Merge branch 'master' into strip-suffix-on-referenced-imgs-at-doc-root

Author: zkoppert

.dockerignore

@@ -25,15 +25,4 @@ updates:
         update-types:
           - 'minor'
           - 'patch'
-  - package-ecosystem: 'docker'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-    commit-message:
-      prefix: 'chore(deps)'
-    groups:
-      dependencies:
-        applies-to: version-updates
-        update-types:
-          - 'minor'
-          - 'patch'
+

.github/dependabot.yaml

@@ -14,18 +14,18 @@ jobs:
     strategy:
       matrix:
         ruby:
-          - "3.2"
           - "3.3"
           - "3.4"
+          - "4.0"
       fail-fast: false
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 10
 
-      - uses: ruby/setup-ruby@0cb964fd540e0a24c900370abf38a33466142735 # v1
+      - uses: ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f # v1
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
@@ -48,13 +48,13 @@ jobs:
           sudo apt-get update -qq
           sudo apt-get install perl rakudo-pkg
 
-          curl -L http://cpanmin.us | perl - --sudo App::cpanminus
+          curl -fsSL https://cpanmin.us | perl - --sudo App::cpanminus
           sudo cpanm --installdeps --notest Pod::Simple
 
       - name: Install Python dependencies
         run: |
           echo 'docutils==0.22.4 --hash=sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de' > /tmp/requirements.txt
-          python -m pip install -r /tmp/requirements.txt
+          python -m pip install --require-hashes --no-deps -r /tmp/requirements.txt
 
       - name: Run rake
         run: |

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-issue-message: >

.github/workflows/stale.yml

@@ -8,3 +8,4 @@ vendor/
 .DS_Store
 .venv
 venv
+coverage/

.gitignore

@@ -7,12 +7,10 @@ gem "RedCloth"
 # using a tag version here because 0.18.3 was not published by the author to encourage users to upgrade.
 # however we want to bump up to this version since this has a security patch
 gem "commonmarker", git: "https://github.com/gjtorikian/commonmarker.git", tag: "v0.18.3"
-gem "rdoc", "~> 6.13.1"
+gem "rdoc", "~> 7.2.0"
 gem "org-ruby", "0.9.12"
 gem "creole", "~>0.5.0"
 gem "wikicloth", "=0.8.3"
 gem "twitter-text", "~> 1.14"
 gem "asciidoctor", "~> 2.0.26"
-gem "rake"
 gem "rexml"
-gem "nokogiri", "~> 1.19"

Dockerfile

@@ -9,39 +9,41 @@ GIT
 PATH
   remote: .
   specs:
-    github-markup (5.0.1)
+    github-markup (6.0.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
     RedCloth (4.3.4)
-    activesupport (7.2.3.1)
+    activesupport (8.1.3)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
-      minitest (>= 5.1, < 6)
+      minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     asciidoctor (2.0.26)
     base64 (0.3.0)
-    benchmark (0.5.0)
-    bigdecimal (4.1.0)
+    bigdecimal (4.1.2)
     builder (3.3.0)
     cgi (0.5.1)
     charlock_holmes (0.7.9)
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
     crass (1.0.6)
     creole (0.5.0)
-    date (3.4.1)
+    date (3.5.1)
+    docile (1.4.1)
     drb (2.2.3)
+    erb (6.0.4)
     expression_parser (0.9.0)
-    github-linguist (9.3.0)
+    github-linguist (9.5.0)
       cgi
       charlock_holmes (~> 0.7.7)
       mini_mime (~> 1.0)
@@ -52,35 +54,41 @@ GEM
     htmlentities (4.3.4)
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
+    json (2.19.5)
     logger (1.7.0)
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (5.27.0)
-    nokogiri (1.19.2)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
+    nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.2-aarch64-linux-gnu)
+    nokogiri (1.19.3-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.2-arm-linux-gnu)
+    nokogiri (1.19.3-arm-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.2-arm64-darwin)
+    nokogiri (1.19.3-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-darwin)
+    nokogiri (1.19.3-x86_64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-gnu)
+    nokogiri (1.19.3-x86_64-linux-gnu)
       racc (~> 1.4)
     nokogiri-diff (0.3.0)
       nokogiri (~> 1.5)
       tdiff (~> 0.4)
     org-ruby (0.9.12)
       rubypants (~> 0.2)
-    psych (5.2.3)
+    prism (1.9.0)
+    psych (5.3.1)
       date
       stringio
     racc (1.8.1)
-    rake (13.3.1)
-    rdoc (6.13.1)
+    rake (13.4.2)
+    rdoc (7.2.0)
+      erb
       psych (>= 4.0.0)
+      tsort
     redcarpet (3.6.1)
     rexml (3.4.4)
     ruby-enum (0.9.0)
@@ -91,15 +99,23 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     securerandom (0.4.1)
-    stringio (3.1.6)
+    simplecov (0.22.0)
+      docile (~> 1.1)
+      simplecov-html (~> 0.11)
+      simplecov_json_formatter (~> 0.1)
+    simplecov-html (0.13.2)
+    simplecov_json_formatter (0.1.4)
+    stringio (3.2.0)
     tdiff (0.4.0)
+    tsort (0.2.0)
     twitter-text (1.14.7)
       unf (~> 0.1.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.9.1)
+    uri (1.1.1)
     wikicloth (0.8.3)
       builder
       expression_parser
@@ -117,23 +133,24 @@ PLATFORMS
 
 DEPENDENCIES
   RedCloth
-  activesupport (~> 7.2.3)
+  activesupport (~> 8.1.3)
   asciidoctor (~> 2.0.26)
   commonmarker!
   creole (~> 0.5.0)
   github-linguist (>= 7.1.3)
   github-markup!
   html-pipeline (~> 1.0)
   kramdown
-  minitest (~> 5.4, >= 5.4.3)
-  nokogiri (~> 1.19)
+  minitest (~> 6.0, >= 5.4.3)
+  nokogiri (~> 1.19.2)
   nokogiri-diff (~> 0.3.0)
   org-ruby (= 0.9.12)
-  rake
-  rdoc (~> 6.13.1)
+  rake (~> 13)
+  rdoc (~> 7.2.0)
   redcarpet
   rexml
   sanitize (>= 4.6.3)
+  simplecov (~> 0.22)
   twitter-text (~> 1.14)
   wikicloth (= 0.8.3)
 

Gemfile

@@ -1,3 +1,37 @@
+## 6.0.0 - 2026-05-04
+
+### Breaking
+
+* Drop support for Ruby < 3.3 (Ruby 3.1 EOL March 2025, Ruby 3.2 EOL March 2026)
+
+### Security
+
+* Use HTTPS for cpanminus download in CI to prevent MITM attacks [#2050](https://github.com/github/markup/pull/2050)
+* Bump nokogiri to >= 1.19.1 to fix GHSA-wx95-c6cv-8532
+* Harden CI pip install with `--require-hashes --no-deps` [#2048](https://github.com/github/markup/pull/2048)
+* Use HTTPS for RubyGems source URL in Gemfile [#1854](https://github.com/github/markup/pull/1854)
+* Add explicit `contents: read` permissions to CI workflow [#1855](https://github.com/github/markup/pull/1855)
+* Bump rexml from 3.3.0 to 3.3.9 (multiple security fixes)
+
+### Bug Fixes
+
+* Fix RST section ID rendering to iterate all anchors instead of only the first [040f91d](https://github.com/github/markup/commit/040f91d)
+
+### Documentation
+
+* Fix spelling errors in codebase [#1479](https://github.com/github/markup/pull/1479)
+* Fix broken Textile language link in README [#1703](https://github.com/github/markup/pull/1703)
+
+### Infrastructure
+
+* Remove legacy Dockerfile and .dockerignore (Ubuntu Trusty, non-functional) [#2048](https://github.com/github/markup/pull/2048)
+* Update CI test matrix: drop Ruby 3.2, add Ruby 4.0 (now testing 3.3, 3.4, 4.0)
+* Bump nokogiri to 1.19.2, activesupport to 7.2.3.1
+* Bump github-linguist from 7.30.0 to 9.1.0, then to 9.3.0
+* Pin all GitHub Actions to commit SHAs for supply chain hardening
+* Add Dependabot configuration for automated dependency updates
+* Various Dependabot bumps for CI actions (ruby/setup-ruby, actions/checkout, actions/cache, actions/setup-python, actions/stale)
+
 ## 5.0.1 - 2024-06-17
 * Bump activesupport from 4.0 to 7.1.3.4
 

Gemfile.lock

@@ -1,8 +1,11 @@
-require File.expand_path("../lib/github-markup", __FILE__)
+version_file = File.expand_path("../lib/github-markup.rb", __FILE__)
+version_match = File.read(version_file).match(/VERSION = ['"]([^'"]+)['"]/)
+raise "Could not find VERSION in #{version_file}" unless version_match
+version = version_match[1]
 
 Gem::Specification.new do |s|
   s.name          = "github-markup"
-  s.version       = GitHub::Markup::VERSION
+  s.version       = version
   s.summary       = "The code GitHub uses to render README.markup"
   s.description   = <<~DESC
     This gem is used by GitHub to render any fancy markup such as Markdown,
@@ -13,19 +16,20 @@ Gem::Specification.new do |s|
   s.homepage      = "https://github.com/github/markup"
   s.license       = "MIT"
 
-  s.required_ruby_version = '>= 3.1.0'
+  s.required_ruby_version = '>= 3.3.0'
 
   s.files         = `git ls-files`.split($\)
   s.executables   = s.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
   s.test_files    = s.files.grep(%r{^(test|spec|features)/})
   s.require_paths = %w[lib]
 
   s.add_development_dependency 'rake', '~> 13'
-  s.add_development_dependency 'activesupport', '~> 7.2.3'
-  s.add_development_dependency 'minitest', '~> 5.4', '>= 5.4.3'
+  s.add_development_dependency 'activesupport', '~> 8.1.3'
+  s.add_development_dependency 'minitest', '>= 5.4.3', '~> 6.0'
   s.add_development_dependency 'html-pipeline', '~> 1.0'
   s.add_development_dependency 'sanitize', '>= 4.6.3'
   s.add_development_dependency 'nokogiri', '~> 1.19.2'
   s.add_development_dependency 'nokogiri-diff', '~> 0.3.0'
   s.add_development_dependency "github-linguist", ">= 7.1.3"
+  s.add_development_dependency 'simplecov', '~> 0.22'
 end