Update Markdown and HTML parsing gems

GitLab Dependency Botrequested to merge
gitlab-renovate-forks/gitlab:renovate-gems/markdown-and-html-parsing-gems into master

This MR contains the following updates:

Package Update Change MyDiffEnd
loofah (changelog) patch 2.25.1 -> 2.25.2 https://my.diffend.io/gems/loofah/2.25.1/2.25.2
nokogiri patch 1.19.3 -> 1.19.4 https://my.diffend.io/gems/nokogiri/1.19.3/1.19.4
rouge (source, changelog) minor 5.0.0 -> 5.1.0 https://my.diffend.io/gems/rouge/5.0.0/5.1.0

MR created with the help of gitlab-org/frontend/renovate-gitlab-bot

Release Notes

flavorjones/loofah (loofah)

v2.25.2

Compare Source

Security
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#​58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
  • Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones
Improved
  • Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #​305 @​flavorjones
  • Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #​304 @​flavorjones
  • Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #​305 @​flavorjones
rouge-ruby/rouge (rouge)

v5.1.0

Compare Source

Comparison with the previous version

  • General
    • add a more helpful #inspect method for lexers (#​2303 by Jeanine Adkisson)
    • Wrap code/pre references in changelog (#​2293 by Matt Jankowski)
    • remove redundant alias declarations, and warn on duplicate registration (#​2317 by Jeanine Adkisson)
    • update AGENTS.md and CONTRIBUTING.md (#​2316 by Jeanine Adkisson)
  • AddmusicK/Ramekin Lexer (NEW)
    • Add an AddmusicK/Ramekin lexer (#​2277 by Jeanine Adkisson)
  • AppleScript Lexer
    • Fix applescript warning and move files to locations that match the tag (#​2321 by Jeanine Adkisson)
  • Makefile Lexer
    • Add comment support in Makefile body blocks (#​2305 by Tan Le)
  • Markdown Lexer
    • Fix edge case in markdown lexer for links (#​2308 by Marcel Amirault)
  • Java Lexer
    • Support modern Java syntax (#​2300 by Tan Le)
    • Fix Java import static tokenized as separate tokens (#​2298 by Tan Le)
  • Perl Lexer
    • Overhaul the perl lexer (#​2307 by Jeanine Adkisson)
  • Properties Lexer
    • properties: fix comments at eof and escaped chars in keys (#​2320 by Jeanine Adkisson)
  • Shell Lexer
    • shell: use Str::Interpol instead of Str::Escape (#​2310 by Jeanine Adkisson)
    • Add bitwise shift operators to shell math context (#​2297 by Tan Le)
    • add support for bash 5.3 curly substitutions (#​2309 by Jeanine Adkisson)
  • VHDL Lexer
    • VHDL: support delimited comments (#​2304 by marph91)
  • Vue Lexer
    • Fix @​ event shorthand in Vue templates (#​2296 by Tan Le)
  • YAML Lexer
    • Fix bug with yaml separator in code blocks (#​2313 by Marcel Amirault)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports