leptris 1.9.377.0-aarch64-linux → 1.9.378.0-aarch64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 219ca05fcab28bf94140e49c1d4424ad7453bcaf9aeb5e72e1e13354d4250cab
-  data.tar.gz: 68d614158658b99d9516dd15e2a079105c35c6133236333a0a04f6ada5fd0ca5
+  metadata.gz: 2ba79bde3af1d4d761b8ef2c76181e70bb301c495580df031c9ec1367e3b8162
+  data.tar.gz: 8a8a3cf775405cde5b8ee9afa1f86f442cf1c1bf06bcc2f7c527a3acf401ffa0
 SHA512:
-  metadata.gz: 1bd0f3fa08a85ef4d92a5ec65cff603f586baef657a6f4290df7d7161189f423b54e1bd1b45dc9c0fd5250d3788f2c0149ee1ee876fe35475b5982d50b4dd830
-  data.tar.gz: 470154ffe7045fb6c5b0175953c057c8d33d373edfa4d6d57127f5625c60254b9671aae362bf45ceda8f2dac232d1b29531dfa04995718b3f758a363c07122c0
+  metadata.gz: dd19893f0914c2360defb6cfac75de98d375533c6f677b89a711857a84bbc56dfe28f70a7dc5464db8b5084b1b96864e09b5fd071f0ab5a6b2c027406b9b2a5e
+  data.tar.gz: 4403b111e2d1eee3bbcab572b49ee159cd51c8dd92841d88d656efe766e3e8d82f1e806483ef04d9ec89192d561f3f1669094153122ef1d25e8ac1e5135e908d

data/CHANGELOG.md

@@ -1,3 +1,21 @@
+## [1.9.378.0] - 2026-10-21
+
+### Fixed — engine sync (libleptris 1.9.378)
+
+- **Node-set XPath after sibling insertion (leptris-ruby#519,
+  leptris/leptris#1802)**: the lazy element index was invalidated
+  by `add_child` but not by the sibling/prepend splice paths, so
+  `xpath("//name")` after `add_next_sibling` answered from the
+  pre-insert tree until an unrelated child insert rebuilt it.
+  `insert_before`, `insert_after` and `prepend_child` now
+  invalidate the document index.
+
+### Changed — engine sync
+
+- **WHATWG HTML verdict parity complete (leptris/leptris#1803)**:
+  1555/1555 corpus documents now report parse errors exactly when
+  html5lib does, with tree parity unchanged at 1555/1555.
+
 ## [1.9.356.0] - 2026-10-14
 
 ### Fixed — engine sync (libleptris 1.9.356)

data/Rakefile

@@ -8,7 +8,7 @@ RSpec::Core::RakeTask.new(:spec)
 # Pin for `rake compile` and the platform-gem builds. Keep in lockstep
 # with .github/workflows/build.yml (which calls `rake compile`) and the
 # CHANGELOG when libleptris releases.
-LIBLEPTRIS_VERSION = "1.9.377"
+LIBLEPTRIS_VERSION = "1.9.378"
 # Vendored alongside libleptris for fn:normalize-unicode (TODO
 # .restructure/20): built per platform with a RELOCATABLE @rpath
 # install name, loaded by ffi.rb before libleptris so the

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.377.0"
+  VERSION = "1.9.378.0"
 end

data/vendor-src/README.md

@@ -1,7 +1,7 @@
 Sources vendored in this gem (recompile rights; the ruby
 variant builds them at install via extconf.rb):
 
-- libleptris v1.9.377
+- libleptris v1.9.378
 - utf8proc v2.11.0
 
 Rebuild by hand:

data/vendor-src/libleptris/CHANGELOG.md

@@ -1,5 +1,59 @@
 ## [Unreleased]
 
+## [1.9.378] - 2026-10-21
+
+### Added
+
+- **SECURITY.md: private reporting channel and CVE-response note
+  (PR #1804).** Reports go through GitHub Security Advisories, with
+  an acknowledgment target, coordinated disclosure, and CVE
+  assignment when warranted. The supported-version table follows
+  the lockstep rule: a fix is delivered only when the binding
+  release carries the fixed engine. The hardening inventory records
+  what actually ships: zero required runtime dependencies,
+  ASAN+leak and macOS `leaks` lanes, nightly libFuzzer on the
+  parser, explicit depth/size limits, and the conformance suites.
+- **Test suite runs in parallel without changing any test (PR
+  #1799).** `gtest_discover_tests` now bakes the case list at build
+  time for native builds (`POST_BUILD`; cross builds keep
+  `PRE_TEST`), so `ctest --parallel` expands real cases instead of
+  `_NOT_BUILT` placeholders. CI runs the native and matrix lanes at
+  `--parallel 4` (qemu s390x and ILP32 stay serial). The CLI test
+  helper passed `WORKING_DIRECTORY` inside `PROPERTIES`, which
+  silently dropped the following `RUN_SERIAL`; passing it as a
+  keyword restores the serialization. Same 2074 cases, all green:
+  66.0 s serial → 31.0 s `-j4` locally; the export check alone
+  20.7-23.3 s → 8.7-9.3 s.
+
+### Fixed
+
+- **dom: node-set XPath no longer answers from a stale element
+  index after sibling insertion (leptris-ruby#519, PR #1802).** The
+  lazy TODO 132 index was invalidated by `append_child` but not by
+  `insert_before`, `insert_after` or `prepend_child`, so a
+  `//name` query after `add_next_sibling` missed the new element
+  until an unrelated child insert rebuilt the index. All three
+  splice paths now invalidate the document index; the regression
+  spec covers each path plus the compiled-handle FFI face the
+  bindings evaluate with.
+- **html: WHATWG verdict parity is complete — 1555/1555, zero
+  misses (PR #1803).** The remaining 20 corpus documents now report
+  at their html5lib source sites: `adoption-agency-1.3` for
+  formatting end tags whose element is in scope but not the current
+  node; the `</menuitem>` endTagOther pair (stray, and found with
+  non-implied open elements above); tokenizer
+  `expected-dashes-or-doctype`,
+  `unexpected-character-after-solidus-in-tag` and
+  `attributes-in-end-tag`; AfterAfterFrameset trailing characters,
+  BeforeHead `end-tag-after-implied-root`, BeforeHtml
+  `unexpected-end-tag-before-html`, and foreign-content end-tag
+  mismatch; `unexpected-form-in-table` for both the insertion and
+  the ignored duplicate plus the `</form>` table-voodoo pair;
+  template `foster-parenting-character`; and
+  `two-heads-are-not-better-than-one`. Tree parity stays
+  1555/1555; the verdict floor is pinned at the full corpus count.
+
+
 ## [1.9.377] - 2026-10-20
 
 ### Added

data/vendor-src/libleptris/CMakeLists.txt

@@ -3,7 +3,7 @@
 cmake_minimum_required(VERSION 3.20)
 
 project(leptris
-    VERSION 1.9.377
+    VERSION 1.9.378
     DESCRIPTION "Fast XML parser and XPath evaluator in pure C"
     LANGUAGES C CXX
 )

data/vendor-src/libleptris/SECURITY.md

@@ -0,0 +1,94 @@
+# Security Policy
+
+libleptris is a parser and transformation engine: it reads untrusted
+documents. Memory safety and predictable resource behavior on hostile
+input are part of the product, not an afterthought.
+
+## Supported versions
+
+Security fixes land on the latest release of the current major line and
+are shipped in the next patch release. The engine follows the lockstep
+runtime rule — binding versions are `{engine-semver}.{binding-patch}` —
+so a fix is considered delivered only when the corresponding binding
+release carries the fixed engine.
+
+| Version | Supported |
+|---|---|
+| latest `1.x` release | yes |
+| any earlier release/tag | no (upgrade to the latest patch) |
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security report.**
+
+Use GitHub's private vulnerability reporting on this repository:
+**Security → Advisories → Report a vulnerability** (direct link:
+<https://github.com/leptris/leptris/security/advisories/new>).
+
+Please include, when available:
+
+- the engine version (or binding version and its pinned engine),
+- the input document/expression that triggers the problem,
+- the build configuration (sanitizer output, platform, compiler),
+- the observed impact (crash, out-of-bounds access, infinite loop,
+  excessive memory, code execution, information disclosure).
+
+If you report a bug that affects a binding, include both the binding
+version and the engine version it pins; the engine is the shared
+implementation and the fix belongs there first.
+
+## What to expect
+
+- **Acknowledgment** within 5 business days.
+- **Triage and reproduction** in the private advisory thread. We may
+  ask for the exact input and a minimized reproducer.
+- **Fix and coordinated disclosure.** The fix lands on a private or
+  public branch as circumstances require, is released through the
+  normal release workflow, and the advisory is published with credit
+  (unless you prefer to remain anonymous).
+- **CVE assignment** is requested through the GitHub advisory when the
+  issue warrants one.
+
+Please give us a reasonable window to ship a patch before public
+disclosure. We will keep you informed of the timeline in the advisory
+thread.
+
+## In scope
+
+- The C engine: XML/HTML parsing, DTD validation, XPath, XSLT,
+  XInclude, serialization, encoding conversion, SAX and pull APIs.
+- The shipped CLI (`leptris`) and public C API surface.
+- The FFI layer and descriptor surface consumed by the language
+  bindings (leptris-ruby, leptris-py, leptris-ts, leptris-rs).
+- Resource-exhaustion behavior on untrusted input (unbounded
+  recursion, allocation amplification, algorithmic complexity) when it
+  is reachable without a misconfiguration.
+
+## Out of scope
+
+- Vulnerabilities in third-party dependencies of the language
+  bindings, unless the engine's handling of their output is unsafe.
+- Builds with sanitizers or assertions disabled by the reporter.
+- Reports that require a modified engine binary.
+- Denial of service by simply feeding a very large document when the
+  configured limits are explicitly disabled by the caller.
+
+## Hardening in the repository
+
+- **Zero required runtime dependencies** by default; `utf8proc` and
+  `iconv` are optional compile-time features.
+- **Sanitizers in CI**: AddressSanitizer with leak detection on Linux
+  (`asan.yml`), plus the macOS `leaks` lane.
+- **Fuzzing**: nightly libFuzzer runs over the parser
+  (`fuzz-nightly.yml`), with the crash corpus triaged into regression
+  specs; the XPath and mutation harnesses live alongside it in
+  `test/fuzz/`.
+- **Depth and size limits** enforced by the parser; all limits are
+  explicit and documented in the public headers.
+- **Conformance suites** (W3C XPath, libxslt, WHATWG html5lib, XSD,
+  DTD) run on every change, so hardening fixes cannot regress silently.
+
+## Recognition
+
+We are happy to credit reporters in the published advisory and in the
+release notes. Thank you for helping keep document parsing safe.

data/vendor-src/libleptris/TODO.SOTA.md

@@ -28,9 +28,23 @@ docs/MISSION-PLAN.md and is updated at every release.
 ## Gate A — Conformance: zero reds everywhere
 
 ### A1 WHATWG verdict parity: 1394/1555 → 1555/1555
-The remaining 161 verdict cases + ~270 code-set divergences
-(html5lib-verdict-redlist.txt). Ground every slice in html5lib's
-actual source (~/src/external/html5lib):
+**Measured 2026-10-21 (main after #1800): 1535/1555 verdict,
+1555/1555 tree, zero false positives; floor pinned at 1535.** The
+remaining 20 verdict misses: adoption-agency (tests2:10, tests19:98,
+tests19:99, tests26:1, tests26:9), menuitem strays (menuitem:10/12),
+table/caption singletons (tests9:16, tests10:15, tests16:197,
+pending-spec-changes:2, tests20:48), tokenizer singletons (tests10:2,
+tests2:18, tests2:58, tests19:41, tests19:82) and two-heads
+(tests3:13). The remaining ~270 code-set divergences are prose-dialect
+labels from older corpus datasets; the verdict gate is presence-only.
+The slices already shipped: initial mode, raw-text EOF, unterminated
+close, frameset, fenced walk, InBody EOF allowed-set, in-select,
+foster-by-kind, unknown-doctype (#1778-#1791), raw-text strays,
+non-html-root, end-tag-too-early, after-body/frameset phases,
+start-tag phases, select/table/foreign, need-space-after-doctype
+(#1794), misplaced/stray-p, after-html codes, image (#1797, #1800).
+Ground every further slice in html5lib's actual source
+(~/src/external/html5lib):
 - [ ] escaped-state EOF codes (`unexpected-eof-in-text-mode`,
       `eof-in-script-in-script`) — the script-data state machine's
       EOF classification
@@ -76,6 +90,14 @@ actual source (~/src/external/html5lib):
 ## Gate B — Performance: every published row ≥1.00x
 
 ### B1 build row: ~2.9x → ≤1.0x (the #242 campaign)
+**Measured 2026-10-21: 1.86-1.92x** (moxml `sota/04-performance`
+branch + leptris 1.9.376.0; harness `wt/460-harness/build_bench.rb`,
+31 interleaved reps: 4.08ms vs Nokogiri 2.20ms for 250 records).
+Was 2.95x at the 1.9.363 era; the add_child alias and same-doc fast
+path landed since. StackProf attribution: `NativeNode.create_element`
+14.6%, GC mark+sweep 19%, `prime_contract` 7.7%, attach path 45% of
+tree; the `invalidate_namespace_cache!` line attribution is a
+sampling artifact (deleting both attach invalidations gains ~5%).
 Harness: wt/460-harness/build_bench.rb. Decomposition on record.
 - [ ] per-element object budget: one Ruby object per created node
       (drop the shell entirely post-create-priming; the mint cache

data/vendor-src/libleptris/docs/MISSION-PLAN.md

@@ -161,3 +161,15 @@ One table, updated at every release train: gate, command, last run,
 verdict. When every row of Gate A and Gate B reads "green (dated)"
 and Gate D1 is green, the mission is achieved — and v1.0.0 is the
 tag that says so.
+
+| Gate | Command | Last run | Verdict |
+|------|---------|----------|---------|
+| A1 WHATWG tree parity | `test_html5lib --gtest_filter=Html5LibCorpus.*` | 2026-10-21 | green, 1555/1555 |
+| A1 WHATWG verdict parity | `Html5LibCorpus.ErrorVerdictParity` | 2026-10-21 | 1535/1555 (floor 1535; **red**) |
+| A7 libxslt | `LibxsltSuite` | 2026-10-20 | 205/205 (204 + 1 macOS skip) |
+| B1 build row | `wt/460-harness/build_bench.rb` | 2026-10-21 | 1.86-1.92x (**red**, sota/04 branch) |
+| B2 walk row | `wt/460-harness/walk_read_bench.rb` | 2026-10-20 | 0.88x (green) |
+| Test-suite runtime (fidelity) | `ctest`, 2074 cases | 2026-10-21 | 66.0 s serial → 31.0 s `-j4` (same 2074/2074; PR #1799) |
+| Rides 1.9.377 | registries | 2026-10-21 | rubygems/PyPI 1.9.377.0, npm 0.1.21 |
+| Issues | all repos | 2026-10-21 | 0 open (ruby#514/#515 closed with gem verification) |
+

data/vendor-src/libleptris/scripts/check_shared_exports.sh

@@ -26,7 +26,7 @@ cmake -B "$BUILD" -S "$ROOT" \
     -DLEPTRIS_BUILD_BENCHMARKS=OFF \
     > /dev/null
 
-cmake --build "$BUILD" --target leptris_shared > /dev/null
+cmake --build "$BUILD" --target leptris_shared --parallel > /dev/null
 
 LIB=$(find "$BUILD" -name 'libleptris.*.dylib' -o -name 'libleptris.so*' \
         2>/dev/null | grep -v '[0-9]\.dylib$' | head -1)
@@ -98,13 +98,17 @@ REQUIRED=(
 )
 
 rc=0
+# One nm pass instead of one per symbol: the export table is a few KB
+# but nm re-reads the whole dylib each time (~55 spawns + reads).
+# macOS: nm -gU; Linux: nm -D --defined-only. The macOS spelling
+# prefixes symbols with '_', hence the optional underscore.
+EXPORTS=$(mktemp)
+trap 'rm -f "$EXPORTS"' EXIT
+if ! nm -gU "$LIB" > "$EXPORTS" 2>/dev/null; then
+    nm -D --defined-only "$LIB" > "$EXPORTS" 2>/dev/null || true
+fi
 for sym in "${REQUIRED[@]}"; do
-    # nm flags: -g externals only, -U exclude undefined, -C no demangle.
-    # macOS:    nm -gU <lib>
-    # Linux:    nm -D --defined-only <lib>
-    if nm -gU "$LIB" 2>/dev/null | grep -qE " _?${sym}\$"; then
-        echo "  OK   $sym"
-    elif nm -D --defined-only "$LIB" 2>/dev/null | grep -qE " ${sym}\$"; then
+    if grep -qE "[[:space:]]_?${sym}\$" "$EXPORTS"; then
         echo "  OK   $sym"
     else
         echo "  MISS $sym"

data/vendor-src/libleptris/src/leptris/dom/element_modify.c

@@ -543,6 +543,13 @@ LeptrisStatus leptris_element_prepend_child(LeptrisElement parent, LeptrisElemen
     /* Call internal void function, assume success */
     leptris_element_prepend_child_internal(parent, (LeptrisNode*)child);
     leptris_element_invalidate_child_cache(parent);
+
+    /* TODO 132: the child splice changed the element set — a cached
+     * index would describe the pre-insert tree (leptris-ruby #519). */
+    if (leptris_element_get_document(parent)) {
+        leptris_element_index_invalidate(
+            leptris_element_get_document(parent));
+    }
     return LEPTRIS_OK;
 }
 
@@ -671,6 +678,13 @@ LeptrisStatus leptris_element_insert_before(LeptrisElement sibling, LeptrisEleme
 
     leptris_node_increment_version(LEPTRIS_ELEMENT_AS_NODE(parent));
     leptris_element_invalidate_child_cache(parent);
+
+    /* TODO 132: the sibling splice changed the element set — a cached
+     * index would describe the pre-insert tree (leptris-ruby #519). */
+    if (leptris_element_get_document(parent)) {
+        leptris_element_index_invalidate(
+            leptris_element_get_document(parent));
+    }
     return LEPTRIS_OK;
 }
 
@@ -785,6 +799,13 @@ LeptrisStatus leptris_element_insert_after(LeptrisElement sibling, LeptrisElemen
 
     leptris_node_increment_version(LEPTRIS_ELEMENT_AS_NODE(parent));
     leptris_element_invalidate_child_cache(parent);
+
+    /* TODO 132: the sibling splice changed the element set — a cached
+     * index would describe the pre-insert tree (leptris-ruby #519). */
+    if (leptris_element_get_document(parent)) {
+        leptris_element_index_invalidate(
+            leptris_element_get_document(parent));
+    }
     return LEPTRIS_OK;
 }
 

data/vendor-src/libleptris/src/leptris/html/html_parse.c

@@ -4035,10 +4035,13 @@ static void h_append(HBuilder* b, LeptrisNodeRef n) {
                 if (*q != ' ' && *q != '\t' && *q != '\n' &&
                     *q != '\r') { ws = 0; break; }
         if (!ws) {
-            /* AfterFrameset processCharacters reports
-             * unexpected-char-after-frameset; the after-</html>
-             * flavor is reported by the expected-eof block below. */
-            if (!b->after_html)
+            /* AfterFrameset/AfterAfterFrameset processCharacters
+             * both report and DROP the run (no phase switch). */
+            if (b->after_html)
+                h_diag(b, "expected-eof-but-got-char",
+                       b->err_line_memo_off,
+                       "characters after </html> in the frameset phase");
+            else
                 h_diag(b, "unexpected-char-after-frameset",
                        b->err_line_memo_off,
                        "characters after </frameset>");
@@ -4068,12 +4071,15 @@ static void h_append(HBuilder* b, LeptrisNodeRef n) {
             b->after_body_done = 1;
             /* AfterAfterBody/AfterAfterFrameset processCharacters
              * report expected-eof-but-got-char; AfterBody reports
-             * unexpected-char-after-body (tests2:55, tests19:41). */
-            if (b->after_html)
+             * unexpected-char-after-body (tests2:55, tests19:41).
+             * AfterAfterBody then switches to in-body and inserts
+             * the run — clear the phase flags so later comments are
+             * body content, not document epilog. */
+            if (b->after_html) {
                 h_diag(b, "expected-eof-but-got-char",
                        b->err_line_memo_off,
                        "characters after </html>");
-            else
+            } else
                 h_diag(b, "unexpected-char-after-body",
                        b->err_line_memo_off,
                        "characters after </body>");
@@ -4214,6 +4220,31 @@ static void h_append(HBuilder* b, LeptrisNodeRef n) {
                    b->err_line_memo_off,
                    "hidden input inserted in table context");
         }
+        /* Template content whose last node is a table-context
+         * element inserts text as that node's sibling (the template
+         * flavor of foster parenting). html5lib still reports the
+         * foster (template.dat:112: <template><tr>…</tr>a). */
+        if (b->whatwg && b->whatwg_foster &&
+            leptris_node_get_type(n) == LEPTRIS_NODE_TYPE_TEXT &&
+            b->depth > 0 &&
+            b->open_id[b->depth - 1] == h_id_template) {
+            const char* tc =
+                leptris_text_node_get_content((LeptrisTextNode*)n);
+            int nonws = 0;
+            if (tc)
+                for (const char* w = tc; *w; w++)
+                    if (*w != ' ' && *w != '\t' && *w != '\n' &&
+                        *w != '\r') { nonws = 1; break; }
+            LeptrisNodeRef last = leptris_node_last_child_internal(
+                (LeptrisNode*)b->open[b->depth - 1]);
+            if (nonws && last &&
+                leptris_node_get_type(last) ==
+                    LEPTRIS_NODE_TYPE_ELEMENT &&
+                h_is_table_context((LeptrisElement)last))
+                h_diag(b, "foster-parenting-character",
+                       b->err_line_memo_off,
+                       "text fostered in template table content");
+        }
         /* #659 foster (WHATWG only): text/elements in table context
          * go before the nearest open table in ITS parent. */
         if (b->whatwg_foster && tbl_ctx && h_fosterable(b, n)) {
@@ -4652,7 +4683,7 @@ static void h_reconstruct(HBuilder* b) {
 /* The adoption agency proper. Returns 1 when the end tag is fully
  * consumed; 0 means no formatting entry matched and the caller
  * runs its generic (any-other-end-tag) handling. */
-static int h_afe_end(HBuilder* b, const char* subject) {
+static int h_afe_end(HBuilder* b, const char* subject, size_t off) {
     if (b->depth > 0) {
         LeptrisElement cur = b->open[b->depth - 1];
         const char* cn = leptris_element_name(cur);
@@ -4703,6 +4734,14 @@ static int h_afe_end(HBuilder* b, const char* subject) {
                 return 1;
             }
         }
+        /* html5lib adoption-agency-1.3: the formatting element is
+         * in the stack and in scope, but open elements sit above
+         * it (it is not the current node). Parsing proceeds. */
+        if (b->whatwg_adopt && b->depth != (size_t)si + 1) {
+            h_diag(b, "adoption-agency-1.3", off,
+                   "</%s> formatting element is not the current node",
+                   subject);
+        }
         int fbi = -1;
         for (size_t k = (size_t)si + 1; k < b->depth; k++) {
             /* Only HTML-namespace elements are furthest-block
@@ -6107,6 +6146,15 @@ static LeptrisDocument html_parse_shared(
                     }
                     p = (ce + 3 <= end) ? ce + 3 : end;
                 } else {
+                    /* Tokenizer markup-declaration-open: "<!" that
+                     * is neither a comment nor DOCTYPE (and, in
+                     * HTML content, not CDATA) reports
+                     * expected-dashes-or-doctype (tests10:2:
+                     * <![CDATA[a]]> outside foreign content). */
+                    if (b.whatwg)
+                        h_diag(&b, "expected-dashes-or-doctype",
+                               (size_t)(p - b.input_base),
+                               "<! markup declaration");
                     /* CDATA-ish bogus: skip to '>'. WHATWG makes
                      * it a bogus comment (tests1:42-49) — except
                      * doctype-shaped constructs, which the
@@ -6217,6 +6265,20 @@ static LeptrisDocument html_parse_shared(
             const char* q = ns;
             while (q < end && !h_is_ws(*q) && *q != '>' && *q != '/') q++;
             size_t nlen = (size_t)(q - ns);
+            /* Tokenizer: an end tag may carry attributes
+             * syntactically (they are ignored at tree time, but
+             * the token reports attributes-in-end-tag;
+             * tests2:18's </b test<b ...>). A lone "/" before
+             * ">" is the self-closing form, not an attribute. */
+            {
+                const char* tq = q;
+                while (tq < end && h_is_ws(*tq)) tq++;
+                if (tq < end && *tq != '>' &&
+                    !(*tq == '/' && tq + 1 < end && tq[1] == '>'))
+                    h_diag(&b, "attributes-in-end-tag",
+                           (size_t)(tq - b.input_base),
+                           "attributes in an end tag");
+            }
             while (q < end && *q != '>') q++;
             if (q < end) q++;
             /* Flush pending text before closing. A
@@ -6254,6 +6316,17 @@ static LeptrisDocument html_parse_shared(
                 for (size_t i = 0; i < cl0; i++)
                     lname0[i] = h_lower(ns[i]);
                 lname0[cl0] = 0;
+                /* html5lib InForeignContent.processEndTag: an end
+                 * tag that does not name the current foreign node
+                 * reports before the walk (tests19:82: <math></p>). */
+                {
+                    const char* topn = leptris_element_name(
+                        b.open[b.depth - 1]);
+                    if (topn && !h_ieq_raw(topn, lname0))
+                        h_diag(&b, "unexpected-end-tag",
+                               (size_t)(p - b.input_base),
+                               "</%s> in foreign content", lname0);
+                }
                 int match_foreign = 0, crossed_ip = 0;
                 for (size_t d = b.depth; d > 0; d--) {
                     if (b.open_ns[d - 1] == H_NS_HTML) break;
@@ -6304,6 +6377,15 @@ static LeptrisDocument html_parse_shared(
                 text = p;
                 continue;
             }
+            /* AfterAfterBody/AfterAfterFrameset processEndTag: ANY
+             * end tag is a phase error, and the token is then
+             * reprocessed in body — report once and fall through
+             * with the phase flags cleared (tests19:43). */
+            if (b.whatwg && b.after_html) {
+                h_diag(&b, "expected-eof-but-got-end-tag",
+                       (size_t)(p - b.input_base),
+                       "end tag after </html>");
+            }
             /* Stray end tags with no open stack. The raw-text family
              * completes during start-tag handling; void elements and
              * menuitem have no in-body end handler. html5lib's
@@ -6319,7 +6401,16 @@ static LeptrisDocument html_parse_shared(
                 int stray = h_is_rawtext_name(rn) ||
                             (h_is_void(rn) && strcmp(rn, "br") != 0) ||
                             strcmp(rn, "menuitem") == 0;
-                if (stray) {
+                /* BeforeHtml endTagOther: every end tag other than
+                 * head/body/html/br reports here (html5lib
+                 * BeforeHtmlPhase; tests2:18's </b ...>). */
+                int before_html = !b.top_tail && !b.head_tag_seen &&
+                                  !b.body_seen && !b.body_tag_seen;
+                int bb_exempt = strcmp(rn, "head") == 0 ||
+                                strcmp(rn, "body") == 0 ||
+                                strcmp(rn, "html") == 0 ||
+                                strcmp(rn, "br") == 0;
+                if (stray || (before_html && !bb_exempt)) {
                     const char* code = "unexpected-end-tag";
                     if (b.after_html)
                         code = "expected-eof-but-got-end-tag";
@@ -6329,9 +6420,8 @@ static LeptrisDocument html_parse_shared(
                         code = "unexpected-end-tag-after-frameset";
                     else if (b.frameset)
                         code = "unexpected-end-tag-in-frameset";
-                    else if (!b.top_tail && !b.head_tag_seen &&
-                             !b.body_seen && !b.body_tag_seen)
-                        code = "end-tag-after-implied-root";
+                    else if (before_html)
+                        code = "unexpected-end-tag-before-html";
                     h_diag(&b, code, (size_t)(p - b.input_base),
                            "</%s> has no matching open element", rn);
                     p = q;
@@ -6339,6 +6429,39 @@ static LeptrisDocument html_parse_shared(
                     continue;
                 }
             }
+            /* InHead/AfterHead endTagOther: a </p> before body
+             * content is dropped with unexpected-end-tag and
+             * inserts no empty p (tests19:3). Depth-0 only — the
+             * in-body stray-p rule below owns the body phase. */
+            if (b.whatwg && nlen == 1 && h_lower(ns[0]) == 'p' &&
+                b.depth == 0 && !b.body_seen &&
+                (b.head_tag_seen || b.head_end_seen) &&
+                !b.frameset && !b.after_body && !b.after_html)
+                h_diag(&b, "unexpected-end-tag",
+                       (size_t)(p - b.input_base),
+                       "</p> outside the body phase");
+            /* BeforeHead endTagOther: before the head phase starts
+             * (only the html element open), any end tag other than
+             * head/body/html/br is end-tag-after-implied-root
+             * (tests19:2: <html></p><!--foo-->). */
+            if (b.whatwg && nlen && b.depth == 1 &&
+                b.open_id[0] == h_id_html &&
+                !b.head_tag_seen && !b.head_end_seen &&
+                !b.body_seen && !b.body_tag_seen &&
+                !b.frameset && !b.after_body && !b.after_html) {
+                char* ph = h_pooled_lower(b.pool, ns, nlen);
+                if (ph && strcmp(ph, "head") != 0 &&
+                    strcmp(ph, "body") != 0 &&
+                    strcmp(ph, "html") != 0 &&
+                    strcmp(ph, "br") != 0) {
+                    h_diag(&b, "end-tag-after-implied-root",
+                           (size_t)(p - b.input_base),
+                           "</%s> before the head phase", ph);
+                    p = q;
+                    text = p;
+                    continue;
+                }
+            }
             if (nlen && (b.depth > 0 ||
                          (b.whatwg &&
                           ((nlen == 4 &&
@@ -6376,7 +6499,7 @@ static LeptrisDocument html_parse_shared(
                          * at body); a SPECIAL element crossed
                          * ignores the tag (menuitem:8: x stays in
                          * the p). */
-                        int msp = 0;
+                        int msp = 0, implied_ok = 1;
                         for (size_t d2 = b.depth; d2 > 0; d2--) {
                             const char* on2 =
                                 leptris_element_name(b.open[d2 - 1]);
@@ -6387,13 +6510,39 @@ static LeptrisDocument html_parse_shared(
                                 break;
                             }
                             if (h_is_special_ww(on2)) break;
+                            if (!h_is_implied_end_name(on2))
+                                implied_ok = 0;
                         }
-                        (void)msp;
+                        /* html5lib endTagOther reports in both
+                         * shapes: the walk found the element but
+                         * non-implied nodes sit above it, or the
+                         * walk stopped at a special (stray). */
+                        if (!msp)
+                            h_diag(&b, "unexpected-end-tag",
+                                   (size_t)(p - b.input_base),
+                                   "</menuitem> is a stray end tag");
+                        else if (!implied_ok)
+                            h_diag(&b, "unexpected-end-tag",
+                                   (size_t)(p - b.input_base),
+                                   "</menuitem> with open elements above");
                         p = q;
                         text = p;
                         continue;
                     }
                     if (b.whatwg && strcmp(lname, "form") == 0) {
+                        /* InTable endTagOther runs the body rule
+                         * under table voodoo: both codes report
+                         * (tests16:197: <form><table></form>). */
+                        if (b.depth > 0 &&
+                            h_id_table_ctx(b.open_id[b.depth - 1])) {
+                            h_diag(&b,
+                                   "unexpected-end-tag-implies-table-voodoo",
+                                   (size_t)(p - b.input_base),
+                                   "</form> inside a table");
+                            h_diag(&b, "unexpected-end-tag",
+                                   (size_t)(p - b.input_base),
+                                   "</form> inside a table");
+                        }
                         /* Vendored rule: </form> closes implied
                          * end-tag layers (option/optgroup/li/dd/
                          * dt/p), then pops the form ONLY when it
@@ -6564,7 +6713,8 @@ static LeptrisDocument html_parse_shared(
                      * matched; otherwise the generic path below
                      * is the any-other-end-tag run. */
                     if (b.whatwg_adopt && h_is_formatting(lname) &&
-                        h_afe_end(&b, lname)) {
+                        h_afe_end(&b, lname,
+                                  (size_t)(p - b.input_base))) {
                         p = q;
                         text = p;
                         continue;
@@ -7255,9 +7405,14 @@ static LeptrisDocument html_parse_shared(
         }
         if (!name) goto done;
         /* #659 (13.2.6.4.7): <image> is renamed <img> and
-         * reprocessed (tests1:90). */
-        if (b.whatwg && strcmp(name, "image") == 0)
+         * reprocessed (tests1:90); html5lib reports the legacy
+         * spelling as image-start-tag (tests19:89). */
+        if (b.whatwg && strcmp(name, "image") == 0) {
+            h_diag(&b, "image-start-tag",
+                   (size_t)(p - b.input_base),
+                   "<image> acts as <img>");
             name = h_pooled_lower(b.pool, "img", 3);
+        }
         /* #1218: ONE classification per start tag — every
          * downstream consumer (frameset-ok, void, open) reads the
          * resolved entry instead of re-walking the bucket. */
@@ -7367,7 +7522,41 @@ static LeptrisDocument html_parse_shared(
                 /* InBody/AfterHead startTagHead: any <head> after
                  * the head phase started is an unexpected start tag
                  * (tests6:1: </head> <head>). */
-                if (b.whatwg &&
+                /* An explicit <head> while the IMPLIED head already
+                 * holds head content is html5lib's InHead
+                 * startTagHead — two-heads-are-not-better-than-one
+                 * (tests3:13: <html><meta><head>). */
+                int head_content_before = 0;
+                if (!b.head_tag_seen && !b.head_end_seen &&
+                    b.depth == 1 && b.open[0] &&
+                    b.open_id[0] == h_id_html) {
+                    LeptrisNodeRef hc =
+                        leptris_node_last_child_internal(
+                            (LeptrisNode*)b.open[0]);
+                    if (hc && leptris_node_get_type(hc) ==
+                                  LEPTRIS_NODE_TYPE_ELEMENT) {
+                        const char* hn2 = leptris_element_name(
+                            (LeptrisElement)hc);
+                        head_content_before =
+                            hn2 && (h_ieq_raw(hn2, "title") ||
+                                    h_ieq_raw(hn2, "meta") ||
+                                    h_ieq_raw(hn2, "link") ||
+                                    h_ieq_raw(hn2, "base") ||
+                                    h_ieq_raw(hn2, "basefont") ||
+                                    h_ieq_raw(hn2, "bgsound") ||
+                                    h_ieq_raw(hn2, "script") ||
+                                    h_ieq_raw(hn2, "style") ||
+                                    h_ieq_raw(hn2, "noframes") ||
+                                    h_ieq_raw(hn2, "noscript") ||
+                                    h_ieq_raw(hn2, "template"));
+                    }
+                }
+                if (b.whatwg && head_content_before)
+                    h_diag(&b,
+                           "two-heads-are-not-better-than-one",
+                           (size_t)(p - b.input_base),
+                           "<head> in the implied head");
+                else if (b.whatwg &&
                     (b.head_tag_seen || b.head_end_seen ||
                      b.body_tag_seen || b.body_seen))
                     h_diag(&b, "unexpected-start-tag",
@@ -7685,7 +7874,30 @@ static LeptrisDocument html_parse_shared(
         /* 13.2.6.4.7: a <form> start tag with the form pointer
          * already set (a form still open) is IGNORED - <form><form>
          * is one form (tests6:13); likewise inside a table
-         * (tests20:46/47). </form> clears the pointer. */
+         * (tests20:46/47). </form> clears the pointer.
+         *
+         * html5lib reports both flavors: InTable startTagForm
+         * always says unexpected-form-in-table (even when it
+         * inserts), and InBody reports unexpected-start-tag for a
+         * duplicate (tests20:48: <table><form></table><form>). */
+        if (b.whatwg && strcmp(name, "form") == 0) {
+            int in_tbl = b.depth > 0 &&
+                         h_id_table_ctx(b.open_id[b.depth - 1]);
+            if (!in_tbl && b.depth >= 2 &&
+                b.open_ns[b.depth - 1] == H_NS_HTML &&
+                b.open_id[b.depth - 1] == h_id_form &&
+                b.open_ns[b.depth - 2] == H_NS_HTML &&
+                b.open_id[b.depth - 2] == h_id_table)
+                in_tbl = 1;   /* table > form wrapper */
+            if (in_tbl)
+                h_diag(&b, "unexpected-form-in-table",
+                       (size_t)(p - b.input_base),
+                       "<form> in table context");
+            else if (b.form_open)
+                h_diag(&b, "unexpected-start-tag",
+                       (size_t)(p - b.input_base),
+                       "<form> while a form is open");
+        }
         if (b.whatwg && strcmp(name, "form") == 0 && b.form_open) {
             /* The generic pre-element flush above already drained
              * the pending run. */
@@ -8331,7 +8543,7 @@ static LeptrisDocument html_parse_shared(
                     }
                 }
                 if (!dup_out_of_scope) {
-                h_afe_end(&b, name);
+                h_afe_end(&b, name, (size_t)(p - b.input_base));
                 /* The agency's 8-iteration cap can leave the
                  * entry — the start-tag branch removes it
                  * unconditionally. */
@@ -8415,6 +8627,14 @@ static LeptrisDocument html_parse_shared(
                     q += 2;
                     break;
                 }
+                /* Tokenizer self-closing-start-tag: a solidus not
+                 * followed by '>' reports and reprocesses in
+                 * before-attribute-name (tests2:58). */
+                if (b.whatwg)
+                    h_diag(&b,
+                           "unexpected-character-after-solidus-in-tag",
+                           (size_t)(q - b.input_base),
+                           "'/' before an attribute name");
                 q++;
                 continue;
             }
@@ -8749,6 +8969,14 @@ static LeptrisDocument html_parse_shared(
                         drop = 1;
                         break;
                     }
+                /* AfterAfterFrameset processCharacters reports
+                 * expected-eof-but-got-char for every non-space
+                 * character (tests19:41). */
+                if (drop)
+                    h_diag(&b, "expected-eof-but-got-char",
+                           (size_t)(text - b.input_base),
+                           "characters after </html> in the frameset"
+                           " phase");
             }
             if (!drop) {
                 if (!b.post_table_text) h_reconstruct(&b);

data/vendor-src/libleptris/test/CMakeLists.txt

@@ -19,6 +19,17 @@ endif()
 
 include(GoogleTest)
 
+# Native builds discover the gtest cases at BUILD time so the list is
+# baked into CTestTestfile and `ctest --parallel` can schedule the
+# whole suite. PRE_TEST expands the list while ctest runs, which only
+# works serially — under -j the _NOT_BUILT placeholders execute. Cross
+# builds must keep PRE_TEST: their binaries cannot run on the host.
+if(CMAKE_CROSSCOMPILING)
+    set(LEPTRIS_GTEST_DISCOVERY_MODE PRE_TEST)
+else()
+    set(LEPTRIS_GTEST_DISCOVERY_MODE POST_BUILD)
+endif()
+
 # Convenience aggregate target — `cmake --build build --target check_all`.
 add_custom_target(check_all
     COMMENT "Running all Leptris specs")
@@ -52,10 +63,12 @@ function(leptris_add_test name)
     # Timing specs measure ratios; concurrent processes steal cache
     # and skew short measurements — run test_perf's cases serially.
     if(name STREQUAL "test_perf")
-        gtest_discover_tests(${name} DISCOVERY_MODE PRE_TEST
+        gtest_discover_tests(${name}
+                             DISCOVERY_MODE ${LEPTRIS_GTEST_DISCOVERY_MODE}
                              PROPERTIES RUN_SERIAL TRUE)
     else()
-        gtest_discover_tests(${name} DISCOVERY_MODE PRE_TEST)
+        gtest_discover_tests(${name}
+                             DISCOVERY_MODE ${LEPTRIS_GTEST_DISCOVERY_MODE})
     endif()
     add_dependencies(check_all ${name})
 endfunction()
@@ -69,13 +82,15 @@ function(leptris_add_cli_test name)
     target_compile_definitions(${name} PRIVATE
         LEPTRIS_CLI_BIN="${CMAKE_BINARY_DIR}/cli/leptris"
         LEPTRIS_SOURCE_DIR="${CMAKE_SOURCE_DIR}")
+    # WORKING_DIRECTORY is a first-class keyword in the modern
+    # gtest_discover_tests signature. Passing it inside PROPERTIES
+    # made the parser eat RUN_SERIAL as an unparsed argument, so the
+    # CLI cases were never actually serialized (ctest -j4 then races
+    # the shared fixture cwd — the schematron/rng flakes).
     gtest_discover_tests(${name}
-        DISCOVERY_MODE PRE_TEST
-        PROPERTIES
+        DISCOVERY_MODE ${LEPTRIS_GTEST_DISCOVERY_MODE}
         WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-        # CLI cases spawn subprocesses; fork/exec contention under
-        # parallel ctest flakes them — run serially.
-        RUN_SERIAL TRUE
+        PROPERTIES RUN_SERIAL TRUE
     )
     add_dependencies(check_all ${name} leptris-cli)
 endfunction()

data/vendor-src/libleptris/test/html/test_html5lib.cpp

@@ -998,6 +998,18 @@ TEST(Html5LibCorpus, ErrorVerdictParity) {
      * eof-in-comment-double-dash; the plaintext/EOF slice adds the
      * plaintext open-at-EOF and the "</" tokenizer EOF codes; the
      * stray-end-tag slice makes the depth-0 branch phase-aware for
-     * raw-text, void and menuitem names. Only raises. */
-    EXPECT_GE(parity, (size_t)1532);
+     * raw-text, void and menuitem names; this batch adds the
+     * depth-0 </p> phase code, the after-</html> end-tag code, the
+     * frameset after-html character code, and image-start-tag; the
+     * agency slice adds adoption-agency-1.3 for formatting end tags
+     * whose element is in scope but not the current node; the
+     * menuitem slice adds the endTagOther pair for </menuitem>
+     * (stray before a special, or found with non-implied open
+     * elements above); the closing slice adds the frameset
+     * trailing-character code, BeforeHead end-tag-after-implied-
+     * root, foreign-content end-tag mismatch, markup-declaration
+     * (expected-dashes-or-doctype), solidus-in-tag, attributes-in-
+     * end-tag, before-html end tags, form-in-table, template foster
+     * characters and two-heads. Only raises. */
+    EXPECT_GE(parity, (size_t)1555);
 }

data/vendor-src/libleptris/test/xpath/test_xpath.cpp

@@ -94,6 +94,111 @@ TEST(XPathFunctions, CountReturnsNodeSetSize) {
     leptris_document_free(doc);
 }
 
+/* leptris-ruby #519: a node-set XPath run primes the TODO 132 element
+ * index. Sibling insertions change the element set but did not
+ * invalidate it, so the next //name query answered from the stale
+ * index and missed the inserted element. Child insertion (append)
+ * always invalidated; every splice path must too. */
+TEST(XPathIndexInvalidation, SiblingInsertionsRefreshDescendantAxis) {
+    const char xml[] = "<root><anchor/></root>";
+
+    auto eval_count = [](LeptrisDocument doc, const char* expr) -> int {
+        LeptrisXPathResult r = leptris_xpath_eval(doc, nullptr, expr);
+        if (!r) return -1;
+        int n = (int)leptris_xpath_result_count(r);
+        leptris_xpath_result_free(r);
+        return n;
+    };
+
+    /* TODO 190: the index builds on the SECOND axis query. Prime it so
+     * the post-insert query is served from the cached index — the
+     * stale-read shape in the report. */
+    auto prime = [&eval_count](LeptrisDocument doc) {
+        EXPECT_EQ(eval_count(doc, "//anchor"), 1);
+        EXPECT_EQ(eval_count(doc, "//anchor"), 1);
+    };
+
+    /* insert_after — the shape in the report (add_next_sibling). */
+    {
+        LeptrisDocument doc =
+            leptris_parse_string(xml, strlen(xml), nullptr);
+        ASSERT_NE(doc, nullptr);
+        prime(doc);
+        EXPECT_EQ(eval_count(doc, "//ext"), 0);
+        LeptrisElement anchor = leptris_element_first_child_any(
+            leptris_document_root(doc));
+        ASSERT_NE(anchor, nullptr);
+        LeptrisElement ext = leptris_element_create(doc, "ext");
+        ASSERT_NE(ext, nullptr);
+        ASSERT_EQ(leptris_element_insert_after(anchor, ext), LEPTRIS_OK);
+        EXPECT_EQ(eval_count(doc, "//ext"), 1);
+        leptris_document_free(doc);
+    }
+
+    /* insert_before. */
+    {
+        LeptrisDocument doc =
+            leptris_parse_string(xml, strlen(xml), nullptr);
+        ASSERT_NE(doc, nullptr);
+        prime(doc);
+        EXPECT_EQ(eval_count(doc, "//ext"), 0);
+        LeptrisElement anchor = leptris_element_first_child_any(
+            leptris_document_root(doc));
+        ASSERT_NE(anchor, nullptr);
+        LeptrisElement ext = leptris_element_create(doc, "ext");
+        ASSERT_NE(ext, nullptr);
+        ASSERT_EQ(leptris_element_insert_before(anchor, ext), LEPTRIS_OK);
+        EXPECT_EQ(eval_count(doc, "//ext"), 1);
+        leptris_document_free(doc);
+    }
+
+    /* prepend_child — the other child splice that skipped invalidation. */
+    {
+        LeptrisDocument doc =
+            leptris_parse_string(xml, strlen(xml), nullptr);
+        ASSERT_NE(doc, nullptr);
+        prime(doc);
+        EXPECT_EQ(eval_count(doc, "//ext"), 0);
+        LeptrisElement root = leptris_document_root(doc);
+        ASSERT_NE(root, nullptr);
+        LeptrisElement ext = leptris_element_create(doc, "ext");
+        ASSERT_NE(ext, nullptr);
+        ASSERT_EQ(leptris_element_prepend_child(root, ext), LEPTRIS_OK);
+        EXPECT_EQ(eval_count(doc, "//ext"), 1);
+        leptris_document_free(doc);
+    }
+
+    /* Compiled handle — the raw FFI face the binding evaluates with. */
+    {
+        LeptrisDocument doc =
+            leptris_parse_string(xml, strlen(xml), nullptr);
+        ASSERT_NE(doc, nullptr);
+        prime(doc);
+        LeptrisXPathCompiled compiled = leptris_xpath_compile("//ext");
+        ASSERT_NE(compiled, nullptr);
+        LeptrisXPathResult first =
+            leptris_xpath_compiled_eval(compiled, doc, nullptr);
+        ASSERT_NE(first, nullptr);
+        EXPECT_EQ(leptris_xpath_result_count(first), 0u);
+        leptris_xpath_result_free(first);
+
+        LeptrisElement anchor = leptris_element_first_child_any(
+            leptris_document_root(doc));
+        ASSERT_NE(anchor, nullptr);
+        LeptrisElement ext = leptris_element_create(doc, "ext");
+        ASSERT_NE(ext, nullptr);
+        ASSERT_EQ(leptris_element_insert_after(anchor, ext), LEPTRIS_OK);
+
+        LeptrisXPathResult second =
+            leptris_xpath_compiled_eval(compiled, doc, nullptr);
+        ASSERT_NE(second, nullptr);
+        EXPECT_EQ(leptris_xpath_result_count(second), 1u);
+        leptris_xpath_result_free(second);
+        leptris_xpath_compiled_free(compiled);
+        leptris_document_free(doc);
+    }
+}
+
 /* Lane 07 tail (#692-B): function items report a distinct public
  * result type at the boundary — closures and named references. */
 TEST(XPathResultTypes, FunctionItemsReportFunctionType) {

data/vendor-src/libleptris/vcpkg.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/microsoft/vcpkg/master/scripts/vcpkg.schema.json",
   "name": "leptris",
-  "version": "1.9.377",
+  "version": "1.9.378",
   "description": "High-performance XML parser and XPath 1.0 engine in C (libleptris)",
   "homepage": "https://github.com/leptris/leptris",
   "license": "MIT",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.377.0
+  version: 1.9.378.0
 platform: aarch64-linux
 authors:
 - Ribose Inc.
@@ -206,6 +206,7 @@ files:
 - vendor-src/libleptris/CONTEXT.md
 - vendor-src/libleptris/LICENSE.md
 - vendor-src/libleptris/README.adoc
+- vendor-src/libleptris/SECURITY.md
 - vendor-src/libleptris/TODO.SOTA.md
 - vendor-src/libleptris/TODO.assemble/README.md
 - vendor-src/libleptris/TODO.bindings/01-mutation-construction.md