[Security] Bump nokogiri from 1.8.1 to 1.8.2

[dependabot-preview]

Bumps nokogiri from 1.8.1 to 1.8.2. This update includes security fixes.

Vulnerabilities fixed

Nokogiri gem, via libxml, is affected by DoS vulnerabilities
The version of libxml2 packaged with Nokogiri contains a
vulnerability. Nokogiri has mitigated these issue by upgrading to
libxml 2.9.6.

It was discovered that libxml2 incorrecty handled certain files. An attacker
could use this issue with specially constructed XML data to cause libxml2 to
consume resources, leading to a denial of service.

Patched versions: [">= 1.8.2"]
Unaffected versions: []

Changelog

Sourced from nokogiri's changelog.

1.8.2 / 2018-01-29

Security Notes

[MRI] The update of vendored libxml2 from 2.9.5 to 2.9.7 addresses at least one published vulnerability, CVE-2017-15412. [#1714 has complete details]

Dependencies

• [MRI] libxml2 is updated from 2.9.5 to 2.9.7
• [MRI] libxslt is updated from 1.1.30 to 1.1.32

Features

• [MRI] OpenBSD installation should be a bit easier now. [#1685] (Thanks, jeremyevans!)
• [MRI] Cross-built Windows gems now support Ruby 2.5

Bug fixes

• Node#serialize once again returns UTF-8-encoded strings. [#1659]
• [JRuby] made SAX parsing of characters consistent with C implementation [#1676] (Thanks, andrew-aladev!)
• [MRI] Predefined entities, when inspected, no longer cause a segfault. [#1238]

Commits

• f80f4ad version bump to 1.8.2
• d35ed46 update CHANGELOG
• 62b1a5b update CHANGELOG
• 6e14afe Merge pull request #1713 from sparklemotion/flavorjones-1238-segfault-reparen...
• b1494e5 ensure EntityReferences ignore malformed children
• d3456e4 update CHANGELOG
• bf94cf5 remove hacks to discover the path to racc
• 734d4d4 Merge pull request #1704 from larskanis/win-ruby-2.5
• cc80904 Appveyor: Add ruby-2.4 and ruby-head to build matrix
• 992d81b Windows: Add cross build for ruby-2.5
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot ignore this [minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use [this|these] label[s] will set the current labels as the default for future PRs for this repo and language

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)

Finally, you can contact us by mentioning @dependabot.