From 8e0aa7d636fde7e1f873b55ccf294aeea28a6dd8 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 9 Jun 2026 12:10:31 -0400 Subject: [PATCH] =?UTF-8?q?dep:=20update=20nokogiri=201.18.10=20=E2=86=92?= =?UTF-8?q?=201.19.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Security bump clearing 3 advisories: GHSA-c4rq-3m3g-8wgx (High, CSS selector tokenizer ReDoS), GHSA-v2fc-qm4h-8hqv (XSLT transform memory leak), GHSA-wx95-c6cv-8532 (unchecked xmlC14NExecute return). None exposed: loofah/rails-html-sanitizer use DOM/XPath not CSS selectors, every app CSS selector is a compile-time literal, and campfire uses no XSLT or XML canonicalization. The 1.18→1.19 minor bump is a Ruby-4-support/packaging milestone — bundled libxml2 2.13.9 / libxslt 1.1.43 are unchanged, so HTML parsing and ActionText sanitization output are identical. Ruby floor 3.2 (campfire runs 3.4.5); all 4 locked platforms still ship. Transitive dep via Rails/loofah (no Gemfile change). 33 commits analyzed, 0 mitigations. Verified green via full unit + system suites. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-nokogiri_v1.18.10..v1.19.3.md 🤖 Assisted by Claude --- Gemfile.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index a45765c..bbd10a9 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -234,13 +234,13 @@ GEM net-smtp (0.5.1) net-protocol nio4r (2.7.5) - nokogiri (1.18.10-aarch64-linux-gnu) + nokogiri (1.19.3-aarch64-linux-gnu) racc (~> 1.4) - nokogiri (1.18.10-arm64-darwin) + nokogiri (1.19.3-arm64-darwin) racc (~> 1.4) - nokogiri (1.18.10-x86_64-darwin) + nokogiri (1.19.3-x86_64-darwin) racc (~> 1.4) - nokogiri (1.18.10-x86_64-linux-gnu) + nokogiri (1.19.3-x86_64-linux-gnu) racc (~> 1.4) openssl (3.3.0) ostruct (0.6.3)