Allow nokogiri 1.11 and above

[aried3r]

[kwent]

@soundasleep Please merge. This is fixing a critical vulnerability: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-vr8q-g5c7-m54m

[krtschmr]

only question is: should we force 1.11 to be the minimum?

[aried3r]

Nokogiri 1.11 ist 2 days old and ends support for Ruby 2.3 and 2.4.

There might be users that use this project or nokogiri itself in ways that is safe enough for them, given the vulnerability.

I'd say, allow people to update, but don't force this version, at least for now.

https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md#v1110--2021-01-03

WDYT?

[krtschmr]

That's actually a fair argument. We run 2.7 so we can force 1.11. I opened a pull request earlier today where we use 1.11, then saw yours and just asked why, but i never thought about older versions ;-)

Seems like owner abandoned this project. The classy fail of github opensource somehow. sad.

i dobut this gets merged :/

[baburdick]

When the new maintainers revive this project, please close this in favor of #16 or #17.

[mscrivo]

Resolved in #17