Commits on Dec 5, 2015

1. Update Nokogiri for a security patch …

   Problem:
   
   Running `bundler-audit` reveals a security vulnerability in Nokogiri,
   which can be traced back to a libxml2 vulnerability.
   
   ```
   $ bundle-audit
   Name: nokogiri
   Version: 1.6.6.2
   Advisory: CVE-2015-1819
   Criticality: Unknown
   URL: sparklemotion/nokogiri#1374
   Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
   Solution: upgrade to ~> 1.6.6.4, >= 1.6.7.rc4
   
   Vulnerabilities found!
   ```
   
   Solution:
   
   Update nokogiri to `~> 1.6.6.4`, as suggested.
   
   Nokogiri is a dependency of capybara,
   which is a dependency of poltergeist.
   
   We only need to specify the nokogiri version for the test bundler group,
   which already depends on it.
   
   References:
   
   https://github.com/rubysec/bundler-audit
   sparklemotion/nokogiri#1374
   http://www.ubuntu.com/usn/usn-2812-1/
   
   Only use nokogiri in test bundler group
   
   Nokogiri is a dependency of capybara,
   which is a dependency of poltergeist.
   We only need to specify nokogiri for bundler groups that already depend
   on it.

   

   c-lliope committed Dec 5, 2015
   Configuration menu

   • View commit details
   • Copy full SHA for 12e0db4
   • Browse repository at this point

   Copy the full SHA

   12e0db4 View commit details

   Browse the repository at this point in the history