leptris 1.9.367.1 → 1.9.368.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d93690616a6a4e8afb445f405bef0c2c2de88d33565601c05de186f41556156
-  data.tar.gz: 807688720d8e8b653bcc41428e2a78afbf1a678609bd9d84fba91f5845678778
+  metadata.gz: 30686ca983cb245b5c714d377fcfc15564120e9a9d07b214404d421ecc061ad6
+  data.tar.gz: 9533b2b213a8223e0e44ac82869859e9db9d9459e61531679cf8e9f27f1e6eaf
 SHA512:
-  metadata.gz: e47a9852816fd941095e25717b305e0c892ebd60b502db6aaab5e085a6aa5473ce4848fdaf8fd1f80835284ae603685dbaa169bd4cd0e165e42537f32e21cc47
-  data.tar.gz: dd01a8479f4853bda4cc63c24fb048fe2614fc2d463eb03663dc6b3cfbabff0d1a57cdb85e413d2901bb260db73c02338db73eeb9eaef0649697667b8ee7f4c4
+  metadata.gz: 2aac2d092f0d80717257a49e7cdbee6607ce52759c9d711d48704320ca52a0b6b6ea3e536cc115d86631669d81072e9da6e50ee568fc9c41686e5e1fbb32be53
+  data.tar.gz: d260eb007e6a21cc5fc7f295b3707c49012576397688fa929e630eb9a8fe7e14664ae05da4971ed951f718077699faed8b9bef841e5c61e7d45752a338921aac

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.367"
+LIBLEPTRIS_VERSION = "1.9.368"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.367.1"
+  VERSION = "1.9.368.1"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.367
+- libleptris v1.9.368
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,28 @@
 ## [Unreleased]
 
+## [1.9.368] - 2026-10-18
+
+### Fixed
+
+- **dom: `leptris_element_get_document` is kind-safe (#487, PR #1763).**
+  The addr-based attach face called get_document on the RAW child before
+  any kind routing. For the TEXT nodes a hydration loop appends,
+  get_document read element-form fields — the namebp fast-outs and
+  element parent offsets. A live inline text usually survived the
+  misread; a recycled or heap-backed text handed the walk a wild pointer
+  and the process died: the **Ruby 4.0 + darwin Bus error at
+  element.rb:809** in the lutaml/moxml DOCX hydration suite
+  (leptris-ruby#487) — deterministic across randomized runs, with
+  Ruby 3.3/3.4 and 4.0-ubuntu clean on identical code (GC timing, not
+  semantics). Non-element nodes now route through the per-struct
+  `owner_doc` read (the same authority adopt_for_splice's #1534 kind
+  routing uses); NULL answers for unstamped detached leaves stay part of
+  the contract. Verified on Ruby 4.0.5 darwin with the reporter's
+  harness: the uniword DOCX suite runs 385/385 plain AND under
+  RUBY_GC_STRESS (deterministic SIGSEGV before). Engine suite
+  2036/2036 with a new kind-safety contract test.
+
+
 ## [1.9.367] - 2026-10-17
 
 ### Fixed

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.367
+    VERSION 1.9.368
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/TODO.xslt-full/README.md

@@ -16,8 +16,13 @@ Rules (per repo conventions):
   (benchmarks/xslt/*) — conformance may not cost the lead. A fix
   that regresses a benchmark by >3% needs an algorithmic answer.
 
-Live census (157 open, by failure signature; refresh with the
-triage script in 00):
+**GATE MET (verified 2026-10-17, main @ 75cd5f6e):**
+libxslt suite **205/205** (open_cases.txt empty; macOS legitimately
+skips bug-169 — encoding-sensitive via iconv, Linux CI is
+authoritative), XsltFull **27/27** (the suite carries 27 cases; the
+historical 45 count predates the case consolidation), full suite
+**2053/2053** locally. The census below is the campaign-start
+snapshot, kept for the record:
 - 84 PI/COMMENT-OUT — fragment-node serialization + content edges
 - 28 EMPTY — root-node `/` semantics, doc() chains, early exits
 - 24 DIFF — number corners, attr-set precedence, sort, AVT edges

data/vendor-src/libleptris/src/leptris/dom/element.h

@@ -501,6 +501,12 @@ int leptris_elem_pos_lookup(const struct leptris_document* doc,
                             uint32_t* start_tag_end, uint32_t* element_end);
 
 struct leptris_document* leptris_element_get_document(LeptrisElement elem);
+
+/* #487: the KIND-SAFE document resolver for non-element nodes
+ * (text/cdata/comment/pi) — reads each struct's own owner_doc
+ * field instead of element-form views. get_document routes
+ * non-elements here; element callers keep the element path. */
+struct leptris_document* leptris_leaf_owner_doc(LeptrisNode* n);
 LeptrisMemoryPool* leptris_element_get_pool(LeptrisElement elem);
 
 /* Round 21: header.flags bit 6 — "elem->name is preceded by 8 bytes

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -299,7 +299,7 @@ static int node_in_current_mut_block(struct leptris_document* doc,
  * #1320-family doc stamps: text an int32 offset, cdata/comment/pi
  * a direct pointer. Unstamped = the #540 same-doc detached-chain
  * contract (public creators stamp; hand-built chains don't). */
-static struct leptris_document* leaf_owner_doc(LeptrisNode* n) {
+struct leptris_document* leptris_leaf_owner_doc(LeptrisNode* n) {
     switch (n->type) {
         case LEPTRIS_NODE_TYPE_TEXT:
             return leptris_textnode_owner_doc((LeptrisTextNode*)n);
@@ -390,7 +390,7 @@ static LeptrisNode* adopt_for_splice(LeptrisNode* node,
             src = leptris_element_get_document(
                 (LeptrisElement)top);
         } else {
-            src = leaf_owner_doc(top);
+            src = leptris_leaf_owner_doc(top);
         }
         if (!src || src == target) return node;
         /* #1548: the source is a doomed scratch doc absorbed into

data/vendor-src/libleptris/src/leptris/dom/root_doc_map.c

@@ -400,6 +400,14 @@ LeptrisElement leptris_root_doc_memo_root_for_tests(void) {
 
 struct leptris_document* leptris_element_get_document(LeptrisElement elem) {
     if (!elem) return NULL;
+    /* #487: a non-element node must never read element-form fields
+     * (the namebp fast-outs and element parent offsets below) — a
+     * recycled or heap-backed text handed the walk a wild pointer
+     * and the process died. Route through the kind-safe owner
+     * read; NULL answers are part of the contract (unstamped
+     * detached leaves). */
+    if (((LeptrisNodeRef)elem)->type != LEPTRIS_NODE_TYPE_ELEMENT)
+        return leptris_leaf_owner_doc((LeptrisNode*)elem);
     /* Lane 18 R3: an UNATTACHED namebp-carrying element roots
      * itself in the name slot (#1189) — that slot is its
      * authoritative document and must never see the recyclable-

data/vendor-src/libleptris/test/CMakeLists.txt

@@ -260,16 +260,18 @@ if(Python3_FOUND)
         ENVIRONMENT "PYTHONPATH=")
 endif()
 
-# libFuzzer harness (TODO 40) — built only when LEPTRIS_ENABLE_FUZZING=ON.
-# Not a ctest target; invoked manually with corpus.
+# libFuzzer harnesses — built only when LEPTRIS_ENABLE_FUZZING=ON.
+# Not ctest targets; invoked manually with a corpus (or by the
+# nightly fuzz workflow, which invokes them at the build root —
+# subdirectory targets land under build/test/ by default).
 if(LEPTRIS_ENABLE_FUZZING)
-    add_executable(fuzz_parse ${CMAKE_CURRENT_SOURCE_DIR}/fuzz/fuzz_parse.c)
-    target_link_libraries(fuzz_parse PRIVATE leptris)
-    target_include_directories(fuzz_parse PRIVATE
-        ${PROJECT_SOURCE_DIR}/src/include)
-    # The harness doc and the nightly workflow invoke the binary at
-    # the build root, not under build/test/ where subdirectory
-    # targets land by default.
-    set_target_properties(fuzz_parse PROPERTIES
-        RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})
+    foreach(target fuzz_parse fuzz_mutate fuzz_xpath)
+        add_executable(${target}
+            ${CMAKE_CURRENT_SOURCE_DIR}/fuzz/${target}.c)
+        target_link_libraries(${target} PRIVATE leptris)
+        target_include_directories(${target} PRIVATE
+            ${PROJECT_SOURCE_DIR}/src/include)
+        set_target_properties(${target} PROPERTIES
+            RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})
+    endforeach()
 endif()

data/vendor-src/libleptris/test/dom/test_dom.cpp

@@ -3071,6 +3071,42 @@ TEST(DomAttachInstalled, ForeignMixedChainTextBeforeElement) {
     leptris_document_free(target);
 }
 
+/* leptris-ruby#487: the addr-based attach face ran
+ * leptris_element_get_document on the RAW child before any kind
+ * routing — for a TEXT child that reads element-form fields
+ * (namebp fast-outs, element parent offsets). A live inline text
+ * usually survives the misread; a recycled or heap-backed text
+ * hands the walk a wild pointer and the process dies. The face (and
+ * get_document itself) must be kind-safe. */
+TEST(DomAttachInstalled, TextChildAttachIsKindSafe) {
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);
+    ASSERT_NE(d, nullptr);
+    LeptrisElement root = leptris_document_root(d);
+
+    /* detached text via the public face — a non-element child */
+    LeptrisNodeRef text =
+        leptris_text_node_create(d, "hello");
+    ASSERT_NE(text, nullptr);
+    EXPECT_EQ(leptris_node_get_type(text), LEPTRIS_NODE_TYPE_TEXT);
+
+    /* get_document on the text must not crash and must not
+     * manufacture a bogus document pointer */
+    LeptrisDocument tdoc = leptris_element_get_document(
+        (LeptrisElement)text);
+    EXPECT_TRUE(tdoc == d || tdoc == nullptr);
+
+    /* the attach face with the text child must succeed */
+    EXPECT_EQ(leptris_element_add_child_addr_installed(
+                  (uintptr_t)root, (uintptr_t)text, NULL),
+              LEPTRIS_OK);
+    char* out = leptris_element_serialize(root, nullptr);
+    ASSERT_NE(out, nullptr);
+    EXPECT_STREQ(out, "<r>hello</r>");
+    leptris_free_string(out);
+    leptris_document_free(d);
+}
+
 TEST(DomAttachInstalled, SameDocumentReturnsArgument) {
     LeptrisStatus st = LEPTRIS_OK;
     LeptrisDocument d = leptris_parse_string("<r/>", 4, &st);

data/vendor-src/libleptris/test/fuzz/fuzz_mutate.c

@@ -0,0 +1,146 @@
+/* test/fuzz/fuzz_mutate.c — libFuzzer harness for the MUTATION API
+ * (approach ported from teptris's op-driven fuzz_dump): the input
+ * bytes drive a deterministic builder/mutation sequence — element
+ * creation, attribute and text edits, append/insert/remove, and
+ * cross-document adoption — against three documents (a RECOVER
+ * parse, a second parse, and a fresh programmatic one), then the
+ * final trees serialize and re-parse. Invariants under ASan/UBSan:
+ * no crash, no leak, every op result consumed; status errors from
+ * rejected ops (cycles, foreign shapes) are fine — that IS the
+ * contract. The mutation faces are where the adopt/copy and
+ * sibling-chain bug classes lived (#1755, #1717, #1636). */
+#include "leptris.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static const char* const kNames[] = {
+    "a", "b", "r", "item", "p", "x"};
+#define MUT_ALPHA 6
+
+static const char* name_at(const uint8_t* d, size_t sz, size_t i) {
+    return sz ? kNames[d[i % sz] % MUT_ALPHA] : kNames[0];
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (size < 4 || size > (1u << 20)) return 0;
+
+    /* First half: markup for two documents. Second half: ops. */
+    size_t cut = 1 + (size % (size / 2 ? size / 2 : 1));
+    if (cut >= size) cut = size / 2;
+    const uint8_t* ops = data + cut;
+    size_t nops = size - cut;
+    if (nops > 256) nops = 256;
+
+    LeptrisParseOptions opts;
+    memset(&opts, 0, sizeof(opts));
+    opts.recover = 1;
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc =
+        leptris_parse_string_ex((const char*)data, cut, &opts, &st);
+    if (!doc) return 0;
+    LeptrisDocument doc2 = leptris_parse_string_ex(
+        (const char*)data + cut, nops, &opts, &st);
+    if (!doc2) {
+        leptris_document_free(doc);
+        return 0;
+    }
+    LeptrisDocument fresh = leptris_document_create();
+
+    /* A stable pool of nodes to point ops at: the docs' roots, the
+     * fresh doc's created children, and a few created elements. */
+    enum { POOL = 8 };
+    LeptrisElement pool[POOL] = {0};
+    LeptrisElement root = leptris_document_root(doc);
+    LeptrisElement root2 = leptris_document_root(doc2);
+    if (root) pool[0] = root;
+    if (root2) pool[1] = root2;
+    if (root)
+        for (int i = 2, j = 0; i < POOL && j < 3; j++) {
+            LeptrisElement c = leptris_element_create(fresh, "c");
+            if (!c) break;
+            pool[i++] = c;
+        }
+
+    for (size_t k = 0; k + 1 < nops; k += 2) {
+        unsigned op = ops[k] % 10u;
+        LeptrisElement tgt = pool[ops[k + 1] % POOL];
+        if (!tgt) continue;
+        const char* name = name_at(data, size, k);
+        switch (op) {
+            case 0: {
+                LeptrisElement e = leptris_element_create(doc, name);
+                if (e) (void)leptris_element_append_child(tgt, e);
+                break;
+            }
+            case 1: {
+                /* cross-document adopt-by-copy (#1528/#1755) */
+                LeptrisElement e =
+                    leptris_element_create(doc2, name);
+                if (e) (void)leptris_element_append_child(tgt, e);
+                break;
+            }
+            case 2:
+                (void)leptris_element_set_text(tgt, name);
+                break;
+            case 3:
+                (void)leptris_element_set_attribute(tgt, name, "v");
+                break;
+            case 4:
+                (void)leptris_element_remove_attribute(tgt, name);
+                break;
+            case 5: {
+                LeptrisElement kid =
+                    leptris_element_first_child_any(tgt);
+                if (kid)
+                    (void)leptris_element_remove_child(tgt, kid);
+                break;
+            }
+            case 6:
+                (void)leptris_element_remove_children(tgt);
+                break;
+            case 7: {
+                /* insert_before with a fresh sibling of the target's
+                 * parent (cycle rejection walks the parent chain) */
+                LeptrisElement p = leptris_element_parent(tgt);
+                if (p) {
+                    LeptrisElement e =
+                        leptris_element_create(doc, name);
+                    if (e) (void)leptris_element_insert_before(
+                            tgt, e);
+                }
+                break;
+            }
+            case 8: {
+                char* out = leptris_document_serialize(doc, NULL);
+                if (out) leptris_free_string(out);
+                break;
+            }
+            default: {
+                LeptrisXPathResult r =
+                    leptris_xpath_eval(doc, NULL, "//node()");
+                if (r) leptris_xpath_result_free(r);
+                break;
+            }
+        }
+    }
+
+    /* Final trees must serialize and re-parse without incident. */
+    LeptrisDocument docs[3] = {doc, doc2, fresh};
+    for (int i = 0; i < 3; i++) {
+        char* out = leptris_document_serialize(docs[i], NULL);
+        if (out) {
+            LeptrisParseOptions back_opts;
+            memset(&back_opts, 0, sizeof(back_opts));
+            back_opts.recover = 1;
+            LeptrisStatus st2 = LEPTRIS_OK;
+            LeptrisDocument back = leptris_parse_string_ex(
+                out, strlen(out), &back_opts, &st2);
+            if (back) leptris_document_free(back);
+            leptris_free_string(out);
+        }
+        leptris_document_free(docs[i]);
+    }
+    return 0;
+}

data/vendor-src/libleptris/test/fuzz/fuzz_parse.c

@@ -1,40 +1,49 @@
-/* test/fuzz/fuzz_parse.c — libFuzzer harness for leptris_parse_string.
- *
- * Run:
- *   cmake -B build -S . -DLEPTRIS_ENABLE_FUZZING=ON
- *   cmake --build build --target fuzz_parse
- *   mkdir -p corpus && cp test/fixtures/*.xml corpus/
- *   ./build/fuzz_parse -max_total_time=600 corpus/
- *
- * Crashes are written to crash-*; add them as regression tests.
- *
- * See TODO 40.
- */
-
+/* test/fuzz/fuzz_parse.c — libFuzzer harness for the parse surface
+ * (approach ported from teptris test/fuzz): parse -> serialize ->
+ * re-parse, under both the default and the RECOVER parse mode. The
+ * invariants under fuzz are the memory-safety contracts (no crash
+ * under ASan/UBSan, no leak — every parse path frees or transfers
+ * its document), not semantic correctness — the conformance suites
+ * own that. The serialize output is engine-owned memory; re-parsing
+ * it exercises the serializer's guarantee that its bytes parse
+ * back. */
 #include "leptris.h"
 
 #include <stdint.h>
 #include <stdlib.h>
+#include <string.h>
 
-int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-    /* Avoid pathological inputs that immediately exceed the depth limit
-     * (already covered by tests).  Cap input size for speed. */
-    if (size > 1024 * 1024) return 0;
+static void round_trip(const char* data, size_t size, int recover) {
+    LeptrisParseOptions opts;
+    memset(&opts, 0, sizeof(opts));
+    opts.recover = recover;
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc = leptris_parse_string_ex(data, size, &opts, &st);
+    if (st != LEPTRIS_OK && doc == NULL) return;
 
-    LeptrisStatus st;
-    LeptrisDocument doc = leptris_parse_string((const char*)data, size, &st);
+    /* exercise XPath against whatever tree came back */
+    LeptrisXPathResult r = leptris_xpath_eval(doc, NULL, "//node()");
+    if (r) leptris_xpath_result_free(r);
 
-    if (doc) {
-        /* Exercise serialize + free to catch use-after-free in cleanup. */
-        char* out = leptris_document_serialize(doc, NULL);
-        if (out) leptris_free_string(out);
+    char* out = leptris_document_serialize(doc, NULL);
+    if (out) {
+        LeptrisParseOptions opts2;
+        memset(&opts2, 0, sizeof(opts2));
+        opts2.recover = recover;
+        LeptrisStatus st2 = LEPTRIS_OK;
+        LeptrisDocument doc2 = leptris_parse_string_ex(
+            out, strlen(out), &opts2, &st2);
+        if (doc2) leptris_document_free(doc2);
+        leptris_free_string(out);
+    }
+    leptris_document_free(doc);
+}
 
-        /* Also exercise XPath on the parsed document — catches bugs
-         * in the evaluator's interaction with the DOM. */
-        LeptrisXPathResult r = leptris_xpath_eval(doc, NULL, "//node()");
-        if (r) leptris_xpath_result_free(r);
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    /* Cap input size for speed; the depth cap is tested elsewhere. */
+    if (size == 0 || size > (1u << 20)) return 0;
 
-        leptris_document_free(doc);
-    }
+    round_trip((const char*)data, size, 0);
+    round_trip((const char*)data, size, 1);
     return 0;
 }

data/vendor-src/libleptris/test/fuzz/fuzz_xpath.c

@@ -0,0 +1,67 @@
+/* test/fuzz/fuzz_xpath.c — libFuzzer harness for the XPath evaluator
+ * (approach ported from teptris's fuzz_plan): the input parses into
+ * a document, then a fixed ALPHABET of expressions — paths and
+ * predicates that overlap the corpus shapes — evaluates against it
+ * and every result accessor drains, including kind-mismatched reads
+ * (the contract answers those with NULL/0/false, never a crash).
+ * Invariants under ASan/UBSan: evaluator and result lifetimes, node
+ * handles into a live document, no leaks. */
+#include "leptris.h"
+
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+static const char* const kExprs[] = {
+    "//node()",
+    "//*",
+    "//@*",
+    "/a/b",
+    "//item[@id='1']",
+    "//p[@*]",
+    "count(//*)",
+    "string(//a)",
+    "number(//@n)",
+    "boolean(//x)",
+    "//a[2]/following-sibling::*",
+    "//@xmlns:*/..",
+    "//* | //@* | //text()",
+};
+#define XPATH_ALPHA ((int)(sizeof(kExprs) / sizeof(kExprs[0])))
+
+static void drain(LeptrisXPathResult r) {
+    if (!r) return;
+    size_t n = leptris_xpath_result_count(r);
+    for (size_t i = 0; i < n; i++) {
+        LeptrisElement e = leptris_xpath_result_get(r, i);
+        (void)e; /* a handle into the live document — no deref race */
+        (void)leptris_xpath_result_node_kind(r, i);
+    }
+    LeptrisNodeRef nodes[8];
+    LeptrisXPathNodeKind kinds[8];
+    (void)leptris_xpath_result_get_nodes_ex(r, nodes, kinds, 8);
+    char* whole = leptris_xpath_result_string(r);
+    if (whole) leptris_free_string(whole);
+}
+
+int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (size == 0 || size > (1u << 20)) return 0;
+
+    LeptrisParseOptions opts;
+    memset(&opts, 0, sizeof(opts));
+    opts.recover = 1;
+    LeptrisStatus st = LEPTRIS_OK;
+    LeptrisDocument doc =
+        leptris_parse_string_ex((const char*)data, size, &opts, &st);
+    if (!doc) return 0;
+
+    for (int i = 0; i < XPATH_ALPHA; i++) {
+        LeptrisXPathResult r =
+            leptris_xpath_eval(doc, NULL, kExprs[i]);
+        drain(r);
+        if (r) leptris_xpath_result_free(r);
+    }
+
+    leptris_document_free(doc);
+    return 0;
+}

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.367",
+  "version": "1.9.368",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.367.1
+  version: 1.9.368.1
 platform: ruby
 authors:
 - Ribose Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-17 00:00:00.000000000 Z
+date: 2026-10-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -773,7 +773,9 @@ files:
 - vendor-src/libleptris/test/fixtures/malformed.xml
 - vendor-src/libleptris/test/fixtures/namespaces.xml
 - vendor-src/libleptris/test/fixtures/utf16_decl.xml
+- vendor-src/libleptris/test/fuzz/fuzz_mutate.c
 - vendor-src/libleptris/test/fuzz/fuzz_parse.c
+- vendor-src/libleptris/test/fuzz/fuzz_xpath.c
 - vendor-src/libleptris/test/html/html5lib-redlist.txt
 - vendor-src/libleptris/test/html/html5lib-tests/LICENSE
 - vendor-src/libleptris/test/html/html5lib-tests/README.md