Update gitlab-markup to 2.2.0 and rdoc to 8.1.0

What does this MR do and why?

Updates gitlab-markup from 2.1.0 to 2.2.0 and rdoc from 6.17.0 to 8.1.0.

gitlab-markup 2.2.0 relaxes its rdoc pin from ~> 6.13 to >= 6.13, < 9, which allows rdoc to move to the 8.x series.

rdoc 8.x requires rbs >= 4.0.0, but solargraph 0.58.x capped rbs at <= 4.0.0.dev.4. solargraph 0.60.x relaxes that to rbs >= 3.10.0, so this also bumps solargraph from ~> 0.58.0 to ~> 0.60.0 to unblock the upgrade.

Resulting lock changes

  • gitlab-markup 2.1.0 → 2.2.0
  • rdoc 6.17.0 → 8.1.0
  • rbs 3.9.5 → 4.2.0
  • solargraph 0.58.3 → 0.60.1
  • New transitive deps from solargraph: commander, highline, parlour, sord
  • psych and stringio drop from the lock since rdoc 8 no longer pulls them in; both remain available as Ruby default gems.

Both Gemfile.lock and Gemfile.next.lock were regenerated via bundle exec rake bundler:gemfile:sync.

Spec updates for rdoc 8 output

rdoc 8 changes its HTML output in two ways that spec/lib/gitlab/other_markup_spec.rb asserted against. Both are rdoc rendering changes, not GitLab behavior changes:

  • Headings now get slug-based IDs (heading-1, another-h2) on the <h> element itself instead of the old label--prefixed anchor. After GitLab's MarkupHeadingAnchorFilter the IDs are user-content-heading-N, matching the scheme org-mode already uses.
  • A link with a disallowed scheme (javascript:) is now dropped entirely rather than rendered as an empty <a>, so XSS[JaVaScriPt:alert(1)] renders as <p>XSS</p>. This is strictly safer; no dangerous href reaches the output in either version.

Verified locally: both examples pass (2 examples, 0 failures).

Minor backward-compat note (non-blocking)

rdoc 8 moves the old label- anchor into a <span class="legacy-anchor"> before each heading. If GitLab's sanitizer strips that span, deep links to old #label-... rdoc headings would stop resolving. Worth a later look, but not a regression this MR needs to handle.

Edited by Stan Hu

Merge request reports

Loading
Loading