Skip to content

Commit 031169c

Browse files
committed
Pin Haml to versions before Haml 6
middleman-syntax does not support Haml 6 [[1]]. However, it does not place any restriction on the version of Haml used, so bundler will try and install the latest version of Haml. This commit adds a restriction on the version of Haml in our gemspec. This is a bit of a hack, as we don't actually require Haml ourselves, but it will make our tests pass and provide a better experience for our users until middleman-syntax is fixed. [1]: middleman/middleman-syntax#80
1 parent 5506067 commit 031169c

File tree

2 files changed

+5
-0
lines changed

2 files changed

+5
-0
lines changed

CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,10 @@
22

33
## Unreleased
44

5+
### Fixes
6+
7+
- You no longer need to downgrade Haml yourself, `bundle install` will now make sure Haml 6 is not installed (see issue [#318: Error: Filters is not a module](https://github.com/alphagov/tech-docs/gem/issues/318)).
8+
59
## 3.3.1
610

711
This change solves a potential security issue with HTML snippets. Pages indexed in search results have their entire contents indexed, including any HTML code snippets. These HTML snippets would appear in the search results unsanitised, making it possible to render arbitrary HTML or run arbitrary scripts.

govuk_tech_docs.gemspec

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ Gem::Specification.new do |spec|
4747
spec.add_dependency "nokogiri"
4848
spec.add_dependency "openapi3_parser", "~> 0.9.0"
4949
spec.add_dependency "redcarpet", "~> 3.5.1"
50+
spec.add_dependency "haml", "< 6.0.0"
5051

5152
spec.add_development_dependency "byebug"
5253
spec.add_development_dependency "capybara", "~> 3.32"

0 commit comments

Comments
 (0)