CVS commit: pkgsrc/textproc/ruby-nokogiri

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sat Nov  7 15:23:37 UTC 2026

Modified Files:
        pkgsrc/textproc/ruby-nokogiri: Makefile PLIST distinfo

Log Message:
textproc/ruby-nokogiri: update to 1.19.7

1.19.5 (2026-11-01)

Security

* [CRuby] (Low) Fixed a possible use-after-free when an attribute value is
  replaced via Node#[]= or Node#lang= while Ruby objects still reference the
  attribute's children.  See GHSA-3w22-6jfg-527w for more information.

* [CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless
  the document was parsed with parse_noscript_content_as_text: true,
  preventing a mutation XSS in applications that allow noscript in sanitized
  HTML.  A fragment now parses noscript content the same way as its
  document, and raises ArgumentError if given a conflicting
  parse_noscript_content_as_text: value.  Comments and raw-text elements
  inside noscript are still serialized unchanged, as the HTML standard
  requires, so applications that sanitize HTML and allow noscript should
  parse with parse_noscript_content_as_text: true or remove noscript
  elements.  See GHSA-4p39-36wj-23h4 for more information.

* [JRuby] (Low) NONET now blocks external DTDs and entities whose systemId
  uses a short-form IPv4 host such as 127.1, or is an absolute path in a
  document parsed from a network URL.  Previously Nokogiri fetched them over
  the network during a parse with DTDLOAD or NOENT, potentially enabling
  SSRF.  See GHSA-v995-44v6-5fqm for more information.

Improved

* [CRuby] The HTML5 parser now has linear performance when parsing many
  attributes.  Previously performance was quadratic due to two hotspots, one
  in detecting duplicate attributes and one in constructing the libxml2 data
  structures.  (#3393) @flavorjones

* [CRuby] Improved XPath argument marshalling performance by using ALLOCV_N
  instead of rb_gc_register_address.  (#3648) @jhawthorn

Fixed

(This is too many to write here, please refer
<https://github.com/sparklemotion/nokogiri/blob/cb8cd033a3c6c67109a745f7eb4a98b05e82adbe/CHANGELOG.md>
in detail.)

1.19.6 / 2026-11-02

Fixed

* [JRuby] Parsing or reparenting an HTML4 element that has an xmlns
  attribute and a child element no longer raises NullPointerException.  This
  was a regression in v1.19.5.  (#3753) @flavorjones

1.19.7 / 2026-11-02
Fixed

* [CRuby] Compile against Ruby 4.1.0-preview1, which defines HAVE_RB_LEN_T
  but not RB_FIX2LEN.  (#3755) @andrewfader


To generate a diff of this commit:
cvs rdiff -u -r1.111 -r1.112 pkgsrc/textproc/ruby-nokogiri/Makefile
cvs rdiff -u -r1.43 -r1.44 pkgsrc/textproc/ruby-nokogiri/PLIST
cvs rdiff -u -r1.78 -r1.79 pkgsrc/textproc/ruby-nokogiri/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/ruby-nokogiri/Makefile
diff -u pkgsrc/textproc/ruby-nokogiri/Makefile:1.111 pkgsrc/textproc/ruby-nokogiri/Makefile:1.112
--- pkgsrc/textproc/ruby-nokogiri/Makefile:1.111        Fri Jun 19 13:11:17 2026
+++ pkgsrc/textproc/ruby-nokogiri/Makefile      Sat Nov  7 15:23:37 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.111 2026/06/19 13:11:17 tsutsui Exp $
+# $NetBSD: Makefile,v 1.112 2026/11/07 15:23:37 taca Exp $
 
-DISTNAME=      nokogiri-1.19.4
+DISTNAME=      nokogiri-1.19.7
 CATEGORIES=    textproc
 
 MAINTAINER=    tsutsui%NetBSD.org@localhost

Index: pkgsrc/textproc/ruby-nokogiri/PLIST
diff -u pkgsrc/textproc/ruby-nokogiri/PLIST:1.43 pkgsrc/textproc/ruby-nokogiri/PLIST:1.44
--- pkgsrc/textproc/ruby-nokogiri/PLIST:1.43    Mon Sep 15 04:46:04 2025
+++ pkgsrc/textproc/ruby-nokogiri/PLIST Sat Nov  7 15:23:37 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.43 2025/09/15 04:46:04 tsutsui Exp $
+@comment $NetBSD: PLIST,v 1.44 2026/11/07 15:23:37 taca Exp $
 bin/nokogiri${RUBY_SUFFIX}
 ${GEM_HOME}/cache/${GEM_NAME}.gem
 ${GEM_EXTSDIR}/gem.build_complete
@@ -64,6 +64,8 @@ ${GEM_LIBDIR}/gumbo-parser/src/error.c
 ${GEM_LIBDIR}/gumbo-parser/src/error.h
 ${GEM_LIBDIR}/gumbo-parser/src/foreign_attrs.c
 ${GEM_LIBDIR}/gumbo-parser/src/foreign_attrs.gperf
+${GEM_LIBDIR}/gumbo-parser/src/hashmap.c
+${GEM_LIBDIR}/gumbo-parser/src/hashmap.h
 ${GEM_LIBDIR}/gumbo-parser/src/insertion_mode.h
 ${GEM_LIBDIR}/gumbo-parser/src/macros.h
 ${GEM_LIBDIR}/gumbo-parser/src/nokogiri_gumbo.h
@@ -73,6 +75,8 @@ ${GEM_LIBDIR}/gumbo-parser/src/replaceme
 ${GEM_LIBDIR}/gumbo-parser/src/string_buffer.c
 ${GEM_LIBDIR}/gumbo-parser/src/string_buffer.h
 ${GEM_LIBDIR}/gumbo-parser/src/string_piece.c
+${GEM_LIBDIR}/gumbo-parser/src/string_set.c
+${GEM_LIBDIR}/gumbo-parser/src/string_set.h
 ${GEM_LIBDIR}/gumbo-parser/src/svg_attrs.c
 ${GEM_LIBDIR}/gumbo-parser/src/svg_attrs.gperf
 ${GEM_LIBDIR}/gumbo-parser/src/svg_tags.c

Index: pkgsrc/textproc/ruby-nokogiri/distinfo
diff -u pkgsrc/textproc/ruby-nokogiri/distinfo:1.78 pkgsrc/textproc/ruby-nokogiri/distinfo:1.79
--- pkgsrc/textproc/ruby-nokogiri/distinfo:1.78 Fri Jun 19 13:11:17 2026
+++ pkgsrc/textproc/ruby-nokogiri/distinfo      Sat Nov  7 15:23:37 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.78 2026/06/19 13:11:17 tsutsui Exp $
+$NetBSD: distinfo,v 1.79 2026/11/07 15:23:37 taca Exp $
 
-BLAKE2s (nokogiri-1.19.4.gem) = 93f0800faf010eeda807555cc620517288ee8a46436475cb6aabdf3eaaa7f32b
-SHA512 (nokogiri-1.19.4.gem) = b349dbadfcab6cdde847e3f03284a79be77313b8c02a0fb45b557b001dfdc2b7d937de9f14daaf3f5c03a198138a8c547d3d9a79f030e404b966afca0f6d730c
-Size (nokogiri-1.19.4.gem) = 4369408 bytes
+BLAKE2s (nokogiri-1.19.7.gem) = 50f3717681ed4e5343ccd9a597786be2c6d384c9301816218245db2dbcf9b7a6
+SHA512 (nokogiri-1.19.7.gem) = 81185fcdf65c117b2dc6ac30fd30ca6e758961424f51e687a93549c5269f015c0093714d42a510e33437c2dd9c9aa9ca46ea470c329ed6f10b93112704b23c11
+Size (nokogiri-1.19.7.gem) = 4387328 bytes