Skip to content

Bump nokogiri from 1.19.3 to 1.19.4 in the bundler group across 1 directory - #442

Merged
rsmoke merged 2 commits into
stagingfrom
dependabot/bundler/bundler-672a667423
Jul 6, 2026
Merged

Bump nokogiri from 1.19.3 to 1.19.4 in the bundler group across 1 directory#442
rsmoke merged 2 commits into
stagingfrom
dependabot/bundler/bundler-672a667423

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 23, 2026

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 1 update in the / directory: nokogiri.

Updates nokogiri from 1.19.3 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem
Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
Commits
  • 8cfb9da version bump to v1.19.4
  • a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
  • 6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
  • f658a54 fix: JRuby NONET bypass in XML::Schema
  • 39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
  • 04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
  • 7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
  • ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
  • 5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
  • 9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 1 update in the / directory: [nokogiri](https://github.com/sparklemotion/nokogiri).


Updates `nokogiri` from 1.19.3 to 1.19.4
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.3...v1.19.4)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.19.4
  dependency-type: direct:production
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Jun 23, 2026
@rsmoke
rsmoke merged commit 0a6d88c into staging Jul 6, 2026
3 checks passed
@rsmoke
rsmoke deleted the dependabot/bundler/bundler-672a667423 branch July 6, 2026 15:19
rsmoke added a commit that referenced this pull request Jul 6, 2026
* Bump net-imap in the bundler group across 1 directory

Bumps the bundler group with 1 update in the / directory: [net-imap](https://github.com/ruby/net-imap).


Updates `net-imap` from 0.6.4 to 0.6.4.1
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](ruby/net-imap@v0.6.4...v0.6.4.1)

---
updated-dependencies:
- dependency-name: net-imap
  dependency-version: 0.6.4.1
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>

* Add analytics dashboard and related configurations

- Included Trackable module in ApplicationController for tracking purposes.
- Added new analytics jobs in recurring.yml for hourly, daily rollup, and pruning.
- Updated queue.yml to configure analytics queue with specific threading and polling settings.
- Defined route for analytics dashboard in routes.rb.
- Enhanced layout views to include links to the analytics dashboard for authorized users.
- Added Chart.js to importmap for data visualization support.

* Add analytics tables and sequences for daily and hourly rollups

- Created tables for analytics_daily_rollups and analytics_hourly_rollups with relevant columns for tracking user interactions.
- Added sequences for both tables to manage primary key generation.
- Established primary key constraints and unique indexes to ensure data integrity and optimize query performance.
- Included additional table for page_views with corresponding sequence and constraints for comprehensive analytics tracking.

* Enhance analytics dashboard functionality and live data handling

- Implemented a refresh action in the AnalyticsDashboardController to trigger rollup jobs synchronously, allowing immediate chart updates.
- Updated the analytics dashboard view to include a refresh button and a notice for stale data.
- Modified the analytics policy to authorize the refresh action for admin users.
- Adjusted routes to include a POST endpoint for refreshing analytics data.
- Enhanced the PageView model with live summary and top pages methods to provide real-time analytics data.
- Improved data handling in the controller to ensure top pages and summary stats reflect current data without waiting for rollup jobs.

* Update Tailwind CSS to version 4.1.18 with property layer adjustments

- Modified the properties layer in tailwind.css to enhance support for various CSS features.
- Updated theme and base layers to ensure consistent styling and improved layout handling.
- Adjusted spacing and color variables for better design flexibility and responsiveness.

* Refactor analytics dashboard views and remove HAML support

- Converted analytics dashboard views from HAML to ERB format for consistency.
- Added new partials for stat cards and building rows to enhance modularity.
- Updated Gemfile to remove HAML-related gems and dependencies.
- Adjusted importmap to include Chart.js for improved data visualization.
- Enhanced the .gitignore to exclude .OLD files and HAML files.

* Update recurring job schedule format in recurring.yml

- Changed the schedule format for the AnalyticsRollupJob from "every week on Sunday at 02:30" to "at 2:30am every Sunday" for improved clarity and consistency.

* Enhance analytics dashboard with new chart data scoping and Turbo integration

- Added a test to verify that hourly chart data is correctly scoped to the selected time range.
- Updated the analytics chart controller to handle Turbo caching by destroying the chart before caching.
- Modified the analytics dashboard view to prevent Turbo from restoring cached canvas data, ensuring fresh data is displayed on navigation.

* Remove unnecessary schema creation comments from SQL structure files

* Enhance analytics dashboard with time range selection and caching prevention

- Added a new test to verify that the selected time range is reflected on the analytics dashboard and that caching is disabled.
- Updated the analytics dashboard view to display the selected time range and prevent browser caching.
- Modified the analytics dashboard controller to include a method for setting cache control headers.

* Implement Stimulus controller for time range selection in analytics dashboard

- Added a new test to verify the use of a Stimulus controller for handling time range changes instead of inline JavaScript.
- Updated the analytics dashboard view to utilize data attributes for the Stimulus controller, enhancing maintainability and separation of concerns.
- Registered the new AnalyticsRangeController in the JavaScript controllers index.

* Bump nokogiri in the bundler group across 1 directory (#442)

Bumps the bundler group with 1 update in the / directory: [nokogiri](https://github.com/sparklemotion/nokogiri).


Updates `nokogiri` from 1.19.3 to 1.19.4
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.3...v1.19.4)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.19.4
  dependency-type: direct:production
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: rsmokeUM <rsmoke@umich.edu>

* Bump the bundler group across 1 directory with 2 updates (#443)

Bumps the bundler group with 2 updates in the / directory: [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) and [faraday](https://github.com/lostisland/faraday).


Updates `concurrent-ruby` from 1.3.6 to 1.3.7
- [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases)
- [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md)
- [Commits](ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7)

Updates `faraday` from 2.14.2 to 2.14.3
- [Release notes](https://github.com/lostisland/faraday/releases)
- [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md)
- [Commits](lostisland/faraday@v2.14.2...v2.14.3)

---
updated-dependencies:
- dependency-name: concurrent-ruby
  dependency-version: 1.3.7
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: faraday
  dependency-version: 2.14.3
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Refactor analytics range selection in dashboard

- Removed the inline data attribute for the analytics range URL in the dashboard view.
- Updated the AnalyticsRangeController to construct the URL dynamically using the current window location, improving maintainability and flexibility in handling range changes.

* Update analytics dashboard spec to use specific chart ID selectors for label extraction

- Changed the selector for extracting chart labels in the analytics dashboard spec from a generic attribute to specific IDs for the 24-hour and 7-day charts.
- This improves the accuracy of the tests by ensuring they target the correct elements in the HTML response.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant