# \[ANN\] nokogiri 1.8.3 released **URL:** \ **Category:** ruby-talk\ **Created:** [16 June 2018 20:14 UTC](https://rubytalk.org/t/ann-nokogiri-1-8-3-released/74655 "2018-06-16T20:14:32Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Mike\_Dalessio1](https://yyz1.discourse-cdn.com/flex029/user_avatar/rubytalk.org/mike_dalessio1/32/1903_2.png) [@Mike\_Dalessio1](https://rubytalk.org/u/Mike_Dalessio1)\ **Post date:** [16 June 2018 20:14 UTC](https://rubytalk.org/t/ann-nokogiri-1-8-3-released/74655/1 "2018-06-16T20:14:32Z")
Nokogiri version 1.8.3 has been released! TL;DR: This is a feature and bugfix release. There's also a commit reverted in the vendored upstream libxml2 that the Nokogiri maintainers feel introduced unnecessary security risk involving sanitizing HTML attributes. You're encouraged to read the release notes and the related documents if you're curious or want to evaluate whether you should upgrade. The release is being made from NYC, at the twelfth and final GORUCO. Much love to the many organizers and attendees over the years that made it the longest-running regional Ruby conference in North America. ❤ ❤ ❤ Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser. Among Nokogiri's many features is the ability to search documents via XPath or CSS3 selectors. \* [http://nokogiri.org](http://nokogiri.org) \* Installation Help: [Installing Nokogiri - Nokogiri](http://nokogiri.org/tutorials/installing_nokogiri.html) \* Tutorials: [http://nokogiri.org](http://nokogiri.org) \* GitHub: [GitHub - sparklemotion/nokogiri: Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.](https://github.com/sparklemotion/nokogiri) \* Mailing List: [https://groups.google.com/group/nokogiri-talk](https://groups.google.com/group/nokogiri-talk) \* Bug Reports: [Issues · sparklemotion/nokogiri · GitHub](https://github.com/sparklemotion/nokogiri/issues) \* Chat/Gitter: [https://gitter.im/sparklemotion/nokogiri](https://gitter.im/sparklemotion/nokogiri) # 1.8.3 / 2018-06-16 ## Security Notes [MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here: > [Do not URI escape in server side includes · GNOME/libxml2@960f0e2 · GitHub](https://github.com/GNOME/libxml2/commit/960f0e2) and more information is available about this commit and its impact here: > [https://github.com/flavorjones/loofah/issues/144](https://github.com/flavorjones/loofah/issues/144) This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities. If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here: > [Bug 769760 – Attributes containing server side includes are not "round tripped" properly](https://bugzilla.gnome.org/show_bug.cgi?id=769760) ## Dependencies \* [MRI] libxml2 is updated from 2.9.7 to 2.9.8 ## Features \* Node#classes, #add\_class, #append\_class, and #remove\_class are added. \* NodeSet#append\_class is added. \* NodeSet#remove\_attribute is a new alias for NodeSet#remove\_attr. \* NodeSet#each now returns an Enumerator when no block is passed (Thanks, @park53kr!) \* [JRuby] General improvements in JRuby implementation (Thanks, @kares!) ## Bug fixes \* CSS attribute selectors now gracefully handle queries using integers. [#711] \* Handle ASCII-8BIT encoding on fragment input [#553] \* Handle non-string return values within `Reader` [#898] \* [JRuby] Allow Node#replace to insert Comment and CDATA nodes. [#1666] \* [JRuby] Stability and speed improvements to `Node`, `Sax::PushParser`, and the JRuby implementation [#1708, #1710, #1501] ---
**Author:** ![Stephen\_Schor](https://yyz1.discourse-cdn.com/flex029/user_avatar/rubytalk.org/stephen_schor/32/1961_2.png) [@Stephen\_Schor](https://rubytalk.org/u/Stephen_Schor)\ **Post date:** [16 June 2018 20:40 UTC](https://rubytalk.org/t/ann-nokogiri-1-8-3-released/74655/2 "2018-06-16T20:40:15Z")
❤ Phone. Brevity. Typos. > **···** > > On Sat, Jun 16, 2018, 4:15 PM Mike Dalessio \ wrote: > > > Nokogiri version 1.8.3 has been released! > > > > TL;DR: This is a feature and bugfix release. There's also a commit > > reverted in the vendored upstream libxml2 that the Nokogiri maintainers > > feel introduced unnecessary security risk involving sanitizing HTML > > attributes. You're encouraged to read the release notes and the related > > documents if you're curious or want to evaluate whether you should upgrade. > > > > The release is being made from NYC, at the twelfth and final GORUCO. Much > > love to the many organizers and attendees over the years that made it the > > longest-running regional Ruby conference in North America. ❤ ❤ ❤ > > > > Nokogiri (鋸) is an HTML, XML, SAX, and Reader parser. Among Nokogiri's > > many features is the ability to search documents via XPath or CSS3 > > selectors. > > > > \* [http://nokogiri.org](http://nokogiri.org) > > \* Installation Help: > > [Installing Nokogiri - Nokogiri](http://nokogiri.org/tutorials/installing_nokogiri.html) > > \* Tutorials: [http://nokogiri.org](http://nokogiri.org) > > \* GitHub: [GitHub - sparklemotion/nokogiri: Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby.](https://github.com/sparklemotion/nokogiri) > > \* Mailing List: [https://groups.google.com/group/nokogiri-talk](https://groups.google.com/group/nokogiri-talk) > > \* Bug Reports: [Issues · sparklemotion/nokogiri · GitHub](https://github.com/sparklemotion/nokogiri/issues) > > \* Chat/Gitter: [https://gitter.im/sparklemotion/nokogiri](https://gitter.im/sparklemotion/nokogiri) > > > > # 1.8.3 / 2018-06-16 > > > > ## Security Notes > > > > [MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 > > (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 > > (rails-html-sanitizer gem). The commit in question is here: > > > > \> [Do not URI escape in server side includes · GNOME/libxml2@960f0e2 · GitHub](https://github.com/GNOME/libxml2/commit/960f0e2) > > > > and more information is available about this commit and its impact here: > > > > \> [https://github.com/flavorjones/loofah/issues/144](https://github.com/flavorjones/loofah/issues/144) > > > > This release simply reverts the libxml2 commit in question to protect > > users of Nokogiri's vendored libraries from similar vulnerabilities. > > > > If you're offended by what happened here, I'd kindly ask that you comment > > on the upstream bug report here: > > > > \> [Bug 769760 – Attributes containing server side includes are not "round tripped" properly](https://bugzilla.gnome.org/show_bug.cgi?id=769760) > > > > ## Dependencies > > > > \* [MRI] libxml2 is updated from 2.9.7 to 2.9.8 > > > > ## Features > > > > \* Node#classes, #add\_class, #append\_class, and #remove\_class are added. > > \* NodeSet#append\_class is added. > > \* NodeSet#remove\_attribute is a new alias for NodeSet#remove\_attr. > > \* NodeSet#each now returns an Enumerator when no block is passed (Thanks, > > @park53kr!) > > \* [JRuby] General improvements in JRuby implementation (Thanks, @kares!) > > > > ## Bug fixes > > > > \* CSS attribute selectors now gracefully handle queries using integers. > > [#711] > > \* Handle ASCII-8BIT encoding on fragment input [#553] > > \* Handle non-string return values within `Reader` [#898] > > \* [JRuby] Allow Node#replace to insert Comment and CDATA nodes. [#1666] > > \* [JRuby] Stability and speed improvements to `Node`, `Sax::PushParser`, > > and the JRuby implementation [#1708, #1710, #1501] > > > > Unsubscribe: \ > > \<[http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>](http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-talk>);