Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package rubygem-nokogiri for openSUSE:Factory checked in at 2026-11-06 19:34:54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/rubygem-nokogiri (Old) and /work/SRC/openSUSE:Factory/.rubygem-nokogiri.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-nokogiri" Fri Nov 6 19:34:54 2026 rev:75 rq:1395479 version:1.19.7 Changes: -------- --- /work/SRC/openSUSE:Factory/rubygem-nokogiri/rubygem-nokogiri.changes 2026-06-30 15:11:38.424399526 +0200 +++ /work/SRC/openSUSE:Factory/.rubygem-nokogiri.new.3759290/rubygem-nokogiri.changes 2026-11-06 19:38:15.458661088 +0100 @@ -1,0 +2,210 @@ +Wed Nov 4 10:36:00 UTC 2026 - Marcus Rueckert <[email protected]> + +- 1.19.7: + - [CRuby] Compile against Ruby 4.1.0-preview1, which defines + `HAVE_RB_LEN_T` but not `RB_FIX2LEN`. (#3755) @andrewfader + For all details see included CHANGELOG.md +- 1.19.6: + - Jruby only change +- 1.19.5 + - Security + - [CRuby] (Low) Fixed a possible use-after-free when an + attribute value is replaced via `Node#[]=` or `Node#lang=` + while Ruby objects still reference the attribute's children. + See GHSA-3w22-6jfg-527w for more information. + - [CRuby] (Low) The HTML5 serializer now escapes text inside + `noscript` unless the document was parsed with + `parse_noscript_content_as_text: true`, preventing a mutation + XSS in applications that allow `noscript` in sanitized HTML. + A fragment now parses `noscript` content the same way as its + document, and raises `ArgumentError` if given a conflicting + `parse_noscript_content_as_text:` value. Comments and + raw-text elements inside `noscript` are still serialized + unchanged, as the HTML standard requires, so applications + that sanitize HTML and allow `noscript` should parse with + `parse_noscript_content_as_text: true` or remove `noscript` + elements. See GHSA-4p39-36wj-23h4 for more information. + - [JRuby] (Low) `NONET` now blocks external DTDs and entities + whose systemId uses a short-form IPv4 host such as `127.1`, + or is an absolute path in a document parsed from a network + URL. Previously Nokogiri fetched them over the network during + a parse with `DTDLOAD` or `NOENT`, potentially enabling SSRF. + See GHSA-v995-44v6-5fqm for more information. + - Improved + - [CRuby] The HTML5 parser now has linear performance when + parsing many attributes. Previously performance was quadratic + due to two hotspots, one in detecting duplicate attributes + and one in constructing the libxml2 data structures. (#3393) + @flavorjones + - [CRuby] Improved XPath argument marshalling performance by + using `ALLOCV_N` instead of `rb_gc_register_address`. (#3648) + @jhawthorn + - Fixed + - `Node#namespace=` now declares the namespace on the node when + no declaration of its prefix is in scope there. Previously, + on CRuby, a node given a namespace and then moved under an + element that binds the same prefix, or the default namespace, + to a different URI was serialized in that other namespace. On + JRuby, the namespace was missing from + `Node#namespace_definitions`. (#3459, #3462) @flavorjones + - `XML::Reader` is no longer affected by changes made to its + source String after the reader is created. Previously, such a + change could make the reader parse the changed String on + JRuby, or changed or freed memory on CRuby with libxml2 < + 2.11. (#3694) @flavorjones + - `Node#namespace = false` now raises `TypeError`. Previously + it crashed the process on CRuby and raised + `ClassCastException` on JRuby. (#3719) @flavorjones + - `XML::XPathContext.new` and `XML::XPathContext#node=` raise + `TypeError` when the argument is not a `Node`. Previously, on + CRuby, most such arguments crashed the process. (#3720) + @flavorjones + - CSS `an+b` selectors with a zero or negative step now follow + the Selectors spec: `:nth-child(0n+3)` matches only the third + element (previously nothing), `0n-1` matches nothing instead + of raising `ZeroDivisionError`, and `-n+0` / `-2n` match + nothing instead of every (or every other) element. @afurm + - CSS `#id`, `.class` and attribute selectors whose value + contains a quote character, such as `#it\'s` or `[a=\'b\']`, + now match that value. Previously they raised + `Nokogiri::XML::XPath::SyntaxError` or generated an XPath + query with a different meaning. An `#id` selector containing + an escaped newline no longer drops the text after it. (#3724, + #3727) @flavorjones + - CSS `:contains()` arguments, custom pseudo-class string + arguments, and element names containing a CSS escape, such as + `p:contains('it\'s')` or `a\-b`, now match. Previously they + raised `Nokogiri::XML::XPath::SyntaxError`. An element name + that is not an XML name after unescaping, such as `a\!b`, + raises `Nokogiri::CSS::SyntaxError`, except as an unprefixed + name in an HTML5 document, where it matches by local name. In + ids, classes, attribute values, element names and string + arguments, an escape for U+0000, a surrogate, or a code point + above U+10FFFF now decodes to U+FFFD, and a vertical tab + after a hexadecimal escape is no longer dropped, as CSS + Syntax Level 3 requires. (#3728, #3729) @flavorjones + - CSS attribute names containing a CSS escape, such as + `[a\-b]`, now match. Previously they raised + `Nokogiri::XML::XPath::SyntaxError`. An unprefixed attribute + name that cannot be written as an XPath name test after + unescaping, such as `[\@click]` or `[\:class]`, matches an + attribute with that exact name in no namespace. The HTML + parsers create such attributes. A prefixed one, such as + `[x|a\!b]`, raises `Nokogiri::CSS::SyntaxError`. (#3732, + #3735) @flavorjones + - [CRuby] The HTML5 serializer escapes `<` and `>` in attribute + values as `<` and `>`, following + [whatwg/html#6362](https://github.com/whatwg/html/pull/6362). + Previously they were written literally. (#3529, #3741) + @flavorjones + - [CRuby] Reparenting removes a node's declaration of a prefix + that the new parent binds to the same URI. (#3462) + @flavorjones + - [CRuby] Builder now correctly builds namespaced nodes that + define their own namespace when that ns prefix collides with + one defined by the parent (or another ancestor). (#3458, + #3461) @flavorjones + - [CRuby] `Reader.outer_xml` and `.inner_xml` properly capture + syntax errors. (#3558) @flavorjones + - [CRuby] `XML::SAX::PushParser` and `HTML4::SAX::PushParser` + keep parsing correctly after GC compaction relocates their + SAX parser. (#3665) @zanker + - [CRuby] `XML::Reader` keeps reading correctly when GC + compaction runs. Previously, compaction could move the IO or + String the reader was created from, and the reader then + crashed or parsed the wrong bytes. (#3666, #3668) @zanker + - [CRuby] `XSLT::Stylesheet#transform` calls custom XSLT + extension functions correctly when GC compaction runs. + Previously, after compaction moved a stylesheet that uses an + extension module, a later transform raised an exception or + crashed. (#3667) @jeremy + - [CRuby] `XSLT::Stylesheet#transform` passes the correct + params when GC compaction runs while it converts a param with + `#to_str`. Previously, compaction could move the bytes of + earlier short params, and the transform raised `RuntimeError` + or silently left a param empty. (#3670) @flavorjones + - [CRuby] `XML::SAX::ParserContext.io` and + `HTML4::SAX::ParserContext.io` keep parsing correctly after + GC compaction relocates the IO. (#3669) @zanker + - [CRuby] `Document#canonicalize` passes the correct inclusive + namespace prefixes when it converts a prefix with `#to_str`, + and when GC compaction runs during canonicalization. + Previously, libxml2 could read freed or moved memory, and the + output lost namespaces or Ruby crashed. Raising on a prefix + with a null byte also no longer leaks memory. (#3714, #3750) + @Priyank-gouda678 @flavorjones + - [CRuby] `XSLT::Stylesheet#transform` calls custom XSLT + extension functions correctly when GC compaction runs during + the transform. Previously, compaction could move an extension + handler instance, and a later call to one of its functions + raised an exception or crashed. (#3748) @flavorjones + - [CRuby] `XSLT::Stylesheet#transform` calls custom XSLT + extension functions correctly after an extension function + runs another transform with the same stylesheet, or while + another thread does. Previously, the inner or concurrent + transform released extension handler instances that the other + transform still used, and GC could free them. (#3748) + @flavorjones + - [CRuby] `XML::Reader.from_memory` accepts an object that + responds to `to_str`. Previously, it could raise + `Nokogiri::XML::SyntaxError`. (#3694) @flavorjones + - [CRuby] `XPathContext#evaluate` no longer leaks memory when a + custom XPath function handler raises an exception. (#3715, + #1610) @flavorjones + - [CRuby] When a custom XPath function handler raises an + exception, `XPathContext#evaluate` now resets libxml2's error + handlers and unregisters the custom function lookup. + Previously, libxml2 could keep references to + garbage-collected Ruby objects. (#3715) @flavorjones + - [CRuby MacOS] Fixed an issue handling SIGINT during HTML5 + parsing. (#3528, #3535) @stevecheckoway + - [CRuby] gumbo: `gumbo_parse_with_options` no longer crashes + when `stop_on_first_error` is set and the parse ends on an + unknown end tag in a fragment context. This is a C API path; + it is not reachable from Ruby, because Nokogiri never sets + `stop_on_first_error`. (#3672) @jeremy + - [JRuby] Fixed multiple issues with + `Node#namespace_definitions` so that it now behaves + identically to CRuby. (#2543, #3460) @flavorjones + - [CRuby] HTML5 fragment parsing raises `TypeError` when the + context node or one of its ancestors is an element whose + `name` returns something other than a `String`. Previously + this could crash the process. (#3740) @flavorjones + - [CRuby] HTML5 parsing no longer leaks memory when a comment + follows `</body>` and a `<frameset>` start tag follows the + comment. (#3744) @flavorjones + - [CRuby] An XSLT extension function that raises an exception + no longer leaks memory or leaves behind a stale libxml2 error + handler, which could write into a freed Ruby object. (#3718, + #3721) @Priyank-gouda678 @flavorjones + - [CRuby] When an IO's `read` raises an exception that is not a + `StandardError`, such as `Interrupt` or + `Timeout::ExitException`, parsing with `XML::Document`, + `HTML4::Document` or `XML::Reader` no longer leaks memory or + leaves behind a stale libxml2 error handler. (#3718, #3721) + @Priyank-gouda678 @flavorjones + - [CRuby] Nokogiri compiles on 64-bit Windows with Ruby 4.1, + which stores String and Array lengths in the new `rb_len_t` + type. Previously compilation failed with an incompatible + pointer type error in `xml_node_set.c`. (#3711) @larskanis + - [CRuby] `Node#line=` now raises `NoMethodError` on + `Document`, `DTD`, `Attr`, `ElementDecl`, `AttributeDecl` and + `EntityDecl`, as `#line` already does on all of them except + `Attr`. Previously it wrote past the end of the node's memory + or overwrote an unrelated field, which could crash the + process. (#3737, #3738) @Priyank-gouda678 @flavorjones + - [JRuby] `Document#create_element` and `Node.new` no longer + set the namespace to the document's default namespace. The + namespace must be set explicitly with `namespace=` or by + parenting the node. (#3457, #3463) @flavorjones + - [JRuby] XPath queries work when Xalan is loaded by a parent + of the JRuby class loader and the thread's context class + loader is that parent, as in a servlet container with Xalan + in `WEB-INF/lib`. Previously they raised + `DTMConfigurationException: No default implementation found`. + Nokogiri also no longer sets the JVM-wide system property + `org.apache.xml.dtm.DTMManager`, which made XSLT + transformations and other Xalan users in the same JVM fail in + that setup. (#3707) @flavorjones + +------------------------------------------------------------------- @@ -467 +677 @@ - The Nokogiri maintainers wish to stress that Nokogiri users were not vulnerable to this CVE, as we explained in [GHSA-qwq9-89rg-ww72](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qwq9-89rg-ww72), and so upgrading is really at the discretion of users. + The Nokogiri maintainers wish to stress that Nokogiri users were not vulnerable to this CVE, as we explained in GHSA-qwq9-89rg-ww72, and so upgrading is really at the discretion of users. @@ -496 +706 @@ -* [CRuby] Vendored libxml2 is updated to address CVE-2023-29469, CVE-2023-28484, and one other security-related issue. See [GHSA-pxvg-2qj5-37jqGHSA-pxvg-2qj5-37jq](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-pxvg-2qj5-37jq) for more information. +* [CRuby] Vendored libxml2 is updated to address CVE-2023-29469, CVE-2023-28484, and one other security-related issue. See GHSA-pxvg-2qj5-37jqGHSA-pxvg-2qj5-37jq for more information. @@ -790 +1000 @@ -* [CRuby] Address CVE-2022-23476, unchecked return value from `xmlTextReaderExpand`. See [GHSA-qv4q-mr5r-qprj](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-qv4q-mr5r-qprj) for more information. +* [CRuby] Address CVE-2022-23476, unchecked return value from `xmlTextReaderExpand`. See GHSA-qv4q-mr5r-qprj for more information. @@ -885 +1095 @@ - * [CRuby] Address [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181), improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See [GHSA-xh29-r2w5-wx8m](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xh29-r2w5-wx8m) for more information. + * [CRuby] Address [CVE-2022-29181](https://nvd.nist.gov/vuln/detail/CVE-2022-29181), improper handling of unexpected data types, related to untrusted inputs to the SAX parsers. See GHSA-xh29-r2w5-wx8m for more information. @@ -897 +1107 @@ - * [CRuby] Vendored libxml2 is updated to address [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824). See [GHSA-cgx6-hpwq-fhv5](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-cgx6-hpwq-fhv5) for more information. + * [CRuby] Vendored libxml2 is updated to address [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824). See GHSA-cgx6-hpwq-fhv5 for more information. @@ -965 +1175 @@ - Please see [GHSA-fq42-c5rg-92c2](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2) for more information about these CVEs. + Please see GHSA-fq42-c5rg-92c2 for more information about these CVEs. @@ -1127 +1337 @@ - [JRuby] Address CVE-2021-41098 ([GHSA-2rr5-8q37-2w7h](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2rr5-8q37-2w7h)). + [JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h. @@ -2579 +2788,0 @@ - Old: ---- nokogiri-1.19.4.gem New: ---- nokogiri-1.19.7.gem ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rubygem-nokogiri.spec ++++++ --- /var/tmp/diff_new_pack.WoM8c2/_old 2026-11-06 19:38:16.876720404 +0100 +++ /var/tmp/diff_new_pack.WoM8c2/_new 2026-11-06 19:38:16.881720614 +0100 @@ -24,7 +24,7 @@ # Name: rubygem-nokogiri -Version: 1.19.4 +Version: 1.19.7 Release: 0 %define mod_name nokogiri %define mod_full_name %{mod_name}-%{version} ++++++ nokogiri-1.19.4.gem -> nokogiri-1.19.7.gem ++++++ ++++ 4465 lines of diff (skipped)
