lexxy-variables 0.0.4 → 0.0.5

data/vendor/bundle/ruby/3.4.0/gems/lexxy-0.9.25/lib/lexxy/version.rb

@@ -0,0 +1,3 @@
+module Lexxy
+  VERSION = "0.9.25"
+end

data/vendor/bundle/ruby/3.4.0/gems/{loofah-2.25.1 → loofah-2.25.2}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 2.25.2 / 2026-07-15
+
+### Security
+
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes numeric character references without semicolons (e.g. `javascript&#58alert(1)`), which browsers decode and execute, and rejects schemes split by them. See [GHSA-5qhf-9phg-95m2](https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2). @flavorjones
+* Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes the named character references `	` and `
`, which `CGI.unescapeHTML` does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. `java	script:alert(1)`). See [GHSA-8whx-365g-h9vv](https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv). @flavorjones
+* Ensure that both `href` and `xlink:href` attributes on SVG elements like `use` are restricted to local (same-document) references. Previously only `xlink:href` was restricted, allowing the SVG 2 `href` attribute to reference external documents. See [GHSA-9wjq-cp2p-hrgf](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf). @flavorjones
+
+### Improved
+
+* Harden `data:` URI mediatype parsing in `Loofah::HTML5::Scrub.allowed_uri?`. The mediatype is now parsed following the [WHATWG data: URL spec](https://fetch.spec.whatwg.org/#data-urls) and [RFC 2397](https://www.rfc-editor.org/rfc/rfc2397) instead of simply being split on a colon. A `data:` URI with an omitted or malformed mediatype is now treated as `text/plain` and allowed, and one without the required comma is now rejected. #305 @flavorjones
+* Remove `feed` from the default set of allowed protocols. The [feed URI scheme](https://en.wikipedia.org/wiki/Feed_URI_scheme) was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @flavorjones
+* Remove a vestigial `&#x70` alternative from `Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR`. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @flavorjones
+
+
 ## 2.25.1 / 2026-03-17
 
 * Ensure `Loofah::HTML5::Scrub.allowed_uri?` recognizes unescaped whitespace entities and rejects schemas containing them. See [GHSA-46fp-8f5p-pf2m](https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m). #302 @flavorjones

data/vendor/bundle/ruby/3.4.0/gems/{loofah-2.25.1 → loofah-2.25.2}/lib/loofah/html5/safelist.rb

@@ -605,6 +605,11 @@ module Loofah
         "stroke",
       ])
 
+      SVG_HREF_ATTRIBUTES = Set.new([
+        "xlink:href",
+        "href",
+      ])
+
       SVG_ALLOW_LOCAL_HREF = Set.new([
         "altGlyph",
         "animate",
@@ -978,7 +983,7 @@ module Loofah
         "stroke-opacity",
       ])
 
-      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|%)3A/i
+      PROTOCOL_SEPARATOR = /:|(&#0*58)|(&#x0*3a)|(%|%)3A/i
 
       ACCEPTABLE_PROTOCOLS = Set.new([
         "afs",
@@ -987,7 +992,6 @@ module Loofah
         "data",
         "ed2k",
         "fax",
-        "feed",
         "ftp",
         "gopher",
         "http",

data/vendor/bundle/ruby/3.4.0/gems/{loofah-2.25.1 → loofah-2.25.2}/lib/loofah/html5/scrub.rb

@@ -14,7 +14,43 @@ module Loofah
       CSS_WHITESPACE = " "
       CSS_PROPERTY_STRING_WITHOUT_EMBEDDED_QUOTES = /\A(["'])?[^"']+\1\z/
       DATA_ATTRIBUTE_NAME = /\Adata-[\w-]+\z/
-      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*:/ # RFC 3986
+
+      # Decimal (`&#58`) or hexadecimal (`&#x3a`) form, with or without the trailing semicolon that
+      # CGI.unescapeHTML requires but browsers do not.
+      NUMERIC_CHARACTER_REFERENCE = /&#(x[0-9a-f]+|[0-9]+);?/i
+
+      # A scheme (RFC 3986) followed by a protocol separator. The separator must recognize the same
+      # encoded-colon forms as PROTOCOL_SEPARATOR, otherwise a scheme split by an encoded colon (for
+      # example "javascript&#58alert(1)") would not be recognized as having a scheme and would skip
+      # protocol validation.
+      URI_PROTOCOL_REGEX = /\A[a-z][a-z0-9+\-.]*#{SafeList::PROTOCOL_SEPARATOR}/
+
+      # Matches a valid MIME type "essence" (type "/" subtype, no parameters), used to
+      # decide whether a data: URI mediatype is well-formed; a non-match is not a valid
+      # MIME type, which the data: URL processor treats as text/plain. Specs:
+      #
+      #   https://mimesniff.spec.whatwg.org/#valid-mime-type
+      #   https://mimesniff.spec.whatwg.org/#mime-type-essence
+      #   https://mimesniff.spec.whatwg.org/#http-token-code-point
+      #
+      # The character class below is the HTTP token set (tchar) from RFC 9110 section
+      # 5.6.2, https://www.rfc-editor.org/rfc/rfc9110#name-tokens :
+      #
+      #   tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^"
+      #         / "_" / "`" / "|" / "~" / DIGIT / ALPHA
+      #
+      # ALPHA is written a-z, not a-zA-Z, because allowed_uri? downcases the input first.
+      DATA_URI_MEDIATYPE = %r{
+        \A
+        [a-z0-9!\#$%&'*+\-.^_`|~]+   # type:    1*tchar
+        /                            # "/" is not a tchar, so it is the sole delimiter
+        [a-z0-9!\#$%&'*+\-.^_`|~]+   # subtype: 1*tchar
+        \z
+      }x
+
+      # HTML5 named character references for whitespace that browsers strip from
+      # URIs. CGI.unescapeHTML does not decode these, so they are handled explicitly.
+      WHITESPACE_CHARACTER_REFERENCES = /&(Tab|NewLine);/
 
       class << self
         def allowed_element?(element_name)
@@ -48,7 +84,7 @@ module Loofah
             end
 
             next unless SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) &&
-              attr_name == "xlink:href" &&
+              SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) &&
               attr_node.value =~ /^\s*[^#\s].*/m
 
             attr_node.remove
@@ -141,29 +177,52 @@ module Loofah
           attr_node.value = values.join(" ")
         end
 
-        # Returns true if the given URI string is safe, false otherwise.
-        # This method can be used to validate URI attribute values without
-        # requiring a Nokogiri DOM node.
+        # Returns true if the given URI string is safe, false otherwise. This method can be used to
+        # validate URI attribute values without requiring a Nokogiri DOM node.
         def allowed_uri?(uri_string)
-          # Replace control characters both before and after unescaping.
-          uri_string = CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, ""))
-            .gsub(CONTROL_CHARACTERS, "")
-            .gsub("&colon;", ":")
-            .downcase
+          # CGI.unescapeHTML decodes numeric references only when they carry a trailing semicolon, so
+          # also decode the semicolon-less ones, which browsers still decode and execute. Normalizing
+          # more aggressively than a browser only rejects more, which is safe. Control characters are
+          # stripped both before and after decoding, since decoding can produce them. That strip must
+          # precede WHITESPACE_CHARACTER_REFERENCES: removing a control character can reveal a named
+          # whitespace reference.
+          uri_string = decode_numeric_character_references(CGI.unescapeHTML(uri_string.gsub(CONTROL_CHARACTERS, "")))
+          uri_string.gsub!(CONTROL_CHARACTERS, "")
+          uri_string.gsub!(WHITESPACE_CHARACTER_REFERENCES, "")
+          uri_string.gsub!("&colon;", ":")
+          uri_string.downcase!
           if URI_PROTOCOL_REGEX.match?(uri_string)
             protocol = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[0]
             return false unless SafeList::ALLOWED_PROTOCOLS.include?(protocol)
 
             if protocol == "data"
               # permit only allowed data mediatypes
-              mediatype = uri_string.split(SafeList::PROTOCOL_SEPARATOR)[1]
-              mediatype, _ = mediatype.split(/[;,]/)[0..1] if mediatype
-              return false if mediatype && !SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(mediatype)
+              return false unless SafeList::ALLOWED_URI_DATA_MEDIATYPES.include?(data_uri_mediatype(uri_string))
             end
           end
           true
         end
 
+        def decode_numeric_character_references(string)
+          string.gsub(NUMERIC_CHARACTER_REFERENCE) do |reference|
+            digits = ::Regexp.last_match(1)
+            hexadecimal = digits.start_with?("x", "X")
+            digits = digits[1..-1] if hexadecimal
+            significant_digits = digits.sub(/\A0+/, "")
+
+            # The largest code point is U+10FFFF: 7 decimal or 6 hexadecimal significant digits.
+            # Anything longer is out of range; skip it without building a large integer from it.
+            next reference if significant_digits.length > (hexadecimal ? 6 : 7)
+
+            codepoint = significant_digits.to_i(hexadecimal ? 16 : 10)
+            begin
+              codepoint.chr(Encoding::UTF_8)
+            rescue RangeError
+              reference
+            end
+          end
+        end
+
         def scrub_uri_attribute(attr_node)
           if allowed_uri?(attr_node.value)
             false
@@ -238,6 +297,20 @@ module Loofah
             string
           end
         end
+
+        private
+
+        # Returns the mediatype of a data: URI per RFC 2397, or nil when the
+        # required comma is absent. allowed_uri? entity-decodes, downcases, and
+        # strips control characters before calling this. An omitted or malformed
+        # mediatype resolves to "text/plain", matching the WHATWG data: URL processor.
+        def data_uri_mediatype(uri_string)
+          metadata, comma, _data = uri_string.delete_prefix("data:").partition(",")
+          return nil if comma.empty?
+
+          mediatype = metadata.delete_suffix(";base64").split(";", 2).first.to_s.strip
+          mediatype.match?(DATA_URI_MEDIATYPE) ? mediatype : "text/plain"
+        end
       end
     end
   end

data/vendor/bundle/ruby/3.4.0/gems/{loofah-2.25.1 → loofah-2.25.2}/lib/loofah/version.rb

@@ -2,5 +2,5 @@
 
 module Loofah
   # The version of Loofah you are using
-  VERSION = "2.25.1"
+  VERSION = "2.25.2"
 end

data/vendor/bundle/ruby/3.4.0/gems/{parser-3.3.11.1 → parser-3.3.12.0}/lib/parser/current.rb

@@ -111,7 +111,7 @@ module Parser
     CurrentRuby = Ruby32
 
   when /^3\.3\./
-    current_version = '3.3.11'
+    current_version = '3.3.12'
     if RUBY_VERSION != current_version
       warn_syntax_deviation 'parser/ruby33', current_version
     end

data/vendor/bundle/ruby/3.4.0/gems/{parser-3.3.11.1 → parser-3.3.12.0}/lib/parser/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Parser
-  VERSION = '3.3.11.1'
+  VERSION = '3.3.12.0'
 end

data/vendor/bundle/ruby/3.4.0/gems/{rails-html-sanitizer-1.7.0 → rails-html-sanitizer-1.7.1}/CHANGELOG.md

@@ -1,3 +1,18 @@
+## v1.7.1 / 2026-07-15
+
+* SVG reference elements now restrict both `href` and `xlink:href` to local references.
+
+  Previously `PermitScrubber` restricted only `xlink:href` on elements in `SVG_ALLOW_LOCAL_HREF`,
+  so a plain `href` attribute on those elements could reference an external document. Applications
+  are only affected if the allowed tags are overridden to include an SVG reference element such as
+  `use`; the default configuration is not affected.
+
+  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now
+  `~> 2.25, >= 2.25.2`.
+
+  *Mike Dalessio*
+
+
 ## v1.7.0 / 2026-02-24
 
 * Add `Rails::HTML::Sanitizer.allowed_uri?` which delegates to `Loofah::HTML5::Scrub.allowed_uri?`,

data/vendor/bundle/ruby/3.4.0/gems/{rails-html-sanitizer-1.7.0 → rails-html-sanitizer-1.7.1}/lib/rails/html/sanitizer/version.rb

@@ -3,7 +3,7 @@
 module Rails
   module HTML
     class Sanitizer
-      VERSION = "1.7.0"
+      VERSION = "1.7.1"
     end
   end
 end

data/vendor/bundle/ruby/3.4.0/gems/{rails-html-sanitizer-1.7.0 → rails-html-sanitizer-1.7.1}/lib/rails/html/scrubbers.rb

@@ -172,7 +172,7 @@ module Rails
             Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
           end
 
-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m
+          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m
             attr_node.remove
           end
 

data/vendor/bundle/ruby/3.4.0/specifications/{concurrent-ruby-1.3.7.gemspec → concurrent-ruby-1.3.8.gemspec}

@@ -1,15 +1,15 @@
 # -*- encoding: utf-8 -*-
-# stub: concurrent-ruby 1.3.7 ruby lib/concurrent-ruby
+# stub: concurrent-ruby 1.3.8 ruby lib/concurrent-ruby
 
 Gem::Specification.new do |s|
   s.name = "concurrent-ruby".freeze
-  s.version = "1.3.7".freeze
+  s.version = "1.3.8".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
   s.metadata = { "changelog_uri" => "https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md", "source_code_uri" => "https://github.com/ruby-concurrency/concurrent-ruby" } if s.respond_to? :metadata=
   s.require_paths = ["lib/concurrent-ruby".freeze]
   s.authors = ["Jerry D'Antonio".freeze, "Petr Chalupa".freeze, "The Ruby Concurrency Team".freeze]
-  s.date = "2026-06-16"
+  s.date = "2026-07-19"
   s.description = "Modern concurrency tools including agents, futures, promises, thread pools, actors, supervisors, and more.\nInspired by Erlang, Clojure, Go, JavaScript, actors, and classic concurrency patterns.\n".freeze
   s.email = "concurrent-ruby@googlegroups.com".freeze
   s.extra_rdoc_files = ["CHANGELOG.md".freeze, "LICENSE.txt".freeze, "README.md".freeze]

data/vendor/bundle/ruby/3.4.0/specifications/{erb-6.0.4.gemspec → erb-6.0.5.gemspec}

@@ -1,13 +1,13 @@
 # -*- encoding: utf-8 -*-
-# stub: erb 6.0.4 ruby lib
+# stub: erb 6.0.5 ruby lib
 # stub: ext/erb/escape/extconf.rb
 
 Gem::Specification.new do |s|
   s.name = "erb".freeze
-  s.version = "6.0.4".freeze
+  s.version = "6.0.5".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
-  s.metadata = { "changelog_uri" => "https://github.com/ruby/erb/blob/v6.0.4/NEWS.md", "homepage_uri" => "https://github.com/ruby/erb", "source_code_uri" => "https://github.com/ruby/erb" } if s.respond_to? :metadata=
+  s.metadata = { "changelog_uri" => "https://github.com/ruby/erb/blob/v6.0.5/NEWS.md", "homepage_uri" => "https://github.com/ruby/erb", "source_code_uri" => "https://github.com/ruby/erb" } if s.respond_to? :metadata=
   s.require_paths = ["lib".freeze]
   s.authors = ["Masatoshi SEKI".freeze, "Takashi Kokubun".freeze]
   s.bindir = "libexec".freeze

data/vendor/bundle/ruby/3.4.0/specifications/{lexxy-0.9.24.gemspec → lexxy-0.9.25.gemspec}

@@ -1,10 +1,10 @@
 # -*- encoding: utf-8 -*-
-# stub: lexxy 0.9.24 ruby lib
+# stub: lexxy 0.9.25 ruby lib
 # stub: ext/Rakefile
 
 Gem::Specification.new do |s|
   s.name = "lexxy".freeze
-  s.version = "0.9.24".freeze
+  s.version = "0.9.25".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
   s.metadata = { "changelog_uri" => "https://github.com/basecamp/lexxy", "homepage_uri" => "https://github.com/basecamp/lexxy", "source_code_uri" => "https://github.com/basecamp/lexxy" } if s.respond_to? :metadata=

data/vendor/bundle/ruby/3.4.0/specifications/{loofah-2.25.1.gemspec → loofah-2.25.2.gemspec}

@@ -1,9 +1,9 @@
 # -*- encoding: utf-8 -*-
-# stub: loofah 2.25.1 ruby lib
+# stub: loofah 2.25.2 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "loofah".freeze
-  s.version = "2.25.1".freeze
+  s.version = "2.25.2".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
   s.metadata = { "bug_tracker_uri" => "https://github.com/flavorjones/loofah/issues", "changelog_uri" => "https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md", "documentation_uri" => "https://www.rubydoc.info/gems/loofah/", "funding_uri" => "https://github.com/sponsors/flavorjones", "homepage_uri" => "https://github.com/flavorjones/loofah", "source_code_uri" => "https://github.com/flavorjones/loofah" } if s.respond_to? :metadata=
@@ -15,7 +15,7 @@ Gem::Specification.new do |s|
   s.homepage = "https://github.com/flavorjones/loofah".freeze
   s.licenses = ["MIT".freeze]
   s.required_ruby_version = Gem::Requirement.new(">= 2.5.0".freeze)
-  s.rubygems_version = "4.0.3".freeze
+  s.rubygems_version = "4.0.10".freeze
   s.summary = "Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.".freeze
 
   s.installed_by_version = "3.6.9".freeze

data/vendor/bundle/ruby/3.4.0/specifications/{parser-3.3.11.1.gemspec → parser-3.3.12.0.gemspec}

@@ -1,15 +1,15 @@
 # -*- encoding: utf-8 -*-
-# stub: parser 3.3.11.1 ruby lib
+# stub: parser 3.3.12.0 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "parser".freeze
-  s.version = "3.3.11.1".freeze
+  s.version = "3.3.12.0".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
-  s.metadata = { "bug_tracker_uri" => "https://github.com/whitequark/parser/issues", "changelog_uri" => "https://github.com/whitequark/parser/blob/v3.3.11.1/CHANGELOG.md", "documentation_uri" => "https://www.rubydoc.info/gems/parser/3.3.11.1", "source_code_uri" => "https://github.com/whitequark/parser/tree/v3.3.11.1" } if s.respond_to? :metadata=
+  s.metadata = { "bug_tracker_uri" => "https://github.com/whitequark/parser/issues", "changelog_uri" => "https://github.com/whitequark/parser/blob/v3.3.12.0/CHANGELOG.md", "documentation_uri" => "https://www.rubydoc.info/gems/parser/3.3.12.0", "source_code_uri" => "https://github.com/whitequark/parser/tree/v3.3.12.0" } if s.respond_to? :metadata=
   s.require_paths = ["lib".freeze]
   s.authors = ["whitequark".freeze]
-  s.date = "2026-03-27"
+  s.date = "2026-07-16"
   s.description = "A Ruby parser written in pure Ruby.".freeze
   s.email = ["whitequark@whitequark.org".freeze]
   s.executables = ["ruby-parse".freeze, "ruby-rewrite".freeze]

data/vendor/bundle/ruby/3.4.0/specifications/{rails-html-sanitizer-1.7.0.gemspec → rails-html-sanitizer-1.7.1.gemspec}

@@ -1,12 +1,12 @@
 # -*- encoding: utf-8 -*-
-# stub: rails-html-sanitizer 1.7.0 ruby lib
+# stub: rails-html-sanitizer 1.7.1 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "rails-html-sanitizer".freeze
-  s.version = "1.7.0".freeze
+  s.version = "1.7.1".freeze
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0".freeze) if s.respond_to? :required_rubygems_version=
-  s.metadata = { "bug_tracker_uri" => "https://github.com/rails/rails-html-sanitizer/issues", "changelog_uri" => "https://github.com/rails/rails-html-sanitizer/blob/v1.7.0/CHANGELOG.md", "documentation_uri" => "https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.0", "source_code_uri" => "https://github.com/rails/rails-html-sanitizer/tree/v1.7.0" } if s.respond_to? :metadata=
+  s.metadata = { "bug_tracker_uri" => "https://github.com/rails/rails-html-sanitizer/issues", "changelog_uri" => "https://github.com/rails/rails-html-sanitizer/blob/v1.7.1/CHANGELOG.md", "documentation_uri" => "https://www.rubydoc.info/gems/rails-html-sanitizer/1.7.1", "source_code_uri" => "https://github.com/rails/rails-html-sanitizer/tree/v1.7.1" } if s.respond_to? :metadata=
   s.require_paths = ["lib".freeze]
   s.authors = ["Rafael Mendon\u00E7a Fran\u00E7a".freeze, "Kasper Timm Hansen".freeze, "Mike Dalessio".freeze]
   s.date = "1980-01-02"
@@ -15,13 +15,13 @@ Gem::Specification.new do |s|
   s.homepage = "https://github.com/rails/rails-html-sanitizer".freeze
   s.licenses = ["MIT".freeze]
   s.required_ruby_version = Gem::Requirement.new(">= 2.7.0".freeze)
-  s.rubygems_version = "4.0.3".freeze
+  s.rubygems_version = "4.0.10".freeze
   s.summary = "This gem is responsible to sanitize HTML fragments in Rails applications.".freeze
 
   s.installed_by_version = "3.6.9".freeze
 
   s.specification_version = 4
 
-  s.add_runtime_dependency(%q<loofah>.freeze, ["~> 2.25".freeze])
+  s.add_runtime_dependency(%q<loofah>.freeze, ["~> 2.25".freeze, ">= 2.25.2".freeze])
   s.add_runtime_dependency(%q<nokogiri>.freeze, [">= 1.15.7".freeze, "!= 1.16.0".freeze, "!= 1.16.0.rc1".freeze, "!= 1.16.1".freeze, "!= 1.16.2".freeze, "!= 1.16.3".freeze, "!= 1.16.4".freeze, "!= 1.16.5".freeze, "!= 1.16.6".freeze, "!= 1.16.7".freeze])
 end