nokogiri 1.13.8 → 1.15.7

data/LICENSE.md

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright 2008 -- 2021 by Mike Dalessio, Aaron Patterson, Yoko Harada, Akinori MUSHA, John Shahid, Karol Bucek, Sam Ruby, Craig Barnes, Stephen Checkoway, Lars Kanis, Sergio Arbeo, Timothy Elliott, Nobuyoshi Nakada, Charles Nutter, Patrick Mahoney.
+Copyright 2008 -- 2023 by Mike Dalessio, Aaron Patterson, Yoko Harada, Akinori MUSHA, John Shahid, Karol Bucek, Sam Ruby, Craig Barnes, Stephen Checkoway, Lars Kanis, Sergio Arbeo, Timothy Elliott, Nobuyoshi Nakada, Charles Nutter, Patrick Mahoney.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

data/README.md

@@ -2,7 +2,7 @@
 
 # Nokogiri
 
-Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for [reading](https://nokogiri.org/tutorials/parsing_an_html_xml_document.html), writing, [modifying](https://nokogiri.org/tutorials/modifying_an_html_xml_document.html), and [querying](https://nokogiri.org/tutorials/searching_a_xml_html_document.html) documents. It is fast and standards-compliant by relying on native parsers like libxml2 (CRuby) and xerces (JRuby).
+Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for [reading](https://nokogiri.org/tutorials/parsing_an_html_xml_document.html), writing, [modifying](https://nokogiri.org/tutorials/modifying_an_html_xml_document.html), and [querying](https://nokogiri.org/tutorials/searching_a_xml_html_document.html) documents. It is fast and standards-compliant by relying on native parsers like libxml2, libgumbo, and xerces.
 
 ## Guiding Principles
 
@@ -40,10 +40,6 @@ Some guiding principles Nokogiri tries to follow:
 
 All official documentation is posted at https://nokogiri.org (the source for which is at https://github.com/sparklemotion/nokogiri.org/, and we welcome contributions).
 
-Consider subscribing to [Tidelift][tidelift] which provides license assurances and timely security notifications for your open source dependencies, including Nokogiri. [Tidelift][tidelift] subscriptions also help the Nokogiri maintainers fund our [automated testing](https://ci.nokogiri.org) which in turn allows us to ship releases, bugfixes, and security updates more often.
-
-  [tidelift]: https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme
-
 ### Reading
 
 Your first stops for learning more about Nokogiri should be:
@@ -57,7 +53,6 @@ Your first stops for learning more about Nokogiri should be:
 
 There are a few ways to ask exploratory questions:
 
-- The Ruby Discord chat server is active at https://discord.gg/UyQnKrT
 - The Nokogiri mailing list is active at https://groups.google.com/group/nokogiri-talk
 - Open an issue using the "Help Request" template at https://github.com/sparklemotion/nokogiri/issues
 
@@ -103,12 +98,21 @@ We bump `Major.Minor.Patch` versions following this guidance:
 - Updating packaged libraries for security-related reasons.
 
 
+### Sponsorship
+
+You can help sponsor the maintainers of this software through one of these organizations:
+
+- [github.com/sponsors/flavorjones](https://github.com/sponsors/flavorjones)
+- [opencollective.com/nokogiri](https://opencollective.com/nokogiri)
+- [tidelift.com/subscription/pkg/rubygems-nokogiri](https://tidelift.com/subscription/pkg/rubygems-nokogiri?utm_source=rubygems-nokogiri&utm_medium=referral&utm_campaign=readme)
+
+
 ## Installation
 
 Requirements:
 
-- Ruby >= 2.6
-- JRuby >= 9.3.0.0
+- Ruby >= 2.7
+- JRuby >= 9.4.0.0
 
 
 ### Native Gems: Faster, more reliable installation
@@ -119,10 +123,13 @@ Requirements:
 
 Nokogiri ships pre-compiled, "native" gems for the following platforms:
 
-- Linux: `x86-linux` and `x86_64-linux` (req: `glibc >= 2.17`), including musl platforms like Alpine
+- Linux:
+  - `x86-linux` and `x86_64-linux` (req: `glibc >= 2.17`)
+  - `aarch64-linux` and `arm-linux` (req: `glibc >= 2.29`)
+  - Note that musl platforms like Alpine **are** supported
 - Darwin/MacOS: `x86_64-darwin` and `arm64-darwin`
-- Windows: `x86-mingw32` and `x64-mingw32`
-- Java: any platform running JRuby 9.3 or higher
+- Windows: `x86-mingw32`, `x64-mingw32`, and `x64-mingw-ucrt`
+- Java: any platform running JRuby 9.4 or higher
 
 To determine whether your system supports one of these gems, look at the output of `bundle platform` or `ruby -e 'puts Gem::Platform.local.to_s'`.
 

data/dependencies.yml

@@ -1,23 +1,41 @@
 libxml2:
-  version: "2.9.14"
-  sha256: "60d74a257d1ccec0475e749cba2f21559e48139efba6ff28224357c7c798dfee"
-  # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.14.sha256sum
+  version: "2.11.7"
+  sha256: "fb27720e25eaf457f94fd3d7189bcf2626c6dccf4201553bc8874d50e3560162"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.11/libxml2-2.11.7.sha256sum
 
 libxslt:
-  version: "1.1.35"
-  sha256: "8247f33e9a872c6ac859aa45018bc4c4d00b97e2feac9eebc10c93ce1f34dd79"
-  # sha-256 hash provided in https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.sha256sum
+  version: "1.1.39"
+  sha256: "2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.39.sha256sum
 
 zlib:
-  version: "1.2.12"
-  sha256: "91844808532e5ce316b3c010929493c0244f3d37593afd6de04f71821d5136d9"
+  version: "1.2.13"
+  sha256: "b3a24de97a8fdbc835b9833169501030b8977031bcb54b3b3ac13740f846ab30"
   # SHA-256 hash provided on http://zlib.net/
 
 libiconv:
-  version: "1.16"
-  sha256: "e6a1b1b589654277ee790cce3734f07876ac4ccfaecbee8afa0b649cf529cc04"
-  # gpg: Signature made Fri 26 Apr 2019 03:36:38 PM EDT
-  # gpg:                using RSA key 4F494A942E4616C2
-  # gpg: Good signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>" [expired]
-  # gpg: Note: This key has expired!
-  # Primary key fingerprint: 68D9 4D8A AEEA D48A E7DC  5B90 4F49 4A94 2E46 16C2
+  version: "1.17"
+  sha256: "8f74213b56238c85a50a5329f77e06198771e70dd9a739779f4c02f65d971313"
+  # signature verified by following this path:
+  # - release announced at https://savannah.gnu.org/forum/forum.php?forum_id=10175
+  # - which links to https://savannah.gnu.org/users/haible as the releaser
+  # - which links to https://savannah.gnu.org/people/viewgpg.php?user_id=1871 as the gpg key
+  #
+  # So:
+  # - wget -q -O - https://savannah.gnu.org/people/viewgpg.php?user_id=1871 | gpg --import
+  #     gpg: key F5BE8B267C6A406D: 1 signature not checked due to a missing key
+  #     gpg: key F5BE8B267C6A406D: public key "Bruno Haible (Open Source Development) <bruno@clisp.org>" imported
+  #     gpg: Total number processed: 1
+  #     gpg:               imported: 1
+  #     gpg: marginals needed: 3  completes needed: 1  trust model: pgp
+  #     gpg: depth: 0  valid:   4  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 4u
+  #     gpg: next trustdb check due at 2024-05-09
+  # - gpg --verify libiconv-1.17.tar.gz.sig ports/archives/libiconv-1.17.tar.gz
+  #     gpg: Signature made Sun 15 May 2022 11:26:42 AM EDT
+  #     gpg:                using RSA key 9001B85AF9E1B83DF1BDA942F5BE8B267C6A406D
+  #     gpg: Good signature from "Bruno Haible (Open Source Development) <bruno@clisp.org>" [unknown]
+  #     gpg: WARNING: This key is not certified with a trusted signature!
+  #     gpg:          There is no indication that the signature belongs to the owner.
+  #     Primary key fingerprint: 9001 B85A F9E1 B83D F1BD  A942 F5BE 8B26 7C6A 406D
+  #
+  # And this sha256sum is calculated from that verified tarball.

data/ext/nokogiri/extconf.rb

@@ -15,7 +15,7 @@ PACKAGE_ROOT_DIR = File.expand_path(File.join(File.dirname(__FILE__), "..", ".."
 REQUIRED_LIBXML_VERSION = "2.6.21"
 RECOMMENDED_LIBXML_VERSION = "2.9.3"
 
-REQUIRED_MINI_PORTILE_VERSION = "~> 2.8.0" # keep this version in sync with the one in the gemspec
+REQUIRED_MINI_PORTILE_VERSION = "~> 2.8.2" # keep this version in sync with the one in the gemspec
 REQUIRED_PKG_CONFIG_VERSION = "~> 1.1"
 
 # Keep track of what versions of what libraries we build against
@@ -200,7 +200,7 @@ def nix?
 end
 
 def truffle?
-  ::RUBY_ENGINE == "truffleruby"
+  RUBY_ENGINE == "truffleruby"
 end
 
 def concat_flags(*args)
@@ -211,6 +211,16 @@ def local_have_library(lib, func = nil, headers = nil)
   have_library(lib, func, headers) || have_library("lib#{lib}", func, headers)
 end
 
+def zlib_source(version_string)
+  # As of 2022-12, I'm starting to see failed downloads often enough from zlib.net that I want to
+  # change the default to github.
+  if ENV["NOKOGIRI_USE_CANONICAL_ZLIB_SOURCE"]
+    "https://zlib.net/fossils/zlib-#{version_string}.tar.gz"
+  else
+    "https://github.com/madler/zlib/releases/download/v#{version_string}/zlib-#{version_string}.tar.gz"
+  end
+end
+
 def gnome_source
   # As of 2022-02-20, some mirrors have expired SSL certificates. I'm able to retrieve from my home,
   # but whatever host is resolved on the github actions workers see an expired cert.
@@ -219,7 +229,7 @@ def gnome_source
   if ENV["NOKOGIRI_USE_CANONICAL_GNOME_SOURCE"]
     "https://download.gnome.org"
   else
-    "https://mirror.csclub.uwaterloo.ca/gnome" # old reliable
+    "https://muug.ca/mirror/gnome" # old reliable
   end
 end
 
@@ -362,7 +372,7 @@ def try_link_iconv(using = nil)
       preserving_globals do
         yield if block_given?
 
-        try_link(<<~'SRC', opt)
+        try_link(<<~SRC, opt)
           #include <stdlib.h>
           #include <iconv.h>
           int main(void)
@@ -400,8 +410,8 @@ def iconv_configure_flags
     return ["--with-iconv=yes"]
   end
 
-  config = preserving_globals { have_package_configuration("libiconv") }
-  if config && try_link_iconv("pkg-config libiconv") { have_package_configuration("libiconv") }
+  config = preserving_globals { pkg_config("libiconv") }
+  if config && try_link_iconv("pkg-config libiconv") { pkg_config("libiconv") }
     cflags, ldflags, libs = config
 
     return [
@@ -430,10 +440,12 @@ def process_recipe(name, version, static_p, cross_p, cacheable_p = true)
       "#{@target}/#{RUBY_PLATFORM}/#{@name}/#{@version}"
     end
 
-    recipe.target = File.join(PACKAGE_ROOT_DIR, "ports") if cacheable_p
-    # Prefer host_alias over host in order to use the correct compiler prefix for cross build, but
-    # use host if not set.
+    # We use 'host' to set compiler prefix for cross-compiling. Prefer host_alias over host. And
+    # prefer i686 (what external dev tools use) to i386 (what ruby's configure.ac emits).
     recipe.host = RbConfig::CONFIG["host_alias"].empty? ? RbConfig::CONFIG["host"] : RbConfig::CONFIG["host_alias"]
+    recipe.host = recipe.host.gsub(/i386/, "i686")
+
+    recipe.target = File.join(PACKAGE_ROOT_DIR, "ports") if cacheable_p
     recipe.configure_options << "--libdir=#{File.join(recipe.path, "lib")}"
 
     yield recipe
@@ -525,7 +537,6 @@ def process_recipe(name, version, static_p, cross_p, cacheable_p = true)
 
       EOM
 
-      pp(recipe.files)
       chdir_for_build { recipe.cook }
       FileUtils.touch(checkpoint)
     end
@@ -573,6 +584,34 @@ def do_clean
   exit!(0)
 end
 
+# In ruby 3.2, symbol resolution changed on Darwin, to introduce the `-bundle_loader` flag to
+# resolve symbols against the ruby binary.
+#
+# This makes it challenging to build a single extension that works with both a ruby with
+# `--enable-shared` and one with `--disable-shared. To work around that, we choose to add
+# `-flat_namespace` to the link line (later in this file).
+#
+# The `-flat_namespace` line introduces its own behavior change, which is that (similar to on
+# Linux), any symbols in the extension that are exported may now be resolved by shared libraries
+# loaded by the Ruby process. Specifically, that means that libxml2 and libxslt, which are
+# statically linked into the nokogiri bundle, will resolve (at runtime) to a system libxml2 loaded
+# by Ruby on Darwin. And it appears that often Ruby on Darwin does indeed load the system libxml2,
+# and that messes with our assumptions about whether we're running with a patched libxml2 or a
+# vanilla libxml2.
+#
+# We choose to use `-load_hidden` in this case to prevent exporting those symbols from libxml2 and
+# libxslt, which ensures that they will be resolved to the static libraries in the bundle. In other
+# words, when we use `load_hidden`, what happens in the extension stays in the extension.
+#
+# See https://github.com/rake-compiler/rake-compiler-dock/issues/87 for more info.
+#
+# Anyway, this method is the logical bit to tell us when to turn on these workarounds.
+def needs_darwin_linker_hack
+  config_cross_build? &&
+    darwin? &&
+    Gem::Requirement.new("~> 3.2").satisfied_by?(Gem::Version.new(RbConfig::CONFIG["ruby_version"].split("+").first))
+end
+
 #
 #  main
 #
@@ -580,7 +619,7 @@ do_help if arg_config("--help")
 do_clean if arg_config("--clean")
 
 if openbsd? && !config_system_libraries?
-  if %x(#{ENV["CC"] || "/usr/bin/cc"} -v 2>&1) !~ /clang/
+  unless %x(#{ENV["CC"] || "/usr/bin/cc"} -v 2>&1).include?("clang")
     (ENV["CC"] ||= find_executable("egcc")) ||
       abort("Please install gcc 4.9+ from ports using `pkg_add -v gcc`")
   end
@@ -616,6 +655,9 @@ $LIBS = concat_flags($LIBS, ENV["LIBS"])
 # errors/warnings. see #2302
 append_cflags(["-std=c99", "-Wno-declaration-after-statement"])
 
+# gumbo html5 serialization is slower with O3, let's make sure we use O2
+append_cflags("-O2")
+
 # always include debugging information
 append_cflags("-g")
 
@@ -625,8 +667,18 @@ append_cflags("-Winline")
 # good to have no matter what Ruby was compiled with
 append_cflags("-Wmissing-noreturn")
 
+# check integer loss of precision
+if darwin?
+  append_cflags("-Wshorten-64-to-32")
+else
+  append_cflags("-Wconversion -Wno-sign-conversion")
+end
+
 # handle clang variations, see #1101
-append_cflags("-Wno-error=unused-command-line-argument-hard-error-in-future") if darwin?
+if darwin?
+  append_cflags("-Wno-error=unused-command-line-argument-hard-error-in-future")
+  append_cflags("-Wno-unknown-warning-option")
+end
 
 # these tend to be noisy, but on occasion useful during development
 # append_cflags(["-Wcast-qual", "-Wwrite-strings"])
@@ -643,14 +695,34 @@ append_cppflags(' "-Idummypath"') if windows?
 
 if config_system_libraries?
   message "Building nokogiri using system libraries.\n"
-  ensure_package_configuration(opt: "zlib", pc: "zlib", lib: "z",
-    headers: "zlib.h", func: "gzdopen")
-  ensure_package_configuration(opt: "xml2", pc: "libxml-2.0", lib: "xml2",
-    headers: "libxml/parser.h", func: "xmlParseDoc")
-  ensure_package_configuration(opt: "xslt", pc: "libxslt", lib: "xslt",
-    headers: "libxslt/xslt.h", func: "xsltParseStylesheetDoc")
-  ensure_package_configuration(opt: "exslt", pc: "libexslt", lib: "exslt",
-    headers: "libexslt/exslt.h", func: "exsltFuncRegister")
+  ensure_package_configuration(
+    opt: "zlib",
+    pc: "zlib",
+    lib: "z",
+    headers: "zlib.h",
+    func: "gzdopen",
+  )
+  ensure_package_configuration(
+    opt: "xml2",
+    pc: "libxml-2.0",
+    lib: "xml2",
+    headers: "libxml/parser.h",
+    func: "xmlParseDoc",
+  )
+  ensure_package_configuration(
+    opt: "xslt",
+    pc: "libxslt",
+    lib: "xslt",
+    headers: "libxslt/xslt.h",
+    func: "xsltParseStylesheetDoc",
+  )
+  ensure_package_configuration(
+    opt: "exslt",
+    pc: "libexslt",
+    lib: "exslt",
+    headers: "libexslt/exslt.h",
+    func: "exsltFuncRegister",
+  )
 
   have_libxml_headers?(REQUIRED_LIBXML_VERSION) ||
     abort("ERROR: libxml2 version #{REQUIRED_LIBXML_VERSION} or later is required!")
@@ -666,6 +738,10 @@ else
   cross_build_p = config_cross_build?
   message "Cross build is #{cross_build_p ? "enabled" : "disabled"}.\n"
 
+  if needs_darwin_linker_hack
+    append_ldflags("-Wl,-flat_namespace")
+  end
+
   require "yaml"
   dependencies = YAML.load_file(File.join(PACKAGE_ROOT_DIR, "dependencies.yml"))
 
@@ -674,7 +750,7 @@ else
   if cross_build_p || windows?
     zlib_recipe = process_recipe("zlib", dependencies["zlib"]["version"], static_p, cross_build_p) do |recipe|
       recipe.files = [{
-        url: "https://zlib.net/fossils/#{recipe.name}-#{recipe.version}.tar.gz",
+        url: zlib_source(recipe.version),
         sha256: dependencies["zlib"]["sha256"],
       }]
       if windows?
@@ -712,17 +788,29 @@ else
       else
         class << recipe
           def configure
-            cflags = concat_flags(ENV["CFLAGS"], "-fPIC", "-g")
-            execute("configure",
-              ["env", "CHOST=#{host}", "CFLAGS=#{cflags}", "./configure", "--static", configure_prefix])
+            env = {}
+            env["CFLAGS"] = concat_flags(ENV["CFLAGS"], "-fPIC", "-g")
+            env["CHOST"] = host
+            execute("configure", ["./configure", "--static", configure_prefix], { env: env })
+            if darwin?
+              # needed as of zlib 1.2.13
+              Dir.chdir(work_path) do
+                makefile = File.read("Makefile").gsub(/^AR=.*$/, "AR=#{host}-libtool")
+                File.open("Makefile", "w") { |m| m.write(makefile) }
+              end
+            end
           end
         end
       end
     end
 
     unless nix?
-      libiconv_recipe = process_recipe("libiconv", dependencies["libiconv"]["version"], static_p,
-        cross_build_p) do |recipe|
+      libiconv_recipe = process_recipe(
+        "libiconv",
+        dependencies["libiconv"]["version"],
+        static_p,
+        cross_build_p,
+      ) do |recipe|
         recipe.files = [{
           url: "https://ftp.gnu.org/pub/gnu/libiconv/#{recipe.name}-#{recipe.version}.tar.gz",
           sha256: dependencies["libiconv"]["sha256"],
@@ -760,15 +848,25 @@ else
   if zlib_recipe
     append_cppflags("-I#{zlib_recipe.path}/include")
     $LIBPATH = ["#{zlib_recipe.path}/lib"] | $LIBPATH
-    ensure_package_configuration(opt: "zlib", pc: "zlib", lib: "z",
-      headers: "zlib.h", func: "gzdopen")
+    ensure_package_configuration(
+      opt: "zlib",
+      pc: "zlib",
+      lib: "z",
+      headers: "zlib.h",
+      func: "gzdopen",
+    )
   end
 
   if libiconv_recipe
     append_cppflags("-I#{libiconv_recipe.path}/include")
     $LIBPATH = ["#{libiconv_recipe.path}/lib"] | $LIBPATH
-    ensure_package_configuration(opt: "iconv", pc: "iconv", lib: "iconv",
-      headers: "iconv.h", func: "iconv_open")
+    ensure_package_configuration(
+      opt: "iconv",
+      pc: "iconv",
+      lib: "iconv",
+      headers: "iconv.h",
+      func: "iconv_open",
+    )
   end
 
   libxml2_recipe = process_recipe("libxml2", dependencies["libxml2"]["version"], static_p, cross_build_p) do |recipe|
@@ -784,8 +882,13 @@ else
       recipe.patch_files = Dir[File.join(PACKAGE_ROOT_DIR, "patches", "libxml2", "*.patch")].sort
     end
 
+    cppflags = concat_flags(ENV["CPPFLAGS"])
     cflags = concat_flags(ENV["CFLAGS"], "-O2", "-U_FORTIFY_SOURCE", "-g")
 
+    if cross_build_p
+      cppflags = concat_flags(cppflags, "-DNOKOGIRI_PRECOMPILED_LIBRARIES")
+    end
+
     if zlib_recipe
       recipe.configure_options << "--with-zlib=#{zlib_recipe.path}"
     end
@@ -816,6 +919,7 @@ else
       "--with-c14n",
       "--with-debug",
       "--with-threads",
+      "CPPFLAGS=#{cppflags}",
       "CFLAGS=#{cflags}",
     ]
   end
@@ -839,6 +943,11 @@ else
       recipe.configure_options += ["RANLIB=/usr/bin/ranlib", "AR=/usr/bin/ar"]
     end
 
+    if windows?
+      cflags = concat_flags(cflags, "-ULIBXSLT_STATIC", "-DIN_LIBXSLT")
+      cflags = concat_flags(cflags, "-ULIBEXSLT_STATIC", "-DIN_LIBEXSLT")
+    end
+
     recipe.configure_options << if source_dir
       "--config-cache"
     else
@@ -860,9 +969,13 @@ else
   $libs = $libs.shellsplit.tap do |libs|
     [libxml2_recipe, libxslt_recipe].each do |recipe|
       libname = recipe.name[/\Alib(.+)\z/, 1]
-      File.join(recipe.path, "bin", "#{libname}-config").tap do |config|
+      config_basename = "#{libname}-config"
+      File.join(recipe.path, "bin", config_basename).tap do |config|
         # call config scripts explicit with 'sh' for compat with Windows
-        $CPPFLAGS = %x(sh #{config} --cflags).strip << " " << $CPPFLAGS
+        cflags = %x(sh #{config} --cflags).strip
+        message("#{config_basename} cflags: #{cflags}\n")
+        $CPPFLAGS = concat_flags(cflags, $CPPFLAGS) # prepend
+
         %x(sh #{config} --libs).strip.shellsplit.each do |arg|
           case arg
           when /\A-L(.+)\z/
@@ -881,7 +994,7 @@ else
       end
 
       patches_string = recipe.patch_files.map { |path| File.basename(path) }.join(" ")
-      append_cppflags(%[-DNOKOGIRI_#{recipe.name.upcase}_PATCHES="\\\"#{patches_string}\\\""])
+      append_cppflags(%[-DNOKOGIRI_#{recipe.name.upcase}_PATCHES="\\"#{patches_string}\\""])
 
       case libname
       when "xml2"
@@ -900,16 +1013,17 @@ else
   end.shelljoin
 
   if static_p
+    static_archive_ld_flag = needs_darwin_linker_hack ? ["-load_hidden"] : []
     $libs = $libs.shellsplit.map do |arg|
       case arg
       when "-lxml2"
-        File.join(libxml2_recipe.path, "lib", libflag_to_filename(arg))
+        static_archive_ld_flag + [File.join(libxml2_recipe.path, "lib", libflag_to_filename(arg))]
       when "-lxslt", "-lexslt"
-        File.join(libxslt_recipe.path, "lib", libflag_to_filename(arg))
+        static_archive_ld_flag + [File.join(libxslt_recipe.path, "lib", libflag_to_filename(arg))]
       else
         arg
       end
-    end.shelljoin
+    end.flatten.shelljoin
   end
 
   ensure_func("xmlParseDoc", "libxml/parser.h")
@@ -945,11 +1059,11 @@ libgumbo_recipe = process_recipe("libgumbo", "1.0.0-nokogiri", static_p, cross_b
     end
 
     def compile
-      cflags = concat_flags(ENV["CFLAGS"], "-fPIC", "-g")
+      cflags = concat_flags(ENV["CFLAGS"], "-fPIC", "-O2", "-g")
 
       env = { "CC" => gcc_cmd, "CFLAGS" => cflags }
       if config_cross_build?
-        if /darwin/.match?(host)
+        if host.include?("darwin")
           env["AR"] = "#{host}-libtool"
           env["ARFLAGS"] = "-o"
         else
@@ -965,7 +1079,7 @@ end
 append_cppflags("-I#{File.join(libgumbo_recipe.path, "include")}")
 $libs = $libs + " " + File.join(libgumbo_recipe.path, "lib", "libgumbo.a")
 $LIBPATH = $LIBPATH | [File.join(libgumbo_recipe.path, "lib")]
-ensure_func("gumbo_parse_with_options", "gumbo.h")
+ensure_func("gumbo_parse_with_options", "nokogiri_gumbo.h")
 
 have_func("xmlHasFeature") || abort("xmlHasFeature() is missing.") # introduced in libxml 2.6.21
 have_func("xmlFirstElementChild") # introduced in libxml 2.7.3
@@ -976,21 +1090,23 @@ have_func("xmlSchemaSetParserStructuredErrors") # introduced in libxml 2.6.23
 have_func("rb_gc_location") # introduced in Ruby 2.7
 have_func("rb_category_warning") # introduced in Ruby 3.0
 
-have_func("vasprintf")
-
 other_library_versions_string = OTHER_LIBRARY_VERSIONS.map { |k, v| [k, v].join(":") }.join(",")
-append_cppflags(%[-DNOKOGIRI_OTHER_LIBRARY_VERSIONS="\\\"#{other_library_versions_string}\\\""])
+append_cppflags(%[-DNOKOGIRI_OTHER_LIBRARY_VERSIONS="\\"#{other_library_versions_string}\\""])
 
 unless config_system_libraries?
   if cross_build_p
     # When precompiling native gems, copy packaged libraries' headers to ext/nokogiri/include
     # These are packaged up by the cross-compiling callback in the ExtensionTask
-    copy_packaged_libraries_headers(to_path: File.join(PACKAGE_ROOT_DIR, "ext/nokogiri/include"),
-      from_recipes: [libxml2_recipe, libxslt_recipe])
+    copy_packaged_libraries_headers(
+      to_path: File.join(PACKAGE_ROOT_DIR, "ext/nokogiri/include"),
+      from_recipes: [libxml2_recipe, libxslt_recipe],
+    )
   else
     # When compiling during installation, install packaged libraries' header files into ext/nokogiri/include
-    copy_packaged_libraries_headers(to_path: "include",
-      from_recipes: [libxml2_recipe, libxslt_recipe])
+    copy_packaged_libraries_headers(
+      to_path: "include",
+      from_recipes: [libxml2_recipe, libxslt_recipe],
+    )
     $INSTALLFILES << ["include/**/*.h", "$(rubylibdir)"]
   end
 end
@@ -1008,3 +1124,5 @@ if config_clean?
     EOF
   end
 end
+
+# rubocop:enable Style/GlobalVars