Skip to content

🚨 [security] Update html-proofer: 3.14.1 → 3.17.0 (minor)#18

Closed
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/html-proofer-3.17.0
Closed

🚨 [security] Update html-proofer: 3.14.1 → 3.17.0 (minor)#18
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/html-proofer-3.17.0

Conversation

@depfu
Copy link
Copy Markdown

@depfu depfu bot commented Nov 21, 2020

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ html-proofer (3.14.1 → 3.17.0) · Repo

Release Notes

3.16.0

  • Add support for before_request: #577

3.15.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 63 commits:

↗️ ffi (indirect, 1.11.2 → 1.13.1) · Repo · Changelog

Release Notes

1.13.1 (from changelog)

Changed:

  • Revert use of ucrtbase.dll as default C library on Windows-MINGW. ucrtbase.dll is still used on MSWIN target. #790
  • Test for ffi_prep_closure_loc() to make sure we can use this function. This fixes incorrect use of system libffi on MacOS Mojave (10.14). #787
  • Update types.conf on x86_64-dragonflybsd

1.13.0 (from changelog)

Added:

  • Add TruffleRuby support. Almost all specs are running on TruffleRuby and succeed. #768
  • Add ruby source files to the java gem. This allows to ship the Ruby library code per platform java gem and add it as a default gem to JRuby. #763
  • Add FFI::Platform::LONG_DOUBLE_SIZE
  • Add bounds checks for writing to an inline char[] . #756
  • Add long double as callback return value. #771
  • Update type definitions and add types from stdint.h and stddef.h on i386-windows, x86_64-windows, x86_64-darwin, x86_64-linux, arm-linux, powerpc-linux. #749
  • Add new type definitions for powerpc-openbsd and sparcv9-openbsd. #775, #778

Changed:

  • Raise required ruby version to >= 2.3.
  • Lots of cleanups and improvements in library, specs and benchmarks.
  • Fix a lot of compiler warnings at the C-extension
  • Fix several install issues on MacOS:
    • Look for libffi in SDK paths, since recent versions of macOS removed it from /usr/include . #757
    • Fix error ld: library not found for -lgcc_s.10.4
    • Don't built for i386 architecture as it is deprecated
  • Several fixes for MSVC build on Windows. #779
  • Use ucrtbase.dll as default C library on Windows instead of old msvcrt.dll. #779
  • Update builtin libffi to fix a Powerpc issue with parameters of type long
  • Allow unmodified sourcing of (the ruby code of) this gem in JRuby and TruffleRuby as a default gem. #747
  • Improve check to detect if a module has a #find_type method suitable for FFI. This fixes compatibility with stdlib mkmf . #776

Removed:

  • Reject callback with :string return type at definition, because it didn't work so far and is not save to use. #751, #782

1.12.2 (from changelog)

  • Fix possible segfault at FFI::Struct#[] and []= after GC.compact . #742

1.12.1 (from changelog)

Added:

  • Add binary gem support for ruby-2.7 on Windows

1.12.0 (from changelog)

Added:

  • FFI::VERSION is defined as part of require 'ffi' now. It is no longer necessary to require 'ffi/version' .

Changed:

  • Update libffi to latest master.

Deprecated:

  • Overwriting struct layouts is now warned and will be disallowed in ffi-2.0. #734, #735

1.11.3 (from changelog)

Removed:

  • Remove support for tainted objects which cause deprecation warnings in ruby-2.7. #730

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.10.5 → 1.10.10) · Repo · Changelog

Security Advisories 🚨

🚨 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.

Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

Release Notes

1.10.10

1.10.10 / 2020-07-06

Features

  • [MRI] Cross-built Windows gems now support Ruby 2.7 [#2029]. Note that prior to this release, the v1.11.x prereleases provided this support.

1.10.9

1.10.9 / 2020-03-01

Fixed

  • [MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [#1985, #2001]
  • [JRuby] Change NodeSet#to_a to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [#1968, #1969] (Thanks, @headius!)

1.10.8

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7

1.10.7 / 2019-12-03

Bug

  • [MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6

1.10.6 / 2019-12-03

Bug

  • [MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @nurse!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ parallel (indirect, 1.19.0 → 1.20.0) · Repo

Commits

See the full diff on Github. The new version differs by 23 commits:

↗️ typhoeus (indirect, 1.3.1 → 1.4.0) · Repo · Changelog

Release Notes

1.4.0 (from changelog)

Full Changelog

1 feature

  • Faraday adapter exceptions namespace compatibility with Faraday v1 (@iMacTia in #616)

3 Others

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

↗️ yell (indirect, 2.2.0 → 2.2.2) · Repo

Sorry, we couldn't find anything useful about this release.

🆕 nokogumbo (added, 2.0.2)

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

  • Circle CI, Semaphore and Travis-CI are all excellent options.
  • If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
  • If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with depfu/.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Nov 21, 2020
@depfu depfu bot requested a review from AnjaPrivat November 21, 2020 21:19
github-learning-lab[bot]
github-learning-lab bot requested changes Nov 21, 2020
View reviewed changes
Copy link
Copy Markdown

@github-learning-lab github-learning-lab bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was expecting your file to be named _posts/0000-01-02-AnjaPrivat.md.

Let's edit this pull request to fix both of these issues.

⌨️ Activity: Fixing your pull request

  1. Click the Files Changed tab in this pull request
  2. Verify that the only file edited is named _posts/0000-01-02-AnjaPrivat.md.
  3. If the file is improperly named, or not in a proper location, use the edit function to correct it.
  4. Above the contents of the file, select all text in the field that contains the filename and delete it.
  5. Continue pressing your backspace key to also delete any directory names that exist.
  6. Type the proper filename: 
    _posts/0000-01-02-AnjaPrivat.md
  7. Scroll to the bottom and enter a commit message and commit in the Commit Changes section.

Note: Can't find the button to edit the file? It may look like a pencil, or it may look like three dots.

If you would like assistance troubleshooting the issue you are encountering, create a post on the GitHub Community board. You might also want to search for your issue to see if other people have resolved it in the past.

I'll respond below when I detect a commit on this branch.

@depfu depfu bot mentioned this pull request Nov 21, 2020
Closed
@depfu
Copy link
Copy Markdown
Author

depfu bot commented Dec 23, 2020

Closed in favor of #19.

@depfu depfu bot closed this Dec 23, 2020
@depfu depfu bot deleted the depfu/update/html-proofer-3.17.0 branch December 23, 2020 19:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-learning-lab github-learning-lab[bot] github-learning-lab[bot] requested changes

@AnjaPrivat AnjaPrivat Awaiting requested review from AnjaPrivat

Assignees

@AnjaPrivat AnjaPrivat

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@AnjaPrivat