Bump nokogiri from 1.8.2 to 1.8.5 in /website/docs/0.4.0-incubating

[dependabot[bot]]

Bumps nokogiri from 1.8.2 to 1.8.5.

Changelog

Sourced from nokogiri's changelog.

1.8.5 / 2018-10-04

Security

[MRI] Pulled in upstream patches from libxml2 that address CVE-2018-14404 and CVE-2018-14567. Full details are available in #1785. Note that these patches are not yet (as of 2018-10-04) in an upstream release of libxml2.

Fixed

• [MRI] Fix regression in installation when building against system libraries, where some systems would not be able to find libxml2 or libxslt when present. (Regression introduced in v1.8.3.) [#1722]
• [JRuby] Fix node reparenting when the destination doc is empty. [#1773]

1.8.4 / 2018-07-03

Fixed

• [MRI] Fix memory leak when creating nodes with namespaces. (Introduced in v1.5.7) [#1771]

1.8.3 / 2018-06-16

Security

[MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here:

https://github.com/GNOME/libxml2/commit/960f0e2

and more information is available about this commit and its impact here:

flavorjones/loofah#144

This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities.

If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here:

https://bugzilla.gnome.org/show_bug.cgi?id=769760

More Security

[MRI] Vendored libxml2 upgraded to v2.9.8 which addresses CVE-2016-9318 [#1582].

Dependencies

• [MRI] libxml2 is updated from 2.9.7 to 2.9.8

Added

... (truncated)

Commits

• e28fa4b version bump to v1.8.5
• 712edef update changelog
• 7feb4c1 Merge branch 'fix-1773'
• 7cc6cf6 Organize imports in XmlNode.java.
• 1697442 Allow reparenting nodes to be a child of an empty document.
• 7b8cd0f Merge pull request #1786 from sparklemotion/1785-canonical-usns
• 5bff4bb pull in upstream libxml2 patches
• c232226 changelog
• 862b88f changelog
• b3750eb remove -Wextra CFLAG
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.