[Security] Bump yard from 0.9.9 to 0.9.15

[dependabot-preview]

Bumps yard from 0.9.9 to 0.9.15. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Vulnerability Alert Database.

CVE-2017-17042
More details available at https://nvd.nist.gov/vuln/detail/CVE-2017-17042.

Affected versions: < 0.9.11

Sourced from The Ruby Advisory Database.

Potential arbitrary file read vulnerability in yard server
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block
relative paths with an initial ../ sequence, which allows attackers to conduct
directory traversal attacks and read arbitrary files.

Patched versions: >= 0.9.11
Unaffected versions: none

Release notes

Sourced from yard's releases.

Release v0.9.15

0.9.15 - July 17th, 2018

• Fixed security issue in parsing of Ruby code that could allow for arbitrary
  execution. Credit to Nelson Elhage nelhage@nelhage.com for discovering this
  issue.

Release v0.9.14

• Fixed a regression in symbol parsing (#1170).

Release v0.9.13

• Added support for grouped constants via @!group directive (#1056).
• Added support for quoted symbols (#1168).
• Added support for i18n in tag text (#1169).
• Fixed HTML rendering of inline code blocks (#1152).
• Fixed rendering of anchor URLs in rendered HTML (#1154).

Release v0.9.11

• Mark C methods as explicit but also remove explicit check in stats. (#727)
• Report unresolved parent namespaces as undocumentable errors instead. (#753)
• No longer ignore overridden methods from documentation check in stats (#719)
• Fix JRuby throwing exception when remove_method called on non-existent method. (#732)
• Add basic support for private_class_method (#747)
• Ensure namespace is always set when parent module is not found. (#753)
• Set overflow as auto on table of contents.
• Report 100% documented if nothing is undocumented. (#754)
• Added support for RubyGems 2.0.0+. (#742)
• Allow users to enter their own YARD RakeTask name. (#705)
• Fixed a typo that was causing Windows detection to always fail. (#715)
• Add debug information when loading a plugin fails. (#711)

0.8.7.3 - November 1, 2013

• Handle Unicode method/class/file names in server URL encoding (Handle legal UTF-8 method names docmeta/rubydoc.info#69).
• Style keyword style hashes with same symbol color in code highlighting (#707).
• Fix broken JS when visiting docs in file:// scheme (#706).
• Add support for new AsciiDoc file extensions (#704).
• Fix issues where non-Ruby code blocks would not display in Ruby 2 (#702).
• Add support for extra Ruby 2 symbol types in Ripper (#701).
• Ensure config directory exists before saving config file (#700).

[0.8.7.2] - September 18, 2013

... (truncated)

Changelog

Sourced from yard's changelog.

0.9.15 - July 17th, 2018

• Fixed security issue in parsing of Ruby code that could allow for arbitrary
  execution. Credit to Nelson Elhage nelhage@nelhage.com for discovering this
  issue.

0.9.14 - June 2nd, 2018

• Fixed a regression in symbol parsing (#1170).

0.9.13 - May 28th, 2018

• Added support for grouped constants via @!group directive (#1056).
• Added support for quoted symbols (#1168).
• Added support for i18n in tag text (#1169).
• Fixed HTML rendering of inline code blocks (#1152).
• Fixed rendering of anchor URLs in rendered HTML (#1154).

0.9.12 - November 26th, 2017

• Be more explicit about lack of support for absolute paths in extra files
  specified by yard doc command.

0.9.11 - November 23rd, 2017

• Fixed security issue in --readme that allowed for arbitrary file reads on
  disk. Credit to ztz ztz@ztz.me for discovering this issue.
• Improved styling for inline code blocks (#1142).

0.9.10 - November 18th, 2017

• Added --fail-on-warning option for yard doc which exits with a non-zero
  code if there are any warnings (#1093).
• Added support for parsing inside Struct.new blocks (#1099).
• Added support new ripper AST tokens (#1104, #1124).
• Fixed an issue where [**see**](https://github.com/see) (obj) reference tags would fail (#1111)
• Fix sorting in yard stats (#1123).

Commits

• 8a0e6ac Tag release v0.9.15
• d7859cb Fix parsing of defined? blocks for complex expressions
• 44ca65d Merge branch 'pr-1171'
• 3eca759 Run the smoke test only during CI.
• 41e6c84 Tag release v0.9.14
• 1245beb Update changelog
• cd4452b Fix parsing of symbols when symbol is a keyword
• b4c0de2 Add a smoke test, running yard on the full yard source
• 2ab0eea Refactor legacy token list tests to avoid toplevel include
• 5321e10 Update changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #55.