brakeman 7.0.2 → 7.1.1

data/bundle/ruby/3.1.0/gems/{haml-5.2.2 → haml-6.4.0}/lib/haml/util.rb

@@ -14,6 +14,24 @@ module Haml
   module Util
     extend self
 
+    begin # Ruby 3.2+ or ERB 4+
+      require 'erb/escape'
+
+      define_singleton_method(:escape_html, ERB::Escape.instance_method(:html_escape))
+    rescue LoadError
+      require 'cgi/escape'
+
+      def self.escape_html(html)
+        CGI.escapeHTML(html.to_s)
+      end
+    end
+
+    # TODO: Remove unescape_interpolation's workaround and get rid of `respond_to?`.
+    def self.escape_html_safe(html)
+      html = html.to_s
+      (html.respond_to?(:html_safe?) && html.html_safe?) ? html : escape_html(html)
+    end
+
     # Silence all output to STDERR within a block.
     #
     # @yield A block in which no output will be printed to STDERR
@@ -35,20 +53,6 @@ module Haml
       false
     end
 
-    # Returns the given text, marked as being HTML-safe.
-    # With older versions of the Rails XSS-safety mechanism,
-    # this destructively modifies the HTML-safety of `text`.
-    #
-    # It only works if you are using ActiveSupport or the parameter `text`
-    # implements the #html_safe method.
-    #
-    # @param text [String, nil]
-    # @return [String, nil] `text`, marked as HTML-safe
-    def html_safe(text)
-      return unless text
-      text.html_safe
-    end
-
     # Checks that the encoding of a string is valid
     # and cleans up potential encoding gotchas like the UTF-8 BOM.
     # If it's not, yields an error string describing the invalid character
@@ -214,7 +218,7 @@ MSG
           end
           content = eval("\"#{interpolated}\"")
           content = "#{char}#{content}" if char == '@' || char == '$'
-          content = "Haml::Helpers.html_escape((#{content}))" if escape_html
+          content = "Haml::Util.escape_html_safe((#{content}).to_s)" if escape_html
 
           res << "\#{#{content}}"
         end

data/bundle/ruby/3.1.0/gems/{haml-5.2.2 → haml-6.4.0}/lib/haml/version.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-
 module Haml
-  VERSION = "5.2.2"
+  VERSION = '6.4.0'
 end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/whitespace.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+module Haml
+  class Whitespace < Temple::Filter
+    def on_whitespace
+      [:static, "\n"]
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+require 'haml/engine'
+require 'haml/error'
+require 'haml/version'
+require 'haml/template'
+
+if File.basename($0) != 'haml'
+  begin
+    require 'rails'
+    require 'haml/railtie'
+  rescue LoadError
+  end
+end

data/bundle/ruby/3.1.0/gems/parallel-1.27.0/lib/parallel/version.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+module Parallel
+  VERSION = Version = '1.27.0' # rubocop:disable Naming/ConstantName
+end

data/bundle/ruby/3.1.0/gems/{parallel-1.26.3 → parallel-1.27.0}/lib/parallel.rb

@@ -255,7 +255,7 @@ module Parallel
 
       if options[:in_processes] && options[:in_threads]
         raise ArgumentError, "Please specify only one of `in_processes` or `in_threads`."
-      elsif RUBY_PLATFORM =~ (/java/) && !(options[:in_processes])
+      elsif RUBY_PLATFORM =~ (/java/) && !options[:in_processes]
         method = :in_threads
         size = options[method] || processor_count
       elsif options[:in_threads]

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/config.rb

@@ -177,6 +177,11 @@ class Reline::Config
     if_stack = []
 
     lines.each_with_index do |line, no|
+      # Even after encoding conversion, we need to verify the encoding is valid
+      # as some invalid byte sequences might pass through the conversion.
+      unless line.valid_encoding?
+        raise InvalidInputrc, "#{file}:#{no + 1}: can't be converted to the locale #{Reline.encoding_system_needs.name}"
+      end
       next if line.match(/\A\s*#/)
 
       no += 1

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/io/ansi.rb

@@ -124,6 +124,10 @@ class Reline::ANSI < Reline::IO
       Reline.core.line_editor.handle_signal
     end
     c = @input.getbyte
+
+    # When "Escape non-ASCII Input with Control-V" is enabled in macOS Terminal.app,
+    # all non-ascii bytes are automatically escaped with `C-v`.
+    # "\xE3\x81\x82" (U+3042) becomes "\x16\xE3\x16\x81\x16\x82".
     (c == 0x16 && @input.tty? && @input.raw(min: 0, time: 0, &:getbyte)) || c
   rescue Errno::EIO
     # Maybe the I/O has been closed.
@@ -180,14 +184,14 @@ class Reline::ANSI < Reline::IO
     s = [ENV["LINES"].to_i, ENV["COLUMNS"].to_i]
     return s if s[0] > 0 && s[1] > 0
     [24, 80]
-  rescue Errno::ENOTTY, Errno::ENODEV
+  rescue SystemCallError
     [24, 80]
   end
 
   def set_screen_size(rows, columns)
     @input.winsize = [rows, columns]
     self
-  rescue Errno::ENOTTY, Errno::ENODEV
+  rescue SystemCallError
     self
   end
 
@@ -295,7 +299,7 @@ class Reline::ANSI < Reline::IO
     # Signal.trap may raise an ArgumentError if the platform doesn't support the signal.
   end
 
-  def read_single_char(keyseq_timeout)
+  def read_single_char(timeout_second)
     # Disable intr to read `C-c` `C-z` `C-\` for quoted insert
     @input.raw(intr: false) do
       super

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/io.rb

@@ -37,10 +37,10 @@ module Reline
     end
 
     # Read a single encoding valid character from the input.
-    def read_single_char(keyseq_timeout)
+    def read_single_char(timeout_second)
       buffer = String.new(encoding: Encoding::ASCII_8BIT)
       loop do
-        timeout = buffer.empty? ? Float::INFINITY : keyseq_timeout
+        timeout = buffer.empty? ? Float::INFINITY : timeout_second
         c = getc(timeout)
         return unless c
 

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/key_actor/emacs.rb

@@ -377,11 +377,11 @@ module Reline::KeyActor
     # 187 M-;
     nil,
     # 188 M-<
-    nil,
+    :beginning_of_history,
     # 189 M-=
     nil,
     # 190 M->
-    nil,
+    :end_of_history,
     # 191 M-?
     nil,
     # 192 M-@

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/line_editor.rb

@@ -470,14 +470,6 @@ class Reline::LineEditor
     end
   end
 
-  def print_nomultiline_prompt
-    Reline::IOGate.disable_auto_linewrap(true) if Reline::IOGate.win?
-    # Readline's test `TestRelineAsReadline#test_readline` requires first output to be prompt, not cursor reset escape sequence.
-    Reline::IOGate.write Reline::Unicode.strip_non_printing_start_end(@prompt) if @prompt && !@is_multiline
-  ensure
-    Reline::IOGate.disable_auto_linewrap(false) if Reline::IOGate.win?
-  end
-
   def render
     wrapped_cursor_x, wrapped_cursor_y = wrapped_cursor_position
     new_lines = wrapped_prompt_and_input_lines.flatten(1)[screen_scroll_top, screen_height].map do |prompt, line|
@@ -1654,6 +1646,16 @@ class Reline::LineEditor
   end
   alias_method :next_history, :ed_next_history
 
+  private def ed_beginning_of_history(key)
+    move_history(0, line: :end, cursor: :end)
+  end
+  alias_method :beginning_of_history, :ed_beginning_of_history
+
+  private def ed_end_of_history(key)
+    move_history(Reline::HISTORY.size, line: :end, cursor: :end)
+  end
+  alias_method :end_of_history, :ed_end_of_history
+
   private def ed_newline(key)
     process_insert(force: true)
     if @is_multiline

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/unicode/east_asian_width.rb

@@ -129,7 +129,7 @@ class Reline::Unicode::EastAsianWidth
     [0x450, 1],
     [0x451, -1],
     [0x482, 1],
-    [0x487, 0],
+    [0x489, 0],
     [0x590, 1],
     [0x5bd, 0],
     [0x5be, 1],
@@ -356,6 +356,7 @@ class Reline::Unicode::EastAsianWidth
     [0x109d, 0],
     [0x10ff, 1],
     [0x115f, 2],
+    [0x11ff, 0],
     [0x135c, 1],
     [0x135f, 0],
     [0x1711, 1],
@@ -411,8 +412,6 @@ class Reline::Unicode::EastAsianWidth
     [0x1a7e, 1],
     [0x1a7f, 0],
     [0x1aaf, 1],
-    [0x1abd, 0],
-    [0x1abe, 1],
     [0x1ace, 0],
     [0x1aff, 1],
     [0x1b03, 0],
@@ -491,10 +490,6 @@ class Reline::Unicode::EastAsianWidth
     [0x20ab, 1],
     [0x20ac, -1],
     [0x20cf, 1],
-    [0x20dc, 0],
-    [0x20e0, 1],
-    [0x20e1, 0],
-    [0x20e4, 1],
     [0x20f0, 0],
     [0x2102, 1],
     [0x2103, -1],
@@ -767,7 +762,7 @@ class Reline::Unicode::EastAsianWidth
     [0xa48f, 1],
     [0xa4c6, 2],
     [0xa66e, 1],
-    [0xa66f, 0],
+    [0xa672, 0],
     [0xa673, 1],
     [0xa67d, 0],
     [0xa69d, 1],
@@ -840,6 +835,10 @@ class Reline::Unicode::EastAsianWidth
     [0xabed, 0],
     [0xabff, 1],
     [0xd7a3, 2],
+    [0xd7af, 1],
+    [0xd7c6, 0],
+    [0xd7ca, 1],
+    [0xd7fb, 0],
     [0xdfff, 1],
     [0xf8ff, -1],
     [0xfaff, 2],

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline/unicode.rb

@@ -72,26 +72,32 @@ class Reline::Unicode
 
   require 'reline/unicode/east_asian_width'
 
+  def self.east_asian_width(ord)
+    chunk_index = EastAsianWidth::CHUNK_LAST.bsearch_index { |o| ord <= o }
+    size = EastAsianWidth::CHUNK_WIDTH[chunk_index]
+    size == -1 ? Reline.ambiguous_width : size
+  end
+
   def self.get_mbchar_width(mbchar)
     ord = mbchar.ord
     if ord <= 0x1F # in EscapedPairs
       return 2
-    elsif ord <= 0x7E # printable ASCII chars
+    elsif mbchar.length == 1 && ord <= 0x7E # printable ASCII chars
       return 1
     end
+
     utf8_mbchar = mbchar.encode(Encoding::UTF_8)
-    ord = utf8_mbchar.ord
-    chunk_index = EastAsianWidth::CHUNK_LAST.bsearch_index { |o| ord <= o }
-    size = EastAsianWidth::CHUNK_WIDTH[chunk_index]
-    if size == -1
-      Reline.ambiguous_width
-    elsif size == 1 && utf8_mbchar.size >= 2
-      second_char_ord = utf8_mbchar[1].ord
-      # Halfwidth Dakuten Handakuten
-      # Only these two character has Letter Modifier category and can be combined in a single grapheme cluster
-      (second_char_ord == 0xFF9E || second_char_ord == 0xFF9F) ? 2 : 1
-    else
-      size
+    zwj = false
+    utf8_mbchar.chars.sum do |c|
+      if zwj
+        zwj = false
+        0
+      elsif c.ord == 0x200D # Zero Width Joiner
+        zwj = true
+        0
+      else
+        east_asian_width(c.ord)
+      end
     end
   end
 
@@ -214,7 +220,7 @@ class Reline::Unicode
           next
         elsif padding && !cover_begin && prev_width < start_col && start_col < total_width
           # Add preceding padding. This padding might have background color.
-          chunk << ' '
+          chunk << ' ' * (total_width - start_col)
           chunk_start_col ||= start_col
           chunk_end_col = total_width
           next
@@ -228,7 +234,7 @@ class Reline::Unicode
           # Current character exceeds end_col
           if padding && end_col < total_width
             # Add succeeding padding. This padding might have background color.
-            chunk << ' '
+            chunk << ' ' * (end_col - prev_width)
             chunk_start_col ||= prev_width
             chunk_end_col = end_col
           end

data/bundle/ruby/3.1.0/gems/reline-0.6.2/lib/reline/version.rb

@@ -0,0 +1,3 @@
+module Reline
+  VERSION = '0.6.2'
+end

data/bundle/ruby/3.1.0/gems/{reline-0.6.1 → reline-0.6.2}/lib/reline.rb

@@ -324,8 +324,6 @@ module Reline
       line_editor.auto_indent_proc = auto_indent_proc
       line_editor.dig_perfect_match_proc = dig_perfect_match_proc
 
-      # Readline calls pre_input_hook just after printing the first prompt.
-      line_editor.print_nomultiline_prompt
       pre_input_hook&.call
 
       unless Reline::IOGate.dumb?
@@ -347,7 +345,8 @@ module Reline
                 # io_gate is Reline::ANSI because the key :bracketed_paste_start is only assigned in Reline::ANSI
                 key = Reline::Key.new(io_gate.read_bracketed_paste, :insert_multiline_text)
               when :quoted_insert, :ed_quoted_insert
-                key = Reline::Key.new(io_gate.read_single_char(config.keyseq_timeout), :insert_raw_char)
+                char = io_gate.read_single_char(config.keyseq_timeout.fdiv(1000))
+                key = Reline::Key.new(char || '', :insert_raw_char)
               end
               line_editor.set_pasting_state(io_gate.in_pasting?)
               line_editor.update(key)

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/NEWS.md

@@ -1,5 +1,149 @@
 # News
 
+## 3.4.4 - 2025-09-10 {#version-3-4-4}
+
+### Improvement
+
+  * Accept `REXML::Document.new("")` for backward compatibility
+    * GH-296
+    * GH-295
+    * Patch by NAITOH Jun
+    * Reported by Joe Rafaniello
+
+### Thanks
+
+  * NAITOH Jun
+
+  * Joe Rafaniello
+
+## 3.4.3 - 2025-09-07 {#version-3-4-3}
+
+### Improvement
+
+  * Reject no root element XML as an invalid XML
+    * GH-289
+    * GH-291
+    * Patch by NAITOH Jun
+    * Reported by Sutou Kouhei
+
+### Fixes
+
+  * Fixed an issue with `IOSource#read_until` when reaching the end of a file
+    * GH-287
+    * GH-288
+    * Patch by NAITOH Jun
+    * Reported by Jason Thomas
+
+### Thanks
+
+  * NAITOH Jun
+
+  * Sutou Kouhei
+
+  * Jason Thomas
+
+## 3.4.2 - 2025-08-26 {#version-3-4-2}
+
+### Improvement
+
+  * Improved performance.
+    * GH-244
+    * GH-245
+    * GH-246
+    * GH-249
+    * GH-256
+    * Patch by NAITOH Jun
+
+  * Raise appropriate exception when failing to match start tag in DOCTYPE
+    * GH-247
+    * Patch by NAITOH Jun
+
+  * Deprecate accepting array as an element in XPath.match, first and each
+    * GH-252
+    * Patch by tomoya ishida
+
+  * Don't call needless encoding_updated
+    * GH-259
+    * Patch by Sutou Kouhei
+
+  * Reuse XPath::match
+    * GH-263
+    * Patch by pboling
+
+  * Cache redundant calls for doctype
+    * GH-264
+    * Patch by pboling
+
+  * Use Safe Navigation (&.) from Ruby 2.3
+    * GH-265
+    * Patch by pboling
+
+  * Remove redundant return statements
+    * GH-266
+    * Patch by pboling
+
+  * Added XML declaration check & Source#skip_spaces method
+    * GH-282
+    * Patch by NAITOH Jun
+    * Reported by Sofi Aberegg
+
+### Fixes
+
+  * Fix docs typo
+    * GH-248
+    * Patch by James Coleman
+
+  * Fix reverse sort in xpath_parser
+    * GH-251
+    * Patch by tomoya ishida
+
+  * Fix duplicate responses in XPath following, following-sibling, preceding, preceding-sibling
+    * GH-255
+    * Patch by NAITOH Jun
+
+  * Fix wrong Encoding resolution
+    * GH-258
+    * Patch by Sutou Kouhei
+
+  * Handle nil when parsing fragment
+    * GH-267
+    * GH-268
+    * Patch by pboling
+
+  * [Documentation] Use # to reference instance methods
+    * GH-269
+    * GH-270
+    * Patch by pboling
+
+  * Fix & Deprecate REXML::Text#text_indent
+    * GH-273
+    * GH-275
+    * Patch by pboling
+
+  * remove bundler from dev deps
+    * GH-276
+    * GH-277
+    * Patch by pboling
+
+  * remove ostruct from dev deps
+    * GH-280
+    * GH-281
+    * Patch by pboling
+
+### Thanks
+
+  * NAITOH Jun
+
+  * tomoya ishida
+
+  * James Coleman
+
+  * pboling
+
+  * Sutou Kouhei
+
+  * Sofi Aberegg
+
 ## 3.4.1 - 2025-02-16 {#version-3-4-1}
 
 ### Improvement
@@ -386,7 +530,7 @@
 
     * Patch by NAITOH Jun.
 
-  * Improved parse performance when an attribute has many `<`s.
+  * Improved parse performance when an attribute has many `>`s.
 
     * GH-126
 

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/attribute.rb

@@ -130,10 +130,7 @@ module REXML
     end
 
     def doctype
-      if @element
-        doc = @element.document
-        doc.doctype if doc
-      end
+      @element&.document&.doctype
     end
 
     # Returns the attribute value, with entities replaced
@@ -173,7 +170,7 @@ module REXML
       @element = element
 
       if @normalized
-        Text.check( @normalized, NEEDS_A_SECOND_CHECK, doctype )
+        Text.check( @normalized, NEEDS_A_SECOND_CHECK )
       end
 
       self
@@ -202,9 +199,11 @@ module REXML
     end
 
     def xpath
-      path = @element.xpath
-      path += "/@#{self.expanded_name}"
-      return path
+      @element.xpath + "/@#{self.expanded_name}"
+    end
+
+    def document
+      @element&.document
     end
   end
 end

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/cdata.rb

@@ -58,7 +58,7 @@ module REXML
     #  c = CData.new( " Some text " )
     #  c.write( $stdout )     #->  <![CDATA[ Some text ]]>
     def write( output=$stdout, indent=-1, transitive=false, ie_hack=false )
-      Kernel.warn( "#{self.class.name}.write is deprecated", uplevel: 1)
+      Kernel.warn( "#{self.class.name}#write is deprecated", uplevel: 1)
       indent( output, indent )
       output << START
       output << @string

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/child.rb

@@ -83,13 +83,12 @@ module REXML
     # Returns:: the document this child belongs to, or nil if this child
     # belongs to no document
     def document
-      return parent.document unless parent.nil?
-      nil
+      parent&.document
     end
 
     # This doesn't yet handle encodings
     def bytes
-      document.encoding
+      document&.encoding
 
       to_s
     end

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/comment.rb

@@ -48,7 +48,7 @@ module REXML
     # ie_hack::
     #    Needed for conformity to the child API, but not used by this class.
     def write( output, indent=-1, transitive=false, ie_hack=false )
-      Kernel.warn("Comment.write is deprecated.  See REXML::Formatters", uplevel: 1)
+      Kernel.warn("#{self.class.name}#write is deprecated.  See REXML::Formatters", uplevel: 1)
       indent( output, indent )
       output << START
       output << @string

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/doctype.rb

@@ -171,15 +171,11 @@ module REXML
     end
 
     def context
-      if @parent
-        @parent.context
-      else
-        nil
-      end
+      @parent&.context
     end
 
     def entity( name )
-      @entities[name].unnormalized if @entities[name]
+      @entities[name]&.unnormalized
     end
 
     def add child
@@ -288,8 +284,7 @@ module REXML
     end
 
     def to_s
-      context = nil
-      context = parent.context if parent
+      context = parent&.context
       notation = "<!NOTATION #{@name}"
       reference_writer = ReferenceWriter.new(@middle, @public, @system, context)
       reference_writer.write(notation)

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/document.rb

@@ -95,7 +95,9 @@ module REXML
       @entity_expansion_text_limit = Security.entity_expansion_text_limit
       super()
       @context = context
-      return if source.nil?
+      # `source = ""` is an invalid usage because no root element XML is an invalid XML.
+      # But we accept `""` for backward compatibility.
+      return if source.nil? or source == ""
       if source.kind_of? Document
         @context = source.context
         super source
@@ -309,8 +311,8 @@ module REXML
     end
 
     # :call-seq:
-    #    doc.write(output=$stdout, indent=-1, transtive=false, ie_hack=false, encoding=nil)
-    #    doc.write(options={:output => $stdout, :indent => -1, :transtive => false, :ie_hack => false, :encoding => nil})
+    #    doc.write(output=$stdout, indent=-1, transitive=false, ie_hack=false, encoding=nil)
+    #    doc.write(options={:output => $stdout, :indent => -1, :transitive => false, :ie_hack => false, :encoding => nil})
     #
     # Write the XML tree out, optionally with indent.  This writes out the
     # entire XML document, including XML declarations, doctype declarations,
@@ -415,7 +417,7 @@ module REXML
     #
     # Deprecated. Use REXML::Security.entity_expansion_limit= instead.
     def Document::entity_expansion_limit
-      return Security.entity_expansion_limit
+      Security.entity_expansion_limit
     end
 
     # Set the entity expansion limit. By default the limit is set to 10240.
@@ -429,7 +431,7 @@ module REXML
     #
     # Deprecated. Use REXML::Security.entity_expansion_text_limit instead.
     def Document::entity_expansion_text_limit
-      return Security.entity_expansion_text_limit
+      Security.entity_expansion_text_limit
     end
 
     attr_reader :entity_expansion_count
@@ -448,6 +450,20 @@ module REXML
     end
 
     private
+
+    attr_accessor :namespaces_cache
+
+    # New document level cache is created and available in this block.
+    # This API is thread unsafe. Users can't change this document in this block.
+    def enable_cache
+      @namespaces_cache = {}
+      begin
+        yield
+      ensure
+        @namespaces_cache = nil
+      end
+    end
+
     def build( source )
       Parsers::TreeParser.new( source, self ).parse
     end