Skip to content

Upgrading crass 0.2 to 1

Unknown0.2.1 → 1.0.8Security5Changed1Fixed2Other2

Full comparisonBack to crass
Fetching 9 releases from GitHub…6 / 9
UnknownUpgrade verdict

DepDelta is still reading the notes for 3 of 9 releases, so breaking changes can't be ruled out yet.

In plain terms
  • DepDelta is still reading the release notes in this range, so it can't rule out breaking changes yet.
  • This page updates as the notes come in.
Must act Top 3 of 5 that need code or config changes

What you must change

Security5
Fixes a tokenizer bug where a ) after an escaped backslash in a bad URL did not terminate the token, letting CSS sanitizers pass through content browsers would apply.
1.0.8GitHub ReleaseSummarizedView source
Fixes a high-severity denial of service where a large numeric exponent consumed excessive CPU and memory before clamping.
High
1.0.7GitHub ReleaseSummarizedView source
Fixes stack exhaustion and memory use from deeply nested blocks or functions by adding a configurable maximum nesting depth.
:maximum_depthSystemStackError
1.0.7GitHub ReleaseSummarizedView source
Fixes stack exhaustion from long runs of adjacent comments by skipping discarded comments iteratively instead of recursively.
SystemStackError
1.0.7GitHub ReleaseSummarizedView source
Fixes a denial of service where many non-ASCII characters caused excessive CPU use during tokenization.
1.0.7GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published Ruby source. Not mixed with prose notes.

  • removed: method Crass.string()
  • changed: method Parser.consume_declarations(_ = …) → method Parser.consume_declarations(_ = …, _ = …)
  • changed: method Tokenizer.consume_string(_) → method Tokenizer.consume_string(_ = …)
  • added: const Parser.DEFAULT_MAXIMUM_DEPTH
  • added: const Tokenizer.RE_QUOTED_URL_START
  • added: const Tokenizer.RE_WHITESPACE_ANCHORED
  • added: method Parser.discard_block(_)
  • added: method Parser.parse_component_value(_ = …)
  • added: method Parser.parse_component_values(_ = …)
  • added: method Parser.parse_declaration(_ = …)
  • added: method Parser.parse_declarations(_ = …, _ = …)
  • added: method Parser.parse_rule(_ = …)
  • added: method TokenScanner.peek()
  • added: method Tokenizer.consume_comments()
  • added: property Scanner.string: reader