Update gitlab-markup to 2.2.0 and rdoc to 8.1.0
What does this MR do and why?
Updates gitlab-markup from 2.1.0 to 2.2.0 and rdoc from 6.17.0 to 8.1.0.
gitlab-markup 2.2.0 relaxes its rdoc pin from ~> 6.13 to >= 6.13, < 9,
which allows rdoc to move to the 8.x series.
rdoc 8.x requires rbs >= 4.0.0, but solargraph 0.58.x capped rbs at
<= 4.0.0.dev.4. solargraph 0.60.x relaxes that to rbs >= 3.10.0, so this
also bumps solargraph from ~> 0.58.0 to ~> 0.60.0 to unblock the upgrade.
Resulting lock changes
gitlab-markup2.1.0 → 2.2.0rdoc6.17.0 → 8.1.0rbs3.9.5 → 4.2.0solargraph0.58.3 → 0.60.1- New transitive deps from solargraph:
commander,highline,parlour,sord psychandstringiodrop from the lock since rdoc 8 no longer pulls them in; both remain available as Ruby default gems.
Both Gemfile.lock and Gemfile.next.lock were regenerated via
bundle exec rake bundler:gemfile:sync.
Spec updates for rdoc 8 output
rdoc 8 changes its HTML output in two ways that spec/lib/gitlab/other_markup_spec.rb
asserted against. Both are rdoc rendering changes, not GitLab behavior changes:
- Headings now get slug-based IDs (
heading-1,another-h2) on the<h>element itself instead of the oldlabel--prefixed anchor. After GitLab'sMarkupHeadingAnchorFilterthe IDs areuser-content-heading-N, matching the scheme org-mode already uses. - A link with a disallowed scheme (
javascript:) is now dropped entirely rather than rendered as an empty<a>, soXSS[JaVaScriPt:alert(1)]renders as<p>XSS</p>. This is strictly safer; no dangerous href reaches the output in either version.
Verified locally: both examples pass (2 examples, 0 failures).
Minor backward-compat note (non-blocking)
rdoc 8 moves the old label- anchor into a <span class="legacy-anchor"> before
each heading. If GitLab's sanitizer strips that span, deep links to old
#label-... rdoc headings would stop resolving. Worth a later look, but not a
regression this MR needs to handle.