build(deps): bump nokogiri from 1.15.3 to 1.19.3 in /docs/multiple-tests/multi-patterns/src by dependabot[bot] · Pull Request #216 · codacy/codacy-bundler-audit

dependabot · 2026-05-08T11:55:17Z

Bumps nokogiri from 1.15.3 to 1.19.3.

Release notes

v1.19.3 / 2026-04-27

Fixed / Security

Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
[CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.

46b89e5d7b9e844c2ee360794240c6ea2a4e6fa0c5892a4ed487db621224b639  nokogiri-1.19.3-aarch64-linux-gnu.gem
8392dfdcd21be7a94dbbe9ccc138dea01b97b24cb2dc02a114ca98bfb1d9a0b7  nokogiri-1.19.3-aarch64-linux-musl.gem
3919d5ffc334ad778a4a9eb88fda7dcb8b1fb58c8a52ac640c6dcd2f038e774f  nokogiri-1.19.3-arm-linux-gnu.gem
9ce1cb6346bb9c67b1550eb537aa183ead91e4b6eadb2f36ade02d8dd2a79fb6  nokogiri-1.19.3-arm-linux-musl.gem
71b9bd424b1b7abc18b05052a1a3cfd3627abdca62be280854cc411791357e42  nokogiri-1.19.3-arm64-darwin.gem
40ea6ebf5cf2005dae1dee26dd557d3afb41fb6de6c9764aca8cf06fdb841db1  nokogiri-1.19.3-java.gem
8bb7132cad356c879a1286eaabcb5e68326cb2490317984280fbc62f456d506a  nokogiri-1.19.3-x64-mingw-ucrt.gem
77f3fba57d46c53ab31e62fc6c28f705109d1bf6264356c76f132b2be5728d4d  nokogiri-1.19.3-x86_64-darwin.gem
2f5078620fe12e83669b5b17311b32532a8153d02eee7ad06948b926d6080976  nokogiri-1.19.3-x86_64-linux-gnu.gem
248c906d2166eca5efb56d52fdee5f9a1f51d69a72e2b64fdac647b4ce39ea3f  nokogiri-1.19.3-x86_64-linux-musl.gem
78312cbac32a40c812780d9678221b79d51288eec00054c1a8d15f7ce05960e8  nokogiri-1.19.3.gem

v1.19.2 / 2026-03-19

Dependencies

[JRuby] Saxon-HE is updated to 12.7, from 9.6.0-4. Saxon-HE is a transitive dependency of nu.validator:jing, and this update addresses CVEs in Saxon-HE's own transitive dependencies JDOM and dom4j. We don't think this warrants a security release, however we're cutting a patch release to help users whose security scanners are flagging this. #3611 @flavorjones

SHA256 Checksums

c34d5c8208025587554608e98fd88ab125b29c80f9352b821964e9a5d5cfbd19  nokogiri-1.19.2-aarch64-linux-gnu.gem
7f6b4b0202d507326841a4f790294bf75098aef50c7173443812e3ac5cb06515  nokogiri-1.19.2-aarch64-linux-musl.gem
b7fa1139016f3dc850bda1260988f0d749934a939d04ef2da13bec060d7d5081  nokogiri-1.19.2-arm-linux-gnu.gem
61114d44f6742ff72194a1b3020967201e2eb982814778d130f6471c11f9828c  nokogiri-1.19.2-arm-linux-musl.gem
58d8ea2e31a967b843b70487a44c14c8ba1866daa1b9da9be9dbdf1b43dee205  nokogiri-1.19.2-arm64-darwin.gem
e9d67034bc80ca71043040beea8a91be5dc99b662daa38a2bfb361b7a2cc8717  nokogiri-1.19.2-java.gem
8ccf25eea3363a2c7b3f2e173a3400582c633cfead27f805df9a9c56d4852d1a  nokogiri-1.19.2-x64-mingw-ucrt.gem
7d9af11fda72dfaa2961d8c4d5380ca0b51bc389dc5f8d4b859b9644f195e7a4  nokogiri-1.19.2-x86_64-darwin.gem
fa8feca882b73e871a9845f3817a72e9734c8e974bdc4fbad6e4bc6e8076b94f  nokogiri-1.19.2-x86_64-linux-gnu.gem
93128448e61a9383a30baef041bf1f5817e22f297a1d400521e90294445069a8  nokogiri-1.19.2-x86_64-linux-musl.gem
38fdd8b59db3d5ea9e7dfb14702e882b9bf819198d5bf976f17ebce12c481756  nokogiri-1.19.2.gem

Full Changelog: sparklemotion/nokogiri@v1.19.1...v1.19.2

v1.19.1 / 2026-02-16

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.3 / 2026-04-27

Fixed / Security

Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.

[CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.

v1.19.2 / 2026-03-19

Dependencies

[JRuby] Saxon-HE is updated to 12.7, from 9.6.0-4. Saxon-HE is a transitive dependency of nu.validator:jing, and this update addresses CVEs in Saxon-HE's own transitive dependencies JDOM and dom4j. We don't think this warrants a security release, however we're cutting a patch release to help users whose security scanners are flagging this. #3611 @flavorjones

v1.19.1 / 2026-02-16

Security

[CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

Introduce native gem support for Ruby 4.0. #3590

End support for Ruby 3.1, for which upstream support ended 2025-03-26.

End support for JRuby 9.4 (which targets Ruby 3.1 compatibility).

v1.18.10 / 2025-09-15

Dependencies

[CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.

[CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18

v1.18.9 / 2025-07-20

Security

[CRuby] Applied upstream libxml2 patches to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796. See GHSA-353f-x4gh-cqq8 for more information.

v1.18.8 / 2025-04-21

... (truncated)

Commits

c139a3d version bump to v1.19.3
7501a63 fix: backtracking in CSS tokenizer rules (v1.19.x backport) (#3627)
03e7968 test: skip CSS tokenizer benchmarks on JRuby
b984b7e fix: ReDoS in CSS tokenizer ident rule
0092623 fix: ReDoS in CSS tokenizer STRING rule
ee17d33 fix: memory leak in XSLT transform (backport to v1.19.x) (#3624)
ce188a3 doc: update CHANGELOG
caeaac4 fix: memory leak in XSLT transform
25220bf dep(test): test against libxml-ruby v6 (#3618)
0caeb21 doc: add security warnings for untrusted XSLT stylesheets
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.15.3 to 1.19.3. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.15.3...v1.19.3) --- updated-dependencies: - dependency-name: nokogiri dependency-version: 1.19.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

codacy-production · 2026-05-08T11:56:34Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric Results

Duplication 0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codacy-production

Pull Request Overview

While this PR successfully bumps nokogiri to version 1.19.3 to address several security vulnerabilities, it introduces two critical regressions that must be addressed before merging.

First, a major security regression occurred during dependency resolution: the rack gem was downgraded from version 2.2.6.4 to 1.6.13. This older version is nearly a decade old and contains numerous high-severity vulnerabilities (DoS, XSS, and session management flaws). Second, the PR replaces the generic 'ruby' platform with 'x86_64-linux', which will break the local development environment for any team members using different architectures, such as macOS (Darwin).

About this PR

The PLATFORMS section change from 'ruby' to 'x86_64-linux' suggests a configuration change in the build environment that may break dependency resolution for developers on non-Linux systems. This should be reverted to include the generic 'ruby' platform.

Test suggestions

Verify that nokogiri is updated to 1.19.3 in Gemfile.lock
Ensure that the rack gem version remains stable or is upgraded

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Ensure that the rack gem version remains stable or is upgraded

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-05-08T11:57:24Z

CVE-2023-27530

      racc (~> 1.4)
    racc (1.7.1)
-    rack (2.2.6.4)
+    rack (1.6.13)


_{🔴 HIGH RISK}

Significant security regression detected: rack was downgraded from 2.2.6.4 to 1.6.13. This version is over 8 years old and introduces at least 15 known vulnerabilities, including high-severity risks like memory exhaustion DoS (CVE-2023-27530) and XSS (CVE-2026-25500). This major downgrade likely occurred as a side effect of the dependency resolution for the nokogiri update.

Recommended Action: Investigate your Gemfile constraints to ensure rack is pinned to ~> 2.2 or higher, then run bundle update rack to restore a secure version.

See Issue in Codacy
See Issue in Codacy
See Issue in Codacy
See Issue in Codacy
See Issue in Codacy
See Issue in Codacy

codacy-production · 2026-05-08T11:57:24Z


 PLATFORMS
-  ruby
+  x86_64-linux


_{🟡 MEDIUM RISK}

Suggestion: Replacing the generic ruby platform with x86_64-linux breaks cross-platform compatibility for developers on other architectures (e.g., Apple Silicon Macs). If specific Linux support is required for CI/CD, you should add it as an additional platform rather than replacing the default entry.

Suggested Fix: Run bundle lock --add-platform x86_64-linux to support both generic ruby environments and specific Linux builds.

dependabot · 2026-06-23T07:25:06Z

Superseded by #220.

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels May 8, 2026

dependabot Bot mentioned this pull request May 8, 2026

build(deps): bump nokogiri from 1.15.3 to 1.18.3 in /docs/multiple-tests/multi-patterns/src #190

Closed

codacy-production Bot reviewed May 8, 2026

View reviewed changes

dependabot Bot closed this Jun 23, 2026

dependabot Bot deleted the dependabot/bundler/docs/multiple-tests/multi-patterns/src/nokogiri-1.19.3 branch June 23, 2026 07:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump nokogiri from 1.15.3 to 1.19.3 in /docs/multiple-tests/multi-patterns/src#216

build(deps): bump nokogiri from 1.15.3 to 1.19.3 in /docs/multiple-tests/multi-patterns/src#216
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/docs/multiple-tests/multi-patterns/src/nokogiri-1.19.3

dependabot Bot commented on behalf of github May 8, 2026

Uh oh!

codacy-production Bot commented May 8, 2026 •

edited

Loading

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot May 8, 2026

Uh oh!

codacy-production Bot May 8, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 8, 2026

v1.19.3 / 2026-04-27

Fixed / Security

v1.19.2 / 2026-03-19

Dependencies

SHA256 Checksums

v1.19.1 / 2026-02-16

v1.19.3 / 2026-04-27

Fixed / Security

v1.19.2 / 2026-03-19

Dependencies

v1.19.1 / 2026-02-16

Security

v1.19.0 / 2025-12-28

Ruby

v1.18.10 / 2025-09-15

Dependencies

v1.18.9 / 2025-07-20

Security

v1.18.8 / 2025-04-21

Uh oh!

codacy-production Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot May 8, 2026

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

codacy-production Bot commented May 8, 2026 •

edited

Loading