.gem 0868c8d0a147904d4dedaaa05af5f06656f2d3c67e4432601718559bf69d6cea nokogiri-1.12.5-x86_64-linux.gem 2b20905942acc580697c8c496d0d1672ab617facb9d30d156b3c7676e67902ec nokogiri-1.12.5.gem1.12.4 / 2021-08-29
Notable fix: Namespace inheritance
Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.
This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.
Compensating Feature in XML::Document
This release of Nokogiri introduces a new
Documentboolean attribute,namespace_inheritance, which controls whether children should inherit a namespace when they are reparented.Nokogiri::XML:Documentdefaults this attribute tofalsemeaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.CRuby users who desire the pre-v1.12.0 behavior may set
document.namespace_inheritance = truebefore reparenting nodes.See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.
Fix for XML::Builder
... (truncated)
Sourced from nokogiri's changelog.
1.12.5 / 2021-09-27
Security
[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).
In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.
CRuby users are not affected by this CVE.
Fixed
- [CRuby]
Document#to_xhtmlproperly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g.,<br></br>) instead of a self-closing tag (e.g.,<br/>) in previous Nokogiri versions. [https://github.com/facebook/rocksdb/issues/2324]1.12.4 / 2021-08-29
Notable fix: Namespace inheritance
Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.
This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.
Compensating Feature in XML::Document
This release of Nokogiri introduces a new
Documentboolean attribute,namespace_inheritance, which controls whether children should inherit a namespace when they are reparented.Nokogiri::XML:Documentdefaults this attribute tofalsemeaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.CRuby users who desire the pre-v1.12.0 behavior may set
document.namespace_inheritance = truebefore reparenting nodes.See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.
Fix for XML::Builder
However, recognizing that we want
Builder-created children to inherit namespaces, Builder now will setnamespace_inheritance=trueon the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored.Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so:
Nokogiri::XML::Builder.new(namespace_inheritance: false)See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage.
Downstream gem maintainers
Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance:
... (truncated)
47f6a46 version bump to v1.12.52a0ac88 update CHANGELOG6b60637 Merge pull request https://github.com/facebook/rocksdb/issues/2329 from sparklemotion/flavorjones-GHSA-2rr5-8q37-2w7h_1...4bd943c fix(jruby): SAX parser uses an entity resolverf943ee4 refactor(jruby): handle errors more consistently2790122 format: test files01e1618 Merge pull request https://github.com/facebook/rocksdb/issues/2327 from sparklemotion/2324-xhtml-self-closing-tags_v1.12.xa0180c7 fix: HTML4::Document.to_xhtml self-closing tags564ac17 release v1.12.44d5754b backport https://github.com/facebook/rocksdb/issues/2320