to make sure it's marked properly. Also, we make sure the new node is
decorated if necessary with its document's decorators.

Fixes #3359

Co-authored-by: Jean Boussier <jean.boussier@gmail.com>
(cherry picked from commit c72503a)

…t to v1.17.x) (#3364)

Backport of #3363 addressing #3359.

Back in b92660e (#1834 fixing #1063) I omitted support in JRuby for
the "new_parent_document" argument to `Node#dup` because there was no
performance reason to implement it. So the test was skipped.

However, in 1e7d38a and other commits in #3117 (fixing #316), I
introduced a call to `initialize_copy_with_args` that passes the new
parent document as an argument on both CRuby and JRuby
implementations. Because the test was skipped, I didn't catch that
this broke on JRuby.

In particular this was a problem for Loofah which relies on
decorators, and even more particularly this broke the
`Loofah::TextBehavior` formatting concern for
`Loofah::*::DocumentFragment` objects.

Maybe we should be running downstream tests with JRuby, too? But that
feels like a big investment right now so I'll avoid scarring on the
first cut, and wait to see if it happens again.

(cherry picked from commit dda0be2)

…3373)

Backport of #3372

https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6

https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.6

See related #3437 and #3438

I'm not making any kind of statement or promises about whether I'll cut
security releases for v1.17.x in the future. I'm doing this because
Mastodon 4.2 still supports Ruby 3.0 and its dependency on ruby-saml
makes it potentially impacted by the underlying libxml2 fixes.

I know somebody out there, somewhere, is going to say "I'll stay on Ruby
3.0 if Mike is going to keep cutting security updates", and hoo boy that
is NOT a bet you should be making. I am the most enthusiastic supporter
of "dropping support for EOL versions of Ruby" that you will ever meet,
and this is NOT going to continue.

I know somebody out there, somewhere, is going to try to convince me
that because I made this one security update, I'm somehow _obligated_ to
continue supporting the v1.17.x branch. If you feel the urge to send me
a message like that, please restrain yourself and do not make me regret
doing this thing.