1.12.5 / 2021-09-27

1.12.5 / 2021-09-27

Security

[JRuby] Address CVE-2021-41098 (GHSA-2rr5-8q37-2w7h).

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parsers resolve external entities (XXE) by default. This fix turns off entity-resolution-by-default in the JRuby SAX parsers to match the CRuby SAX parsers' behavior.

CRuby users are not affected by this CVE.

Fixed

• [CRuby] Document#to_xhtml properly serializes self-closing tags in libxml > 2.9.10. A behavior change introduced in libxml 2.9.11 resulted in emitting start and and tags (e.g., <br></br>) instead of a self-closing tag (e.g., <br/>) in previous Nokogiri versions. [#2324]

---

SHA256 checksums:

36bfa3a07aced069b3f3c9b39d9fb62cb0728d284d02b079404cd55780beaeff  nokogiri-1.12.5-arm64-darwin.gem
16b1a9ddbb70a9c998462912a5972097cbc79c3e01eb373906886ef8a469f589  nokogiri-1.12.5-java.gem
218dcc6edd1b49cc6244b5f88afb978739bb2f3f166c271557fe5f51e4bc713c  nokogiri-1.12.5-x64-mingw32.gem
e33bb919d64c16d931a5f26dc880969e587d225cfa97e6b56e790fb52179f527  nokogiri-1.12.5-x86-linux.gem
e13c2ed011b8346fbd589e96fe3542d763158bc2c7ad0f4f55f6d801afd1d9ff  nokogiri-1.12.5-x86-mingw32.gem
1ed64f7db7c1414b87fce28029f2a10128611d2037e0871ba298d00f9a00edd6  nokogiri-1.12.5-x86_64-darwin.gem
0868c8d0a147904d4dedaaa05af5f06656f2d3c67e4432601718559bf69d6cea  nokogiri-1.12.5-x86_64-linux.gem
2b20905942acc580697c8c496d0d1672ab617facb9d30d156b3c7676e67902ec  nokogiri-1.12.5.gem

1.12.4 / 2021-08-29

1.12.4 / 2021-08-29

Notable fix: Namespace inheritance

Namespace behavior when reparenting nodes has historically been poorly specified and the behavior diverged between CRuby and JRuby. As a result, making this behavior consistent in v1.12.0 introduced a breaking change.

This patch release reverts the Builder behavior present in v1.12.0..v1.12.3 but keeps the Document behavior. This release also introduces a Document attribute to allow affected users to easily change this behavior for their legacy code without invasive changes.

Compensating Feature in XML::Document

This release of Nokogiri introduces a new Document boolean attribute, namespace_inheritance, which controls whether children should inherit a namespace when they are reparented. Nokogiri::XML:Document defaults this attribute to false meaning "do not inherit," thereby making explicit the behavior change introduced in v1.12.0.

CRuby users who desire the pre-v1.12.0 behavior may set document.namespace_inheritance = true before reparenting nodes.

See https://nokogiri.org/rdoc/Nokogiri/XML/Document.html#namespace_inheritance-instance_method for example usage.

Fix for XML::Builder

However, recognizing that we want Builder-created children to inherit namespaces, Builder now will set namespace_inheritance=true on the underlying document for both JRuby and CRuby. This means that, on CRuby, the pre-v1.12.0 behavior is restored.

Users who want to turn this behavior off may pass a keyword argument to the Builder constructor like so:

Nokogiri::XML::Builder.new(namespace_inheritance: false)

See https://nokogiri.org/rdoc/Nokogiri/XML/Builder.html#label-Namespace+inheritance for example usage.

Downstream gem maintainers

Note that any downstream gems may want to specifically omit Nokogiri v1.12.0--v1.12.3 from their dependency specification if they rely on child namespace inheritance:

Gem::Specification.new do |gem|
  # ...
  gem.add_runtime_dependency 'nokogiri', '!=1.12.3', '!=1.12.2', '!=1.12.1', '!=1.12.0'
  # ...
end

Fixed

• [JRuby] Fix NPE in Schema parsing when an imported resource doesn't have a systemId. [#2296] (Thanks, @pepijnve!)

---

SHA256 checksums:

892808245fad3dea1bd4405461ba45d8f2261a6e23af91b8fc4b136e37cd3475  nokogiri-1.12.4-arm64-darwin.gem
1179f2c8fc13f4cb349b4e9219fbe7c1e7b885e24aceb2c8a0e06d1c3fe3ec2a  nokogiri-1.12.4-java.gem
44e728900a919ca9d8c6a3f545c2ff4903f4f45c47255904548386ad9f9869d6  nokogiri-1.12.4-x64-mingw32.gem
1116dac823e27f5255024c3154f0db3d2c9008cfdcaf11bbd66bde7770dca12d  nokogiri-1.12.4-x86-linux.gem
129b372c37dc817b588c623e6899ad32fe166498320789611ae3de0c361166ed  nokogiri-1.12.4-x86-mingw32.gem
f6f606dbdedd94e85e2fdc5e5829833441962115c3b62a2eab0a51f8ba938c3a  nokogiri-1.12.4-x86_64-darwin.gem
d706df7ed9382c749382e5b3bd9bfa4986935c0c5e36856d75fd9008d80f4da0  nokogiri-1.12.4-x86_64-linux.gem
7fec161ee1c7b2329e05fed019bfc7b1f910a39e6b30ae95825e75dda2094de9  nokogiri-1.12.4.gem

1.12.3 / 2021-08-06

1.12.3 / 2021-08-06

Fixed

• [CRuby] Fix compilation of libgumbo on older systems with versions of GCC that give errors on C99-isms. Affected systems include RHEL6, RHEL7, and SLES12. [#2302]

---

Checksums:

454eb62fc97285c485279509b04a3dcdcd329d2d0d8040dd6361c331550f3f59  nokogiri-1.12.3-arm64-darwin.gem
f9c83416f486ab3ea1a1cf58a3337dd3b95c4059350773a95ed2219415aaba8e  nokogiri-1.12.3-java.gem
a4a21f5e58f1485d3807802aac316c14b017d596f48fe088fd963863b078d34a  nokogiri-1.12.3-x64-mingw32.gem
9da1fb5436217d94d789ba8936bbb4fa36c8367d0eff43f1c4bbd150a1fe8170  nokogiri-1.12.3-x86-linux.gem
102e169468cf70b7d7f8719648f9f69f2ef4dfb9e7a59a1392b3c1fcb74e2e88  nokogiri-1.12.3-x86-mingw32.gem
4ae5202f5b184e5264d282502998846844352c135633c8fd1165ebd4ca2bdef9  nokogiri-1.12.3-x86_64-darwin.gem
eac6482a21c3cf63fea82a7d48131d701bd305dec01f38374a9c976f772f3b60  nokogiri-1.12.3-x86_64-linux.gem
d1975e30090ae723e05a6c9bd95fb795527e1a14d53a614735e2c3d8eef1e1e0  nokogiri-1.12.3.gem

1.12.2 / 2021-08-04

1.12.2 / 2021-08-04

Fixed

• Ensure that C extension files in non-native gem installations are loaded using require and rely on $LOAD_PATH instead of using require_relative. This issue only exists when deleting shared libraries that exist outside the extensions directory, something users occasionally do to conserve disk space. [#2300]

---

Checksums:

2ef276b482b56cfa488dd24c261c0bf42a47770bd0c15993f5c0d8b61879c114  nokogiri-1.12.2-arm64-darwin.gem
b483fb44ca38ba5890d53a16ab06e56cb23e6facc861ad1260c7bdf45d8227a2  nokogiri-1.12.2-java.gem
254e63ce59f95a4c30721d9ec85f8eb5e5e4f61e8da35015e41b85a262c014ea  nokogiri-1.12.2-x64-mingw32.gem
f66fbeca97668d3b6563d9311fe59b3dda5f7177405ec7a4d9dceca9d8d23b23  nokogiri-1.12.2-x86-linux.gem
0ece40121d72ab9704e429e06aa2011c7c59112886e000e3dac4ded3f3aeb3d6  nokogiri-1.12.2-x86-mingw32.gem
b9e33ebbb6c5b7575cfcb69bb52f776541642bbed08c88a36c1a33718458a8b9  nokogiri-1.12.2-x86_64-darwin.gem
bd8e7eb8345ef0679f2db3afa2bc13d7338b786c51aaa05ac6e22c1c8da3f3b3  nokogiri-1.12.2-x86_64-linux.gem
94a219a8078bf55f10834445be61b3ad9aa1e1047ec1bed048a86e3ab3245bc5  nokogiri-1.12.2.gem

1.12.1 / 2021-08-03

1.12.1 / 2021-08-03

Fixed

• Fix compilation of libgumbo on BSD systems by avoiding GNU-isms. [#2298]

---

Checksums:

194092568135d7897d8df0472c27c82b395a6c09054b8f4e8929805faf9eb877  nokogiri-1.12.1-arm64-darwin.gem
e9e16b36f6528af16c62bcfaeae517badb1ec07f5e856b5c151a913d3b0e6368  nokogiri-1.12.1-java.gem
ee1c497c759fdbbe482ab8a0c497b75d44efce5d2ae20fdb93b8c225508dc75a  nokogiri-1.12.1-x64-mingw32.gem
30c7dff0c9a56a2f03e4e4aa029e14f15282af37d469a0b159446de4c500b28b  nokogiri-1.12.1-x86-linux.gem
fcbdfc03405624ec0a186fa1bb41111a27264f4e7a7398c64c0d4e1e83769739  nokogiri-1.12.1-x86-mingw32.gem
ee4c88c46b8797bc6dbeee233ef0862a34d8a1a799e9fdcdfb0dfd8a42bb629b  nokogiri-1.12.1-x86_64-darwin.gem
f861b04e3268bda45036907f56ceede16b9fe1969099cb8888d378f71706fc63  nokogiri-1.12.1-x86_64-linux.gem
66dc1f0aa02fc62efb166465dfcc520785068cce4a9a3d2822cdea1f1ce66775  nokogiri-1.12.1.gem

1.12.0 / 2021-08-02

1.12.0 / 2021-08-02

Notable Addition: HTML5 Support (CRuby only)

HTML5 support has been added (to CRuby only) by merging Nokogumbo into Nokogiri. The Nokogumbo public API has been preserved, so this functionality is available under the Nokogiri::HTML5 namespace. [#2204]

Please note that HTML5 support is not available for JRuby in this version. However, we feel it is important to think about JRuby and we hope to work on this in the future. If you're interested in helping with HTML5 support on JRuby, please reach out to the maintainers by commenting on issue #2227.

Many thanks to Sam Ruby, Steve Checkoway, and Craig Barnes for creating and maintaining Nokogumbo and supporting the Gumbo HTML5 parser. They're now Nokogiri core contributors with all the powers and privileges pertaining thereto. 🙌

Notable Change: Nokogiri::HTML4 module and namespace

Nokogiri::HTML has been renamed to Nokogiri::HTML4, and Nokogiri::HTML is aliased to preserve backwards-compatibility. Nokogiri::HTML and Nokogiri::HTML4 parse methods still use libxml2's (or NekoHTML's) HTML4 parser in the v1.12 release series.

Take special note that if you rely on the class name of an object in your code, objects will now report a class of Nokogiri::HTML4::Foo where they previously reported Nokogiri::HTML::Foo. Instead of relying on the string returned by Object#class, prefer Class#=== or Object#is_a? or Object#instance_of?.

Future releases of Nokogiri may deprecate HTML methods or otherwise change this behavior, so please start using HTML4 in place of HTML.

Added

• [CRuby] Nokogiri::VERSION_INFO["libxslt"]["datetime_enabled"] is a new boolean value which describes whether libxslt (or, more properly, libexslt) has compiled-in datetime support. This generally going to be true, but some distros ship without this support (e.g., some mingw UCRT-based packages, see msys2/MINGW-packages#8957). See #2272 for more details.

Changed

• Introduce a new constant, Nokogiri::XML::ParseOptions::DEFAULT_XSLT, which adds the libxslt-preferred options of NOENT | DTDLOAD | DTDATTR | NOCDATA to ParseOptions::DEFAULT_XML.
• Nokogiri.XSLT parses stylesheets using ParseOptions::DEFAULT_XSLT, which should make some edge-case XSL transformations match libxslt's default behavior. [#1940]

Fixed

• [CRuby] Namespaced attributes are handled properly when their parent node is reparented into another document. Previously, the namespace may have gotten dropped. [#2228]
• [CRuby] Reparented nodes no longer inherit their parent's namespace. Previously, a node without a namespace was forced to adopt its parent's namespace. [#1712]

Improved

• [CRuby] Speed up (slightly) the compile time of packaged libraries libiconv, libxml2, and libxslt by using autoconf's --disable-dependency-tracking option. ("ruby" platform gem only.)

Deprecated

• Deprecating Nokogumbo's Nokogiri::HTML5.get. This method will be removed in a future version of Nokogiri.

Dependencies

• [CRuby] Upgrade mini_portile2 dependency from ~> 2.5.0 to ~> 2.6.1. ("ruby" platform gem only.)

---

Checksums:

b0b5650ba7903c317e0ebd4ca67ed10617735719cf3595ad98dd21974404e5d2  nokogiri-1.12.0.gem
60360d9994bb2e8852deb39f8833ba81a819df921c4192d857323c181645d95e  nokogiri-1.12.0-java.gem
c439f29de83294e61eca919edfea9d6176f23fa51b23d8a3d7261de6268e5847  nokogiri-1.12.0-x64-mingw32.gem
89d43ad2ea4f492ebc4c380288077186f0242ccfd65afe14fa0b45529d1f4b5e  nokogiri-1.12.0-x86-mingw32.gem
20fc8eba21f6e6b82720c05d694d2879ebdf6756351d5d2fb236e93febd346d0  nokogiri-1.12.0-x86-linux.gem
a21c803d17f89cceda599af1adc139ae17454539276e3f9dbdafea34081b1983  nokogiri-1.12.0-x86_64-linux.gem
f6b01a013829a499a0bf72a7d5109d117b9d4333823295dcd34eb002be0f0054  nokogiri-1.12.0-arm64-darwin.gem
97b4260b3912dcfad8427b5ea15ba094790dec1f4725ee074cfc5e9b45906352  nokogiri-1.12.0-x86_64-darwin.gem

1.12.0.rc1 / 2021-07-09

1.12.0.rc1 / 2021-07-09

Notable Addition: HTML5 Support (CRuby only)

HTML5 support has been added (to CRuby only) by merging Nokogumbo into Nokogiri. The Nokogumbo public API has been preserved, so this functionality is available under the Nokogiri::HTML5 namespace. [#2204]

Please note that HTML5 support is not available for JRuby in this version. However, we feel it is important to think about JRuby and we hope to work on this in the future. If you're interested in helping with HTML5 support on JRuby, please reach out to the maintainers by commenting on issue #2227.

Many thanks to Sam Ruby, Steve Checkoway, and Craig Barnes for creating and maintaining Nokogumbo and supporting the Gumbo HTML5 parser. They're now Nokogiri core contributors with all the powers and privileges pertaining thereto. 🙌

Notable Change: Nokogiri::HTML4 module and namespace

Nokogiri::HTML has been renamed to Nokogiri::HTML4, and Nokogiri::HTML is aliased to preserve backwards-compatibility. Nokogiri::HTML and Nokogiri::HTML4 parse methods still use libxml2's (or NekoHTML's) HTML4 parser in the v1.12 release series.

Take special note that if you rely on the class name of an object in your code, objects will now report a class of Nokogiri::HTML4::Foo where they previously reported Nokogiri::HTML::Foo. Instead of relying on the string returned by Object#class, prefer Class#=== or Object#is_a? or Object#instance_of?.

Future releases of Nokogiri may deprecate HTML methods or otherwise change this behavior, so please start using HTML4 in place of HTML.

Added

• [CRuby] Nokogiri::VERSION_INFO["libxslt"]["datetime_enabled"] is a new boolean value which describes whether libxslt (or, more properly, libexslt) has compiled-in datetime support. This generally going to be true, but some distros ship without this support (e.g., some mingw UCRT-based packages, see msys2/MINGW-packages#8957). See #2272 for more details.

Changed

• Introduce a new constant, Nokogiri::XML::ParseOptions::DEFAULT_XSLT, which adds the libxslt-preferred options of NOENT | DTDLOAD | DTDATTR | NOCDATA to ParseOptions::DEFAULT_XML.
• Nokogiri.XSLT parses stylesheets using ParseOptions::DEFAULT_XSLT, which should make some edge-case XSL transformations match libxslt's default behavior. [#1940]

Fixed

• [CRuby] Namespaced attributes are handled properly when their parent node is reparented into another document. Previously, the namespace may have gotten dropped. [#2228]
• [CRuby] Reparented nodes no longer inherit their parent's namespace. Previously, a node without a namespace was forced to adopt its parent's namespace. [#1712]

Improved

• [CRuby] Speed up (slightly) the compile time of packaged libraries libiconv, libxml2, and libxslt by using autoconf's --disable-dependency-tracking option. ("ruby" platform gem only.)

Deprecated

• Deprecating Nokogumbo's Nokogiri::HTML5.get. This method will be removed in a future version of Nokogiri.

Dependencies

• [CRuby] Upgrade mini_portile2 dependency from ~> 2.5.0 to ~> 2.6.1. ("ruby" platform gem only.)

---

Checksums:

cb38e1023d5e1b6a33a1b5c7659b68ce7c88449eb69430db128d4d53731b1638  gems/nokogiri-1.12.0.rc1.gem
b5e8e912013cc73e78a1817c5b131cdbc3e224dd4c3158063b562f0a89cb9adb  gems/nokogiri-1.12.0.rc1-java.gem
598b9ed6b98fea43dfc74dbd0cbe24994a26fb1e3dff1a727ba79392495d40d5  gems/nokogiri-1.12.0.rc1-x64-mingw32.gem
7a11a5d911d98a8ddc6a88e712aae82a953fe291f9bb150d4cfe34539489792a  gems/nokogiri-1.12.0.rc1-x86-mingw32.gem
41ace0fcff1901a8d6661cac815fa573d934d9e8280e21e2ec16dd1bd3a6ff7a  gems/nokogiri-1.12.0.rc1-x86-linux.gem
5843752b3d989954ace6fee40ba0634c615b8c579f885c70ff067a8fcc62fa69  gems/nokogiri-1.12.0.rc1-x86_64-linux.gem
8e0ecef0dd76a640f4e1ba4dd9b5df8c5ee352ec944ad7f6beedb89c0b49bfcb  gems/nokogiri-1.12.0.rc1-arm64-darwin.gem
ae56204ca3d8154c46c9fc55f526ff8a71b9a3f4bc879dca26674f4714d7dff6  gems/nokogiri-1.12.0.rc1-x86_64-darwin.gem

1.11.7 / 2021-06-02

1.11.7 / 2021-06-02

• [CRuby] Backporting an upstream fix to XPath recursion depth limits which impacted some users of complex XPath queries. This issue is present in libxml 2.9.11 and 2.9.12. [#2257]

Checksums

SHA256:

4976a9c9e796527d51dc6c311b9bd93a0233f6a7962a0f569aa5c782461836ef  nokogiri-1.11.7.gem
9d69f57f6c024d86e358a8aef7a273f574721e48a6b2e1426cca007827325413  nokogiri-1.11.7-java.gem
6017dee25feb80292b04554cc1bf8a0a2ede3b6c3daeac811902157bbc6a3bdc  nokogiri-1.11.7-x64-mingw32.gem
38892350c1e695eab9bd77483300d681c32a22714d0e2d04d10a4c343b424bdd  nokogiri-1.11.7-x86-mingw32.gem
1d15603cd878fa2b710a3ba3028a99d9dd0c14b75711faebf9fb6ff40bac3880  nokogiri-1.11.7-x86-linux.gem
7ad9741e7a2fee1ffb4a4b2e20b00e87992c9efd969f557ca3b83fb2653b9bfc  nokogiri-1.11.7-x86_64-linux.gem
c93d66d9413ea7c37d30f95e2c54606fec638e556d454e08124d9a33b7fa82c8  nokogiri-1.11.7-arm64-darwin.gem
8761d9c7baacb26546869ed56dbc78d3eb3cabf49b85d91b1cd827cd6e94fb25  nokogiri-1.11.7-x86_64-darwin.gem

1.11.6 / 2021-05-26

1.11.6 / 2021-05-26

Fixed

• [CRuby] DocumentFragment#path now does proper error-checking to handle behavior introduced in libxml > 2.9.10. In v1.11.4 and v1.11.5, calling DocumentFragment#path could result in a segfault.

1.11.5 / 2021-05-19

1.11.5 / 2021-05-19

Fixed

[Windows CRuby] Work around segfault at process exit on Windows when using libxml2 system DLLs.

libxml 2.9.12 introduced new behavior to avoid memory leaks when unloading libxml2 shared libraries (see libxml/!66). Early testing caught this segfault on non-Windows platforms (see #2059 and libxml@956534e) but it was incompletely fixed and is still an issue on Windows platforms that are using system DLLs.

We work around this by configuring libxml2 in this situation to use its default memory management functions. Note that if Nokogiri is not on Windows, or is not using shared system libraries, it will will continue to configure libxml2 to use Ruby's memory management functions. Nokogiri::VERSION_INFO["libxml"]["memory_management"] will allow you to verify when the default memory management functions are being used. [#2241]

Added

Nokogiri::VERSION_INFO["libxml"] now contains the key "memory_management" to declare whether libxml2 is using its default memory management functions, or whether it uses the memory management functions from ruby. See above for more details.