build(deps): bump mechanize from 2.7.6 to 2.8.1 in /Library/Homebrew

[dependabot]

Bumps mechanize from 2.7.6 to 2.8.1.

Release notes

Sourced from mechanize's releases.

2.8.1 / 2021-05-09

Fix

• Gracefully handle parsing errors that contain an invalid byte sequence. Previously, if libxml2 registered a parsing error that itself contained invalid encoding, an exception might be raised. (#553)

2.8.0 / 2021-04-01

• Requirements

  • Mechanize now requires Ruby 2.5 or newer.
  • Move from ntlm-http to rubyntlm gem. (#495, #574)

• New Features

  • Page::Link#uri now handles non-ASCII hrefs. (#569) @​terryyin
  • FileConnection supports Windows drive letters (#483)
  • Credential headers 'Authorization' and 'Cookie' are deleted on cross-origin redirects. (#538) @​kyoshidajp
  • ContentDispositionParser handles ISO8601 date headers, to be robust with websites that ignore RFC2183. (#554) @​reitermarkus

• Bug fix

  • POST headers 'Content-Length', 'Content-MD5', and 'Content-Type' are deleted in a case-insensitive manner on redirects. Previously these headers were treated as case-sensitive.

2.7.7 / 2021-02-01

• Security fixes for CVE-2021-21289

  Mechanize >= v2.0, < v2.7.7 allows for OS commands to be injected into several classes' methods via implicit use of Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

  • Mechanize::CookieJar#load: since v2.0 (see 208e3ed)
  • Mechanize::CookieJar#save_as: since v2.0 (see 5b776a4)
  • Mechanize#download: since v2.2 (see dc91667)
  • Mechanize::Download#save and #save! since v2.1 (see 98b2f51, bd62ff0)
  • Mechanize::File#save and #save_as: since v2.1 (see 2bf7519)
  • Mechanize::FileResponse#read_body: since v2.0 (see 01039f5)

  See GHSA-qrqm-fpv6-6r8g for more information.

  Also see #547, #548. Thank you, @​kyoshidajp!

• New Features

  • Support for Ruby 3.0 by adding webrick as a runtime dependency. (#557) @​pvalena

• Bug fix

  • Ignore input fields with blank names (#542, #536)

Changelog

Sourced from mechanize's changelog.

2.8.1 / 2021-05-09

Fix

• Gracefully handle parsing errors that contain an invalid byte sequence. Previously, if libxml2 registered a parsing error that itself contained invalid encoding, an exception might be raised. (#553)

2.8.0 / 2021-04-01

Requirements

• Mechanize now requires Ruby 2.5 or newer.
• Move from ntlm-http to rubyntlm gem. (#495, #574)

New Features

• Page::Link#uri now handles non-ASCII hrefs. (#569) @​terryyin
• FileConnection supports Windows drive letters (#483)
• Credential headers 'Authorization' and 'Cookie' are deleted on cross-origin redirects. (#538) @​kyoshidajp
• ContentDispositionParser handles ISO8601 date headers, to be robust with websites that ignore RFC2183. (#554) @​reitermarkus

Bug fix

• POST headers 'Content-Length', 'Content-MD5', and 'Content-Type' are deleted in a case-insensitive manner on redirects. Previously these headers were treated as case-sensitive.

2.7.7 / 2021-02-01

• Security fixes for CVE-2021-21289

  Mechanize >= v2.0, < v2.7.7 allows for OS commands to be injected into several classes' methods via implicit use of Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls:

  • Mechanize::CookieJar#load: since v2.0 (see 208e3ed)
  • Mechanize::CookieJar#save_as: since v2.0 (see 5b776a4)
  • Mechanize#download: since v2.2 (see dc91667)
  • Mechanize::Download#save and #save! since v2.1 (see 98b2f51, bd62ff0)
  • Mechanize::File#save and #save_as: since v2.1 (see 2bf7519)
  • Mechanize::FileResponse#read_body: since v2.0 (see 01039f5)

  See GHSA-qrqm-fpv6-6r8g for more information.

  Also see #547, #548. Thank you, @​kyoshidajp!

• New Features

  • Support for Ruby 3.0 by adding webrick as a runtime dependency. (#557) @​pvalena

• Bug fix

... (truncated)

Commits

• a88ebef version bump to v2.8.1
• c6f0e64 Merge pull request #579 from sparklemotion/553-encoding-in-parsing-error
• 49f6009 fix: handle libxml2-generated errors with bad encoding
• 5c67ffb Merge pull request #578 from gogainda/patch-1
• 52fef51 Update ci-test.yml
• bc1c9b4 replace remaining links to docs.seattlerb.org.
• 169ca16 changelog: work around yard incorrectly inferring headers
• a11329b version bump to v2.8.0
• 8273f43 replace the README links to docs.seattlerb.org
• aa09817 convert CHANGELOG from rdoc to markdown
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #324.