Bump the bundler group across 1 directory with 4 updates

[dependabot]

Bumps the bundler group with 4 updates in the / directory: addressable, nokogiri, rubyzip and tzinfo.

Updates addressable from 2.5.2 to 2.8.6

Changelog

Sourced from addressable's changelog.

Addressable 2.8.6

• Memoize regexps for common character classes (#524)

#524: sporkmonger/addressable#524

Addressable 2.8.5

• Fix thread safety issue with encoding tables (#515)
• Define URI::NONE as a module to avoid serialization issues (#509)
• Fix YAML serialization (#508)

#508: sporkmonger/addressable#508 #509: sporkmonger/addressable#509 #515: sporkmonger/addressable#515

Addressable 2.8.4

• Restore Addressable::IDNA.unicode_normalize_kc as a deprecated method (#504)

#504: sporkmonger/addressable#504

Addressable 2.8.3

• Fix template expand level 2 hash support for non-string objects (#499, #498)

#499: sporkmonger/addressable#499 #498: sporkmonger/addressable#498

Addressable 2.8.2

• Improve cache hits and JIT friendliness (#486)
• Improve code style and test coverage (#482)
• Ensure reset of deferred validation (#481)
• Resolve normalization differences between IDNA::Native and IDNA::Pure (#408, #492)
• Remove redundant colon in Addressable::URI::CharacterClasses::AUTHORITY regex (#438) (accidentally reverted by #449 merge but added back in #492)

#492: sporkmonger/addressable#492

Addressable 2.8.1

• refactor Addressable::URI.normalize_path to address linter offenses (#430)
• update gemspec to reflect supported Ruby versions (#466, #464, #463)
• compatibility w/ public_suffix 5.x (#466, #465, #460)
• fixes "invalid byte sequence in UTF-8" exception when unencoding URLs containing non UTF-8 characters (#459)
• Ractor compatibility (#449)
• use the whole string instead of a single line for template match (#431)
• force UTF-8 encoding only if needed (#341)

#449: sporkmonger/addressable#449 #460: sporkmonger/addressable#460 #463: sporkmonger/addressable#463 #464: sporkmonger/addressable#464 #465: sporkmonger/addressable#465 #466: sporkmonger/addressable#466

... (truncated)

Commits

• 35a0f5c gemspec: more #freeze and rubygems_version bump (#526)
• 63ab40e Update version, gemspec, and CHANGELOG for 2.8.6 (#525)
• 20879a9 Memoize regexps for common character classes (#524)
• 60feb48 Link directly to versioned changelog from gemspec (#522)
• d3635cc Bump actions/checkout from 3 to 4 (#521)
• 7cd185e Update version, gemspec, and CHANGELOG for 2.8.5 (#518)
• a5a8514 Fix gemspec generation (#517)
• e01456b Fix thread safety issue with encoding tables (#515)
• cf2153e Allow ruby-head to fail (#516)
• b56cef3 Define URI::NONE as a module to avoid serialization issues (#509)
• Additional commits viewable in compare view

Updates nokogiri from 1.10.1 to 1.15.6

Release notes

Sourced from nokogiri's releases.

1.15.6 / 2024-03-16

Note

This security release is a backport to the unsupported v1.15.x branch. Current stable is v1.16.x, which addressed the referenced CVE in v1.16.2 on 2024-02-04.

Security

• [CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.7 from v2.11.6. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.7

---

sha256 checksums:

d79f713dffff149d60ab272d206a3ca96db2b891ab6a9f65362bfb78aface37a  gems/nokogiri-1.15.6-aarch64-linux.gem
62b5b7b387ec6c61c1ea5f889b7bc579eedd37f265f7cc1dc392484938549f1a  gems/nokogiri-1.15.6-arm-linux.gem
ba93c63f5c03047778abf16c80676fe67e7eb7d871ab0aaa7e2c2dfe4ec20027  gems/nokogiri-1.15.6-arm64-darwin.gem
d24639a546ba58c86d18da1ed124eaecbd45c5ae4c4dec41751b730a2b732ac3  gems/nokogiri-1.15.6-java.gem
e36887d89ec1b080e4a01dd2ff52650003db01d2a5edf5e6ab19e4c0bdb1385f  gems/nokogiri-1.15.6-x64-mingw-ucrt.gem
852c59a398499c8fcb6478d76396dcd50afa8f8902563b76265cd7dc90a731a1  gems/nokogiri-1.15.6-x64-mingw32.gem
19e0a5fbfa4393353fbcf6801f8f62350b6e16f43c907680c5884896858a23a2  gems/nokogiri-1.15.6-x86-linux.gem
9d464bbbaad6721a5a73181165fda67573f64ef2803c3337f6f733603e9d309a  gems/nokogiri-1.15.6-x86-mingw32.gem
32d045cdb0ce097e4543a5e7a79efd13ff05d904e32f4328732149dbea3c7f15  gems/nokogiri-1.15.6-x86_64-darwin.gem
26a79da0377100d6938ae2f1b115230a8a4a4595e35b89164d8495af32091186  gems/nokogiri-1.15.6-x86_64-linux.gem
70ce799b4b3e23b358501f1da3914f70b1c7a113fb12e96a7d53558481146e08  gems/nokogiri-1.15.6.gem

1.15.5 / 2023-11-17

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.6 from v2.11.5. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.6
• [CRuby] Vendored libxslt is updated to v1.1.39 from v1.1.38. For details please see https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.39

---

sha256 checksums:

6dfa1d9837ddb233e234d56e244560ab1bc545d3d1744478060e18691f44ded7  nokogiri-1.15.5-aarch64-linux.gem
e3ac6608c6e1714bc11ff04e29a43fedf4cac2aea1bd88256cc3b927c06f347f  nokogiri-1.15.5-arm-linux.gem
4d7b15d53c0397d131376a19875aa97dd1c8b404c2c03bd2171f9b77e9592d40  nokogiri-1.15.5-arm64-darwin.gem
5f87e71aaeb4f7479b94698737a0aacea77836b4805c7433b655e9565bd56cfe  nokogiri-1.15.5-java.gem
7612be800909ae51e0a7cfbe1f768757857a9ff0339686814ca67d9bae271ca2  nokogiri-1.15.5-x64-mingw-ucrt.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.15.6 / 2024-03-16

Security

• [CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.7 from v2.11.6. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.7

1.15.5 / 2023-11-17

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.6 from v2.11.5. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.6
• [CRuby] Vendored libxslt is updated to v1.1.39 from v1.1.38. For details please see https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.39

1.15.4 / 2023-08-11

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.5 from v2.11.4. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.5

Fixed

• Fixed a typo in a HTML5 parser error message. #2927 (@​anishathalye)
• [CRuby] ObjectSpace.memsize_of is now safe to call on Documents with complex DTDs. In previous versions, this debugging method could result in a segfault. [#2923, #2924]

1.15.3 / 2023-07-05

Fixed

• Passing an object that is not a kind of XML::Node as the first parameter to CDATA.new now raises a TypeError. Previously this would result in either a segfault (CRuby) or a Java exception (JRuby). #2920
• Passing an object that is not a kind of XML::Node as the first parameter to Schema.from_document now raises a TypeError. Previously this would result in either a segfault (CRuby) or a Java exception (JRuby). #2920
• [CRuby] Passing an object that is not a kind of XML::Node as the second parameter to Text.new now raises a TypeError. Previously this would result in a segfault. #2920
• [CRuby] Replacing a node's children via methods like Node#inner_html=, #children=, and #replace no longer defensively dups the node's next sibling if it is a Text node. This behavior was originally adopted to work around libxml2's memory management (see #283 and #595) but should not have included operations involving xmlAddChild(). #2916
• [JRuby] Fixed NPE when serializing an unparented HTML node. [#2559, #2895] (@​cbasguti)

1.15.2 / 2023-05-24

Dependencies

• [JRuby] Vendored org.nokogiri:nekodtd is updated to v0.1.11.noko2. This is functionally equivalent to v0.1.11.noko1 but restores support for Java 8.

... (truncated)

Commits

• 7ab6310 version bump to v1.15.6
• f8156b4 dep: update libxml to 2.11.7 (branch 1.15.x) (#3154)
• 9827619 ci: pin to a version of bundler that works across supported rubies
• 83a2571 dep: bump libxml to v2.11.7
• 5745d4b version bump to v1.15.5
• da2d908 ci: add ruby version to vendored libs cache key (backport) (#3029)
• 0f56450 ci: add ruby version to vendored libs cache key (#3028)
• 32b2c35 dep: update libxml to 2.11.5 and libxslt to 1.1.39 (v1.15.x) (#3025)
• b8f7e16 ci: skip the BSD builds for now
• aa3208b dep: update libxml to 2.11.5 and libxslt to 1.1.39
• Additional commits viewable in compare view

Updates rubyzip from 1.2.2 to 2.3.2

Release notes

Sourced from rubyzip's releases.

v2.3.2

No release notes provided.

v2.3.1

This is a "dummy" release to warn about breaking changes coming in version 3.0.

v2.3.0

• Fix frozen string literal error #431
• Set OutputStream.write_buffer's buffer to binmode #439
• Upgrade rubocop and fix various linting complaints #437 #440

Tooling:

• Add a bin/console script for development #420
• Update rake requirement (development dependency only) to fix a security alert.

v2.2.0

• Add support for decompression plugin gems #427

v2.1.0

• Fix (at least partially) the restore_times and restore_permissions options to Zip::File.new #413
  • Previously, neither option did anything, regardless of what it was set to. We have therefore defaulted them to false to preserve the current behavior, for the time being. If you have explicitly set either to true, it will now have an effect.
  • Fix handling of UniversalTime (mtime, atime, ctime) fields. #421
  • Previously, Zip::File did not pass the options to Zip::Entry in some cases. #423
  • Note that restore_times in this release does nothing on Windows and only restores mtime, not atime or ctime.
• Allow Zip::File.open to take an options hash like Zip::File.new #418
• Always print warnings with warn, instead of a mix of puts and warn #416
• Create temporary files in the system temporary directory instead of the directory of the zip file #411
• Drop unused tmpdir requirement #411

Tooling

• Move CI to xenial and include jruby on JDK11 #419

v2.0.0

Security

• Default the validate_entry_sizes option to true, so that callers can trust an entry's reported size when using extract #403
  • This option defaulted to false in 1.3.0 for backward compatibility, but it now defaults to true. If you are using an older version of ruby and can't yet upgrade to 2.x, you can still use 1.3.0 and set the option to true.

Tooling / Documentation

• Remove test files from the gem to avoid problems with antivirus detections on the test files #405 / #384
• Drop support for unsupported ruby versions #406

v1.3.0

Security

• Add validate_entry_sizes option so that callers can trust an entry's reported size when using extract #403
  • This option defaults to false for backward compatibility in this release, but you are strongly encouraged to set it to true. It will default to true in rubyzip 2.0.

... (truncated)

Changelog

Sourced from rubyzip's changelog.

2.3.2 (2021-07-05)

• A "dummy" release to warn about breaking changes coming in version 3.0. This updated version uses the Gem post_install_message instead of printing to STDERR.

2.3.1 (2021-07-03)

• A "dummy" release to warn about breaking changes coming in version 3.0.

2.3.0 (2020-03-14)

• Fix frozen string literal error #431
• Set OutputStream.write_buffer's buffer to binmode #439
• Upgrade rubocop and fix various linting complaints #437 #440

Tooling:

• Add a bin/console script for development #420
• Update rake requirement (development dependency only) to fix a security alert.

2.2.0 (2020-02-01)

• Add support for decompression plugin gems #427

2.1.0 (2020-01-25)

• Fix (at least partially) the restore_times and restore_permissions options to Zip::File.new #413
  • Previously, neither option did anything, regardless of what it was set to. We have therefore defaulted them to false to preserve the current behavior, for the time being. If you have explicitly set either to true, it will now have an effect.
  • Fix handling of UniversalTime (mtime, atime, ctime) fields. #421
  • Previously, Zip::File did not pass the options to Zip::Entry in some cases. #423
  • Note that restore_times in this release does nothing on Windows and only restores mtime, not atime or ctime.
• Allow Zip::File.open to take an options hash like Zip::File.new #418
• Always print warnings with warn, instead of a mix of puts and warn #416
• Create temporary files in the system temporary directory instead of the directory of the zip file #411
• Drop unused tmpdir requirement #411

Tooling

• Move CI to xenial and include jruby on JDK11 #419

2.0.0 (2019-09-25)

Security

• Default the validate_entry_sizes option to true, so that callers can trust an entry's reported size when using extract #403
  • This option defaulted to false in 1.3.0 for backward compatibility, but it now defaults to true. If you are using an older version of ruby and can't yet upgrade to 2.x, you can still use 1.3.0 and set the option to true.

Tooling / Documentation

• Remove test files from the gem to avoid problems with antivirus detections on the test files #405 / #384
• Drop support for unsupported ruby versions #406

... (truncated)

Commits

• 2f1c1ea Move to using a post install message for 3.0 warning.
• 16de339 Print banner text re v3.0.0 when zip is required.
• 84d7a66 Bump version number and Changelog.
• 3bc55a5 Merge pull request #443 from rubyzip/v2-3-0
• 69186f6 Bump version to 2.3.0
• 516941b Update changelog for #439 and #440
• a64a147 Bump rake version (development dependency)
• 4c789c2 Remove unused constant from #439
• fabacf1 Merge pull request #440 from hainesr/rubocop-names
• b231b28 Merge pull request #439 from henkeinfo/binary-outstream-buffer
• Additional commits viewable in compare view

Updates tzinfo from 1.2.5 to 1.2.11

Release notes

Sourced from tzinfo's releases.

v1.2.11

• Eliminate Object#untaint deprecation warnings on JRuby 9.4.0.0. #145.

TZInfo v1.2.11 on RubyGems.org

v1.2.10

• Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
• Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v1.2.10 on RubyGems.org

v1.2.9

• Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

v1.2.8

• Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
• Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

v1.2.7

• Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
• Fixed warnings when running on Ruby 2.8. #112.

TZInfo v1.2.7 on RubyGems.org

v1.2.6

• Timezone#strftime('%s', time) will now return the correct number of seconds since the epoch. #91.
• Removed the unused TZInfo::RubyDataSource::REQUIRE_PATH constant.
• Fixed "SecurityError: Insecure operation - require" exceptions when loading data with recent Ruby releases in safe mode.
• Fixed warnings when running on Ruby 2.7. #106 and #111.

TZInfo v1.2.6 on RubyGems.org

Changelog

Sourced from tzinfo's changelog.

Version 1.2.11 - 28-Jan-2023

• Eliminate Object#untaint deprecation warnings on JRuby 9.4.0.0. #145.

Version 1.2.10 - 19-Jul-2022

• Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
• Ignore the SECURITY file from Arch Linux's tzdata package. #134.

Version 1.2.9 - 16-Dec-2020

• Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

Version 1.2.8 - 8-Nov-2020

• Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
• Rubinius is no longer supported.

Version 1.2.7 - 2-Apr-2020

• Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
• Fixed warnings when running on Ruby 2.8. #112.

Version 1.2.6 - 24-Dec-2019

• Timezone#strftime('%s', time) will now return the correct number of seconds since the epoch. #91.
• Removed the unused TZInfo::RubyDataSource::REQUIRE_PATH constant.
• Fixed "SecurityError: Insecure operation - require" exceptions when loading data with recent Ruby releases in safe mode.
• Fixed warnings when running on Ruby 2.7. #106 and #111.

Commits

• 2dc46fd Preparing v1.2.11.
• c854e6a Update copyright years.
• 9c092f3 Eliminate Object#untaint deprecation warnings on JRuby 9.4.0.0.
• 4e5f8b7 Add Ruby 3.1, 3.2 and JRuby 9.4.
• 2f58c69 Update the dependency on actions/checkout.
• e52c056 Revert "Workaround for 'Permission denied - NUL' errors with JRuby on Windows."
• 0814dcd Fix the release date.
• fd05e2a Preparing v1.2.10.
• b98c32e Merge branch 'fix-directory-traversal-1.2' into 1.2
• ac3ee68 Remove unnecessary escaping of + within regex character classes.
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.