{"payload":{"feedbackUrl":"https://github.com/orgs/community/discussions/53140","repo":{"id":681025589,"defaultBranch":"main","name":"osv-scanner","ownerLogin":"josieang","currentUserCanPush":false,"isFork":true,"isEmpty":false,"createdAt":"2023-08-21T05:28:06.000Z","ownerAvatar":"https://avatars.githubusercontent.com/u/32358891?v=4","public":true,"private":false,"isOrgOwned":false},"refInfo":{"name":"","listCacheKey":"v0:1714110268.0","currentOid":""},"activityList":{"items":[{"before":"8fd553ab0e5931754fe86b1a540f13d9a6f361ac","after":"02a802d1bf8752abd44a77fe42e4dd9bd6000651","ref":"refs/heads/main","pushedAt":"2024-06-06T04:39:55.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Dependency imports should always be fetched from upstream (#1027)\n\nThere are two places that we call `mergeParents()`:\r\n - Merging data from parent pom.xml files\r\n - Importing dependency management from another project\r\n \r\nIn `mergeParents()`, we first check if `relativePath` is defined to know\r\nif we can parse parent locally.\r\nHowever, this only applies for the first case but not for importing\r\ndependency management.\r\nAlso, once we start fetching parent pom.xml from upstream, we should no\r\nlonger parse locally.\r\n\r\nThis PR adds `allowLocal` to `mergeParents()` to specify if we allow\r\nparsing local parent pom.xml, and once a parent is fetched from\r\nupstream, `allowLocal` is set to false.\r\n\r\n---------\r\n\r\nCo-authored-by: Rex P <106129829+another-rex@users.noreply.github.com>","shortMessageHtmlLink":"Dependency imports should always be fetched from upstream (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2335210729\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/1027\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/1027/hovercard\" href=\"https://github.com/google/osv-scanner/pull/1027\">google#1027</a>)"}},{"before":"d929daa3016394af7a501d05398cb3d00427086d","after":"78fe74df59864017f89cc065bf1e284fbdd5b9cf","ref":"refs/heads/package-config","pushedAt":"2024-06-06T04:36:24.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"revert snapshot file","shortMessageHtmlLink":"revert snapshot file"}},{"before":"cf09e1922c7ab2a9f6db5b050db2797e88bf865b","after":"d929daa3016394af7a501d05398cb3d00427086d","ref":"refs/heads/package-config","pushedAt":"2024-06-06T04:32:05.000Z","pushType":"push","commitsCount":69,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Merge branch 'main' into package-config","shortMessageHtmlLink":"Merge branch 'main' into package-config"}},{"before":"bc5e4b4ac996bdb395d5bd17cf614c883869bac1","after":"cf09e1922c7ab2a9f6db5b050db2797e88bf865b","ref":"refs/heads/package-config","pushedAt":"2024-06-06T04:29:03.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"rename PackageOverrides","shortMessageHtmlLink":"rename PackageOverrides"}},{"before":"b7e6db1d6f2c842008d66cc1ddc16f656410fd59","after":"bc5e4b4ac996bdb395d5bd17cf614c883869bac1","ref":"refs/heads/package-config","pushedAt":"2024-06-06T04:23:52.000Z","pushType":"push","commitsCount":69,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Merge branch 'main' into package-config","shortMessageHtmlLink":"Merge branch 'main' into package-config"}},{"before":"162fa59e482129e5ed38094560e83aa54d8e09d3","after":"b7e6db1d6f2c842008d66cc1ddc16f656410fd59","ref":"refs/heads/package-config","pushedAt":"2024-06-06T04:18:31.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"rename PackageOverrides","shortMessageHtmlLink":"rename PackageOverrides"}},{"before":"157206a11af79296a3f373f877f8dff17b48127b","after":"162fa59e482129e5ed38094560e83aa54d8e09d3","ref":"refs/heads/package-config","pushedAt":"2024-06-06T04:11:18.000Z","pushType":"force_push","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"rename PackageOverrides","shortMessageHtmlLink":"rename PackageOverrides"}},{"before":"9df682974cc0245e3feccc394e1c515e81c30726","after":"8fd553ab0e5931754fe86b1a540f13d9a6f361ac","ref":"refs/heads/main","pushedAt":"2024-06-06T03:51:26.000Z","pushType":"push","commitsCount":43,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Upgrade go version (#1024)","shortMessageHtmlLink":"Upgrade go version (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2334875455\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/1024\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/1024/hovercard\" href=\"https://github.com/google/osv-scanner/pull/1024\">google#1024</a>)"}},{"before":"a11bd38832c6eaac6b74f720170aca0f7386cfa6","after":"157206a11af79296a3f373f877f8dff17b48127b","ref":"refs/heads/package-config","pushedAt":"2024-06-06T03:50:25.000Z","pushType":"push","commitsCount":40,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Merge branch 'google:main' into package-config","shortMessageHtmlLink":"Merge branch 'google:main' into package-config"}},{"before":"525b02fc3ece209d4056f80ffc4c1adac907f0a8","after":"a11bd38832c6eaac6b74f720170aca0f7386cfa6","ref":"refs/heads/package-config","pushedAt":"2024-05-07T01:11:48.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"snapshot","shortMessageHtmlLink":"snapshot"}},{"before":"af547e70a3d288f9b05c37d574907a7c7509e6fe","after":"525b02fc3ece209d4056f80ffc4c1adac907f0a8","ref":"refs/heads/package-config","pushedAt":"2024-05-07T01:04:10.000Z","pushType":"push","commitsCount":25,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Merge branch 'google:main' into package-config","shortMessageHtmlLink":"Merge branch 'google:main' into package-config"}},{"before":"301b293efd74656e134e764dcb8545d89a4b499f","after":"af547e70a3d288f9b05c37d574907a7c7509e6fe","ref":"refs/heads/package-config","pushedAt":"2024-05-07T00:58:54.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"linter","shortMessageHtmlLink":"linter"}},{"before":"22b45d72a1f855154300ae7487e0227cb1ffdd6e","after":"301b293efd74656e134e764dcb8545d89a4b499f","ref":"refs/heads/package-config","pushedAt":"2024-05-07T00:30:09.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"respond to comments","shortMessageHtmlLink":"respond to comments"}},{"before":"d75f136bbfdfd952d770dda15a94e0d9ef6c9a42","after":"9df682974cc0245e3feccc394e1c515e81c30726","ref":"refs/heads/main","pushedAt":"2024-05-06T04:35:03.000Z","pushType":"push","commitsCount":20,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"refactor: apply Rubocop to Ruby generator (#956)\n\nCherry-pick of https://github.com/G-Rath/osv-detector/pull/240\r\n\r\n---\r\n\r\nThis is all pretty harmless but there's some nice small improvements in\r\nhere","shortMessageHtmlLink":"refactor: apply Rubocop to Ruby generator (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2274055819\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/956\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/956/hovercard\" href=\"https://github.com/google/osv-scanner/pull/956\">google#956</a>)"}},{"before":"d2e58adb4130e43c3fad6fbddcabb1b505dab7f7","after":"22b45d72a1f855154300ae7487e0227cb1ffdd6e","ref":"refs/heads/package-config","pushedAt":"2024-04-26T08:13:25.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"implement overriding licenses through the config","shortMessageHtmlLink":"implement overriding licenses through the config"}},{"before":"cdea96c222833579d863809d3390a156bf4446ab","after":"d2e58adb4130e43c3fad6fbddcabb1b505dab7f7","ref":"refs/heads/package-config","pushedAt":"2024-04-26T05:45:01.000Z","pushType":"push","commitsCount":6,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Merge branch 'main' into package-config","shortMessageHtmlLink":"Merge branch 'main' into package-config"}},{"before":null,"after":"cdea96c222833579d863809d3390a156bf4446ab","ref":"refs/heads/package-config","pushedAt":"2024-04-26T05:44:28.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"implement filtering by packages using config files","shortMessageHtmlLink":"implement filtering by packages using config files"}},{"before":"37121e3ce55969485187cf1913a0e7f4d55161db","after":"d75f136bbfdfd952d770dda15a94e0d9ef6c9a42","ref":"refs/heads/main","pushedAt":"2024-04-26T05:39:53.000Z","pushType":"push","commitsCount":5,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"test: include groups when describing package details (#933)\n\nRan into this while working on other stuff - currently if two packages\r\nare the same except for their groups, the failure message doesn't\r\nindicate that which is confusing","shortMessageHtmlLink":"test: include groups when describing package details (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2251432091\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/933\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/933/hovercard\" href=\"https://github.com/google/osv-scanner/pull/933\">google#933</a>)"}},{"before":"4694183272f61df327560867b768dd469b37fd5b","after":"37121e3ce55969485187cf1913a0e7f4d55161db","ref":"refs/heads/main","pushedAt":"2024-04-17T23:43:45.000Z","pushType":"push","commitsCount":97,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Fix paths in test snapshots (#930)\n\nRemove local paths from snapshots","shortMessageHtmlLink":"Fix paths in test snapshots (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2249430432\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/930\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/930/hovercard\" href=\"https://github.com/google/osv-scanner/pull/930\">google#930</a>)"}},{"before":"7fc32b3f65b240ae060afb3e0f31a7ff2d69f14a","after":null,"ref":"refs/heads/new-spdx","pushedAt":"2024-02-06T00:04:35.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"}},{"before":null,"after":"7fc32b3f65b240ae060afb3e0f31a7ff2d69f14a","ref":"refs/heads/new-spdx","pushedAt":"2024-02-05T23:59:22.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"add new spdx identifiers","shortMessageHtmlLink":"add new spdx identifiers"}},{"before":"16caa1a9cf90d73362e44e04224e8b8e90345755","after":"4694183272f61df327560867b768dd469b37fd5b","ref":"refs/heads/main","pushedAt":"2024-02-05T23:39:12.000Z","pushType":"push","commitsCount":50,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"chore(deps-dev): Bump nokogiri from 1.15.5 to 1.16.2 in /docs (#787)\n\nBumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.15.5\r\nto 1.16.2.\r\n<details>\r\n<summary>Release notes</summary>\r\n<p><em>Sourced from <a\r\nhref=\"https://github.com/sparklemotion/nokogiri/releases\">nokogiri's\r\nreleases</a>.</em></p>\r\n<blockquote>\r\n<h2>v1.16.2 / 2024-02-04</h2>\r\n<h3>Security</h3>\r\n<ul>\r\n<li>[CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See\r\n<a\r\nhref=\"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j\">GHSA-xc9x-jj77-9p9j</a>\r\nfor more information.</li>\r\n</ul>\r\n<h3>Dependencies</h3>\r\n<ul>\r\n<li>[CRuby] Vendored libxml2 is updated to <a\r\nhref=\"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5\">v2.12.5</a>\r\nfrom v2.12.4. (<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n</ul>\r\n<hr />\r\n<p>sha256 checksums:</p>\r\n\r\n<pre><code>69ba15d2a2498324489ed63850997f0b8f684260114ea81116d3082f16551d2d\r\nnokogiri-1.16.2-aarch64-linux.gem\r\n6a05ce42e3587a40cf8936ece0beaa5d32922254215d2e8cf9ad40588bb42e57\r\nnokogiri-1.16.2-arm-linux.gem\r\nc957226c8e36b31be6a3afb8602e2128282bf8b40ea51016c4cd21aa2608d3f8\r\nnokogiri-1.16.2-arm64-darwin.gem\r\n122652bfc338cd8a54a692ac035e245e41fd3b8283299202ca26e7a7d50db310\r\nnokogiri-1.16.2-java.gem\r\n7344b5072ca69fc5bedb61cb01a3b765b93a27aae5a2a845c2ba7200e4345074\r\nnokogiri-1.16.2-x64-mingw-ucrt.gem\r\na2a5e184a424111a0d5b77947986484920ad708009c667f061e8d02035c562dd\r\nnokogiri-1.16.2-x64-mingw32.gem\r\n833efddeb51a6c2c9f6356295623c2b2e0d50050d468695c59bd929162953323\r\nnokogiri-1.16.2-x86-linux.gem\r\ne67fc0418dffaff9dc8b1dc65f0605282c3fee9488832d0223b620b4319e0b53\r\nnokogiri-1.16.2-x86-mingw32.gem\r\n5def799e5f139f21a79d7cf71172313a7b6fb0e4b2a31ab9bd5d4ad305994539\r\nnokogiri-1.16.2-x86_64-darwin.gem\r\n5b146240ac6ec6c40fd4367623e74442bca45a542bd3282b1d4d18b07b8e5dfe\r\nnokogiri-1.16.2-x86_64-linux.gem\r\n68922ee5cde27497d995c46f2821957bae961947644eed2822d173daf7567f9c\r\nnokogiri-1.16.2.gem\r\n</code></pre>\r\n<h2>v1.16.1 / 2024-02-03</h2>\r\n<h3>Dependencies</h3>\r\n<ul>\r\n<li>[CRuby] Vendored libxml2 is updated to <a\r\nhref=\"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.4\">v2.12.4</a>\r\nfrom v2.12.3. (<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n</ul>\r\n<h3>Fixed</h3>\r\n<ul>\r\n<li>[CRuby] <code>XML::Reader</code> defaults the encoding to UTF-8 if\r\nit's not specified in either the document or as a method parameter.\r\nPreviously non-ASCII characters were serialized as NCRs in this case. <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/2891\">#2891</a>\r\n(<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n<li>[CRuby] Restored support for compilation by GCC versions earlier\r\nthan 4.6, which was broken in v1.15.0 (540e9aee). <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3090\">#3090</a>\r\n(<a\r\nhref=\"https://github.com/adfoster-r7\"><code>@​adfoster-r7</code></a>)</li>\r\n<li>[CRuby] Patched upstream libxml2 to allow parsing HTML5 in the\r\ncontext of a namespaced node (e.g., foreign content like MathML).\r\n[#3112, <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3116\">#3116</a>]\r\n(<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n<li>[CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when\r\nthe maximum tree depth limit is hit. [#3098, <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3100\">#3100</a>]\r\n(<a\r\nhref=\"https://github.com/stevecheckoway\"><code>@​stevecheckoway</code></a>)</li>\r\n</ul>\r\n<hr />\r\n<p>sha256 checksums:</p>\r\n\r\n<pre><code>a541f35e5b9798a0c97300f9ee18f4217da2a2945a6d5499e4123b9018f9cafc\r\nnokogiri-1.16.1-aarch64-linux.gem\r\n6b82affd195000ab2f9c36cc08744ec2d2fcf6d8da88d59a2db67e83211f7c69\r\nnokogiri-1.16.1-arm-linux.gem\r\n&lt;/tr&gt;&lt;/table&gt; \r\n</code></pre>\r\n</blockquote>\r\n<p>... (truncated)</p>\r\n</details>\r\n<details>\r\n<summary>Changelog</summary>\r\n<p><em>Sourced from <a\r\nhref=\"https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md\">nokogiri's\r\nchangelog</a>.</em></p>\r\n<blockquote>\r\n<h2>v1.16.2 / 2024-02-04</h2>\r\n<h3>Security</h3>\r\n<ul>\r\n<li>[CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See\r\n<a\r\nhref=\"https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j\">GHSA-xc9x-jj77-9p9j</a>\r\nfor more information.</li>\r\n</ul>\r\n<h3>Dependencies</h3>\r\n<ul>\r\n<li>[CRuby] Vendored libxml2 is updated to <a\r\nhref=\"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5\">v2.12.5</a>\r\nfrom v2.12.4. (<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n</ul>\r\n<h2>v1.16.1 / 2024-02-03</h2>\r\n<h3>Dependencies</h3>\r\n<ul>\r\n<li>[CRuby] Vendored libxml2 is updated to <a\r\nhref=\"https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.4\">v2.12.4</a>\r\nfrom v2.12.3. (<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n</ul>\r\n<h3>Fixed</h3>\r\n<ul>\r\n<li>[CRuby] <code>XML::Reader</code> defaults the encoding to UTF-8 if\r\nit's not specified in either the document or as a method parameter.\r\nPreviously non-ASCII characters were serialized as NCRs in this case. <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/2891\">#2891</a>\r\n(<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n<li>[CRuby] Restored support for compilation by GCC versions earlier\r\nthan 4.6, which was broken in v1.15.0 (540e9aee). <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3090\">#3090</a>\r\n(<a\r\nhref=\"https://github.com/adfoster-r7\"><code>@​adfoster-r7</code></a>)</li>\r\n<li>[CRuby] Patched upstream libxml2 to allow parsing HTML5 in the\r\ncontext of a namespaced node (e.g., foreign content like MathML).\r\n[#3112, <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3116\">#3116</a>]\r\n(<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</li>\r\n<li>[CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when\r\nthe maximum tree depth limit is hit. [#3098, <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3100\">#3100</a>]\r\n(<a\r\nhref=\"https://github.com/stevecheckoway\"><code>@​stevecheckoway</code></a>)</li>\r\n</ul>\r\n<h2>v1.16.0 / 2023-12-27</h2>\r\n<h3>Notable Changes</h3>\r\n<h4>Ruby</h4>\r\n<p>This release introduces native gem support for Ruby 3.3.</p>\r\n<p>This release ends support for Ruby 2.7, for which <a\r\nhref=\"https://www.ruby-lang.org/en/downloads/branches/\">upstream support\r\nended 2023-03-31</a>.</p>\r\n<h4>Pattern matching</h4>\r\n<p>This version marks <em>official support</em> for the pattern matching\r\nAPI in <code>XML::Attr</code>, <code>XML::Document</code>,\r\n<code>XML::DocumentFragment</code>, <code>XML::Namespace</code>,\r\n<code>XML::Node</code>, and <code>XML::NodeSet</code> (and their\r\nsubclasses), originally introduced as an experimental feature in\r\nv1.14.0. (<a\r\nhref=\"https://github.com/flavorjones\"><code>@​flavorjones</code></a>)</p>\r\n<p>Documentation on what can be matched:</p>\r\n<ul>\r\n<li><a\r\nhref=\"https://nokogiri.org/rdoc/Nokogiri/XML/Attr.html?h=deconstruct#method-i-deconstruct_keys\"><code>XML::Attr#deconstruct_keys</code></a></li>\r\n<li><a\r\nhref=\"https://nokogiri.org/rdoc/Nokogiri/XML/Document.html?h=deconstruct#method-i-deconstruct_keys\"><code>XML::Document#deconstruct_keys</code></a></li>\r\n<li><a\r\nhref=\"https://nokogiri.org/rdoc/Nokogiri/XML/Namespace.html?h=deconstruct+namespace#method-i-deconstruct_keys\"><code>XML::Namespace#deconstruct_keys</code></a></li>\r\n<li><a\r\nhref=\"https://nokogiri.org/rdoc/Nokogiri/XML/Node.html?h=deconstruct#method-i-deconstruct_keys\"><code>XML::Node#deconstruct_keys</code></a></li>\r\n<li><a\r\nhref=\"https://nokogiri.org/rdoc/Nokogiri/XML/DocumentFragment.html?h=deconstruct#method-i-deconstruct\"><code>XML::DocumentFragment#deconstruct</code></a></li>\r\n<li><a\r\nhref=\"https://nokogiri.org/rdoc/Nokogiri/XML/NodeSet.html?h=deconstruct#method-i-deconstruct\"><code>XML::NodeSet#deconstruct</code></a></li>\r\n</ul>\r\n<!-- raw HTML omitted -->\r\n</blockquote>\r\n<p>... (truncated)</p>\r\n</details>\r\n<details>\r\n<summary>Commits</summary>\r\n<ul>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/673756fdd69d1036874b7d7250cc38a51fd4d7b8\"><code>673756f</code></a>\r\nversion bump to v1.16.2</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/74ffd67a8efb9972657e5c4625fd8419bbccbe06\"><code>74ffd67</code></a>\r\ndep: update libxml to 2.12.5 (branch v1.16.x) (<a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3122\">#3122</a>)</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/0d4018dc7009580659c101fc41efb3babcfec229\"><code>0d4018d</code></a>\r\ndep: update libxml2 to v2.12.5</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/f33a25f4378df33912ebc6b4ebc0f9e8e80ddfa8\"><code>f33a25f</code></a>\r\ndep: remove patch from <a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3112\">#3112</a>\r\nwhich has been released upstream</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/e99416896a182bc520a7940bbe286ec33597ab2b\"><code>e994168</code></a>\r\nversion bump to v1.16.1</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/77ea2f228c20e79c848ca2906813ea5b5010281b\"><code>77ea2f2</code></a>\r\ndev: add files to manifest ignore list</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/756f27c6b7a23294d84bdcca5e03a639d0dd7421\"><code>756f27c</code></a>\r\nbuild(deps): bump actions/{download,upload}-artifact from 3 to 4</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/464f8d41eb73ca9c6dae0b366afcf5f4e8bff342\"><code>464f8d4</code></a>\r\n.gitignore: clangd-related files</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/2beeb960691df28dd5ebf828192c65b60250670f\"><code>2beeb96</code></a>\r\ndoc: update CHANGELOG</li>\r\n<li><a\r\nhref=\"https://github.com/sparklemotion/nokogiri/commit/a26536d7a41fd40c52940e165bb5a4f6b4c39662\"><code>a26536d</code></a>\r\nfix: apply upstream patch for in-context parsing (<a\r\nhref=\"https://redirect.github.com/sparklemotion/nokogiri/issues/3116\">#3116</a>)</li>\r\n<li>Additional commits viewable in <a\r\nhref=\"https://github.com/sparklemotion/nokogiri/compare/v1.15.5...v1.16.2\">compare\r\nview</a></li>\r\n</ul>\r\n</details>\r\n<br />\r\n\r\n\r\n[![Dependabot compatibility\r\nscore](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nokogiri&package-manager=bundler&previous-version=1.15.5&new-version=1.16.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\r\n\r\nDependabot will resolve any conflicts with this PR as long as you don't\r\nalter it yourself. You can also trigger a rebase manually by commenting\r\n`@dependabot rebase`.\r\n\r\n[//]: # (dependabot-automerge-start)\r\n[//]: # (dependabot-automerge-end)\r\n\r\n---\r\n\r\n<details>\r\n<summary>Dependabot commands and options</summary>\r\n<br />\r\n\r\nYou can trigger Dependabot actions by commenting on this PR:\r\n- `@dependabot rebase` will rebase this PR\r\n- `@dependabot recreate` will recreate this PR, overwriting any edits\r\nthat have been made to it\r\n- `@dependabot merge` will merge this PR after your CI passes on it\r\n- `@dependabot squash and merge` will squash and merge this PR after\r\nyour CI passes on it\r\n- `@dependabot cancel merge` will cancel a previously requested merge\r\nand block automerging\r\n- `@dependabot reopen` will reopen this PR if it is closed\r\n- `@dependabot close` will close this PR and stop Dependabot recreating\r\nit. You can achieve the same result by closing it manually\r\n- `@dependabot show <dependency name> ignore conditions` will show all\r\nof the ignore conditions of the specified dependency\r\n- `@dependabot ignore this major version` will close this PR and stop\r\nDependabot creating any more for this major version (unless you reopen\r\nthe PR or upgrade to it yourself)\r\n- `@dependabot ignore this minor version` will close this PR and stop\r\nDependabot creating any more for this minor version (unless you reopen\r\nthe PR or upgrade to it yourself)\r\n- `@dependabot ignore this dependency` will close this PR and stop\r\nDependabot creating any more for this dependency (unless you reopen the\r\nPR or upgrade to it yourself)\r\nYou can disable automated security fix PRs for this repo from the\r\n[Security Alerts\r\npage](https://github.com/google/osv-scanner/network/alerts).\r\n\r\n</details>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>","shortMessageHtmlLink":"chore(deps-dev): Bump nokogiri from 1.15.5 to 1.16.2 in /docs (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2119630229\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/787\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/787/hovercard\" href=\"https://github.com/google/osv-scanner/pull/787\">google…</a>"}},{"before":"bb837b452ee7fb7522be487be0232740fabd81b8","after":null,"ref":"refs/heads/verify-spdx","pushedAt":"2024-01-02T02:07:08.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"}},{"before":"2a7655ffe65892c0ce95498a36923db4668f09e8","after":null,"ref":"refs/heads/do-not-edit","pushedAt":"2024-01-02T02:06:52.000Z","pushType":"branch_deletion","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"}},{"before":null,"after":"2a7655ffe65892c0ce95498a36923db4668f09e8","ref":"refs/heads/do-not-edit","pushedAt":"2024-01-02T01:56:54.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"fix directives related to go generate in package spdx","shortMessageHtmlLink":"fix directives related to go generate in package spdx"}},{"before":"c69806006ce0ebd41e5dc6876db2895ce3745f69","after":"16caa1a9cf90d73362e44e04224e8b8e90345755","ref":"refs/heads/main","pushedAt":"2024-01-02T01:49:19.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"verify license allowlist against spdx identifiers (#729)","shortMessageHtmlLink":"verify license allowlist against spdx identifiers (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2061831678\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/729\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/729/hovercard\" href=\"https://github.com/google/osv-scanner/pull/729\">google#729</a>)"}},{"before":"ffdfb58e2ade7dbf2950dd7976f38deebf58e28a","after":"bb837b452ee7fb7522be487be0232740fabd81b8","ref":"refs/heads/verify-spdx","pushedAt":"2024-01-02T01:39:01.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"add unit tests","shortMessageHtmlLink":"add unit tests"}},{"before":"2f56ea308206f2630bd2aa70762f982ab65b067c","after":"ffdfb58e2ade7dbf2950dd7976f38deebf58e28a","ref":"refs/heads/verify-spdx","pushedAt":"2024-01-02T00:09:24.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"linter","shortMessageHtmlLink":"linter"}},{"before":"c69806006ce0ebd41e5dc6876db2895ce3745f69","after":"2f56ea308206f2630bd2aa70762f982ab65b067c","ref":"refs/heads/verify-spdx","pushedAt":"2024-01-01T23:39:14.000Z","pushType":"push","commitsCount":1,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"verify the spdx licenses passed in to the license allowlist","shortMessageHtmlLink":"verify the spdx licenses passed in to the license allowlist"}},{"before":null,"after":"c69806006ce0ebd41e5dc6876db2895ce3745f69","ref":"refs/heads/verify-spdx","pushedAt":"2024-01-01T23:32:38.000Z","pushType":"branch_creation","commitsCount":0,"pusher":{"login":"josieang","name":null,"path":"/josieang","primaryAvatarUrl":"https://avatars.githubusercontent.com/u/32358891?s=80&v=4"},"commit":{"message":"Add formatting instructions to docs contribution (#723)\n\nI just realized that our contributing to docs instructions is circular\r\n(CONTRIBUTING.md points to docs/README.md which points back to\r\nCONTRIBUTING.md). I removed that line and added in the formatting\r\ninstructions.\r\n\r\n---------\r\n\r\nCo-authored-by: Hayley Denbraver <denbraver@google.com>","shortMessageHtmlLink":"Add formatting instructions to docs contribution (<a class=\"issue-link js-issue-link\" data-error-text=\"Failed to load title\" data-id=\"2057830249\" data-permission-text=\"Title is private\" data-url=\"https://github.com/google/osv-scanner/issues/723\" data-hovercard-type=\"pull_request\" data-hovercard-url=\"/google/osv-scanner/pull/723/hovercard\" href=\"https://github.com/google/osv-scanner/pull/723\">google#723</a>)"}}],"hasNextPage":true,"hasPreviousPage":false,"activityType":"all","actor":null,"timePeriod":"all","sort":"DESC","perPage":30,"cursor":"djE6ks8AAAAEXce59QA","startCursor":null,"endCursor":null}},"title":"Activity · josieang/osv-scanner"}