github-markup 5.0.0 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c0a1b208f2db4d8dbe2da7b892e9ab357901f60a4474967ffce14103a57cbea
-  data.tar.gz: a4d1eb586fdcf139731eb53550af3ce1a6bd4216dc44a2b7bd3bb6f69f237ecf
+  metadata.gz: 80586e3bf671eeee5c18bff710b2ecc03475f997ecf46a1c4cffa5c7e6720ebb
+  data.tar.gz: 9d9d0c4e38e73dc26b2ce431646ee985d8669c6de7e78727f2d2c454e082e50d
 SHA512:
-  metadata.gz: 70544a9808c1858e816e37e283ecc2688b9c775b642f609f3cf92eefb4b6c6cdcf91386c1f058c5e13c90afd537aa99caf188f4ed8a78cd657f6ec50159f8d6f
-  data.tar.gz: a101a59c827e06dd5f687a22c5f7fdfe0316d4ff2cfee7d36d13df0b2bfd65669f1340a072013a02e9e120705d31d0bfaf5efe42b6024e127005b6541bb70dce
+  metadata.gz: e624218e7db37c315a3b74cfdeb261f9002123bfbf8f3b61abb538db5163ff01813183552797f5e2ad3f71ef9f5915e683817c3cd91e3fce9fd1bc9a6f106880
+  data.tar.gz: 9cc7b12ec3ab35d565970653f5c37aeae1bf81b4f2531bd3b226e087f54a114fd9417bff5abe72586147113f1bf63194b15e74ef3fca07575635117dea80df10

data/.github/dependabot.yaml

@@ -0,0 +1,28 @@
+---
+version: 2
+updates:
+  - package-ecosystem: 'bundler'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    commit-message:
+      prefix: 'chore(deps)'
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    commit-message:
+      prefix: 'chore(deps)'
+    groups:
+      dependencies:
+        applies-to: version-updates
+        update-types:
+          - 'minor'
+          - 'patch'
+

data/.github/workflows/ci.yml

@@ -4,6 +4,9 @@ on: [push, pull_request]
 env:
   JRUBY_OPTS: -Xcext.enabled=true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "Test / Ruby ${{ matrix.ruby }}"
@@ -11,29 +14,28 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - "3.0"
-          - "3.1"
-          - "3.2"
           - "3.3"
+          - "3.4"
+          - "4.0"
       fail-fast: false
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 10
 
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@c4e5b1316158f92e3d49443a9d58b31d25ac0f8f # v1
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      - uses: actions/setup-python@v2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          # This should match lib/github/markups.rb GitHub::Markups::MARKUP_RST
-          python-version: '3.x'
+          # Required by lib/github/commands/rest2html (RST rendering)
+          python-version: "3.x"
 
-      - uses: actions/cache@v2
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip
@@ -46,11 +48,13 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install perl rakudo-pkg
 
-          curl -L http://cpanmin.us | perl - --sudo App::cpanminus
+          curl -fsSL https://cpanmin.us | perl - --sudo App::cpanminus
           sudo cpanm --installdeps --notest Pod::Simple
 
       - name: Install Python dependencies
-        run: python -m pip install docutils
+        run: |
+          echo 'docutils==0.22.4 --hash=sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de' > /tmp/requirements.txt
+          python -m pip install --require-hashes --no-deps -r /tmp/requirements.txt
 
       - name: Run rake
         run: |

data/.github/workflows/stale.yml

@@ -0,0 +1,27 @@
+name: Mark stale issues and pull requests
+
+on:
+  schedule:
+    - cron: "0 12 * * *"
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+      pull-requests: write
+
+    steps:
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          stale-issue-message: >
+            This issue has been automatically marked as stale because it has not
+            had recent activity. It will be closed if no further activity occurs.
+            Thank you for your contributions.
+          stale-pr-message: >
+            This pull request has been automatically marked as stale because it has not
+            had recent activity. It will be closed if no further activity occurs.
+            Thank you for your contributions.
+          exempt-issue-labels: keep
+          exempt-pr-labels: keep

data/.gitignore

@@ -1,8 +1,10 @@
 *.pyc
 pkg/
 .bundle
-Gemfile.lock
 .project
 .buildpath
 *~
 vendor/
+.DS_Store
+.venv
+venv

data/Gemfile

@@ -1,4 +1,4 @@
-source "http://rubygems.org"
+source "https://rubygems.org"
 gemspec
 
 gem "redcarpet", :platforms => :ruby
@@ -7,11 +7,12 @@ gem "RedCloth"
 # using a tag version here because 0.18.3 was not published by the author to encourage users to upgrade.
 # however we want to bump up to this version since this has a security patch
 gem "commonmarker", git: "https://github.com/gjtorikian/commonmarker.git", tag: "v0.18.3"
-gem "rdoc", "~> 6.7.0"
-gem "org-ruby", "= 0.9.9"
-gem "creole", "~>0.3.6"
+gem "rdoc", "~> 6.13.1"
+gem "org-ruby", "0.9.12"
+gem "creole", "~>0.5.0"
 gem "wikicloth", "=0.8.3"
 gem "twitter-text", "~> 1.14"
-gem "asciidoctor", "~> 2.0.5"
+gem "asciidoctor", "~> 2.0.26"
 gem "rake"
 gem "rexml"
+gem "nokogiri", "~> 1.19"

data/Gemfile.lock

@@ -0,0 +1,141 @@
+GIT
+  remote: https://github.com/gjtorikian/commonmarker.git
+  revision: 2838ebaa83ee0081d481c21f3bc0e4cb3e8de9da
+  tag: v0.18.3
+  specs:
+    commonmarker (0.18.3)
+      ruby-enum (~> 0.5)
+
+PATH
+  remote: .
+  specs:
+    github-markup (6.0.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    RedCloth (4.3.4)
+    activesupport (7.2.3.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
+      minitest (>= 5.1, < 6)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+    asciidoctor (2.0.26)
+    base64 (0.3.0)
+    benchmark (0.5.0)
+    bigdecimal (4.1.0)
+    builder (3.3.0)
+    cgi (0.5.1)
+    charlock_holmes (0.7.9)
+    concurrent-ruby (1.3.6)
+    connection_pool (3.0.2)
+    crass (1.0.6)
+    creole (0.5.0)
+    date (3.4.1)
+    drb (2.2.3)
+    expression_parser (0.9.0)
+    github-linguist (9.3.0)
+      cgi
+      charlock_holmes (~> 0.7.7)
+      mini_mime (~> 1.0)
+      rugged (~> 1.0)
+    html-pipeline (1.11.0)
+      activesupport (>= 2)
+      nokogiri (~> 1.4)
+    htmlentities (4.3.4)
+    i18n (1.14.8)
+      concurrent-ruby (~> 1.0)
+    logger (1.7.0)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
+    minitest (5.27.0)
+    nokogiri (1.19.2)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    nokogiri (1.19.2-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.2-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.2-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.2-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.2-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri-diff (0.3.0)
+      nokogiri (~> 1.5)
+      tdiff (~> 0.4)
+    org-ruby (0.9.12)
+      rubypants (~> 0.2)
+    psych (5.2.3)
+      date
+      stringio
+    racc (1.8.1)
+    rake (13.3.1)
+    rdoc (6.13.1)
+      psych (>= 4.0.0)
+    redcarpet (3.6.1)
+    rexml (3.4.4)
+    ruby-enum (0.9.0)
+      i18n
+    rubypants (0.7.1)
+    rugged (1.9.0)
+    sanitize (6.1.3)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    securerandom (0.4.1)
+    stringio (3.1.6)
+    tdiff (0.4.0)
+    twitter-text (1.14.7)
+      unf (~> 0.1.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.9.1)
+    wikicloth (0.8.3)
+      builder
+      expression_parser
+      htmlentities
+      nokogiri
+      twitter-text
+
+PLATFORMS
+  aarch64-linux
+  arm-linux
+  arm64-darwin
+  x86-linux
+  x86_64-darwin
+  x86_64-linux
+
+DEPENDENCIES
+  RedCloth
+  activesupport (~> 7.2.3)
+  asciidoctor (~> 2.0.26)
+  commonmarker!
+  creole (~> 0.5.0)
+  github-linguist (>= 7.1.3)
+  github-markup!
+  html-pipeline (~> 1.0)
+  kramdown
+  minitest (~> 5.4, >= 5.4.3)
+  nokogiri (~> 1.19)
+  nokogiri-diff (~> 0.3.0)
+  org-ruby (= 0.9.12)
+  rake
+  rdoc (~> 6.13.1)
+  redcarpet
+  rexml
+  sanitize (>= 4.6.3)
+  twitter-text (~> 1.14)
+  wikicloth (= 0.8.3)
+
+BUNDLED WITH
+   2.3.26

data/HISTORY.md

@@ -1,3 +1,40 @@
+## 6.0.0 - 2026-05-04
+
+### Breaking
+
+* Drop support for Ruby < 3.3 (Ruby 3.1 EOL March 2025, Ruby 3.2 EOL March 2026)
+
+### Security
+
+* Use HTTPS for cpanminus download in CI to prevent MITM attacks [#2050](https://github.com/github/markup/pull/2050)
+* Bump nokogiri to >= 1.19.1 to fix GHSA-wx95-c6cv-8532
+* Harden CI pip install with `--require-hashes --no-deps` [#2048](https://github.com/github/markup/pull/2048)
+* Use HTTPS for RubyGems source URL in Gemfile [#1854](https://github.com/github/markup/pull/1854)
+* Add explicit `contents: read` permissions to CI workflow [#1855](https://github.com/github/markup/pull/1855)
+* Bump rexml from 3.3.0 to 3.3.9 (multiple security fixes)
+
+### Bug Fixes
+
+* Fix RST section ID rendering to iterate all anchors instead of only the first [040f91d](https://github.com/github/markup/commit/040f91d)
+
+### Documentation
+
+* Fix spelling errors in codebase [#1479](https://github.com/github/markup/pull/1479)
+* Fix broken Textile language link in README [#1703](https://github.com/github/markup/pull/1703)
+
+### Infrastructure
+
+* Remove legacy Dockerfile and .dockerignore (Ubuntu Trusty, non-functional) [#2048](https://github.com/github/markup/pull/2048)
+* Update CI test matrix: drop Ruby 3.2, add Ruby 4.0 (now testing 3.3, 3.4, 4.0)
+* Bump nokogiri to 1.19.2, activesupport to 7.2.3.1
+* Bump github-linguist from 7.30.0 to 9.1.0, then to 9.3.0
+* Pin all GitHub Actions to commit SHAs for supply chain hardening
+* Add Dependabot configuration for automated dependency updates
+* Various Dependabot bumps for CI actions (ruby/setup-ruby, actions/checkout, actions/cache, actions/setup-python, actions/stale)
+
+## 5.0.1 - 2024-06-17
+* Bump activesupport from 4.0 to 7.1.3.4
+
 ## 5.0.0 - 2024-06-17
 * Drop support for Ruby versions < 3
 * Bump nokogiri from 1.8.1 to 1.16.5

data/README.md

@@ -20,7 +20,7 @@ The following markups are supported.  The dependencies listed are required if
 you wish to run the library. You can also run `script/bootstrap` to fetch them all.
 
 * [.markdown, .mdown, .mkdn, .md](http://daringfireball.net/projects/markdown/) -- `gem install commonmarker` (https://github.com/gjtorikian/commonmarker)
-* [.textile](https://www.promptworks.com/textile) -- `gem install RedCloth` (https://github.com/jgarber/redcloth)
+* [.textile](https://textile-lang.com/) -- `gem install RedCloth` (https://github.com/jgarber/redcloth)
 * [.rdoc](https://ruby.github.io/rdoc/) -- `gem install rdoc -v 3.6.1`
 * [.org](http://orgmode.org/) -- `gem install org-ruby` (https://github.com/wallyqs/org-ruby)
 * [.creole](http://wikicreole.org/) -- `gem install creole` (https://github.com/larsch/creole)
@@ -72,6 +72,15 @@ require 'github/markup'
 GitHub::Markup.render_s(GitHub::Markups::MARKUP_MARKDOWN, "* One\n* Two")
 ```
 
+Local Development
+-----------------
+
+```sh
+python3 -m venv .venv
+source .venv/bin/activate
+cd script
+./bootstrap
+```
 
 Contributing
 ------------

data/github-markup.gemspec

@@ -13,19 +13,19 @@ Gem::Specification.new do |s|
   s.homepage      = "https://github.com/github/markup"
   s.license       = "MIT"
 
-  s.required_ruby_version = '>= 3.0.0'
+  s.required_ruby_version = '>= 3.3.0'
 
   s.files         = `git ls-files`.split($\)
   s.executables   = s.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
   s.test_files    = s.files.grep(%r{^(test|spec|features)/})
   s.require_paths = %w[lib]
 
-  s.add_development_dependency 'rake', '~> 12'
-  s.add_development_dependency 'activesupport', '~> 4.0'
+  s.add_development_dependency 'rake', '~> 13'
+  s.add_development_dependency 'activesupport', '~> 7.2.3'
   s.add_development_dependency 'minitest', '~> 5.4', '>= 5.4.3'
   s.add_development_dependency 'html-pipeline', '~> 1.0'
   s.add_development_dependency 'sanitize', '>= 4.6.3'
-  s.add_development_dependency 'nokogiri', '~> 1.16.5'
+  s.add_development_dependency 'nokogiri', '~> 1.19.2'
   s.add_development_dependency 'nokogiri-diff', '~> 0.3.0'
   s.add_development_dependency "github-linguist", ">= 7.1.3"
 end

data/lib/github/commands/rest2html

@@ -199,8 +199,8 @@ class GitHubHTMLTranslator(HTMLTranslator):
     # see also: http://bit.ly/NHtyRx
     # the a is to support ::contents with ::sectnums: http://git.io/N1yC
     def visit_section(self, node):
-        id_attribute = node.attributes['ids'][0]
-        self.body.append('<a name="%s"></a>\n' % id_attribute)
+        for id_attribute in node.attributes['ids']:
+            self.body.append('<a name="%s"></a>\n' % id_attribute)
         self.section_level += 1
 
     def depart_section(self, node):

data/lib/github-markup.rb

@@ -1,6 +1,6 @@
 module GitHub
   module Markup
-    VERSION = '5.0.0'
+    VERSION = '6.0.0'
     Version = VERSION
   end
 end

data/test/markups/README.org

@@ -58,7 +58,7 @@ end
      - Skipping text before the first headline (option skip:t)
      - Skipping tables (option |:nil)
      - Custom todo keywords
-     - EXPORT_SELECT_TAGS and EXPORT_EXLUDE_TAGS for controlling parts of
+     - EXPORT_SELECT_TAGS and EXPORT_EXCLUDE_TAGS for controlling parts of
        the tree to export
    - Rewrite "file:(blah).org" links to "http:(blah).html" links. This
      makes the inter-links to other org-mode files work.

data/test/markups/README.org.html

@@ -52,7 +52,7 @@ end
       <li>Skipping text before the first headline (option skip:t)</li>
       <li>Skipping tables (option |:nil)</li>
       <li>Custom todo keywords</li>
-      <li>EXPORT_SELECT_TAGS and EXPORT_EXLUDE_TAGS for controlling parts of
+      <li>EXPORT_SELECT_TAGS and EXPORT_EXCLUDE_TAGS for controlling parts of
         the tree to export</li>
     </ul>
   </li>

data/test/markups/README.rst

@@ -8,6 +8,8 @@ Example text.
 
 .. contents:: Table of Contents
 
+.. _label_for_header_2:
+
 Header 2
 --------
 
@@ -17,6 +19,8 @@ Header 2
 
 3. Somé UTF-8°
 
+4. `Link to the above header <label_for_header_2_>`_
+
 The UTF-8 quote character in this table used to cause python to go boom. Now docutils just silently ignores it.
 
 .. csv-table:: Things that are Awesome (on a scale of 1-11)

data/test/markups/README.rst.html

@@ -9,11 +9,13 @@
 </ul>
 </div>
 <a name="header-2"></a>
+<a name="label-for-header-2"></a>
 <h2><a href="#toc-entry-1">Header 2</a></h2>
 <ol>
 <li>Blah blah <code>code</code> blah</li>
 <li>More <code>code</code>, hooray</li>
 <li>Somé UTF-8°</li>
+<li><a href="#label-for-header-2">Link to the above header</a></li>
 </ol>
 <p>The UTF-8 quote character in this table used to cause python to go boom. Now docutils just silently ignores it.</p>
 <table>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: github-markup
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 6.0.0
 platform: ruby
 authors:
 - Chris Wanstrath
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-17 00:00:00.000000000 Z
+date: 2026-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12'
+        version: '13'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12'
+        version: '13'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 7.2.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: 7.2.3
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
@@ -92,14 +92,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.5
+        version: 1.19.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.16.5
+        version: 1.19.2
 - !ruby/object:Gem::Dependency
   name: nokogiri-diff
   requirement: !ruby/object:Gem::Requirement
@@ -137,14 +137,15 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".dockerignore"
+- ".github/dependabot.yaml"
 - ".github/workflows/ci.yml"
+- ".github/workflows/stale.yml"
 - ".gitignore"
 - ".kick"
 - CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
-- Dockerfile
 - Gemfile
+- Gemfile.lock
 - HISTORY.md
 - LICENSE
 - README.md
@@ -215,14 +216,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.0.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: The code GitHub uses to render README.markup

data/.dockerignore

@@ -1 +0,0 @@
-Dockerfile

data/Dockerfile

@@ -1,39 +0,0 @@
-FROM ubuntu:trusty
-
-RUN apt-get update -qq
-RUN apt-get install -y apt-transport-https
-
-RUN apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 379CE192D401AB61
-RUN echo "deb https://dl.bintray.com/nxadm/rakudo-pkg-debs `lsb_release -cs` main" | tee -a /etc/apt/sources.list.d/rakudo-pkg.list
-RUN apt-get update -qq
-
-RUN apt-get install -y \
-    perl rakudo-pkg curl git build-essential python python-pip \
-    libssl-dev libreadline-dev zlib1g-dev \
-    libicu-dev cmake pkg-config
-
-ENV PATH $PATH:/opt/rakudo-pkg/bin
-RUN install-zef-as-user && zef install Pod::To::HTML
-
-RUN curl -L http://cpanmin.us | perl - App::cpanminus
-RUN cpanm --installdeps --notest Pod::Simple
-
-RUN pip install docutils
-
-ENV PATH $PATH:/root/.rbenv/bin:/root/.rbenv/shims
-RUN curl -fsSL https://github.com/rbenv/rbenv-installer/raw/master/bin/rbenv-installer | bash
-RUN rbenv install 2.4.1
-RUN rbenv global 2.4.1
-RUN rbenv rehash
-
-RUN gem install bundler
-
-WORKDIR /data/github-markup
-COPY github-markup.gemspec .
-COPY Gemfile .
-COPY Gemfile.lock .
-COPY lib/github-markup.rb lib/github-markup.rb
-RUN bundle
-
-ENV LC_ALL en_US.UTF-8
-RUN locale-gen en_US.UTF-8