Re: Nokogiri security update v1.10.5
James Middlemiss <[email protected]> Mon, 18 Nov 2019 14:12:14 +1100
| Newsgroups | gmane.comp.lang.ruby.general |
|---|---|
| Message-ID | <CANakb-e9KPofoGaB=y2NY-YtdT7j4oMe2=MUJYfMsXZ2ViPKtw@mail.gmail.com> |
--===============1892597216== Content-Type: multipart/alternative; boundary="0000000000001aacbc05979651e1" --0000000000001aacbc05979651e1 Content-Type: text/plain; charset="UTF-8" Hey mate, Sorry, I did not mean to reply to this larger thread, I meant to forward elsewhere with more of a "I had a problem here, this fixed it". However, now that we're here, I'm not sure this is is even a Nokogiri problem. I'll try to explain: Dependabot picked up a loofah bump gem "loofah", "~> 2.3.1" > Which updated GEMS loofah (2.2.3) to loofah (2.3.1) and nokogiri (1.10.4) to nokogiri (1.10.5) and DEPENDENCIES loofah (2.2.3) to loofah (2.3.1) This failed our CI Check > #!/bin/bash -eo pipefail bin/rails db:schema:load --trace Traceback (most recent call last): 17: from bin/rails:6:in `<main>' 16: from bin/rails:6:in `require_relative' 15: from /home/circleci/project/config/boot.rb:6:in `<top (required)>' 14: from /home/circleci/project/config/boot.rb:6:in `require' 13: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/setup.rb:1:in `<top (required)>' 12: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/setup.rb:1:in `require_relative' 11: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap.rb:3:in `<top (required)>' 10: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap.rb:3:in `require_relative' 9: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/load_path_cache.rb:55:in `<top (required)>' 8: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/load_path_cache.rb:55:in `require_relative' 7: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/load_path_cache/store.rb:3:in `<top (required)>' 6: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/explicit_require.rb:39:in `with_gems' 5: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/explicit_require.rb:43:in `rescue in with_gems' 4: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/load_path_cache/store.rb:3:in `block in <top (required)>' 3: from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/load_path_cache/store.rb:3:in `require' 2: from /home/circleci/project/vendor/bundle/gems/msgpack-1.2.4/lib/msgpack.rb:8:in `<top (required)>' 1: from /home/circleci/project/vendor/bundle/gems/msgpack-1.2.4/lib/msgpack.rb:11:in `rescue in <top (required)>' /home/circleci/project/vendor/bundle/gems/msgpack-1.2.4/lib/msgpack.rb:11:in `require': libruby.so.2.6: cannot open shared object file: No such file or directory - /home/circleci/project/vendor/bundle/gems/msgpack-1.2.4/lib/msgpack/msgpack.so (LoadError) Exited with code 1 I updated bootsnap (1.3.2) to bootsnap (1.4.5) and msgpack (1.2.4) to msgpack (1.3.1) Got the CI instance to boot and properly execute. Sorry for replying to the main thread. That won't happen again. Best, James. On Mon, Nov 18, 2019 at 1:32 PM Mike Dalessio <[email protected]> wrote: > Hi James, > > Can I ask that you please open a GitHub issue on Nokogiri? Without any > accompanying information I don't know where to start to diagnose what > you're seeing. > > > On Sun, Nov 17, 2019, 9:11 PM James Middlemiss < > [email protected]> wrote: > >> Hi, just throwing my 2 cents in here. >> >> Upgrading to Nokogiri 1.10.5 for us broke our CircleCI implementation. >> >> Fix ended up being to also upgrade: >> bootsnap (1.4.5) >> msgpack (1.3.1) >> >> >> >> On Mon, Nov 18, 2019 at 5:25 AM Mike Dalessio <[email protected]> >> wrote: >> >>> Nokogiri v1.10.5 was released on 2019-10-31. >>> >>> This is a security release. >>> >>> Maintainers realized, after the release of v1.10.5, that it addresses >>> CVEs in upstream libxslt rated as "Priority: Medium" and "Priority: Low" by >>> Canonical, and "NVD Severity: Medium" by Debian. More details are available >>> below. More details are available below. >>> >>> If you're using your distro's system libraries, rather than Nokogiri's >>> vendored libraries, there's no security need to upgrade at this time, >>> though you may want to check with your distro whether they've patched this >>> (Canonical has patched Ubuntu packages). Note that libxslt 1.1.34 addresses >>> these vulnerabilities. >>> >>> Full details about the security update are available in Github Issue >>> #1943 (https://github.com/sparklemotion/nokogiri/issues/1943). >>> >>> Affects: MRI users of Nokogiri's vendored libraries in Nokogiri <= >>> v1.10.4 >>> >>> Advice: Upgrade to Nokogiri v1.10.5 or later >>> >>> --- >>> >>> ## 1.10.5 / 2019-10-31 >>> >>> ### Security >>> >>> [MRI] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs >>> for libxslt: >>> >>> * CVE-2019-13117 >>> * CVE-2019-13118 >>> * CVE-2019-18197 >>> >>> More details are available at #1943. >>> >>> >>> ### Dependencies >>> >>> * [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10 >>> * [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34 >>> >>> >>> >>> >>> Unsubscribe: <mailto:[email protected] >>> ?subject=unsubscribe> >>> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk> >>> >> >> Unsubscribe: <mailto:[email protected]?subject=unsubscribe> >> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk> >> > > Unsubscribe: <mailto:[email protected]?subject=unsubscribe> > <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk> > --0000000000001aacbc05979651e1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr"><div dir=3D"ltr">Hey mate,=C2=A0<br>Sorry, I did not mean = to reply to this larger thread, I meant to forward elsewhere with more of a= "I had a problem here, this fixed it".=C2=A0 However, now that w= e're here, I'm not sure this is is even a Nokogiri problem. I'l= l try to explain:=C2=A0<br><br>Dependabot picked up a loofah bump=C2=A0<spa= n style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Li= beration Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;bac= kground-color:rgb(230,255,237)">gem </span><span class=3D"gmail-pl-s" style= =3D"box-sizing:border-box;color:rgb(3,47,98);font-family:SFMono-Regular,Con= solas,"Liberation Mono",Menlo,monospace;font-size:12px;white-spac= e:pre-wrap;background-color:rgb(230,255,237)"><span class=3D"gmail-pl-pds" = style=3D"box-sizing:border-box">"</span>loofah<span class=3D"gmail-pl-= pds" style=3D"box-sizing:border-box">"</span></span><span style=3D"col= or:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono&= quot;,Menlo,monospace;font-size:12px;white-space:pre-wrap;background-color:= rgb(230,255,237)">, </span><span class=3D"gmail-pl-s" style=3D"box-sizing:b= order-box;color:rgb(3,47,98);font-family:SFMono-Regular,Consolas,"Libe= ration Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;backg= round-color:rgb(230,255,237)"><span class=3D"gmail-pl-pds" style=3D"box-siz= ing:border-box">"</span>~> 2.<span class=3D"gmail-x gmail-x-first g= mail-x-last" style=3D"box-sizing:border-box;border-radius:0.2em;color:rgb(3= 6,41,46);background-color:rgb(172,242,189)">3.1</span><span class=3D"gmail-= pl-pds" style=3D"box-sizing:border-box">"</span></span>=C2=A0></div= ><div dir=3D"ltr"><br>Which updated GEMS<br><span style=3D"color:rgb(36,41,= 46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,m= onospace;font-size:12px;white-space:pre-wrap;background-color:rgb(255,238,2= 40)">loofah (</span><span class=3D"gmail-pl-c1" style=3D"box-sizing:border-= box;color:rgb(0,92,197);font-family:SFMono-Regular,Consolas,"Liberatio= n Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;background= -color:rgb(255,238,240)">2.<span class=3D"gmail-x gmail-x-first" style=3D"b= ox-sizing:border-box;border-top-left-radius:0.2em;border-bottom-left-radius= :0.2em;color:rgb(36,41,46);background-color:rgb(253,184,192)">2</span></spa= n><span class=3D"gmail-x" style=3D"box-sizing:border-box;color:rgb(36,41,46= );background-color:rgb(253,184,192);font-family:SFMono-Regular,Consolas,&qu= ot;Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre-wra= p">.</span><span class=3D"gmail-pl-c1 gmail-x gmail-x-last" style=3D"box-si= zing:border-box;color:rgb(36,41,46);border-top-right-radius:0.2em;border-bo= ttom-right-radius:0.2em;background-color:rgb(253,184,192);font-family:SFMon= o-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12= px;white-space:pre-wrap">3</span><span style=3D"color:rgb(36,41,46);font-fa= mily:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;fo= nt-size:12px;white-space:pre-wrap;background-color:rgb(255,238,240)">)</spa= n>=C2=A0to=C2=A0<span style=3D"color:rgb(36,41,46);font-family:SFMono-Regul= ar,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;whit= e-space:pre-wrap;background-color:rgb(230,255,237)">loofah (</span><span cl= ass=3D"gmail-pl-c1" style=3D"box-sizing:border-box;color:rgb(0,92,197);font= -family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace= ;font-size:12px;white-space:pre-wrap;background-color:rgb(230,255,237)">2.<= span class=3D"gmail-x gmail-x-first" style=3D"box-sizing:border-box;border-= top-left-radius:0.2em;border-bottom-left-radius:0.2em;color:rgb(36,41,46);b= ackground-color:rgb(172,242,189)">3</span></span><span class=3D"gmail-x" st= yle=3D"box-sizing:border-box;color:rgb(36,41,46);background-color:rgb(172,2= 42,189);font-family:SFMono-Regular,Consolas,"Liberation Mono",Men= lo,monospace;font-size:12px;white-space:pre-wrap">.</span><span class=3D"gm= ail-pl-c1 gmail-x gmail-x-last" style=3D"box-sizing:border-box;color:rgb(36= ,41,46);border-top-right-radius:0.2em;border-bottom-right-radius:0.2em;back= ground-color:rgb(172,242,189);font-family:SFMono-Regular,Consolas,"Lib= eration Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap">1</= span><span style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consolas= ,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre= -wrap;background-color:rgb(230,255,237)">)</span><br>and=C2=A0</div><div di= r=3D"ltr"><span style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Con= solas,"Liberation Mono",Menlo,monospace;font-size:12px;white-spac= e:pre-wrap;background-color:rgb(255,238,240)">nokogiri (</span><span class= =3D"gmail-pl-c1" style=3D"box-sizing:border-box;color:rgb(0,92,197);font-fa= mily:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;fo= nt-size:12px;white-space:pre-wrap;background-color:rgb(255,238,240)">1.10</= span><span style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consolas= ,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre= -wrap;background-color:rgb(255,238,240)">.</span><span class=3D"gmail-pl-c1= gmail-x gmail-x-first gmail-x-last" style=3D"box-sizing:border-box;color:r= gb(36,41,46);border-radius:0.2em;background-color:rgb(253,184,192);font-fam= ily:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;fon= t-size:12px;white-space:pre-wrap">4</span><span style=3D"color:rgb(36,41,46= );font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,mon= ospace;font-size:12px;white-space:pre-wrap;background-color:rgb(255,238,240= )">)</span>=C2=A0to=C2=A0<span style=3D"color:rgb(36,41,46);font-family:SFM= ono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:= 12px;white-space:pre-wrap;background-color:rgb(230,255,237)">nokogiri (</sp= an><span class=3D"gmail-pl-c1" style=3D"box-sizing:border-box;color:rgb(0,9= 2,197);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menl= o,monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(230,25= 5,237)">1.10</span><span style=3D"color:rgb(36,41,46);font-family:SFMono-Re= gular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;w= hite-space:pre-wrap;background-color:rgb(230,255,237)">.</span><span class= =3D"gmail-pl-c1 gmail-x gmail-x-first gmail-x-last" style=3D"box-sizing:bor= der-box;color:rgb(36,41,46);border-radius:0.2em;background-color:rgb(172,24= 2,189);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menl= o,monospace;font-size:12px;white-space:pre-wrap">5</span><span style=3D"col= or:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono&= quot;,Menlo,monospace;font-size:12px;white-space:pre-wrap;background-color:= rgb(230,255,237)">)</span><br><br>and DEPENDENCIES</div><div dir=3D"ltr"><s= pan style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"= Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;b= ackground-color:rgb(255,238,240)">loofah (</span><span class=3D"gmail-pl-c1= " style=3D"box-sizing:border-box;color:rgb(0,92,197);font-family:SFMono-Reg= ular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;wh= ite-space:pre-wrap;background-color:rgb(255,238,240)">2.<span class=3D"gmai= l-x gmail-x-first" style=3D"box-sizing:border-box;border-top-left-radius:0.= 2em;border-bottom-left-radius:0.2em;color:rgb(36,41,46);background-color:rg= b(253,184,192)">2</span></span><span class=3D"gmail-x" style=3D"box-sizing:= border-box;color:rgb(36,41,46);background-color:rgb(253,184,192);font-famil= y:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-= size:12px;white-space:pre-wrap">.</span><span class=3D"gmail-pl-c1 gmail-x = gmail-x-last" style=3D"box-sizing:border-box;color:rgb(36,41,46);border-top= -right-radius:0.2em;border-bottom-right-radius:0.2em;background-color:rgb(2= 53,184,192);font-family:SFMono-Regular,Consolas,"Liberation Mono"= ,Menlo,monospace;font-size:12px;white-space:pre-wrap">3</span><span style= =3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberatio= n Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;background= -color:rgb(255,238,240)">)</span>=C2=A0to=C2=A0<span style=3D"color:rgb(36,= 41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menl= o,monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(230,25= 5,237)">loofah (</span><span class=3D"gmail-pl-c1" style=3D"box-sizing:bord= er-box;color:rgb(0,92,197);font-family:SFMono-Regular,Consolas,"Libera= tion Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;backgro= und-color:rgb(230,255,237)">2.<span class=3D"gmail-x gmail-x-first" style= =3D"box-sizing:border-box;border-top-left-radius:0.2em;border-bottom-left-r= adius:0.2em;color:rgb(36,41,46);background-color:rgb(172,242,189)">3</span>= </span><span class=3D"gmail-x" style=3D"box-sizing:border-box;color:rgb(36,= 41,46);background-color:rgb(172,242,189);font-family:SFMono-Regular,Consola= s,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pr= e-wrap">.</span><span class=3D"gmail-pl-c1 gmail-x gmail-x-last" style=3D"b= ox-sizing:border-box;color:rgb(36,41,46);border-top-right-radius:0.2em;bord= er-bottom-right-radius:0.2em;background-color:rgb(172,242,189);font-family:= SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-si= ze:12px;white-space:pre-wrap">1</span><span style=3D"color:rgb(36,41,46);fo= nt-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospa= ce;font-size:12px;white-space:pre-wrap;background-color:rgb(230,255,237)">)= </span><br></div><div dir=3D"ltr"><span style=3D"color:rgb(36,41,46);font-f= amily:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;f= ont-size:12px;white-space:pre-wrap;background-color:rgb(230,255,237)"><br><= /span></div><div dir=3D"ltr">This failed our CI Check ><br><br><font fac= e=3D"monospace">#!/bin/bash -eo pipefail<br>bin/rails db:schema:load --trac= e<br>Traceback (most recent call last):<br> 17: from bin/rails:6:in `<ma= in>'<br> 16: from bin/rails:6:in `require_relative'<br> 15: from= /home/circleci/project/config/boot.rb:6:in `<top (required)>'<br= > 14: from /home/circleci/project/config/boot.rb:6:in `require'<br> 13:= from /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap= /setup.rb:1:in `<top (required)>'<br> 12: from /home/circleci/pro= ject/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/setup.rb:1:in `require_= relative'<br> 11: from /home/circleci/project/vendor/bundle/gems/bootsn= ap-1.3.2/lib/bootsnap.rb:3:in `<top (required)>'<br> 10: from /ho= me/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap.rb:3:in = `require_relative'<br> 9: from /home/circleci/project/vendor/bundle/ge= ms/bootsnap-1.3.2/lib/bootsnap/load_path_cache.rb:55:in `<top (required)= >'<br> 8: from /home/circleci/project/vendor/bundle/gems/bootsnap-1= .3.2/lib/bootsnap/load_path_cache.rb:55:in `require_relative'<br> 7: f= rom /home/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/l= oad_path_cache/store.rb:3:in `<top (required)>'<br> 6: from /hom= e/circleci/project/vendor/bundle/gems/bootsnap-1.3.2/lib/bootsnap/explicit_= require.rb:39:in `with_gems'<br> 5: from /home/circleci/project/vendor= /bundle/gems/bootsnap-1.3.2/lib/bootsnap/explicit_require.rb:43:in `rescue = in with_gems'<br> 4: from /home/circleci/project/vendor/bundle/gems/bo= otsnap-1.3.2/lib/bootsnap/load_path_cache/store.rb:3:in `block in <top (= required)>'<br> 3: from /home/circleci/project/vendor/bundle/gems/b= ootsnap-1.3.2/lib/bootsnap/load_path_cache/store.rb:3:in `require'<br> = 2: from /home/circleci/project/vendor/bundle/gems/msgpack-1.2.4/lib/msgpac= k.rb:8:in `<top (required)>'<br> 1: from /home/circleci/project/= vendor/bundle/gems/msgpack-1.2.4/lib/msgpack.rb:11:in `rescue in <top (r= equired)>'<br>/home/circleci/project/vendor/bundle/gems/msgpack-1.2.= 4/lib/msgpack.rb:11:in `require': libruby.so.2.6: cannot open shared ob= ject file: No such file or directory - /home/circleci/project/vendor/bundle= /gems/msgpack-1.2.4/lib/msgpack/msgpack.so (LoadError)<br>Exited with code = 1</font><br><br>I updated=C2=A0<span style=3D"color:rgb(36,41,46);font-fami= ly:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font= -size:12px;white-space:pre-wrap;background-color:rgb(255,238,240)">bootsnap= (</span><span class=3D"gmail-pl-c1" style=3D"box-sizing:border-box;color:r= gb(0,92,197);font-family:SFMono-Regular,Consolas,"Liberation Mono"= ;,Menlo,monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(= 255,238,240)">1.<span class=3D"gmail-x gmail-x-first" style=3D"box-sizing:b= order-box;border-top-left-radius:0.2em;border-bottom-left-radius:0.2em;colo= r:rgb(36,41,46);background-color:rgb(253,184,192)">3</span></span><span cla= ss=3D"gmail-x" style=3D"box-sizing:border-box;color:rgb(36,41,46);backgroun= d-color:rgb(253,184,192);font-family:SFMono-Regular,Consolas,"Liberati= on Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap">.</span>= <span class=3D"gmail-pl-c1 gmail-x gmail-x-last" style=3D"box-sizing:border= -box;color:rgb(36,41,46);border-top-right-radius:0.2em;border-bottom-right-= radius:0.2em;background-color:rgb(253,184,192);font-family:SFMono-Regular,C= onsolas,"Liberation Mono",Menlo,monospace;font-size:12px;white-sp= ace:pre-wrap">2</span><span style=3D"color:rgb(36,41,46);font-family:SFMono= -Regular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12p= x;white-space:pre-wrap;background-color:rgb(255,238,240)">)</span>=C2=A0to= =C2=A0<span style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consola= s,"Liberation Mono",Menlo,monospace;font-size:12px;white-space:pr= e-wrap;background-color:rgb(230,255,237)"> bootsnap (</span><span class=3D"= gmail-pl-c1" style=3D"box-sizing:border-box;color:rgb(0,92,197);font-family= :SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-s= ize:12px;white-space:pre-wrap;background-color:rgb(230,255,237)">1.<span cl= ass=3D"gmail-x gmail-x-first" style=3D"box-sizing:border-box;border-top-lef= t-radius:0.2em;border-bottom-left-radius:0.2em;color:rgb(36,41,46);backgrou= nd-color:rgb(172,242,189)">4</span></span><span class=3D"gmail-x" style=3D"= box-sizing:border-box;color:rgb(36,41,46);background-color:rgb(172,242,189)= ;font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,mono= space;font-size:12px;white-space:pre-wrap">.</span><span class=3D"gmail-pl-= c1 gmail-x gmail-x-last" style=3D"box-sizing:border-box;color:rgb(36,41,46)= ;border-top-right-radius:0.2em;border-bottom-right-radius:0.2em;background-= color:rgb(172,242,189);font-family:SFMono-Regular,Consolas,"Liberation= Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap">5</span><s= pan style=3D"color:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"= Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap;b= ackground-color:rgb(230,255,237)">)</span></div>and=C2=A0<span style=3D"col= or:rgb(36,41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono&= quot;,Menlo,monospace;font-size:12px;white-space:pre-wrap;background-color:= rgb(255,238,240)">msgpack (</span><span class=3D"gmail-pl-c1" style=3D"box-= sizing:border-box;color:rgb(0,92,197);font-family:SFMono-Regular,Consolas,&= quot;Liberation Mono",Menlo,monospace;font-size:12px;white-space:pre-w= rap;background-color:rgb(255,238,240)">1.<span class=3D"gmail-x gmail-x-fir= st" style=3D"box-sizing:border-box;border-top-left-radius:0.2em;border-bott= om-left-radius:0.2em;color:rgb(36,41,46);background-color:rgb(253,184,192)"= >2</span></span><span class=3D"gmail-x" style=3D"box-sizing:border-box;colo= r:rgb(36,41,46);background-color:rgb(253,184,192);font-family:SFMono-Regula= r,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;white= -space:pre-wrap">.</span><span class=3D"gmail-pl-c1 gmail-x gmail-x-last" s= tyle=3D"box-sizing:border-box;color:rgb(36,41,46);border-top-right-radius:0= .2em;border-bottom-right-radius:0.2em;background-color:rgb(253,184,192);fon= t-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospac= e;font-size:12px;white-space:pre-wrap">4</span><span style=3D"color:rgb(36,= 41,46);font-family:SFMono-Regular,Consolas,"Liberation Mono",Menl= o,monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(255,23= 8,240)">)</span>=C2=A0to=C2=A0<span style=3D"color:rgb(36,41,46);font-famil= y:SFMono-Regular,Consolas,"Liberation Mono",Menlo,monospace;font-= size:12px;white-space:pre-wrap;background-color:rgb(230,255,237)">msgpack (= </span><span class=3D"gmail-pl-c1" style=3D"box-sizing:border-box;color:rgb= (0,92,197);font-family:SFMono-Regular,Consolas,"Liberation Mono",= Menlo,monospace;font-size:12px;white-space:pre-wrap;background-color:rgb(23= 0,255,237)">1.<span class=3D"gmail-x gmail-x-first" style=3D"box-sizing:bor= der-box;border-top-left-radius:0.2em;border-bottom-left-radius:0.2em;color:= rgb(36,41,46);background-color:rgb(172,242,189)">3</span></span><span class= =3D"gmail-x" style=3D"box-sizing:border-box;color:rgb(36,41,46);background-= color:rgb(172,242,189);font-family:SFMono-Regular,Consolas,"Liberation= Mono",Menlo,monospace;font-size:12px;white-space:pre-wrap">.</span><s= pan class=3D"gmail-pl-c1 gmail-x gmail-x-last" style=3D"box-sizing:border-b= ox;color:rgb(36,41,46);border-top-right-radius:0.2em;border-bottom-right-ra= dius:0.2em;background-color:rgb(172,242,189);font-family:SFMono-Regular,Con= solas,"Liberation Mono",Menlo,monospace;font-size:12px;white-spac= e:pre-wrap">1</span><span style=3D"color:rgb(36,41,46);font-family:SFMono-R= egular,Consolas,"Liberation Mono",Menlo,monospace;font-size:12px;= white-space:pre-wrap;background-color:rgb(230,255,237)">)</span><div><br></= div><div>Got the CI instance to boot and properly execute.<br><br>Sorry for= replying to the main thread. That won't happen again.<br><br>Best, Jam= es.<br><br><br></div><div><br><div class=3D"gmail_quote"><div dir=3D"ltr" c= lass=3D"gmail_attr">On Mon, Nov 18, 2019 at 1:32 PM Mike Dalessio <<a hr= ef=3D"mailto:[email protected]">[email protected]</a>> wrote= :<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.= 8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"au= to"><div>Hi James,</div><div dir=3D"auto"><br></div><div dir=3D"auto">Can I= ask that you please open a GitHub issue on Nokogiri? Without any accompany= ing information I don't know where to start to diagnose what you're= seeing.<br><br><br><div class=3D"gmail_quote" dir=3D"auto"><div dir=3D"ltr= " class=3D"gmail_attr">On Sun, Nov 17, 2019, 9:11 PM James Middlemiss <<= a href=3D"mailto:[email protected]" target=3D"_blank">james.o.mi= [email protected]</a>> wrote:<br></div><blockquote class=3D"gmail_quote= " style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);= padding-left:1ex"><div dir=3D"ltr">Hi, just throwing my 2 cents in here.=C2= =A0<br><br>Upgrading to Nokogiri 1.10.5 for us broke our CircleCI implement= ation.=C2=A0<br><br>Fix ended up being to also upgrade:<br>bootsnap (1.4.5)= <br>msgpack (1.3.1)<br><br><br></div><br><div class=3D"gmail_quote"><div di= r=3D"ltr" class=3D"gmail_attr">On Mon, Nov 18, 2019 at 5:25 AM Mike Dalessi= o <<a href=3D"mailto:[email protected]" rel=3D"noreferrer" target= =3D"_blank">[email protected]</a>> wrote:<br></div><blockquote cla= ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid = rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Nokogiri v1.10.5 was re= leased on 2019-10-31.<div><br></div><div>This is a security release.</div><= div><br></div><div>Maintainers realized, after the release of v1.10.5, that= it addresses CVEs in upstream libxslt rated as "Priority: Medium"= ; and "Priority: Low" by Canonical, and "NVD Severity: Mediu= m" by Debian. More details are available below. More details are avail= able below.</div><div><br></div><div><div>If you're using your distro&#= 39;s system libraries, rather than=C2=A0<span>Nokogiri</span>'s vendore= d libraries, there's=C2=A0<span>no</span>=C2=A0security need to upgrade= at this time, though you may want to check with your distro whether they&#= 39;ve patched this (Canonical has patched Ubuntu packages). Note that libxs= lt 1.1.34 addresses these vulnerabilities.</div></div><div><br></div><div>F= ull details about the security update are available in Github Issue #1943 (= <a href=3D"https://github.com/sparklemotion/nokogiri/issues/1943" rel=3D"no= referrer" target=3D"_blank">https://github.com/sparklemotion/nokogiri/issue= s/1943</a>).</div><div><br></div><div>Affects: MRI users of Nokogiri's = vendored libraries in Nokogiri <=3D v1.10.4</div><div><br></div><div>Adv= ice: Upgrade to Nokogiri v1.10.5 or later</div><div><br></div><div>---</div= ><div><br></div><div>## 1.10.5 / 2019-10-31<br><br>### Security<br><br>[MRI= ] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs for libxs= lt:<br><br>* CVE-2019-13117<br>* CVE-2019-13118<br>* CVE-2019-18197<br><br>= More details are available at #1943.<br><br><br>### Dependencies<br><br>* [= MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10<br>* [MRI] vendored l= ibxslt is updated from 1.1.33 to 1.1.34<br><br><br></div><div><br></div></d= iv> <br> Unsubscribe: <mailto:<a href=3D"mailto:[email protected]" = rel=3D"noreferrer" target=3D"_blank">[email protected]</a>?su= bject=3Dunsubscribe><br> <<a href=3D"http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk= " rel=3D"noreferrer noreferrer" target=3D"_blank">http://lists.ruby-lang.or= g/cgi-bin/mailman/options/ruby-talk</a>><br> </blockquote></div> <br> Unsubscribe: <mailto:<a href=3D"mailto:[email protected]" = rel=3D"noreferrer" target=3D"_blank">[email protected]</a>?su= bject=3Dunsubscribe><br> <<a href=3D"http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk= " rel=3D"noreferrer noreferrer" target=3D"_blank">http://lists.ruby-lang.or= g/cgi-bin/mailman/options/ruby-talk</a>><br> </blockquote></div></div></div> <br> Unsubscribe: <mailto:<a href=3D"mailto:[email protected]" = target=3D"_blank">[email protected]</a>?subject=3Dunsubscribe= ><br> <<a href=3D"http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk= " rel=3D"noreferrer" target=3D"_blank">http://lists.ruby-lang.org/cgi-bin/m= ailman/options/ruby-talk</a>><br> </blockquote></div></div></div> --0000000000001aacbc05979651e1-- --===============1892597216== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Unsubscribe: <mailto:[email protected]?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk> --===============1892597216==--