[Security] Bump rexml from 3.2.5 to 3.2.8

Bumps rexml from 3.2.5 to 3.2.8. This update includes a security fix.

Vulnerabilities fixed

REXML contains a denial of service vulnerability

Impact

The REXML gem before 3.2.6 has a DoS vulnerability when it parses an XML that has many <s in an attribute value.

If you need to parse untrusted XMLs, you many be impacted to this vulnerability.

Patches

The REXML gem 3.2.7 or later include the patch to fix this vulnerability.

Workarounds

Don't parse untrusted XMLs.

References

• https://www.ruby-lang.org/en/news/2024/05/16/dos-rexml-cve-2024-35176/

Patched versions: 3.2.7 Affected versions: < 3.2.7

Release notes

Sourced from rexml's releases.

REXML 3.2.8 - 2024-05-16

Fixes

• Suppressed a warning

REXML 3.2.7 - 2024-05-16

Improvements

• Improve parse performance by using StringScanner.

  • GH-106

  • GH-107

  • GH-108

  • GH-109

  • GH-112

  • GH-113

  • GH-114

  • GH-115

  • GH-116

  • GH-117

  • GH-118

  • GH-119

  • GH-121

  • Patch by NAITOH Jun.

• Improved parse performance when an attribute has many <s.

  • GH-124

Fixes

• XPath: Fixed a bug of normalize_space(array).

  • GH-110

  • GH-111

  • Patch by flatisland.

• XPath: Fixed a bug that wrong position is used with nested path.

  • GH-110

  • GH-122

  • Reported by jcavalieri.

  • Patch by NAITOH Jun.

• Fixed a bug that an exception message can't be generated for invalid encoding XML.

... (truncated)

Changelog

Sourced from rexml's changelog.

3.2.8 - 2024-05-16 {#version-3-2-8}

Fixes

• Suppressed a warning

3.2.7 - 2024-05-16 {#version-3-2-7}

Improvements

• Improve parse performance by using StringScanner.

  • GH-106

  • GH-107

  • GH-108

  • GH-109

  • GH-112

  • GH-113

  • GH-114

  • GH-115

  • GH-116

  • GH-117

  • GH-118

  • GH-119

  • GH-121

  • Patch by NAITOH Jun.

• Improved parse performance when an attribute has many <s.

  • GH-124

Fixes

• XPath: Fixed a bug of normalize_space(array).

  • GH-110

  • GH-111

  • Patch by flatisland.

• XPath: Fixed a bug that wrong position is used with nested path.

  • GH-110

  • GH-122

  • Reported by jcavalieri.

  • Patch by NAITOH Jun.

• Fixed a bug that an exception message can't be generated for

... (truncated)

Commits

• 1cf37ba Add 3.2.8 entry
• b67081c Remove an unused variable (#128)
• 94e180e Suppress a warning
• d574ba5 ci: install only gems required for running tests (#129)
• 4670f8f Add missing Thanks section
• 9ba35f9 Bump version
• 085def0 Add 3.2.7 entry
• 4325835 Read quoted attributes in chunks (#126)
• e77365e Exclude older than 2.6 on macos-14
• bf2c8ed Move development dependencies to Gemfile (#124)
• Additional commits viewable in compare view