1.8.4 / 2018-07-03

Bug fixes

1.8.3 / 2018-06-16

Security Notes

[MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here:

github.com/GNOME/libxml2/commit/960f0e2

and more information is available about this commit and its impact here:

github.com/flavorjones/loofah/issues/144

This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities.

If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here:

bugzilla.gnome.org/show_bug.cgi?id=769760

Dependencies

Features

Bug fixes

1.8.2 / 2018-01-29

Security Notes

[MRI] The update of vendored libxml2 from 2.9.5 to 2.9.7 addresses at least one published vulnerability, CVE-2017-15412. [#1714 has complete details]

Dependencies

Features

Bug fixes

1.8.1 / 2017-09-19

Dependencies

Bugs

1.8.0 / 2017-06-04

Backwards incompatibilities

This release ends support for Ruby 2.1 on Windows in the x86-mingw32 and x64-mingw32 platform gems (containing pre-compiled DLLs). Official support ended for Ruby 2.1 on 2017-04-01.

Please note that this deprecation note only applies to the precompiled Windows gems. Ruby 2.1 continues to be supported (for now) in the default gem when compiled on installation.

Dependencies

Compatibility notes

Features

Bugs

1.7.2 / 2017-05-09

Security Notes

[MRI] Upstream libxslt patches are applied to the vendored libxslt 1.1.29 which address CVE-2017-5029 and CVE-2016-4738.

For more information:

1.7.1 / 2017-03-19

Security Notes

[MRI] Upstream libxml2 patches are applied to the vendored libxml 2.9.4 which address CVE-2016-4658 and CVE-2016-5131.

For more information:

1.7.0.1 / 2017-01-04

Bugs

1.7.0 / 2016-12-26

Features

Backwards incompatibilities.

This release ends support for:

1.6.8.1 / 2016-10-03

Dependency License Notes

Removes required dependency on the pkg-config gem. This dependency was introduced in v1.6.8 and, because it's distributed under LGPL, was objectionable to many Nokogiri users (#1488, #1496).

This version makes pkg-config an optional dependency. If it's installed, it's used; but otherwise Nokogiri will attempt to work around its absence.

1.6.8 / 2016-06-06

Security Notes

[MRI] Bundled libxml2 is upgraded to 2.9.4, which fixes many security issues. Many of these had previously been patched in the vendored libxml 2.9.2 in the 1.6.7.x branch, but some are newer.

See these libxml2 email posts for more:

For a more detailed analysis, you may care to read Canonical's take on these security issues:

[MRI] Bundled libxslt is upgraded to 1.1.29, which fixes a security issue as well as many long-known outstanding bugs, some features, some portability improvements, and general cleanup.

See this libxslt email post for more:

Features

Several changes were made to improve performance:

Bug Fixes

Other Notes

1.6.7.2 / 2016-01-20

This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:

CVE-2015-7499

Ubuntu classifies this as “Priority: Low”, RedHat classifies this as “Impact: Moderate”, and NIST classifies this as “Severity: 5.0 (MEDIUM)”.

MITRE record is cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7499

1.6.7.1 / 2015-12-16

This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:

CVE-2015-5312 CVE-2015-7497 CVE-2015-7498 CVE-2015-7499 CVE-2015-7500 CVE-2015-8241 CVE-2015-8242 CVE-2015-8317

See also www.ubuntu.com/usn/usn-2834-1/

1.6.7 / 2015-11-29

Notes

This version supports native builds on Windows using the RubyInstaller DevKit. It also supports Ruby 2.2.x on Windows, as well as making several other improvements to the installation process on various platforms.

This version also includes the security patches already applied in v1.6.6.3 and v1.6.6.4 to the vendored libxml2 and libxslt source. See #1374 and #1376 for details.

Features

Bug Fixes

1.6.6.4 / 2015-11-19

This version pulls in an upstream patch to the vendored libxml2 to address:

This issue was assigned CVE-2015-8710 after the fact. See seclists.org/oss-sec/2015/q4/616 for details.

1.6.6.3 / 2015-11-16

This version pulls in several upstream patches to the vendored libxml2 and libxslt to address:

See #1374 for details.

1.6.6.2 / 2015-01-23

Bug fixes

1.6.6.1 / 2015-01-22

Note that 1.6.6.0 was not released.

Features

Bug fixes

1.6.5 / 2014-11-26

Features

Bug fixes

1.6.4.1 / 2014-11-05

Bug fixes

1.6.4 / 2014-11-04

Features

Bug fixes

1.6.3.1 / 2014-07-21

Bug fixes

1.6.3 / 2014-07-20

Features

Bug fixes

1.6.2.1 / 2014-05-13

Bug fixes

1.6.2 / 2014-05-12

Security Note

A set of security and bugfix patches have been backported from the libxml2 and libxslt repositories onto the version of 2.8.0 packaged with Nokogiri, including these notable security fixes:

It is recommended that you upgrade from 1.6.x to this version as soon as possible.

Compatibility Note

Now requires libxml >= 2.6.21 (was previously >= 2.6.17).

Features

Bugfixes

1.6.1 / 2013-12-14

1.6.0 / 2013-06-08

This release was based on v1.5.10 and 1.6.0.rc1, and contains changes mentioned in both.

1.6.0.rc1 / 2013-04-14

This release was based on v1.5.9, and so does not contain any fixes mentioned in the notes for v1.5.10.

1.5.11 / 2013-12-14

1.5.10 / 2013-06-07

1.5.9 / 2013-03-21

1.5.8 / 2013-03-19

1.5.7 / 2013-03-18

1.5.6 / 2012-12-19

1.5.5 / 2012-06-24

1.5.4 / 2012-06-12

1.5.3 / 2012-06-01

1.5.2 / 2012-03-09

Repackaging of 1.5.1 with a gemspec that is compatible with older Rubies. #631, #632.

1.5.1 / 2012-03-09

1.5.0 / 2011-07-01

1.5.0 beta3 / 2010/12/02

1.5.0 beta2 / 2010/07/30

1.5.0 beta1 / 2010/05/22

1.4.7 / 2011-07-01

1.4.6 / 2011-06-19

1.4.5 / 2011-05-19

1.4.4 / 2010-11-15

1.4.3 / 2010/07/28

1.4.2 / 2010/05/22

1.4.1 / 2009/12/10

1.4.0 / 2009/10/30

1.3.3 / 2009/07/26

1.3.2 / 2009-06-22

1.3.1 / 2009-06-07

1.3.0 / 2009-05-30

1.2.3 / 2009-03-22

1.2.2 / 2009-03-14

1.2.1 / 2009-02-23

1.2.0 / 2009-02-22

1.1.1

1.1.0

1.0.7

1.0.6

1.0.5

1.0.4

1.0.3

1.0.2

1.0.1

1.0.0 / 2008-07-13