nokogiri 1.12.5 → 1.14.3

data/LICENSE.md

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright 2008 -- 2021 by Mike Dalessio, Aaron Patterson, Yoko Harada, Akinori MUSHA, John Shahid, Karol Bucek, Sam Ruby, Craig Barnes, Stephen Checkoway, Lars Kanis, Sergio Arbeo, Timothy Elliott, Nobuyoshi Nakada, Charles Nutter, Patrick Mahoney.
+Copyright 2008 -- 2023 by Mike Dalessio, Aaron Patterson, Yoko Harada, Akinori MUSHA, John Shahid, Karol Bucek, Sam Ruby, Craig Barnes, Stephen Checkoway, Lars Kanis, Sergio Arbeo, Timothy Elliott, Nobuyoshi Nakada, Charles Nutter, Patrick Mahoney.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

data/README.md

@@ -2,7 +2,7 @@
 
 # Nokogiri
 
-Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for [reading](https://nokogiri.org/tutorials/parsing_an_html_xml_document.html), writing, [modifying](https://nokogiri.org/tutorials/modifying_an_html_xml_document.html), and [querying](https://nokogiri.org/tutorials/searching_a_xml_html_document.html) documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).
+Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for [reading](https://nokogiri.org/tutorials/parsing_an_html_xml_document.html), writing, [modifying](https://nokogiri.org/tutorials/modifying_an_html_xml_document.html), and [querying](https://nokogiri.org/tutorials/searching_a_xml_html_document.html) documents. It is fast and standards-compliant by relying on native parsers like libxml2, libgumbo, and xerces.
 
 ## Guiding Principles
 
@@ -30,7 +30,9 @@ Some guiding principles Nokogiri tries to follow:
 [![Appveyor CI](https://ci.appveyor.com/api/projects/status/xj2pqwvlxwuwgr06/branch/main?svg=true)](https://ci.appveyor.com/project/flavorjones/nokogiri/branch/main)
 
 [![Gem Version](https://badge.fury.io/rb/nokogiri.svg)](https://rubygems.org/gems/nokogiri)
-[![SemVer compatibility](https://api.dependabot.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&version-scheme=semver)](https://dependabot.com/compatibility-score/?dependency-name=nokogiri&package-manager=bundler)
+[![SemVer compatibility](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.11.7&new-version=1.12.5)](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates#about-compatibility-scores)
+
+[![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/5344/badge)](https://bestpractices.coreinfrastructure.org/projects/5344)
 [![Tidelift dependencies](https://tidelift.com/badges/package/rubygems/nokogiri)](https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme)
 
 
@@ -38,10 +40,6 @@ Some guiding principles Nokogiri tries to follow:
 
 All official documentation is posted at https://nokogiri.org (the source for which is at https://github.com/sparklemotion/nokogiri.org/, and we welcome contributions).
 
-Consider subscribing to [Tidelift][tidelift] which provides license assurances and timely security notifications for your open source dependencies, including Nokogiri. [Tidelift][tidelift] subscriptions also help the Nokogiri maintainers fund our [automated testing](https://ci.nokogiri.org) which in turn allows us to ship releases, bugfixes, and security updates more often.
-
-  [tidelift]: https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme
-
 ### Reading
 
 Your first stops for learning more about Nokogiri should be:
@@ -55,7 +53,6 @@ Your first stops for learning more about Nokogiri should be:
 
 There are a few ways to ask exploratory questions:
 
-- The Ruby Discord chat server is active at https://discord.gg/UyQnKrT
 - The Nokogiri mailing list is active at https://groups.google.com/group/nokogiri-talk
 - Open an issue using the "Help Request" template at https://github.com/sparklemotion/nokogiri/issues
 
@@ -78,7 +75,7 @@ Full information and description of our security policy is in [`SECURITY.md`](SE
 
 ### Semantic Versioning Policy
 
-Nokogiri follows [Semantic Versioning](https://semver.org/) (since 2017 or so). [![Dependabot's SemVer compatibility score for Nokogiri](https://api.dependabot.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&version-scheme=semver)](https://dependabot.com/compatibility-score/?dependency-name=nokogiri&package-manager=bundler)
+Nokogiri follows [Semantic Versioning](https://semver.org/) (since 2017 or so). [![Dependabot's SemVer compatibility score for Nokogiri](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.11.7&new-version=1.12.5)](https://docs.github.com/en/code-security/supply-chain-security/managing-vulnerabilities-in-your-projects-dependencies/about-dependabot-security-updates#about-compatibility-scores)
 
 We bump `Major.Minor.Patch` versions following this guidance:
 
@@ -101,12 +98,21 @@ We bump `Major.Minor.Patch` versions following this guidance:
 - Updating packaged libraries for security-related reasons.
 
 
+### Sponsorship
+
+You can help sponsor the maintainers of this software through one of these organizations:
+
+- [github.com/sponsors/flavorjones](https://github.com/sponsors/flavorjones)
+- [opencollective.com/nokogiri](https://opencollective.com/nokogiri)
+- [tidelift.com/subscription/pkg/rubygems-nokogiri](https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme)
+
+
 ## Installation
 
 Requirements:
 
-- Ruby >= 2.5
-- JRuby >= 9.2.0.0
+- Ruby >= 2.7
+- JRuby >= 9.4.0.0
 
 
 ### Native Gems: Faster, more reliable installation
@@ -115,12 +121,15 @@ Requirements:
 
 ### Supported Platforms
 
-As of v1.11.0, Nokogiri ships pre-compiled, "native" gems for the following platforms:
+Nokogiri ships pre-compiled, "native" gems for the following platforms:
 
-- Linux: `x86-linux` and `x86_64-linux` (req: `glibc >= 2.17`), including musl platforms like Alpine
+- Linux:
+  - `x86-linux` and `x86_64-linux` (req: `glibc >= 2.17`)
+  - `aarch64-linux` and `arm-linux` (req: `glibc >= 2.29`)
+  - Note that musl platforms like Alpine **are** supported
 - Darwin/MacOS: `x86_64-darwin` and `arm64-darwin`
-- Windows: `x86-mingw32` and `x64-mingw32`
-- Java: any platform running JRuby 9.2 or higher
+- Windows: `x86-mingw32`, `x64-mingw32`, and `x64-mingw-ucrt`
+- Java: any platform running JRuby 9.4 or higher
 
 To determine whether your system supports one of these gems, look at the output of `bundle platform` or `ruby -e 'puts Gem::Platform.local.to_s'`.
 

data/bin/nokogiri

@@ -1,61 +1,77 @@
 #!/usr/bin/env ruby
-require 'optparse'
-require 'open-uri'
-require 'uri'
-require 'rubygems'
-require 'nokogiri'
-autoload :IRB, 'irb'
+# frozen_string_literal: true
+
+require "optparse"
+require "open-uri"
+require "uri"
+require "rubygems"
+require "nokogiri"
+autoload :IRB, "irb"
 
 parse_class = Nokogiri
 encoding = nil
 
 # This module provides some tunables with the nokogiri CLI for use in
 # your ~/.nokogirirc.
-module Nokogiri::CLI
-  class << self
-    # Specify the console engine, defaulted to IRB.
-    #
-    # call-seq:
-    #   require 'pry'
-    #   Nokogiri::CLI.console = Pry
-    attr_writer :console
-
-    def console
-      case @console
-      when Symbol
-        Kernel.const_get(@console)
-      else
-        @console
+module Nokogiri
+  module CLI
+    class << self
+      # Specify the console engine, defaulted to IRB.
+      #
+      # call-seq:
+      #   require 'pry'
+      #   Nokogiri::CLI.console = Pry
+      attr_writer :console
+
+      def console
+        case @console
+        when Symbol
+          Kernel.const_get(@console)
+        else
+          @console
+        end
       end
+
+      attr_accessor :rcfile
     end
 
-    attr_accessor :rcfile
+    self.rcfile  = File.expand_path("~/.nokogirirc")
+    self.console = :IRB
   end
+end
 
-  self.rcfile  = File.expand_path('~/.nokogirirc')
-  self.console = :IRB
+def safe_read(uri_or_path)
+  uri = URI.parse(uri_or_path)
+  case uri
+  when URI::HTTP
+    uri.read
+  when URI::File
+    File.read(uri.path)
+  else
+    File.read(uri_or_path)
+  end
 end
 
 opts = OptionParser.new do |opts|
   opts.banner = "Nokogiri: an HTML, XML, SAX, and Reader parser"
-  opts.define_head "Usage: nokogiri <uri|path> [options]"
-  opts.separator ""
-  opts.separator "Examples:"
-  opts.separator "  nokogiri https://www.ruby-lang.org/"
-  opts.separator "  nokogiri ./public/index.html"
-  opts.separator "  curl -s http://www.nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'"
-  opts.separator ""
-  opts.separator "Options:"
+  opts.define_head("Usage: nokogiri <uri|path> [options]")
+  opts.separator("")
+  opts.separator("Examples:")
+  opts.separator("  nokogiri https://www.ruby-lang.org/")
+  opts.separator("  nokogiri ./public/index.html")
+  opts.separator("  curl -s http://www.nokogiri.org | nokogiri -e'p $_.css(\"h1\").length'")
+  opts.separator("")
+  opts.separator("Options:")
 
   opts.on("--type type", "Parse as type: xml or html (default: auto)", [:xml, :html]) do |v|
-    parse_class = {:xml => Nokogiri::XML, :html => Nokogiri::HTML}[v]
+    parse_class = { xml: Nokogiri::XML, html: Nokogiri::HTML }[v]
   end
 
   opts.on("-C file", "Specifies initialization file to load (default #{Nokogiri::CLI.rcfile})") do |v|
     Nokogiri::CLI.rcfile = v
   end
 
-  opts.on("-E", "--encoding encoding", "Read as encoding (default: #{encoding || 'none'})") do |v|
+  opts.on("-E", "--encoding encoding", "Read as encoding (default: #{encoding || "none"})") do |v|
     encoding = v
   end
 
@@ -64,7 +80,7 @@ opts = OptionParser.new do |opts|
   end
 
   opts.on("--rng <uri|path>", "Validate using this rng file.") do |v|
-    @rng = open(v) {|f| Nokogiri::XML::RelaxNG(f)}
+    @rng = Nokogiri::XML::RelaxNG(safe_read(v))
   end
 
   opts.on_tail("-?", "--help", "Show this message") do
@@ -90,15 +106,10 @@ if File.file?(Nokogiri::CLI.rcfile)
   load Nokogiri::CLI.rcfile
 end
 
-if url || $stdin.tty?
-  case uri = (URI(url) rescue url)
-  when URI::HTTP
-    @doc = parse_class.parse(uri.read, url, encoding)
-  else
-    @doc = parse_class.parse(open(url).read, nil, encoding)
-  end
+@doc = if url || $stdin.tty?
+  parse_class.parse(safe_read(url), url, encoding)
 else
-  @doc = parse_class.parse($stdin, nil, encoding)
+  parse_class.parse($stdin, nil, encoding)
 end
 
 $_ = @doc
@@ -107,12 +118,14 @@ if @rng
   @rng.validate(@doc).each do |error|
     puts error.message
   end
-else
-  if @script
-    eval @script, binding, '<main>'
-  else
-    puts "Your document is stored in @doc..."
-    Nokogiri::CLI.console.start
+elsif @script
+  begin
+    eval(@script, binding, "<main>") # rubocop:disable Security/Eval
+  rescue Exception => e # rubocop:disable Lint/RescueException
+    warn("ERROR: Exception raised while evaluating '#{@script}'")
+    raise e
   end
+else
+  puts "Your document is stored in @doc..."
+  Nokogiri::CLI.console.start
 end
-

data/dependencies.yml

@@ -1,74 +1,41 @@
 libxml2:
-  version: "2.9.12"
-  sha256: "c8d6681e38c56f172892c85ddc0852e1fd4b53b4209e7f4ebf17f7e2eae71d92"
-  #  manually verified checksum:
-  #
-  #    $ gpg --verify libxml2-2.9.12.tar.gz.asc ports/archives/libxml2-2.9.12.tar.gz
-  #    gpg: Signature made Thu 13 May 2021 02:59:16 PM EDT
-  #    gpg:                using RSA key DB46681BB91ADCEA170FA2D415588B26596BEA5D
-  #    gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>" [unknown]
-  #    gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>" [unknown]
-  #    gpg: WARNING: This key is not certified with a trusted signature!
-  #    gpg:          There is no indication that the signature belongs to the owner.
-  #    Primary key fingerprint: C744 15BA 7C9C 7F78 F02E  1DC3 4606 B8A5 DE95 BC1F
-  #         Subkey fingerprint: DB46 681B B91A DCEA 170F  A2D4 1558 8B26 596B EA5D
-  #
-  #  using this pgp signature:
-  #
-  #    -----BEGIN PGP SIGNATURE-----
-  #    
-  #    iQEzBAABCAAdFiEE20ZoG7ka3OoXD6LUFViLJllr6l0FAmCddwQACgkQFViLJllr
-  #    6l11LQgAioRTdfmcC+uK/7+6HPtF/3c5zkX6j8VGYuvFBwZ0jayqMRBAl++fcpjE
-  #    JUU/JKebSZ/KCYjzyeOWK/i3Gq77iqm3UbZFB85rqu4a5P3gmj/4STWVyAx0KU3z
-  #    G3jKqDhJOt7c0acXb5lh2DngfDa1dn/VGcQcIXsqplNxNr4ET7MnSJjZ3nlxYfW2
-  #    E5vWBdPCMUeXDBl6MjYvw9XnGGBLUAaEJWoFToG6jKmVf4GAd9nza20jj5dtbcJq
-  #    QEOaSDKDr+f9h2NS8haOhJ9vOpy52PdeGzaFlbRkXarGXuAr8kITgATVs8FAqcgv
-  #    MoVhmrO5r2hJf0dCM9fZoYqzpMfmNA==
-  #    =KfJ9
-  #    -----END PGP SIGNATURE-----
-  #
+  version: "2.10.4"
+  sha256: "ed0c91c5845008f1936739e4eee2035531c1c94742c6541f44ee66d885948d45"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.10/libxml2-2.10.4.sha256sum
 
 libxslt:
-  version: "1.1.34"
-  sha256: "98b1bd46d6792925ad2dfe9a87452ea2adebf69dcb9919ffd55bf926a7f93f7f"
-  #  manually verified checksum:
-  #
-  #    $ gpg --verify ~/Downloads/libxslt-1.1.34.tar.gz.asc ports/archives/libxslt-1.1.34.tar.gz
-  #    gpg: Signature made Wed 30 Oct 2019 04:02:48 PM EDT
-  #    gpg:                using RSA key DB46681BB91ADCEA170FA2D415588B26596BEA5D
-  #    gpg: Good signature from "Daniel Veillard (Red Hat work email) <veillard@redhat.com>" [unknown]
-  #    gpg:                 aka "Daniel Veillard <Daniel.Veillard@w3.org>" [unknown]
-  #    gpg: WARNING: This key is not certified with a trusted signature!
-  #    gpg:          There is no indication that the signature belongs to the owner.
-  #    Primary key fingerprint: C744 15BA 7C9C 7F78 F02E  1DC3 4606 B8A5 DE95 BC1F
-  #         Subkey fingerprint: DB46 681B B91A DCEA 170F  A2D4 1558 8B26 596B EA5D
-  #
-  #  using this pgp signature:
-  #
-  #    -----BEGIN PGP SIGNATURE-----
-  #    
-  #    iQEzBAABCAAdFiEE20ZoG7ka3OoXD6LUFViLJllr6l0FAl257GgACgkQFViLJllr
-  #    6l2vVggAjJEHmASiS56SxhPOsGqbfBihM66gQFoIymQfMu2430N1GSTkLsfbkJO8
-  #    8yBX11NjzK/m9uxwshMW3rVCU7EpL3PUimN3reXdPiQj9hAOAWF1V3BZNevbQC2E
-  #    FCIraioukaidf8sjUG4/sGpK/gOcP/3hYoN0HUoBigCNJjDqhijxM3M3GJJtCASp
-  #    jL4CQbs2OmxW8ixOZbuWEESvFFHUgYRsdZjRVN+GRfSOvJjxypurmYwQ3RjO7JxL
-  #    2FY8qKQ+xpeID8NV8F5OUEvWBjk1QS133VTqBZNlONdnEtV/og6jNu5k0O/Kvhup
-  #    caR+8TMErOcLr9OgDklO6DoYyAsf9Q==
-  #    =g4i4
-  #    -----END PGP SIGNATURE-----
-  #
+  version: "1.1.37"
+  sha256: "3a4b27dc8027ccd6146725950336f1ec520928f320f144eb5fa7990ae6123ab4"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.37.sha256sum
 
 zlib:
-  version: "1.2.11"
-  sha256: "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1"
+  version: "1.2.13"
+  sha256: "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30"
   # SHA-256 hash provided on http://zlib.net/
 
 libiconv:
-  version: "1.15"
-  sha256: "ccf536620a45458d26ba83887a983b96827001e92a13847b45e4925cc8913178"
-  # gpg: Signature made Fri Feb  3 00:38:12 2017 CET
-  # gpg:                using RSA key 4F494A942E4616C2
-  # gpg: Good signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>" [unknown]
-  # gpg: WARNING: This key is not certified with a trusted signature!
-  # gpg:          There is no indication that the signature belongs to the owner.
-  # Primary key fingerprint: 68D9 4D8A AEEA D48A E7DC  5B90 4F49 4A94 2E46 16C2
+  version: "1.17"
+  sha256: "8f74213b56238c85a50a5329f77e06198771e70dd9a739779f4c02f65d971313"
+  # signature verified by following this path:
+  # - release announced at https://savannah.gnu.org/forum/forum.php?forum_id=10175
+  # - which links to https://savannah.gnu.org/users/haible as the releaser
+  # - which links to https://savannah.gnu.org/people/viewgpg.php?user_id=1871 as the gpg key
+  #
+  # So:
+  # - wget -q -O - https://savannah.gnu.org/people/viewgpg.php?user_id=1871 | gpg --import
+  #     gpg: key F5BE8B267C6A406D: 1 signature not checked due to a missing key
+  #     gpg: key F5BE8B267C6A406D: public key "Bruno Haible (Open Source Development) <bruno@clisp.org>" imported
+  #     gpg: Total number processed: 1
+  #     gpg:               imported: 1
+  #     gpg: marginals needed: 3  completes needed: 1  trust model: pgp
+  #     gpg: depth: 0  valid:   4  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 4u
+  #     gpg: next trustdb check due at 2024-05-09
+  # - gpg --verify libiconv-1.17.tar.gz.sig ports/archives/libiconv-1.17.tar.gz
+  #     gpg: Signature made Sun 15 May 2022 11:26:42 AM EDT
+  #     gpg:                using RSA key 9001B85AF9E1B83DF1BDA942F5BE8B267C6A406D
+  #     gpg: Good signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>" [unknown]
+  #     gpg: WARNING: This key is not certified with a trusted signature!
+  #     gpg:          There is no indication that the signature belongs to the owner.
+  #     Primary key fingerprint: 9001 B85A F9E1 B83D F1BD  A942 F5BE 8B26 7C6A 406D
+  #
+  # And this sha256sum is calculated from that verified tarball.