mjml-rb 0.6.0 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8b17ed30bd6634734e144e636e50a7a940cb074a355b85d0021bf60d4cf12232
-  data.tar.gz: d6c58cb0e3b7e5d23315eab2fa71cbbfc7598ac6d1acbaf9b3eb1abace8473c2
+  metadata.gz: 576ea91f6ddfa5f9761941fa5472420588e1d772907673ba53c6152648a8d42c
+  data.tar.gz: ebf5669edd5b226f15489207df1f50759c91bcff8b3f30a053582fb0a87f84c3
 SHA512:
-  metadata.gz: 7240ddaa993999e89a757206971805019f40b0092db716a355c9b41aa711dbb4ae49808ac3eb498123c39844762483d8f3680271f9f836dc5fccee231c56d9dd
-  data.tar.gz: 80adca7028ef0dafb1d91b5b13b2a9f420bbb4a1c5922d3305249f07f4691438e29f73664387dbfe6f89bfcbebba119aaea98c7f4eb3d5918ee748b60f1b0489
+  metadata.gz: 53032c44384bc5ef6293a93afb4560025b686858b083d8bebf628ebd2df39b65d926f6afd89fb555f79ceb09da6175ea1d06f3eb43e55d2e8e5e982657f0736a
+  data.tar.gz: 77793e15678450c9fb13c8788863d0396a611b8354886b822341d080bb948229d1e28a1d69aa6c9880f9423a5b6507df126b977a31c3a1ad29128df82d4d1fec

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.6.1 — 2026-11-05
+
+- Raise the minimum `nokogiri` version from 1.13 to 1.19.5, which fixes
+  use-after-free, mutation XSS, and JRuby SSRF vulnerabilities.
+- Keep the MJML compatibility target at 5.4.1.
+
+See the [release notes](docs/releases/v0.6.1.md) and
+[Nokogiri security release](https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5).
+
 ## 0.6.0 — 2026-10-16
 
 Target MJML 5.4.1 with a development-only pinned reference compiler. Runtime

data/README.md

@@ -2,7 +2,7 @@
 
 # MJML Ruby Implementation
 
-`mjml-rb` **0.6.0** is a pure-Ruby compiler targeting **MJML 5.4.1**.
+`mjml-rb` **0.6.1** is a pure-Ruby compiler targeting **MJML 5.4.1**.
 The gem version and the upstream MJML version are separate. Node.js/npm is used
 only for the development reference checks; compilation requires neither.
 
@@ -16,16 +16,16 @@ only for the development reference checks; compilation requires neither.
 
 **[Full Usage Guide](docs/USAGE.md)** — API reference, all compiler options, component attribute tables, CLI flags, Rails setup, custom components, and more.
 
-See the [0.6.0 release notes](docs/releases/v0.6.0.md) and [changelog](CHANGELOG.md).
+See the [0.6.1 release notes](docs/releases/v0.6.1.md) and [changelog](CHANGELOG.md).
 
 ## Installation
 
-Requires Ruby **>= 3.3**, `css_parser` **>= 1.17, < 4**, and Nokogiri **>= 1.13**.
+Requires Ruby **>= 3.3**, `css_parser` **>= 1.17, < 4**, and Nokogiri **>= 1.19.5**.
 CI covers Ruby 3.3, 3.4 and 4.0 with `css_parser` 1.21, 2.x and 3.x.
 
 ```ruby
 # Gemfile
-gem "mjml-rb", "~> 0.6.0"
+gem "mjml-rb", "~> 0.6.1"
 ```
 
 ## Quick Start

data/docs/MIGRATING_TO_V5.md

@@ -1,10 +1,10 @@
 # Migrating to MJML v5
 
-`mjml-rb` 0.6.0 targets **MJML 5.4.1**. The 0.5.x line retains v4 behavior.
+`mjml-rb` 0.6.1 targets **MJML 5.4.1**. The 0.5.x line retains v4 behavior.
 There is no v4/v5 runtime switch. The library remains synchronous and requires
 no Node.js packages at runtime.
 
-Requires Ruby >= 3.3, `css_parser` >= 1.17 and < 4, and Nokogiri >= 1.13.
+Requires Ruby >= 3.3, `css_parser` >= 1.17 and < 4, and Nokogiri >= 1.19.5.
 The CI matrix covers `css_parser` 1.21, 2.x and 3.x on Ruby 3.3, 3.4 and 4.0.
 
 ## Includes require opt-in

data/docs/RELEASING.md

@@ -1,35 +1,35 @@
-# Publishing mjml-rb 0.6.0
+# Publishing mjml-rb 0.6.1
 
-The maintainer merges and publishes this release. Preparation does not create a
-tag, publish to RubyGems, or create a GitHub release.
+Release preparation bumps the version, validates the gem, and creates a draft
+GitHub release targeting the release commit. Publishing the GitHub release and
+pushing the gem to RubyGems are separate maintainer actions.
 
-Before merging PR #24, confirm all ten CI jobs pass for its final head, inspect
-the packaged gem and smoke-test its API and CLI from outside the checkout.
-Runtime source under `lib/` and `bin/` must match the downstream-validated
-commit `90f646e35968fdca3afda58c1f2891a7f7a290d6` unless a confirmed blocker is
-fixed and revalidated. Release documentation and package contents may change.
+Before publishing, review the release commit and its CI results, inspect the
+packaged gem, and smoke-test its API and CLI from outside the checkout. Confirm
+that the draft targets the intended release commit and includes the matching
+`mjml-rb-0.6.1.gem` asset. If the release commit changes, rebuild and replace the
+asset and update the draft's target before publishing.
 
-After merging PR #24, run the following from a clean repository checkout.
-The detached checkout selects the PR's exact merge commit even if `main` has
-subsequently advanced. The release date in the changelog and prepared
-[release notes](releases/v0.6.0.md) is 2026-10-16.
+The prepared [release notes](releases/v0.6.1.md) and changelog use 2026-11-05.
+Update the date if publication happens later.
+
+From a clean checkout of the reviewed release commit:
 
 ```sh
 set -e
 test -z "$(git status --porcelain)"
-test "$(gh pr view 24 --repo faraquet/mjml-rb --json state --jq .state)" = "MERGED"
-git fetch origin main --tags
-release_commit=$(gh pr view 24 --repo faraquet/mjml-rb --json mergeCommit --jq .mergeCommit.oid)
-git switch --detach "$release_commit"
-test "$(ruby -Ilib -rmjml-rb/version -e 'print MjmlRb::VERSION')" = "0.6.0"
+test "$(ruby -Ilib -rmjml-rb/version -e 'print MjmlRb::VERSION')" = "0.6.1"
+bundle exec rake test
 gem build mjml-rb.gemspec
-git tag -a v0.6.0 -m "mjml-rb 0.6.0"
-git push origin refs/tags/v0.6.0
-gem push mjml-rb-0.6.0.gem
-gh release create v0.6.0 --repo faraquet/mjml-rb --verify-tag --title "mjml-rb 0.6.0" --notes-file docs/releases/v0.6.0.md
 ```
 
-`gem push` publishes the built artifact to RubyGems using the maintainer's
-credentials, as described in the [RubyGems publishing guide](https://guides.rubygems.org/publishing/).
-No version bump is needed: the gem version is already 0.6.0, and
-`MjmlRb::MJML_COMPATIBILITY_VERSION` remains 5.4.1.
+After maintainer approval to publish:
+
+```sh
+gem push mjml-rb-0.6.1.gem
+gh release edit v0.6.1 --repo faraquet/mjml-rb --draft=false --latest
+```
+
+Publishing the draft creates its `v0.6.1` tag at the selected target if the tag
+does not already exist. `gem push` publishes to RubyGems using the maintainer's
+credentials. `MjmlRb::MJML_COMPATIBILITY_VERSION` remains 5.4.1.

data/docs/USAGE.md

@@ -1,10 +1,10 @@
 # mjml-rb Usage Guide
 
-`mjml-rb` 0.6.0 is a pure-Ruby compiler targeting [MJML 5.4.1](https://mjml.io/).
+`mjml-rb` 0.6.1 is a pure-Ruby compiler targeting [MJML 5.4.1](https://mjml.io/).
 Node.js/npm is only used for development reference checks, never at runtime.
 
 - **Ruby**: >= 3.3 (CI-tested on 3.3, 3.4, and 4.0)
-- **Dependencies**: css_parser (>= 1.17, < 4; CI-tested with 1.21, 2.x and 3.x), nokogiri (>= 1.13)
+- **Dependencies**: css_parser (>= 1.17, < 4; CI-tested with 1.21, 2.x and 3.x), nokogiri (>= 1.19.5)
 - **License**: MIT
 
 ---

data/docs/releases/v0.6.1.md

@@ -0,0 +1,23 @@
+# mjml-rb 0.6.1 — 2026-11-05
+
+Raise the minimum `nokogiri` dependency from 1.13 to 1.19.5 so installations
+include the fixes from Nokogiri's latest security release. Newer Nokogiri
+versions remain supported.
+
+Nokogiri 1.19.5 fixes:
+
+- A possible use-after-free when replacing attribute values on CRuby
+  ([GHSA-3w22-6jfg-527w](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-3w22-6jfg-527w)).
+- Mutation XSS involving HTML5 `noscript` serialization on CRuby
+  ([GHSA-4p39-36wj-23h4](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-4p39-36wj-23h4)).
+- A `NONET` bypass that could allow SSRF on JRuby
+  ([GHSA-v995-44v6-5fqm](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v995-44v6-5fqm)).
+
+These are upstream Nokogiri fixes; this release does not change the MJML
+compiler's rendering behavior. The MJML compatibility target remains **5.4.1**.
+Ruby >= 3.3 and `css_parser` >= 1.17, < 4 are still required.
+
+Update with `bundle update mjml-rb nokogiri`.
+
+See the [Nokogiri 1.19.5 release notes](https://github.com/sparklemotion/nokogiri/releases/tag/v1.19.5)
+for details and the HTML sanitization guidance for `noscript`.

data/lib/mjml-rb/version.rb

@@ -1,4 +1,4 @@
 module MjmlRb
   MJML_COMPATIBILITY_VERSION = "5.4.1".freeze
-  VERSION = "0.6.0".freeze
+  VERSION = "0.6.1".freeze
 end

data/mjml-rb.gemspec

@@ -19,5 +19,5 @@ Gem::Specification.new do |spec|
   spec.executables = ["mjml"]
   spec.require_paths = ["lib"]
   spec.add_dependency "css_parser", ">= 1.17", "< 4"
-  spec.add_dependency "nokogiri", ">= 1.13"
+  spec.add_dependency "nokogiri", ">= 1.19.5"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mjml-rb
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.1
 platform: ruby
 authors:
 - Andrei Andriichuk
@@ -35,14 +35,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.13'
+        version: 1.19.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.13'
+        version: 1.19.5
 description: Ruby-first MJML compiler API and CLI with compatibility-focused behavior.
 email:
 - andreiandriichuk@gmail.com
@@ -65,6 +65,7 @@ files:
 - docs/RELEASING.md
 - docs/USAGE.md
 - docs/releases/v0.6.0.md
+- docs/releases/v0.6.1.md
 - lib/mjml-rb.rb
 - lib/mjml-rb/cli.rb
 - lib/mjml-rb/column_gutter.rb