Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.
Sign up🚨 [security] [ruby] Update nokogiri: 1.10.3 → 1.10.4 (patch) #317
+1
−1
Conversation
depfu
bot
added
the
depfu
label
Aug 12, 2019
ruebot
merged commit 4ba1489
into
master
Aug 12, 2019
1 check passed
continuous-integration/travis-ci/pr
The Travis CI build passed
Details
depfu
bot
deleted the
depfu/update/nokogiri-1.10.4
branch
Aug 12, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
depfu bot commentedAug 12, 2019
Advisory: CVE-2019-5477
Disclosed: August 11, 2019
URL: https://github.com/sparklemotion/nokogiri/issues/1915
Nokogiri Command Injection Vulnerability
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
Commits
See the full diff on Github. The new version differs by 9 commits:
version bump to v1.10.4Merge branch '1915-css-tokenizer-load-file-vulnerability_v1.10.x' into v1.10.xupdate CHANGELOGregenerate lexical scanner using rexical 1.0.7eliminate `eval` from Builder#initializerufo formattingrubocop security scan is run as part of the `test` rake targetadd rubocop as a dev dependencyadding a temporary pipeline for v1.10.xDepfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands