Skip to content

Drop escape_utils dependency

Matthias Käppler requested to merge 377686-remove-escape_utils into master

What does this MR do and why?

During the Ruby 3 gem audit I found that this gem only has Ruby 3 builds for newer versions. It uses a C-extension, which makes it more risky to use across major version upgrades. More importantly, it says on its project page:

As of escape_utils 1.3.0, regular HTML escaping methods are deprecated. Ruby 2.5 introduced C implementations for CGI.escapeHTML and CGI.unescapeHTML which are respectively faster and almost as fast as EscapeUtils. Use that instead.

We only use this gem in a single place in gitlab-rails: https://gitlab.com/gitlab-org/gitlab/-/blob/7359d23f4e078479969c872924150219c6f1665f/lib/banzai/filter/table_of_contents_filter.rb#L96

We should therefore rewrite this filter to use the stdlib methods so we can simply drop this gem.

Use as a transitive dependency

I noticed that the Gemfile.checksum entry did not disappear; this is because we still pull it in as a transitive dependency of https://github.com/brettchalupa/graphql-docs:

    graphql-docs (2.1.0)
      commonmarker (~> 0.16)
      escape_utils (~> 1.2)
      extended-markdown-filter (~> 0.4)
      gemoji (~> 3.0)
      graphql (~> 1.12)
      html-pipeline (~> 2.9)
      sass (~> 3.4)

I searched the gem sources and can find no reference to this gem anywhere outside of gemspec though so I assume it is unused. Plus, this is just a development dependency so should not impact production.

Refs #377686 (closed)

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #377686 (closed)

Edited by Matthias Käppler

Merge request reports