Bump rmagick from 7.0.5 to 7.1.0 in the ruby-minor-and-patch group across 1 directory

[dependabot]

Bumps the ruby-minor-and-patch group with 1 update in the / directory: rmagick.

Updates rmagick from 7.0.5 to 7.1.0

Release notes

Sourced from rmagick's releases.

RMagick 7.1.0

[!IMPORTANT] Draw#annotate and Draw#get_type_metrics no longer interpret the text they are given. A %[...] or %x escape is now drawn as written instead of being replaced.

Build the string in Ruby instead — everything those escapes provided has a direct accessor:

# before
img.annotate(gc, 0, 0, 10, 20, '%wx%h')
after
img.annotate(gc, 0, 0, 10, 20, "#{img.columns}x#{img.rows}")

%[width]/%w → Image#columns, %[height]/%h → Image#rows, %f/%d → Image#filename, %m → Image#format, %b → Image#filesize, %[EXIF:*] and other properties → Image#[], %[artifact:KEY] → Image#artifact (new in this release), %[mean] → Image#channel_mean, %[pixel:p{x,y}] → Image#pixel_color, %[fx:...] → Image#fx or plain Ruby.

The interpolation was never documented, and leaving it in place meant that passing user-supplied text to annotate also handed that text to an expression evaluator, a pixel and metadata reader, and an unbounded CPU sink — on a 1500x1500 image, a 10 KB caption of %[mean] took 78 seconds. It also corrupted ordinary text: %d expanded to the directory the image had been read from, so a caption of "%d items" was drawn as /srv/app/uploads items.

Upgrading

• Text starting with @ is drawn instead of being read from that file. annotate(gc, 0, 0, 0, 20, '@notes.txt') now draws @notes.txt; read the file yourself if that is what you wanted.
• RVG path data is validated against the SVG path grammar. canvas.path(d) raises ArgumentError if d contains anything outside MmZzLlHhVvCcSsQqTtAa, digits, .,+-eE and whitespace.
• Pathnames containing a NUL byte raise ArgumentError instead of being silently truncated.
• Draw#clip_path and Draw#encoding now quote their argument in the generated MVG, and values interpolated by Draw#enquote have " and \ escaped. Rendering is unchanged; this is only visible if you compare Draw#inspect output.
• Text containing a backslash is now drawn as written. Previously a trailing \ escaped the closing delimiter of the MVG token, so the text was mangled.

Breaking Changes

• Reject embedded NUL bytes in pathname arguments by @​Watson1978 in rmagick/rmagick#1827
• Fix arbitrary file read in Draw#annotate with text starting with '@' by @​Watson1978 in rmagick/rmagick#1837
• Fix MVG injection from unvalidated RVG::Path data by @​Watson1978 in rmagick/rmagick#1839
• Fix MVG injection from unescaped values in Draw#enquote by @​Watson1978 in rmagick/rmagick#1841
• Draw annotation text as given instead of interpreting it by @​Watson1978 in rmagick/rmagick#1843

Improvements

• Fix grammar, typos, and content errors in the documentation by @​Watson1978 in rmagick/rmagick#1824
• Add Image#artifact to read the artifacts Image#define writes by @​Watson1978 in rmagick/rmagick#1842

Bug Fixes

• Fix unchecked SetImageArtifact() calls by @​ndossche in rmagick/rmagick#1822
• Fix copy_options() using the option value as the artifact key by @​Watson1978 in rmagick/rmagick#1823
• Fix Magick#set_log_event_mask() by @​ndossche in rmagick/rmagick#1826
• Fix SEGV in Info#stroke_width= and Info#attenuate= with a large Float by @​Watson1978 in rmagick/rmagick#1828
• Fix double free of the annotation text in Draw#annotate by @​Watson1978 in rmagick/rmagick#1829
• Fix double free of the interpreted text in Draw#get_type_metrics by @​Watson1978 in rmagick/rmagick#1830
• Fix use-after-free of cloned images in images_from_imagelist() by @​Watson1978 in rmagick/rmagick#1831
• Fix SEGV in Draw#marshal_load with a non-String pattern by @​Watson1978 in rmagick/rmagick#1832
• Fix heap over-read in Image#recolor by @​Watson1978 in rmagick/rmagick#1833
• Fix SEGV from integer overflow in Image#import_pixels geometry by @​Watson1978 in rmagick/rmagick#1834
• Fix heap over-read in Image#import_pixels with a long or empty map by @​Watson1978 in rmagick/rmagick#1835
• Fix memory leak in ImageList#composite_layers with an unusable source list by @​Watson1978 in rmagick/rmagick#1836

... (truncated)

Changelog

Sourced from rmagick's changelog.

RMagick 7.1.0

[!IMPORTANT] Draw#annotate and Draw#get_type_metrics no longer interpret the text they are given. A %[...] or %x escape in it is now drawn as written instead of being replaced by an image property. Everything those escapes provided is available directly from Ruby -- Image#columns, Image#rows, Image#format, Image#filesize, Image#filename, Image#[], Image#artifact, Image#channel_mean, Image#pixel_color and Image#fx -- so build the string in Ruby and pass the result.

The interpolation was undocumented, and it handed any caller that passed user-supplied text an expression evaluator, a pixel and metadata reader, and an unbounded CPU sink. It also corrupted ordinary captions: "%d items" was drawn as the directory the image had been read from.

Breaking Changes

• Draw annotation text as given instead of interpreting it (#1843)
• Draw text starting with '@' instead of reading it from that file (#1837)
• Validate RVG path data against the SVG path grammar (#1839)
• Escape values and quote the clip-path and encoding names in the MVG program (#1841)
• Reject embedded NUL bytes in pathname arguments (#1827)

Improvements

• Add Image#artifact to read the artifacts Image#define writes (#1842)
• Fix grammar, typos, and content errors in the documentation (#1824)

Bug Fixes

• Fix RVG text being quoted twice and the added quotes being drawn (#1840)
• Fix MVG injection in Draw#text from unescaped backslashes (#1838)
• Fix memory leak in ImageList#composite_layers with an unusable source list (#1836)
• Fix heap over-read in Image#import_pixels with a long or empty map (#1835)
• Fix SEGV from integer overflow in Image#import_pixels geometry (#1834)
• Fix heap over-read in Image#recolor (#1833)
• Fix SEGV in Draw#marshal_load with a non-String pattern (#1832)
• Fix use-after-free of cloned images in images_from_imagelist() (#1831)
• Fix double free of the interpreted text in Draw#get_type_metrics (#1830)
• Fix double free of the annotation text in Draw#annotate (#1829)
• Fix SEGV in Info#stroke_width= and Info#attenuate= with a large Float (#1828)
• Fix Magick#set_log_event_mask() (#1826)
• Fix copy_options() using the option value as the artifact key (#1823)
• Fix unchecked SetImageArtifact() calls (#1822)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions