[Security] Bump yard from 0.9.9 to 0.9.14

[dependabot-preview]

Bumps yard from 0.9.9 to 0.9.14. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

Potential arbitrary file read vulnerability in yard server
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block
relative paths with an initial ../ sequence, which allows attackers to conduct
directory traversal attacks and read arbitrary files.

Patched versions: >= 0.9.11
Unaffected versions: none

Release notes

Sourced from yard's releases.

Release v0.9.14

• Fixed a regression in symbol parsing (#1170).

Release v0.9.13

• Added support for grouped constants via @!group directive (#1056).
• Added support for quoted symbols (#1168).
• Added support for i18n in tag text (#1169).
• Fixed HTML rendering of inline code blocks (#1152).
• Fixed rendering of anchor URLs in rendered HTML (#1154).

Release v0.9.11

• Mark C methods as explicit but also remove explicit check in stats. (#727)
• Report unresolved parent namespaces as undocumentable errors instead. (#753)
• No longer ignore overridden methods from documentation check in stats (#719)
• Fix JRuby throwing exception when remove_method called on non-existent method. (#732)
• Add basic support for private_class_method (#747)
• Ensure namespace is always set when parent module is not found. (#753)
• Set overflow as auto on table of contents.
• Report 100% documented if nothing is undocumented. (#754)
• Added support for RubyGems 2.0.0+. (#742)
• Allow users to enter their own YARD RakeTask name. (#705)
• Fixed a typo that was causing Windows detection to always fail. (#715)
• Add debug information when loading a plugin fails. (#711)

0.8.7.3 - November 1, 2013

• Handle Unicode method/class/file names in server URL encoding (Handle legal UTF-8 method names docmeta/rubydoc.info#69).
• Style keyword style hashes with same symbol color in code highlighting (#707).
• Fix broken JS when visiting docs in file:// scheme (#706).
• Add support for new AsciiDoc file extensions (#704).
• Fix issues where non-Ruby code blocks would not display in Ruby 2 (#702).
• Add support for extra Ruby 2 symbol types in Ripper (#701).
• Ensure config directory exists before saving config file (#700).

0.8.7.2 - September 18, 2013

• Disallow absolute URLs when using frame anchor support.
• Support casted functions in CRuby method declarations (#697)

0.8.7.1 - September 11, 2013

... (truncated)

Changelog

Sourced from yard's changelog.

0.9.14 - June 2nd, 2018

• Fixed a regression in symbol parsing (#1170).

0.9.13 - May 28th, 2018

• Added support for grouped constants via @!group directive (#1056).
• Added support for quoted symbols (#1168).
• Added support for i18n in tag text (#1169).
• Fixed HTML rendering of inline code blocks (#1152).
• Fixed rendering of anchor URLs in rendered HTML (#1154).

0.9.12 - November 26th, 2017

• Be more explicit about lack of support for absolute paths in extra files
  specified by yard doc command.

0.9.11 - November 23rd, 2017

• Fixed security issue in --readme that allowed for arbitrary file reads on
  disk. Credit to ztz ztz@ztz.me for discovering this issue.
• Improved styling for inline code blocks (#1142).

0.9.10 - November 18th, 2017

• Added --fail-on-warning option for yard doc which exits with a non-zero
  code if there are any warnings (#1093).
• Added support for parsing inside Struct.new blocks (#1099).
• Added support new ripper AST tokens (#1104, #1124).
• Fixed an issue where [**see**](https://github.com/see) (obj) reference tags would fail (#1111)
• Fix sorting in yard stats (#1123).

Commits

• 41e6c84 Tag release v0.9.14
• 1245beb Update changelog
• cd4452b Fix parsing of symbols when symbol is a keyword
• 5321e10 Update changelog
• dff428a Tag release v0.9.13
• 12b9c41 Merge pull request #1168 from cboos/format_constant-empty-symbol
• 9a1a329 Merge pull request #1166 from koic/deprecate_safe_level_of_erb_new_in_ruby_2_6
• df24cbe Merge pull request #1167 from dlmccoy/fix_years
• 5d6986b Merge pull request #1169 from kou/support-i18n-in-tag-text
• 682a209 Support i18n in tag text
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use (this|these) label[s] will set the current labels as the default for future PRs for this repo and language
• @dependabot use (this|these) reviewer[s] will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use (this|these) assignee[s] will set the current assignees as the default for future PRs for this repo and language

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #54.