[Security] Bump yard from 0.9.9 to 0.9.16

[dependabot-preview]

Bumps yard from 0.9.9 to 0.9.16. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Vulnerability Alert Database.

CVE-2017-17042
See https://nvd.nist.gov/vuln/detail/CVE-2017-17042.

Affected versions: < 0.9.11

Sourced from The Ruby Advisory Database.

Potential arbitrary file read vulnerability in yard server
lib/yard/core_ext/file.rb in the server in YARD before 0.9.11 does not block
relative paths with an initial ../ sequence, which allows attackers to conduct
directory traversal attacks and read arbitrary files.

Patched versions: >= 0.9.11
Unaffected versions: none

Release notes

Sourced from yard's releases.

Release v0.9.16

No release notes provided.

Release v0.9.15

0.9.15 - July 17th, 2018

• Fixed security issue in parsing of Ruby code that could allow for arbitrary
  execution. Credit to Nelson Elhage [email protected] for discovering this
  issue.

Release v0.9.14

• Fixed a regression in symbol parsing (#1170).

Release v0.9.13

• Added support for grouped constants via @!group directive (#1056).
• Added support for quoted symbols (#1168).
• Added support for i18n in tag text (#1169).
• Fixed HTML rendering of inline code blocks (#1152).
• Fixed rendering of anchor URLs in rendered HTML (#1154).

Release v0.9.11

• Mark C methods as explicit but also remove explicit check in stats. (#727)
• Report unresolved parent namespaces as undocumentable errors instead. (#753)
• No longer ignore overridden methods from documentation check in stats (#719)
• Fix JRuby throwing exception when remove_method called on non-existent method. (#732)
• Add basic support for private_class_method (#747)
• Ensure namespace is always set when parent module is not found. (#753)
• Set overflow as auto on table of contents.
• Report 100% documented if nothing is undocumented. (#754)
• Added support for RubyGems 2.0.0+. (#742)
• Allow users to enter their own YARD RakeTask name. (#705)
• Fixed a typo that was causing Windows detection to always fail. (#715)
• Add debug information when loading a plugin fails. (#711)

0.8.7.3 - November 1, 2013

• Handle Unicode method/class/file names in server URL encoding (Handle legal UTF-8 method names docmeta/rubydoc.info#69).
• Style keyword style hashes with same symbol color in code highlighting (#707).
• Fix broken JS when visiting docs in file:// scheme (#706).
• Add support for new AsciiDoc file extensions (#704).
• Fix issues where non-Ruby code blocks would not display in Ruby 2 (#702).
• Add support for extra Ruby 2 symbol types in Ripper (#701).

... (truncated)

Changelog

Sourced from yard's changelog.

0.9.16 - August 11th, 2018

• Documentation fixes (#1175, #1178).
• Fixed stack overflow issue when parsing extremely large lists (#1176).

0.9.15 - July 17th, 2018

• Fixed security issue in parsing of Ruby code that could allow for arbitrary
  execution. Credit to Nelson Elhage [email protected] for discovering this
  issue.

0.9.14 - June 2nd, 2018

• Fixed a regression in symbol parsing (#1170).

0.9.13 - May 28th, 2018

• Added support for grouped constants via @!group directive (#1056).
• Added support for quoted symbols (#1168).
• Added support for i18n in tag text (#1169).
• Fixed HTML rendering of inline code blocks (#1152).
• Fixed rendering of anchor URLs in rendered HTML (#1154).

0.9.12 - November 26th, 2017

• Be more explicit about lack of support for absolute paths in extra files
  specified by yard doc command.

0.9.11 - November 23rd, 2017

• Fixed security issue in --readme that allowed for arbitrary file reads on
  disk. Credit to ztz [email protected] for discovering this issue.
• Improved styling for inline code blocks (#1142).

0.9.10 - November 18th, 2017

... (truncated)

Commits

• e55e4ac Tag release v0.9.16
• 69d7914 Update changelog
• 61c1665 Merge pull request #1175 from gmalette/gm/change-annotations-for-scoping
• e46506a Merge pull request #1178 from gmalette/gm/fix-annotation-of-files
• 8a7befd Fix StackOverflow for extremely large lists
• 9589e74 Fix test compat with RubyGems in Ruby 2.5+
• 465e1f9 Use the proper annotation for tuples
• fa97a25 Fix annotation in CodeObjects::Base#files
• 8a0e6ac Tag release v0.9.15
• d7859cb Fix parsing of defined? blocks for complex expressions
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #35.