Initial move to SnakeYAML Engine

See jruby/jruby#7570 for some of the justification for this move. We only
require the parser from SnakeYAML, but in the original form it is
encumbered with Java object serialization code that keeps getting
flagged as a CVE risk. We disagree with the assessment, at least
as it pertains to JRuby (we do not use the code in question) but
our inclusion of the library continues to get flagged by auditing
tools.

This commit starts the process of moving to the successor library,
SnakeYAML Engine. The parser API is largely unchanged, except as
seen in this commit. No Java exceptions are thrown, but a number
of Psych tests fail (possibly due to Engine being YAML 1.2 only).
This commit is contained in:
Charles Oliver Nutter 2023-01-13 02:55:52 -06:00 коммит произвёл Hiroshi SHIBATA
Родитель 29133794a3
Коммит 0ee819b71d
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: F9CF13417264FAC2
2 изменённых файлов: 2 добавлений и 2 удалений

Просмотреть файл

@ -5,6 +5,6 @@ module Psych
VERSION = '5.0.2'
if RUBY_ENGINE == 'jruby'
DEFAULT_SNAKEYAML_VERSION = '1.33'.freeze
DEFAULT_SNAKEYAML_VERSION = '2.6'.freeze
end
end

Просмотреть файл

@ -55,7 +55,7 @@ DESCRIPTION
"lib/psych_jars.rb",
"lib/psych.jar"
]
s.requirements = "jar org.yaml:snakeyaml, #{version_module::Psych::DEFAULT_SNAKEYAML_VERSION}"
s.requirements = "jar org.snakeyaml:snakeyaml-engine, #{version_module::Psych::DEFAULT_SNAKEYAML_VERSION}"
s.add_dependency 'jar-dependencies', '>= 0.1.7'
else
s.extensions = ["ext/psych/extconf.rb"]