dep: update libxml to 2.12.5 (branch v1.16.x) (#3122)

**What problem is this PR intended to solve?** Update libxml2 to v2.12.5: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5 **Have you included adequate test coverage?** Yes. **Does this change affect the behavior of either the C or the Java implementations?** Only affects C impl.
sparklemotion · Feb 4, 2024 · 74ffd67 · 74ffd67
2 parents e994168 + 0d4018d
commit 74ffd67
Show file tree

Hide file tree

Showing 4 changed files with 18 additions and 40 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,18 @@ Nokogiri follows [Semantic Versioning](https://semver.org/), please see the [REA
 
 ---
 
+## v1.16.next / unreleased
+
+### Security
+
+* [CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See [GHSA-xc9x-jj77-9p9j](https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-xc9x-jj77-9p9j) for more information.
+
+
+### Dependencies
+
+* [CRuby] Vendored libxml2 is updated to [v2.12.5](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.5) from v2.12.4. (@flavorjones)
+
+
 ## v1.16.1 / 2024-02-03
 
 ### Dependencies

diff --git a/dependencies.yml b/dependencies.yml
@@ -1,8 +1,8 @@
 
 libxml2:
-  version: "2.12.4"
-  sha256: "497360e423cf0bd99eacdb7c6215dea92e6d6e89ee940393c2bae0e77cb9b7d0"
-  # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.12/libxml2-2.12.4.sha256sum
+  version: "2.12.5"
+  sha256: "a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21"
+  # sha-256 hash provided in https://download.gnome.org/sources/libxml2/2.12/libxml2-2.12.5.sha256sum
 
 libxslt:
   version: "1.1.39"

diff --git a/patches/libxml2/0012-parser-Fix-crash-in-xmlParseInNodeContext-with-HTML.patch b/patches/libxml2/0012-parser-Fix-crash-in-xmlParseInNodeContext-with-HTML.patch
diff --git a/test/html5/test_api.rb b/test/html5/test_api.rb
@@ -239,12 +239,11 @@ def test_node_wrap_uses_parent_node_as_parsing_context_node
   end
 
   def test_parse_in_context_of_foreign_namespace
-    if Nokogiri.uses_libxml?("~> 2.12.0")
-      skip_unless_libxml2_patch("0012-parser-Fix-crash-in-xmlParseInNodeContext-with-HTML.patch")
-    end
-
     # https://github.com/sparklemotion/nokogiri/issues/3112
     # https://gitlab.gnome.org/GNOME/libxml2/-/issues/672
+    # released upstream in v2.12.5
+    skip if Nokogiri.uses_libxml?(["~> 2.12.0", "< 2.12.5"])
+
     doc = Nokogiri::HTML5::Document.parse("<html><body><math>")
     math = doc.at_css("math")