Closed Bug 1700620 Opened 3 years ago Closed 3 years ago

[wpt-sync] Sync PR 28212 - Bump lxml from 4.6.2 to 4.6.3 in /css

Categories

(Core :: CSS Parsing and Computation, task, P4)

Product:
Core
Component:
CSS Parsing and Computation
Type:
task

Tracking

()

Status:
RESOLVED FIXED
Milestone:
90 Branch
Tracking Flags:
Tracking Status
firefox90 --- fixed

People

(Reporter: wpt-sync, Unassigned)

References

(
URL
)

Details

(Whiteboard: [wptsync downstream])

Sync web-platform-tests PR 28212 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/28212
Details from upstream follow.

b'dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>' wrote:

Bump lxml from 4.6.2 to 4.6.3 in /css

Bumps lxml from 4.6.2 to 4.6.3.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/lxml/lxml/blob/master/CHANGES.txt">lxml's changelog</a>.</em></p>
<blockquote>
<h1>4.6.3 (2021-03-21)</h1>
<h2>Bugs fixed</h2>
<ul>
<li>A vulnerability (CVE-2021-28957) was discovered in the HTML Cleaner by Kevin Chung,
which allowed JavaScript to pass through. The cleaner now removes the HTML5
<code>formaction</code> attribute.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999"><code>a5f9cb5</code></a> Prepare release of lxml 4.6.3.</li>
<li><a href="https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d"><code>2d01a1b</code></a> Add HTML-5 "formaction" attribute to "defs.link_attrs" (<a href="https://github-redirect.dependabot.com/lxml/lxml/issues/316">GH-316</a>)</li>
<li><a href="https://github.com/lxml/lxml/commit/e986a9cb5d54827c59aefa8803bc90954d67221e"><code>e986a9c</code></a> Fix reference in docs.</li>
<li>See full diff in <a href="https://github.com/lxml/lxml/compare/lxml-4.6.2...lxml-4.6.3">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Component: web-platform-tests → CSS Parsing and Computation
Product: Testing → Core
The PR was not expected to affect any tests, but the try push wasn't a success. Check the try results for infrastructure issues
Pushed by wptsync@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/2f24f9136447
[wpt PR 28212] - Bump lxml from 4.6.2 to 4.6.3 in /css, a=testonly
Test result changes from PR not available.

https://hg.mozilla.org/mozilla-central/rev/2f24f9136447

Status: NEW → RESOLVED
Closed: 3 years ago
status-firefox90: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 90 Branch
You need to log in before you can comment on or make changes to this bug.