From 217824028524d9a8759bf46f53c379acf615621d Mon Sep 17 00:00:00 2001 From: Ignacio Tolstoy Date: Thu, 22 Feb 2024 12:43:38 +0100 Subject: [PATCH 01/14] Update nokogiri CVE-2024-25062 --- github-pages.gemspec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/github-pages.gemspec b/github-pages.gemspec index dacbb09f..9d9594b7 100644 --- a/github-pages.gemspec +++ b/github-pages.gemspec @@ -25,7 +25,7 @@ Gem::Specification.new do |s| end s.add_dependency("mercenary", "~> 0.3") - s.add_dependency("nokogiri", ">= 1.13.6", "< 2.0") + s.add_dependency("nokogiri", ">= 1.16.2", "< 2.0") s.add_dependency("terminal-table", "~> 1.4") s.add_development_dependency("jekyll_test_plugin_malicious", "~> 0.2") s.add_development_dependency("pry", "~> 0.10") From 7292abd8578ba14004e22fa153bf02ab9a4c9173 Mon Sep 17 00:00:00 2001 From: Mark Crossfield Date: Fri, 1 Mar 2024 19:26:55 +0000 Subject: [PATCH 02/14] Avoid Gemfile from site hiding installed gems MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I’ve specified the BUNDLE_GEMFILE as the one that exists in the /src/site location (the source of the site being built) was preventing Jekyll from finding the installed dependencies. --- Dockerfile | 2 ++ Dockerfile.alpine | 2 ++ 2 files changed, 4 insertions(+) diff --git a/Dockerfile b/Dockerfile index 3caedbfe..6fe6a8df 100644 --- a/Dockerfile +++ b/Dockerfile @@ -28,6 +28,8 @@ ENV LANG en_US.UTF-8 ENV LANGUAGE en_US.UTF-8 ENV LC_ALL en_US.UTF-8 +ENV BUNDLE_GEMFILE=/src/gh/pages-gem/Gemfile + WORKDIR /src/site CMD ["jekyll", "serve", "-H", "0.0.0.0", "-P", "4000"] diff --git a/Dockerfile.alpine b/Dockerfile.alpine index aea69e92..717b1b8e 100644 --- a/Dockerfile.alpine +++ b/Dockerfile.alpine @@ -17,6 +17,8 @@ ENV LANG en_US.UTF-8 ENV LANGUAGE en_US.UTF-8 ENV LC_ALL en_US.UTF-8 +ENV BUNDLE_GEMFILE=/src/gh/pages-gem/Gemfile + WORKDIR /src/site CMD ["jekyll", "serve", "-H", "0.0.0.0", "-P", "4000"] From 40126625429c877fc8a0d82b62332ca9e0e4cab6 Mon Sep 17 00:00:00 2001 From: Mark Crossfield Date: Fri, 1 Mar 2024 19:28:02 +0000 Subject: [PATCH 03/14] =?UTF-8?q?Add=20webrick=20as=20Ruby=203=20doesn?= =?UTF-8?q?=E2=80=99t=20include=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This may be fixable by upgrading Jekyll as it is now declared as a dependency. --- lib/github-pages/dependencies.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index 5d3f948d..2da2c956 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -9,6 +9,7 @@ class Dependencies # Jekyll "jekyll" => "3.9.5", "jekyll-sass-converter" => "1.5.2", + "webrick" => "1.8.1", # Converters "kramdown" => "2.4.0", From 8c298f22000a2829919ee57744fe29f07857fe5a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 17 Jun 2024 18:32:41 +0000 Subject: [PATCH 04/14] Bump docker/build-push-action from 5 to 6 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5 to 6. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v5...v6) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/publish-docker.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml index 2c2f50c4..028879a8 100644 --- a/.github/workflows/publish-docker.yml +++ b/.github/workflows/publish-docker.yml @@ -34,7 +34,7 @@ jobs: images: ${{ env.REGISTRY }}/${{ github.repository }} - name: Build Docker Image and Push to Container Registry - uses: docker/build-push-action@v5 + uses: docker/build-push-action@v6 with: context: . push: ${{ github.event_name != 'pull_request' }} From 0d32533cb9c8bbd4ccdb832cd63790b368eb36c6 Mon Sep 17 00:00:00 2001 From: Parker Moore <237985+parkr@users.noreply.github.com> Date: Mon, 24 Jun 2024 15:33:32 -0700 Subject: [PATCH 05/14] Upgrade to Jekyll 3.10.0 No functionality is changed. Since Ruby 3.0 dropped webrick and Ruby 3.4 is going to drop csv, this adds them back as dependencies. https://jekyllrb.com/news/2024/06/23/jekyll-3-10-0-released/ --- lib/github-pages/dependencies.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index 2da2c956..76607aeb 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -7,7 +7,7 @@ module GitHubPages class Dependencies VERSIONS = { # Jekyll - "jekyll" => "3.9.5", + "jekyll" => "3.10.0", "jekyll-sass-converter" => "1.5.2", "webrick" => "1.8.1", From f94a6468037ec955b9d098b13d53973d0a03111d Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Wed, 17 Jul 2024 17:22:19 -0700 Subject: [PATCH 06/14] bump jekyll-commonmark-ghpages --- lib/github-pages/dependencies.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index 76607aeb..8a21e7b9 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -14,7 +14,7 @@ class Dependencies # Converters "kramdown" => "2.4.0", "kramdown-parser-gfm" => "1.1.0", - "jekyll-commonmark-ghpages" => "0.4.0", + "jekyll-commonmark-ghpages" => "0.5.0", # Misc "liquid" => "4.0.4", From 3ecc50f8b97df882d786a15c5fa543699f68ea89 Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Wed, 17 Jul 2024 17:34:55 -0700 Subject: [PATCH 07/14] Update lib/github-pages/dependencies.rb --- lib/github-pages/dependencies.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index 8a21e7b9..f131b29a 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -14,7 +14,7 @@ class Dependencies # Converters "kramdown" => "2.4.0", "kramdown-parser-gfm" => "1.1.0", - "jekyll-commonmark-ghpages" => "0.5.0", + "jekyll-commonmark-ghpages" => "0.5.1", # Misc "liquid" => "4.0.4", From 7b839b231b0a8e753951ebb370bd1ad184281e85 Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Wed, 17 Jul 2024 17:47:06 -0700 Subject: [PATCH 08/14] Add webrick to core --- spec/github-pages/dependencies_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/github-pages/dependencies_spec.rb b/spec/github-pages/dependencies_spec.rb index 619e9739..574ec14d 100644 --- a/spec/github-pages/dependencies_spec.rb +++ b/spec/github-pages/dependencies_spec.rb @@ -5,7 +5,7 @@ describe(GitHubPages::Dependencies) do CORE_DEPENDENCIES = %w( jekyll kramdown kramdown-parser-gfm liquid rouge jekyll-sass-converter - github-pages-health-check + github-pages-health-check webrick ).freeze PLUGINS = described_class::VERSIONS.keys - CORE_DEPENDENCIES From 48dca23c8ce904c9235ef38915ad067f43cc24ff Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Wed, 17 Jul 2024 17:47:49 -0700 Subject: [PATCH 09/14] cosmetic --- spec/github-pages/dependencies_spec.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/spec/github-pages/dependencies_spec.rb b/spec/github-pages/dependencies_spec.rb index 574ec14d..b0248e90 100644 --- a/spec/github-pages/dependencies_spec.rb +++ b/spec/github-pages/dependencies_spec.rb @@ -5,7 +5,8 @@ describe(GitHubPages::Dependencies) do CORE_DEPENDENCIES = %w( jekyll kramdown kramdown-parser-gfm liquid rouge jekyll-sass-converter - github-pages-health-check webrick + github-pages-health-check + webrick ).freeze PLUGINS = described_class::VERSIONS.keys - CORE_DEPENDENCIES From f430f404e8863be299ef39a0d6032c5d71da9193 Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Wed, 17 Jul 2024 17:54:03 -0700 Subject: [PATCH 10/14] nil webrick test --- spec/github-pages/integration_spec.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/spec/github-pages/integration_spec.rb b/spec/github-pages/integration_spec.rb index d673a418..f76fa9b2 100644 --- a/spec/github-pages/integration_spec.rb +++ b/spec/github-pages/integration_spec.rb @@ -309,4 +309,10 @@ def rm_destination expect(contents).to match("markdown: CommonMarkGhPages") end end + + context "webrick" do + it "does nothing" do + # all is well + end + end end From 0a6fecc6683a7780fa9840389d3b49bc9cd18b73 Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Tue, 6 Aug 2024 10:30:26 -0700 Subject: [PATCH 11/14] Attempt to move webrick to the gemspec instead --- github-pages.gemspec | 1 + lib/github-pages/dependencies.rb | 1 - spec/github-pages/dependencies_spec.rb | 1 - spec/github-pages/integration_spec.rb | 6 ------ 4 files changed, 1 insertion(+), 8 deletions(-) diff --git a/github-pages.gemspec b/github-pages.gemspec index 9d9594b7..faeb2b4c 100644 --- a/github-pages.gemspec +++ b/github-pages.gemspec @@ -27,6 +27,7 @@ Gem::Specification.new do |s| s.add_dependency("mercenary", "~> 0.3") s.add_dependency("nokogiri", ">= 1.16.2", "< 2.0") s.add_dependency("terminal-table", "~> 1.4") + s.add_dependency("webrick", "~> 1.8") s.add_development_dependency("jekyll_test_plugin_malicious", "~> 0.2") s.add_development_dependency("pry", "~> 0.10") s.add_development_dependency("rspec", "~> 3.3") diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index f131b29a..52ffa371 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -9,7 +9,6 @@ class Dependencies # Jekyll "jekyll" => "3.10.0", "jekyll-sass-converter" => "1.5.2", - "webrick" => "1.8.1", # Converters "kramdown" => "2.4.0", diff --git a/spec/github-pages/dependencies_spec.rb b/spec/github-pages/dependencies_spec.rb index b0248e90..619e9739 100644 --- a/spec/github-pages/dependencies_spec.rb +++ b/spec/github-pages/dependencies_spec.rb @@ -6,7 +6,6 @@ CORE_DEPENDENCIES = %w( jekyll kramdown kramdown-parser-gfm liquid rouge jekyll-sass-converter github-pages-health-check - webrick ).freeze PLUGINS = described_class::VERSIONS.keys - CORE_DEPENDENCIES diff --git a/spec/github-pages/integration_spec.rb b/spec/github-pages/integration_spec.rb index f76fa9b2..d673a418 100644 --- a/spec/github-pages/integration_spec.rb +++ b/spec/github-pages/integration_spec.rb @@ -309,10 +309,4 @@ def rm_destination expect(contents).to match("markdown: CommonMarkGhPages") end end - - context "webrick" do - it "does nothing" do - # all is well - end - end end From 1c47cb2cfdac3f3070093f601ea096970899afb2 Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Mon, 5 Aug 2024 12:04:45 -0700 Subject: [PATCH 12/14] Fix improperly bound regex --- spec/spec_helper.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index bf8614da..07d6bada 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -16,7 +16,7 @@ # Stub all GitHub API requests so they come back empty. config.before(:each) do - stub_request(:get, /api.github.com/) + stub_request(:get, /api\.github.com/) .to_return(:status => 200, :body => "{}", :headers => {}) end end From fdf1e16adb69567277abd5a5fc9ec4e4f9d7d03c Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Tue, 6 Aug 2024 10:31:59 -0700 Subject: [PATCH 13/14] Escape all the dots --- spec/spec_helper.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index 07d6bada..ef7e9e91 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -16,7 +16,7 @@ # Stub all GitHub API requests so they come back empty. config.before(:each) do - stub_request(:get, /api\.github.com/) + stub_request(:get, /api\.github\.com/) .to_return(:status => 200, :body => "{}", :headers => {}) end end From 4565c456bab6bbea3d1f618e7ff7f333571e4951 Mon Sep 17 00:00:00 2001 From: Yoann Chaudet Date: Tue, 6 Aug 2024 15:43:01 -0700 Subject: [PATCH 14/14] Prep 232 --- lib/github-pages/version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/github-pages/version.rb b/lib/github-pages/version.rb index c69e2cda..6d381bad 100644 --- a/lib/github-pages/version.rb +++ b/lib/github-pages/version.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true module GitHubPages - VERSION = 231 + VERSION = 232 end