CVS commit: [pkgsrc-2026Q3] pkgsrc/textproc/ruby-nokogiri

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Nov 11 10:42:07 UTC 2026

Modified Files:
        pkgsrc/textproc/ruby-nokogiri [pkgsrc-2026Q3]: Makefile PLIST distinfo

Log Message:
Pullup ticket #7364 - requested by taca
textproc/ruby-nokogiri: Security fix

Revisions pulled up:
- textproc/ruby-nokogiri/Makefile                               1.112
- textproc/ruby-nokogiri/PLIST                                  1.44
- textproc/ruby-nokogiri/distinfo                               1.79

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Sat Nov  7 15:23:37 UTC 2026

   Modified Files:
        pkgsrc/textproc/ruby-nokogiri: Makefile PLIST distinfo

   Log Message:
   textproc/ruby-nokogiri: update to 1.19.7

   1.19.5 (2026-11-01)

   Security

   * [CRuby] (Low) Fixed a possible use-after-free when an attribute value is
     replaced via Node#[]= or Node#lang= while Ruby objects still reference the
     attribute's children.  See GHSA-3w22-6jfg-527w for more information.

   * [CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless
     the document was parsed with parse_noscript_content_as_text: true,
     preventing a mutation XSS in applications that allow noscript in sanitized
     HTML.  A fragment now parses noscript content the same way as its
     document, and raises ArgumentError if given a conflicting
     parse_noscript_content_as_text: value.  Comments and raw-text elements
     inside noscript are still serialized unchanged, as the HTML standard
     requires, so applications that sanitize HTML and allow noscript should
     parse with parse_noscript_content_as_text: true or remove noscript
     elements.  See GHSA-4p39-36wj-23h4 for more information.

   * [JRuby] (Low) NONET now blocks external DTDs and entities whose systemId
     uses a short-form IPv4 host such as 127.1, or is an absolute path in a
     document parsed from a network URL.  Previously Nokogiri fetched them over
     the network during a parse with DTDLOAD or NOENT, potentially enabling
     SSRF.  See GHSA-v995-44v6-5fqm for more information.

   Improved

   * [CRuby] The HTML5 parser now has linear performance when parsing many
     attributes.  Previously performance was quadratic due to two hotspots, one
     in detecting duplicate attributes and one in constructing the libxml2 data
     structures.  (#3393) @flavorjones

   * [CRuby] Improved XPath argument marshalling performance by using ALLOCV_N
     instead of rb_gc_register_address.  (#3648) @jhawthorn

   Fixed

   (This is too many to write here, please refer
   <https://github.com/sparklemotion/nokogiri/blob/cb8cd033a3c6c67109a745f7eb4a98b05e82adbe/CHANGELOG.md>
   in detail.)

   1.19.6 / 2026-11-02

   Fixed

   * [JRuby] Parsing or reparenting an HTML4 element that has an xmlns
     attribute and a child element no longer raises NullPointerException.  This
     was a regression in v1.19.5.  (#3753) @flavorjones

   1.19.7 / 2026-11-02
   Fixed

   * [CRuby] Compile against Ruby 4.1.0-preview1, which defines HAVE_RB_LEN_T
     but not RB_FIX2LEN.  (#3755) @andrewfader


To generate a diff of this commit:
cvs rdiff -u -r1.111 -r1.111.4.1 pkgsrc/textproc/ruby-nokogiri/Makefile
cvs rdiff -u -r1.43 -r1.43.10.1 pkgsrc/textproc/ruby-nokogiri/PLIST
cvs rdiff -u -r1.78 -r1.78.4.1 pkgsrc/textproc/ruby-nokogiri/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/ruby-nokogiri/Makefile
diff -u pkgsrc/textproc/ruby-nokogiri/Makefile:1.111 pkgsrc/textproc/ruby-nokogiri/Makefile:1.111.4.1
--- pkgsrc/textproc/ruby-nokogiri/Makefile:1.111        Fri Jun 19 13:11:17 2026
+++ pkgsrc/textproc/ruby-nokogiri/Makefile      Wed Nov 11 10:42:07 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.111 2026/06/19 13:11:17 tsutsui Exp $
+# $NetBSD: Makefile,v 1.111.4.1 2026/11/11 10:42:07 maya Exp $
 
-DISTNAME=      nokogiri-1.19.4
+DISTNAME=      nokogiri-1.19.7
 CATEGORIES=    textproc
 
 MAINTAINER=    tsutsui%NetBSD.org@localhost

Index: pkgsrc/textproc/ruby-nokogiri/PLIST
diff -u pkgsrc/textproc/ruby-nokogiri/PLIST:1.43 pkgsrc/textproc/ruby-nokogiri/PLIST:1.43.10.1
--- pkgsrc/textproc/ruby-nokogiri/PLIST:1.43    Mon Sep 15 04:46:04 2025
+++ pkgsrc/textproc/ruby-nokogiri/PLIST Wed Nov 11 10:42:07 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.43 2025/09/15 04:46:04 tsutsui Exp $
+@comment $NetBSD: PLIST,v 1.43.10.1 2026/11/11 10:42:07 maya Exp $
 bin/nokogiri${RUBY_SUFFIX}
 ${GEM_HOME}/cache/${GEM_NAME}.gem
 ${GEM_EXTSDIR}/gem.build_complete
@@ -64,6 +64,8 @@ ${GEM_LIBDIR}/gumbo-parser/src/error.c
 ${GEM_LIBDIR}/gumbo-parser/src/error.h
 ${GEM_LIBDIR}/gumbo-parser/src/foreign_attrs.c
 ${GEM_LIBDIR}/gumbo-parser/src/foreign_attrs.gperf
+${GEM_LIBDIR}/gumbo-parser/src/hashmap.c
+${GEM_LIBDIR}/gumbo-parser/src/hashmap.h
 ${GEM_LIBDIR}/gumbo-parser/src/insertion_mode.h
 ${GEM_LIBDIR}/gumbo-parser/src/macros.h
 ${GEM_LIBDIR}/gumbo-parser/src/nokogiri_gumbo.h
@@ -73,6 +75,8 @@ ${GEM_LIBDIR}/gumbo-parser/src/replaceme
 ${GEM_LIBDIR}/gumbo-parser/src/string_buffer.c
 ${GEM_LIBDIR}/gumbo-parser/src/string_buffer.h
 ${GEM_LIBDIR}/gumbo-parser/src/string_piece.c
+${GEM_LIBDIR}/gumbo-parser/src/string_set.c
+${GEM_LIBDIR}/gumbo-parser/src/string_set.h
 ${GEM_LIBDIR}/gumbo-parser/src/svg_attrs.c
 ${GEM_LIBDIR}/gumbo-parser/src/svg_attrs.gperf
 ${GEM_LIBDIR}/gumbo-parser/src/svg_tags.c

Index: pkgsrc/textproc/ruby-nokogiri/distinfo
diff -u pkgsrc/textproc/ruby-nokogiri/distinfo:1.78 pkgsrc/textproc/ruby-nokogiri/distinfo:1.78.4.1
--- pkgsrc/textproc/ruby-nokogiri/distinfo:1.78 Fri Jun 19 13:11:17 2026
+++ pkgsrc/textproc/ruby-nokogiri/distinfo      Wed Nov 11 10:42:07 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.78 2026/06/19 13:11:17 tsutsui Exp $
+$NetBSD: distinfo,v 1.78.4.1 2026/11/11 10:42:07 maya Exp $
 
-BLAKE2s (nokogiri-1.19.4.gem) = 93f0800faf010eeda807555cc620517288ee8a46436475cb6aabdf3eaaa7f32b
-SHA512 (nokogiri-1.19.4.gem) = b349dbadfcab6cdde847e3f03284a79be77313b8c02a0fb45b557b001dfdc2b7d937de9f14daaf3f5c03a198138a8c547d3d9a79f030e404b966afca0f6d730c
-Size (nokogiri-1.19.4.gem) = 4369408 bytes
+BLAKE2s (nokogiri-1.19.7.gem) = 50f3717681ed4e5343ccd9a597786be2c6d384c9301816218245db2dbcf9b7a6
+SHA512 (nokogiri-1.19.7.gem) = 81185fcdf65c117b2dc6ac30fd30ca6e758961424f51e687a93549c5269f015c0093714d42a510e33437c2dd9c9aa9ca46ea470c329ed6f10b93112704b23c11
+Size (nokogiri-1.19.7.gem) = 4387328 bytes