ruby-oauth / oauth / 42392536253

82%

push

github

🔒️ Update nokogiri to 1.19.7 (security)

bundler-audit in the Deps Unlocked job flagged nokogiri 1.19.4 with
three published advisories, all fixed in >= 1.19.5:
- GHSA-v995-44v6-5fqm (SSRF on JRuby resolving external DTDs with NONET)
- GHSA-3w22-6jfg-527w (use-after-free replacing an attribute value)
- GHSA-4p39-36wj-23h4 (mutation XSS serializing noscript in HTML5)

Conservative update; only the nokogiri platform pins and their
checksums moved. Verified: `rake bundle:audit:check` → No
vulnerabilities found; 0 local PATH remotes in Gemfile.lock.

170 of 277 branches covered (61.37%)

Branch coverage included in aggregate %.

850 of 969 relevant lines covered (87.72%)

94.64 hits per line