Bump the bundler-security group across 1 directory with 9 updates#3032
Open
dependabot[bot] wants to merge 1 commit into
Open
Bump the bundler-security group across 1 directory with 9 updates#3032dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the bundler-security group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [puma](https://github.com/puma/puma) | `7.2.0` | `7.2.1` | | [yard](https://yardoc.org) | `0.9.38` | `0.9.42` | | [addressable](https://github.com/sporkmonger/addressable) | `2.8.9` | `2.9.0` | | [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) | `1.3.6` | `1.3.7` | | [erb](https://github.com/ruby/erb) | `6.0.2` | `6.0.4` | | [net-imap](https://github.com/ruby/net-imap) | `0.5.7` | `0.5.15` | | [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.19.2` | `1.19.4` | | [rack](https://github.com/rack/rack) | `3.2.5` | `3.2.6` | | [rack-session](https://github.com/rack/rack-session) | `2.1.1` | `2.1.2` | Updates `puma` from 7.2.0 to 7.2.1 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/main/History.md) - [Commits](puma/puma@v7.2.0...v7.2.1) Updates `yard` from 0.9.38 to 0.9.42 Updates `addressable` from 2.8.9 to 2.9.0 - [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md) - [Commits](sporkmonger/addressable@addressable-2.8.9...addressable-2.9.0) Updates `concurrent-ruby` from 1.3.6 to 1.3.7 - [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases) - [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md) - [Commits](ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7) Updates `erb` from 6.0.2 to 6.0.4 - [Release notes](https://github.com/ruby/erb/releases) - [Changelog](https://github.com/ruby/erb/blob/master/NEWS.md) - [Commits](ruby/erb@v6.0.2...v6.0.4) Updates `net-imap` from 0.5.7 to 0.5.15 - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](ruby/net-imap@v0.5.7...v0.5.15) Updates `nokogiri` from 1.19.2 to 1.19.4 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.19.2...v1.19.4) Updates `rack` from 3.2.5 to 3.2.6 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v3.2.5...v3.2.6) Updates `rack-session` from 2.1.1 to 2.1.2 - [Release notes](https://github.com/rack/rack-session/releases) - [Changelog](https://github.com/rack/rack-session/blob/main/releases.md) - [Commits](rack/rack-session@v2.1.1...v2.1.2) --- updated-dependencies: - dependency-name: puma dependency-version: 7.2.1 dependency-type: direct:production dependency-group: bundler-security - dependency-name: yard dependency-version: 0.9.42 dependency-type: direct:development dependency-group: bundler-security - dependency-name: addressable dependency-version: 2.9.0 dependency-type: indirect dependency-group: bundler-security - dependency-name: concurrent-ruby dependency-version: 1.3.7 dependency-type: indirect dependency-group: bundler-security - dependency-name: erb dependency-version: 6.0.4 dependency-type: indirect dependency-group: bundler-security - dependency-name: net-imap dependency-version: 0.5.15 dependency-type: indirect dependency-group: bundler-security - dependency-name: nokogiri dependency-version: 1.19.4 dependency-type: indirect dependency-group: bundler-security - dependency-name: rack dependency-version: 3.2.6 dependency-type: indirect dependency-group: bundler-security - dependency-name: rack-session dependency-version: 2.1.2 dependency-type: indirect dependency-group: bundler-security ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the bundler-security group with 9 updates in the / directory:
7.2.07.2.10.9.380.9.422.8.92.9.01.3.61.3.76.0.26.0.40.5.70.5.151.19.21.19.43.2.53.2.62.1.12.1.2Updates
pumafrom 7.2.0 to 7.2.1Release notes
Sourced from puma's releases.
Changelog
Sourced from puma's changelog.
Commits
92754acRelease v7.2.1 (#3948)ebe9db37.2.1 backport (#3947)Updates
yardfrom 0.9.38 to 0.9.42Updates
addressablefrom 2.8.9 to 2.9.0Changelog
Sourced from addressable's changelog.
Commits
0c3e858Revving version and changelog91915c1Fixing additional vulnerable pathsa091e39Add many more adversarial test cases to ensure we don't have any ReDoS regres...463a819Regenerate gemspec on newer rubygems0afcb0bImprove from O(n^2) to O(n)c87f768Fix a ReDoS vulnerability in URI template matchingUpdates
concurrent-rubyfrom 1.3.6 to 1.3.7Release notes
Sourced from concurrent-ruby's releases.
Changelog
Sourced from concurrent-ruby's changelog.
Commits
4c8fc28Release 1.3.7d91ca94Fix AtomicReference#update livelock when stored value is Float::NAN on JRuby ...7e4d711FixReentrantReadWriteLockread hold overflow into write-lock bit6e37e06FixAtomicReference#updatelivelock when stored value isFloat::NAN2825cfaCleanup spec3fd4932FixReadWriteLockwrong-thread write release and stray read release1974b47Add Ruby 4.0 in CIdf8706dAdd SECURITY.md (#1104)7a1b789Bump actions/upload-pages-artifact from 4 to 59b2dbf7Bump actions/deploy-pages from 4 to 5Updates
erbfrom 6.0.2 to 6.0.4Release notes
Sourced from erb's releases.
Changelog
Sourced from erb's changelog.
Commits
4d2b45eVersion 6.0.49d017beProhibit def_method on marshal-loaded ERB instances9c8fa8aVersion 6.0.30ebc6aeBump rubygems/release-gem from 1.1.2 to 1.2.025a729aBump step-security/harden-runner from 2.15.0 to 2.16.19820802Bump actions/create-github-app-token from 2 to 32611366Bump lewagon/wait-on-check-action from 1.5.0 to 1.6.0890d87fUse github.token instead of missing MATZBOT_DEPENDABOT_MERGE_TOKEN secretafc32b6Fix dependabot auto-merge by using GH_TOKEN env var2fd0a6bfix: exclude some files from published gem (#108)Updates
net-imapfrom 0.5.7 to 0.5.15Release notes
Sourced from net-imap's releases.
... (truncated)
Commits
ce20fc8🔖 Bump version to 0.5.150b7b83c🔀 Merge pull request #703 from ruby/backport/v0.5/security-patchesf22fd6c🍒 pick 0ea9eba3 (#701): ✅ Fix flaky tests for MacOS, TruffleRuby1246074🍒 pick ae9f83b5 (#701): ♻️ Extract str.bytesize lvar in send_literala2f61af🍒 pick 62a0da6d (#701): 🥅 Validate non-synchronizing literals supporte33348c🍒 pick d6ddd294 (#700): 🐛 Prevent trailing{0}in RawData validation4f81b69🍒 pick 1f97168b (#699): 🥅 Validate#enablearguments are all atoms69da4a4🍒 pick 8d9397ab (#698): 🥅 Validate QuotedString contains only valid bytes7aab580🍒 pick e3c50fad (#698): ♻️ Refactor RawText, add improve test coveragefac1733🍒 pick aab64f92 (#686): 🧵 Fix deadlock in#disconnectUpdates
nokogirifrom 1.19.2 to 1.19.4Release notes
Sourced from nokogiri's releases.
... (truncated)
Changelog
Sourced from nokogiri's changelog.
Commits
8cfb9daversion bump to v1.19.4a856d1efix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)6a0aa1efix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...f658a54fix: JRuby NONET bypass in XML::Schema39d26fefix(CRuby): use-after-free in Document#encoding= when setter raises04a09ddfix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...7799fbdfix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)ef19e13fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)5524fa9fix:Document#root=rejects non-element nodes (v1.19.x) (#3643)9891ad1fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)Updates
rackfrom 3.2.5 to 3.2.6Release notes
Sourced from rack's releases.
Changelog
Sourced from rack's changelog.
Commits
e1f22fdBump patch version.31989fdFix typo in test.d268165Fix test expectation.8f425deAdd Ruby v4.0 to the test matrix.bf83042Drop EOL Rubies from external tests.d50c4d3Implement OBS unfolding for multipart requests per RFC 5322 2.2.3bfb6914Limit the number of quoted escapes during multipart parsingb3e5945Add Content-Length size check in Rack::Multipart::Parser7a8f326Fix root prefix bug in Rack::Statica57bc14Only do a simple substitution on the x-accel-mapping pathsUpdates
rack-sessionfrom 2.1.1 to 2.1.2Release notes
Sourced from rack-session's releases.
Changelog
Sourced from rack-session's changelog.
Commits
504367bBump patch version.f43638cDon't fall back to unencrypted coder if encryptors are present.dadcfe6Bump actions/checkout from 4 to 5 (#54)4eb9ea8Add top level session spec to validate existing formats.8f94577Add rails to external tests.38ea47dAllow the v2 encryptor to serialize messages withMarshal(#44)43f2e3aFix compatibility with older Rubies.6a060b8Support UTF-8 data when using the JSON serializer (#39)8ce0146Fixauth_tagretrieval on JRuby (#32)7727185Add AEAD encryption (#23)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.