Bump the bundler group across 1 directory with 13 updates

[dependabot]

Bumps the bundler group with 8 updates in the / directory:

Package	From	To
actionpack	7.2.1	7.2.2.1
httparty	0.22.0	0.24.0
nokogiri	1.16.7	1.18.9
rexml	3.3.8	3.4.2
rack	3.1.7	3.1.18
aws-sdk-s3	1.166.0	1.208.0
net-imap	0.4.16	0.4.20
rails-html-sanitizer	1.6.0	1.6.1

Updates actionpack from 7.2.1 to 7.2.2.1

Release notes

Sourced from actionpack's releases.

7.2.2.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

  [CVE-2024-54133]

  Gannon McGibbon

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

... (truncated)

Commits

• 33beb0a Preparing for 7.2.2.1 release
• 3da2479 Add CSP directive validation
• d0dcb8f Preparing for 7.2.2 release
• 2975a88 Merge remote-tracking branch 'origin/7-2-sec' into 7-2-stable
• 7750d64 Preparing for 7.2.1.2 release
• 05dabd7 Add author to the CHANGELOG entries
• 5f5349f Merge remote-tracking branch 'origin/7-2-sec' into 7-2-stable
• a1f6a13 Preparing for 7.2.1.1 release
• de33c73 Update CHANGELOGs
• 27121e8 Avoid backtracking in filtered_query_string
• Additional commits viewable in compare view

Updates actionmailer from 7.2.1 to 7.2.2.1

Release notes

Sourced from actionmailer's releases.

7.2.2.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

  [CVE-2024-54133]

  Gannon McGibbon

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

... (truncated)

Commits

• 33beb0a Preparing for 7.2.2.1 release
• d0dcb8f Preparing for 7.2.2 release
• 2975a88 Merge remote-tracking branch 'origin/7-2-sec' into 7-2-stable
• 7750d64 Preparing for 7.2.1.2 release
• 7ffd7bd Fix NoMethodError in ActionMailer block_format
• b4ebf86 Fix edge case where ActionMailer::MailHelper#block_format caused a
• 05dabd7 Add author to the CHANGELOG entries
• a1f6a13 Preparing for 7.2.1.1 release
• de33c73 Update CHANGELOGs
• be898cc Avoid backtracking in ActionMailer block_format
• Additional commits viewable in compare view

Updates activerecord from 7.2.1 to 7.2.2.1

Release notes

Sourced from activerecord's releases.

7.2.2.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

  [CVE-2024-54133]

  Gannon McGibbon

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

... (truncated)

Commits

• 33beb0a Preparing for 7.2.2.1 release
• d0dcb8f Preparing for 7.2.2 release
• f6916e7 Merge pull request #53494 from zzak/re-53492
• a7858b5 Merge pull request #53472 from p8/activerecord/improve-attributes-for-inspect...
• e6a8acd Merge pull request #53475 from p8/activerecord/show-all-attributes-in-console
• 91aac4a Merge pull request #53484 from zzak/query_cache-config-disable
• e1cccdc Add CHANGELOG entry for 170e6c178b7358a87a7304bdf80273e0b153f6fd
• 897b382 Merge pull request #53400 from wata727/translate_no_connection_to_not_establi...
• c529251 Revert "Merge pull request #53398 from kamipo/fix_strict_loading_propagation"
• 2975a88 Merge remote-tracking branch 'origin/7-2-sec' into 7-2-stable
• Additional commits viewable in compare view

Updates activestorage from 7.2.1 to 7.2.2.1

Release notes

Sourced from activestorage's releases.

7.2.2.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

  [CVE-2024-54133]

  Gannon McGibbon

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

... (truncated)

Commits

• 33beb0a Preparing for 7.2.2.1 release
• d0dcb8f Preparing for 7.2.2 release
• 7750d64 Preparing for 7.2.1.2 release
• a1f6a13 Preparing for 7.2.1.1 release
• d7ab27b Merge pull request #52962 from rails/rm-releser
• See full diff in compare view

Updates httparty from 0.22.0 to 0.24.0

Release notes

Sourced from httparty's releases.

v0.24.0

What's Changed

• Force binary encoding throughout by @​jnunemaker in jnunemaker/httparty#823
• set Content-Type for Hash body in requests by @​jnunemaker in jnunemaker/httparty#828
• feat: stream multipart file uploads to reduce memory usage by @​jnunemaker in jnunemaker/httparty#829
• fix: prevent SSRF via absolute URL bypassing base_uri by @​jnunemaker in jnunemaker/httparty#830

Full Changelog: jnunemaker/httparty@v0.23.2...v0.24.0

0.23.2

What's Changed

• Add changelog_uri metadata to gemspec by @​baraidrissa in jnunemaker/httparty#817
• Fix multipart with files in binary mode and fields including non-ASCII characters by @​rdimartino in jnunemaker/httparty#822

New Contributors

• @​baraidrissa made their first contribution in jnunemaker/httparty#817
• @​rdimartino made their first contribution in jnunemaker/httparty#822

Full Changelog: jnunemaker/httparty@v0.23.1...v0.23.2

v0.23.1

• Add foul option to class level jnunemaker/httparty@d268387

Full Changelog: jnunemaker/httparty@v0.23.0...v0.23.1

v0.23.0

What's Changed

• new: foul mode to rescue all common network errors: https://github.com/jnunemaker/httparty/blob/891a4a8093afd4cacecab2719223e3170d07f1c0/examples/party_foul_mode.rb
• docs: replace master branch to main for better view by @​bestony in jnunemaker/httparty#803
• Update README.md by @​tradesmanhelix in jnunemaker/httparty#811

New Contributors

• @​ashishra0 made their first contribution with foul mode
• @​bestony made their first contribution in jnunemaker/httparty#803
• @​tradesmanhelix made their first contribution in jnunemaker/httparty#811

Full Changelog: jnunemaker/httparty@v0.22.0...v0.23.0

Commits

• 55ec76e Release 0.24.0
• ddfbc8d Merge pull request #830 from jnunemaker/fix-ssrf-base-uri-bypass
• 0529bcd fix: prevent SSRF via absolute URL bypassing base_uri (GHSA-hm5p-x4rq-38w4)
• 05f38fd Merge pull request #829 from jnunemaker/memory
• 8901c23 feat: stream multipart file uploads to reduce memory usage
• 091bd6a Merge pull request #828 from jnunemaker/issue-826
• 59c0ac5 feat: set Content-Type for Hash body in requests
• 5c8b45e Merge pull request #823 from jnunemaker/mixed-encodings
• 6419cb3 Force binary encoding throughout
• c74571f Release 0.23.2
• Additional commits viewable in compare view

Updates nokogiri from 1.16.7 to 1.18.9

Release notes

Sourced from nokogiri's releases.

v1.18.9 / 2025-07-20

Security

• [CRuby] Applied upstream libxml2 patches to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796. See GHSA-353f-x4gh-cqq8 for more information.

5bcfdf7aa8d1056a7ad5e52e1adffc64ef53d12d0724fbc6f458a3af1a4b9e32  nokogiri-1.18.9-aarch64-linux-gnu.gem
55e9e6ca46c4ad1715e313f407d8481d15be1e3b65d9f8e52ba1c124d01676a7  nokogiri-1.18.9-aarch64-linux-musl.gem
eea3f1f06463ff6309d3ff5b88033c4948d0da1ab3cc0a3a24f63c4d4a763979  nokogiri-1.18.9-arm64-darwin.gem
fe611ae65880e445a9c0f650d52327db239f3488626df4173c05beafd161d46e  nokogiri-1.18.9-arm-linux-gnu.gem
935605e14c0ba17da18d203922440bf6c0676c602659278d855d4622d756a324  nokogiri-1.18.9-arm-linux-musl.gem
ac5a7d93fd0e3cef388800b037407890882413feccca79eb0272a2715a82fa33  nokogiri-1.18.9.gem
1fe5b7aa4a054eda689a969bb4e03999960a6ea806582d327207d687168bceb5  nokogiri-1.18.9-java.gem
6b4fc1523aa0370c78653e38c94cb50e7f3ab786425de66ba7ad24222c1164a3  nokogiri-1.18.9-x64-mingw-ucrt.gem
e0d2deb03d3d7af8016e8c9df5ff4a7d692159cefb135cbb6a4109f265652348  nokogiri-1.18.9-x86_64-darwin.gem
b52f5defedc53d14f71eeaaf990da66b077e1918a2e13088b6a96d0230f44360  nokogiri-1.18.9-x86_64-linux-gnu.gem
e69359d6240c17e64cc9f43970d54f13bfc7b8cc516b819228f687e953425e69  nokogiri-1.18.9-x86_64-linux-musl.gem

v1.18.8 / 2025-04-21

Security

• [CRuby] Vendored libxml2 is updated to v2.13.8 to address CVE-2025-32414 and CVE-2025-32415. See GHSA-5w6v-399v-w3cc for more information.

36badd2eb281fca6214a5188e24a34399b15d89730639a068d12931e2adc210e  nokogiri-1.18.8-aarch64-linux-gnu.gem
664e0f9a77a7122a66d6c03abba7641ca610769a4728db55ee1706a0838b78a2  nokogiri-1.18.8-aarch64-linux-musl.gem
483b5b9fb33653f6f05cbe00d09ea315f268f0e707cfc809aa39b62993008212  nokogiri-1.18.8-arm64-darwin.gem
17de01ca3adf9f8e187883ed73c672344d3dbb3c260f88ffa1008e8dc255a28e  nokogiri-1.18.8-arm-linux-gnu.gem
6e6d7e71fc39572bd613a82d528cf54392c3de1ba5ce974f05c832b8187a040b  nokogiri-1.18.8-arm-linux-musl.gem
8c7464875d9ca7f71080c24c0db7bcaa3940e8be3c6fc4bcebccf8b9a0016365  nokogiri-1.18.8.gem
41002596960ff854198a20aaeb34cff0d445406d5ad85ba7ca9c3fd0c8f03de0  nokogiri-1.18.8-java.gem
11ab0f76772c5f2d718fb253fca5b74c6ef7628b72bbf8deba6ab1ffc93344cf  nokogiri-1.18.8-x64-mingw-ucrt.gem
024cdfe7d9ae3466bba6c06f348fb2a8395d9426b66a3c82f1961b907945cc0c  nokogiri-1.18.8-x86_64-darwin.gem
4a747875db873d18a2985ee2c320a6070c4a414ad629da625fbc58d1a20e5ecc  nokogiri-1.18.8-x86_64-linux-gnu.gem
ddd735fba49475a395b9ea793bb6474e3a3125b89960339604d08a5397de1165  nokogiri-1.18.8-x86_64-linux-musl.gem

v1.18.7 / 2025-03-31

Dependencies

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.18.9 / 2025-07-20

Security

• [CRuby] Applied upstream libxml2 patches to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796. See GHSA-353f-x4gh-cqq8 for more information.

v1.18.8 / 2025-04-21

Security

• [CRuby] Vendored libxml2 is updated to v2.13.8 to address CVE-2025-32414 and CVE-2025-32415. See GHSA-5w6v-399v-w3cc for more information.

v1.18.7 / 2025-03-31

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.13.7, which is a bugfix release.

v1.18.6 / 2025-03-24

Fixed

• [JRuby] In HTML documents, Node#attribute now returns the correct attribute. This has been broken, and returning nil, since v1.17.0. (#3487) @​flavorjones

v1.18.5 / 2025-03-19

Fixed

• [JRuby] Update JRuby's XML serialization so it outputs namespaces exactly like CRuby. (#3455, #3456) @​johnnyshields

v1.18.4 / 2025-03-14

Security

• [CRuby] Vendored libxslt is updated to v1.1.43 to address CVE-2025-24855 and CVE-2024-55549. See GHSA-mrxw-mxhj-p664 for more information.

v1.18.3 / 2025-02-18

Security

• [CRuby] Vendored libxml2 is updated v2.13.6 to address CVE-2025-24928 and CVE-2024-56171. See GHSA-vvfq-8hwr-qm4m for more information.

v1.18.2 / 2024-01-19

... (truncated)

Commits

• 1dcd8ce version bump to v1.18.9
• a05d2b4 Apply upstream patches to address multiple vulnerabilities (#3526)
• 947a55e Apply upstream patches to address multiple vulnerabilities
• 9187f4a version bump to v1.18.8
• 1deea04 dep: libxml2 to v2.13.8 (branch v1.18.x) (#3509)
• 6457fe6 dep: libxml2 to v2.13.8
• 13e8aa4 version bump to v1.18.7
• 605699d dep: bump libxml2 to 2.13.7 (v1.18.x backport) (#3495)
• 804e590 dep: bump libxml2 to 2.13.7
• 52bf15b dep(dev): drop Rubocop from JRuby deps
• Additional commits viewable in compare view

Updates rexml from 3.3.8 to 3.4.2

Release notes

Sourced from rexml's releases.

REXML 3.4.2 - 2025-08-26

Improvement

• Improved performance.

  • GH-244
  • GH-245
  • GH-246
  • GH-249
  • GH-256
  • Patch by NAITOH Jun

• Raise appropriate exception when failing to match start tag in DOCTYPE

  • GH-247
  • Patch by NAITOH Jun

• Deprecate accepting array as an element in XPath.match, first and each

  • GH-252
  • Patch by tomoya ishida

• Don't call needless encoding_updated

  • GH-259
  • Patch by Sutou Kouhei

• Reuse XPath::match

  • GH-263
  • Patch by pboling

• Cache redundant calls for doctype

  • GH-264
  • Patch by pboling

• Use Safe Navigation (&.) from Ruby 2.3

  • GH-265
  • Patch by pboling

• Remove redundant return statements

  • GH-266
  • Patch by pboling

• Added XML declaration check & Source#skip_spaces method

  • GH-282
  • Patch by NAITOH Jun
  • Reported by Sofi Aberegg

Fixes

• Fix docs typo
  • GH-248
  • Patch by James Coleman

... (truncated)

Changelog

Sourced from rexml's changelog.

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

• Improved performance.

  • GH-244
  • GH-245
  • GH-246
  • GH-249
  • GH-256
  • Patch by NAITOH Jun

• Raise appropriate exception when failing to match start tag in DOCTYPE

  • GH-247
  • Patch by NAITOH Jun

• Deprecate accepting array as an element in XPath.match, first and each

  • GH-252
  • Patch by tomoya ishida

• Don't call needless encoding_updated

  • GH-259
  • Patch by Sutou Kouhei

• Reuse XPath::match

  • GH-263
  • Patch by pboling

• Cache redundant calls for doctype

  • GH-264
  • Patch by pboling

• Use Safe Navigation (&.) from Ruby 2.3

  • GH-265
  • Patch by pboling

• Remove redundant return statements

  • GH-266
  • Patch by pboling

• Added XML declaration check & Source#skip_spaces method

  • GH-282
  • Patch by NAITOH Jun
  • Reported by Sofi Aberegg

Fixes

• Fix docs typo
  • GH-248
  • Patch by James Coleman

... (truncated)

Commits

• f36916f Add 3.4.2 entry (#284)
• 5859bde Added XML declaration check & Source#skip_spaces method (#282)
• 1d876e3 Bump actions/checkout from 4 to 5 (#283)
• c87bda8 Remove ostruct from dev deps (#281)
• c60ae02 Remove bundler from dev deps (#277)
• 9b084d7 Fix & Deprecate REXML::Text#text_indent (#275)
• 04a589a Fix a bug that XPath can't be used for no document element (#268)
• 66232ea Remove redundant return statements (#266)
• 63f3e97 Use Safe Navigation (&.) from Ruby 2.3 (#265)
• d427fc5 Avoid redundant calls for doctype (#264)
• Additional commits viewable in compare view

Updates rack from 3.1.7 to 3.1.18

Changelog

Sourced from rack's changelog.

[3.1.18] - 2025-10-10

Security

• CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
• CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.1.17] - 2025-10-07

Security

• CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
• CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
• CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

[3.1.16] - 2025-06-04

Security

• CVE-2025-49007 Fix ReDoS in multipart request.

[3.1.15] - 2025-05-18

• Optional support for CGI::Cookie if not available. (#2327, #2333, [@​earlopain])

[3.1.14] - 2025-05-06

⚠️ This release includes a security fix that may cause certain routes in previously working applications to fail if query parameters exceed 4,096 in count or 4 MB in total size. See rack/rack#2356 for more details.

Security

• CVE-2025-46727 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion.

[3.1.13] - 2025-04-13

• Ensure Rack::ETag correctly updates response body. (#2324, [@​ioquatix])

[3.1.12] - 2025-03-11

Security

• CVE-2025-27610 Local file inclusion in Rack::Static.

[3.1.11] - 2025-03-04

Security

• CVE-2025-27111 Possible Log Injection in Rack::Sendfile.

[3.1.10] - 2025-02-12

... (truncated)

Commits

• 96cf078 Bump patch version.
• cbd541e Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
• 7e69f65 Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
• db6bc0f Normalize adivsories links.
• ad81f80 Fix handling of Errno::EPIPE in multipart tests.
• 8d141b3 Bump patch version.
• f224f93 Limit amount of retained data when parsing multipart requests
• e08f78c Fix denial of service vulnerbilties in multipart parsing
• 02ffd94 Add changelog for v3.1.16
• df2f3f2 Bump patch version.
• Additional commits viewable in compare view

Updates actiontext from 7.2.1 to 7.2.2.1

Release notes

Sourced from actiontext's releases.

7.2.2.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

  [CVE-2024-54133]

  Gannon McGibbon

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

... (truncated)

Commits

• 33beb0a Preparing for 7.2.2.1 release
• d4b2a61 Update vendored trix version to 2.1.10
• d0dcb8f Preparing for 7.2.2 release
• 2975a88 Merge remote-tracking branch 'origin/7-2-sec' into 7-2-stable
• 7750d64 Preparing for 7.2.1.2 release
• 05dabd7 Add author to the CHANGELOG entries
• 5f5349f Merge remote-tracking branch 'origin/7-2-sec' into 7-2-stable
• a1f6a13 Preparing for 7.2.1.1 release
• de33c73 Update CHANGELOGs
• ba286c0 Avoid backtracing in plain_text_for_blockquote_node
• Additional commits viewable in compare view

Updates aws-sdk-s3 from 1.166.0 to 1.208.0

Changelog

Sourced from aws-sdk-s3's changelog.

1.208.0 (2025-12-16)

• Feature - Updates to the S3 Encryption Client. The V3 S3 Encryption Client now requires key committing algorithm suites by default.

1.207.0 (2025-12-15)

• Feature - This release adds support for the new optional field 'LifecycleExpirationDate' in S3 Inventory configurations.

1.206.0 (2025-12-02)

• Feature - New S3 Storage Class FSX_ONTAP

1.205.0 (2025-11-20)

• Feature - Enable / Disable ABAC on a general purpose bucket.

1.204.0 (2025-11-19)

• Feature - Adds support for blocking SSE-C writes to general purpose buckets.

1.203.1 (2025-11-10)

• Issue - Deprecated :checksum_mode parameter in FileDownloader#download. When set to "DISABLED", a deprecation warning is issued and the parameter is ignored. Use :response_checksum_validation on the S3 client instead to control checksum validation behavior.

1.203.0 (2025-11-05)

• Feature - Launch IPv6 dual-stack support for S3 Express

1.202.0 (2025-10-28)

• Feature - Amazon Simple Storage Service / Features: Add conditional writes in CopyObject on destination key to prevent unintended object modifications.

1.201.0 (2025-10-21)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

• Issue - Fix multipart upload to respect request_checksum_calculation when_required mode.

1.200.0 (2025-10-15)

... (truncated)

Commits

• See full diff in compare view

Updates net-imap from 0.4.16 to 0.4.20

Release notes

Sourced from net-imap's releases.

v0.4.20

What's Changed

🔒 Security

This release backports two features to prevent unbounded memory use: the response_handlers keyword argument to Net::IMAP.new so response handlers can be added before the server can send any responses (ruby/net-imap#427), and the max_response_size config attribute (ruby/net-imap#445, GHSA-j3g3-5qv5-52mj, CVE-2025-43857, reported by @​Masamuneee).

[!NOTE] The default max_response_size is nil (unlimited), to avoid backward compatibility issues with secure connections to trusted servers that are well-behaved. It can be configured more conservatively to guard against untrusted servers (for example, connecting to user-provided hostnames). It is the responsibility of net-imap users to configure their client appropriately for the server they are connecting to.

Known Issues

Fixed in v0.4.22: Ruby 3.0.0 through 3.0.2 on Mac OS crash when net/imap is required (ruby/net-imap#471).

[!IMPORTANT] This is fixed by Ruby 3.0.3, which was released 2021-11-24. Ruby 3.0.7 was released on 2024-04-23. Ruby 3.0 has reached its EOL.

If you are affected by ruby/net-imap#471, upgrading Ruby is much more important than upgrading net-imap!

Added

• ✨ Add response_handlers kwarg to Net::IMAP.new by @​nevans in ruby/net-imap#427
  • Backports #419
• ✨ Limit max_response_size by @​nevans in ruby/net-imap#445
  • Backports #444

Documentation

• 📚 Backport documentation to v0.4 by @​nevans in ruby/net-imap#426
  • Backports #418, #420, documentation only from #416, and #424

Other Changes

• ♻️ Update versioned default configs by @​nevans in ruby/net-imap#413
  • Backports #412
• ♻️ Refactor get_response by @​nevans in ruby/net-imap#431
  • Backports #422
• ♻️ Rational config versions by @​nevans in ruby/net-imap#430
  • Backports #429
• ♻️ Extract ResponseReader from get_response by @​nevans in ruby/net-imap#434
  • Backports #433
• ♻️ Refactoring by @​nevans in ruby/net-imap#436
  • Backports #417 and #435

Miscellaneous

• ✅ Various test improvements to v0.4 by @​nevans in ruby/net-imap#425
  • Backports #414, #415, #421, and assert_pattern from minitest (originally in #333)

Full Changelog: ruby/net-imap@v0.4.19...v0.4.20

v0.4.19

What's Changed

... (truncated)

Commits

• 5b8f9ae 🔖 Bump version to 0.4.20
• 8222a36 🔀 Merge pull request #445 from ruby/backport/v0.4-max_response_size
• 641c4c4 ✅ Fix backport compatibility with ruby 2.7
• 19bea63 ✨ Make max_response_size configurable
• ddcaabd ✨ Limit max response size to 512MiB (hard-coded)
• 2ca4dbc 🔀 Merge pull request #436 from ruby/backport/v0.4-refactor-config-and-respons...
• 9279f8a ✅ Fix backport compatibility with ruby 2.7
• 0e27fc1 ♻️ Save ResponseReader ivars: @​buff & @​literal_size
• 17064cd ✅ Fix backport compatibility with ruby 2.7
• e4bb734 ✨ Fix Config::AttrTypeCoercion for Ractor sharing
• Additional commits viewable in compare view

Updates rack-session from 2.0.0 to 2.1.1

Release notes

Sourced from rack-session's releases.

v2.1.1

Full Changelog: rack/rack-session@v2.1.0...v2.1.1

v2.1.0

Full Changelog: rack/rack-session@v2.0.0...v2.1.0

Changelog

Sourced from rack-session's changelog.

v2.1.1

• Prevent Rack::Session::Pool from recreating deleted sessions CVE-2025-46336.

v2.1.0

• Improved compatibility with Ruby 3.3+ and Rack 3+.
• Add support for cookie option partitioned.
• Introduce assume_ssl option to allow secure session cookies through insecure proxy.

Commits

• 96663ec Bump patch version.
• c58ad79 Don't allow session to be recreated accidentally.
• 8a02143 Bump minor version.
• 67c1237 Add release notes.
• 77c56db Rack 3 compatibility.
• 1a10ce8 Test on Ruby v3.4.
• 06b63f5 Bump actions/checkout from 3 to 4 (#47)
• 9818179 Opt-in for MFA requirement (#45)
• 9ad38c0 Test and set Ruby v2.5 as minimum. (#46)
• 4af6114 Add cookie option "partitioned" to DEFAULT_OPTIONS and documentation of class...
• Additional commits viewable in compare view

Updates rails-html-sanitizer from 1.6.0 to 1.6.1

Release notes

Sourced from rails-html-sanitizer's releases.

1.6.1 / 2024-12-02

This is a performance and security release which addresses several possible XSS vulnerabilities.

• The dependency on Nokogiri is updated to v1.15.7 or >=1.16.8.

  This change addresses CVE-2024-53985 (GHSA-w8gc-x259-rc7x).

  Mike Dalessio

• Disallowed tags will be pruned when they appear in foreign content (i.e. SVG or MathML content), regardless of the prune: option value. Previously, disallowed tags were "stripped" unless the gem was configured with the prune: true option.

  The CVEs addressed by this change are:

  • CVE-2024-53986 (GHSA-638j-pmjw-jq48)
  • CVE-2024-53987 (GHSA-2x5m-9ch4-qgrr)

  Mike Dalessio

• The tags "noscript", "mglyph", and "malignmark" will not be allowed, even if explicitly added to the allowlist. If applications try to allow any of these tags, a warning is emitted and the tags are removed from the allow-list.

  The CVEs addressed by this change are:

  • CVE-2024-53988 (GHSA-cfjx-w229-hgx5)
  • CVE-2024-53989 (GHSA-rxv5-gxqc-xx8g)

  Please note that we may restore support for allowing "noscript" in a future release. We do not expect to ever allow "mglyph" or "malignmark", though, especially since browser support is minimal for these tags.

  Mike Dalessio

• Improve performance by eliminating needless operations on attributes that are being removed. #188

  Mike Dalessio

Changelog

Sourced from rails-html-sanitizer's changelog.

1.6.1 / 2024-12-02

This is a performance and security release which addresses several possible XSS vulnerabilities.

• The dependency on Nokogiri is updated to v1.15.7 or >=1.16.8.

  This change addresses CVE-2024-53985 (GHSA-w8gc-x259-rc7x).

  Mike Dalessio

• Disallowed tags will be pruned when they appear in foreign content (i.e. SVG or MathML content), regardless of the prune: option value. Previously, disallowed tags were "stripped" unless the gem was configured with the prune: true option.

  The CVEs addressed by this change are:

  • CVE-2024-53986 (GHSA-638j-pmjw-jq48)
  • CVE-2024-53987 (GHSA-2x5m-9ch4-qgrr)

  Mike Dalessio

• The tags "noscript", "mglyph", and "malignmark" will not be allowed, even if explicitly added to the allowlist. If applications try to allow any of these tags, a warning is emitted and the tags are removed from the allow-list.

  The CVEs addressed by this change are:

  • CVE-2024-53988 (GHSA-cfjx-w229-hgx5)
  • CVE-2024-53989 (GHSA-rxv5-gxqc-xx8g)

  Please note that we may restore support for allowing "noscript" in a future release. We do not expect to ever allow "mglyph" or "malignmark", though, especially since browser support is minimal for these tags.

  Mike Dalessio

• Improve performance by eliminating needless operations on attributes that are being removed. #188

  Mike Dalessio

Commits

• 5e96b19 version bump to v1.6.1
• 383cc7c doc: update CHANGELOG with assigned CVEs
• a7b0cfe Combine the noscript/mglyph prevention blocks
• 5658335 Merge branch 'h1-2509647-noscript' into flavorjones-2024-security-fixes
• 65fb72f Merge branch 'h1-2519936-mglyph-foster-parenting' into flavorjones-2024-secur...
• 3fe22a8 Merge branch 'h1-2519936-foreign-ns-confusion' into flavorjones-2024-security...
• d7a94c1 Merge branch 'h1-2503220-nokogiri-serialization' into flavorjones-2024-securi...
• 3fd6e65 doc: update CHANGELOG
• 1625173 fix: disallow 'noscript' from safe lists
• a0a3e8b fix: disallow 'mglyph' and 'malignmark' from safe lists
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.