chore(deps): update all non-major bundler dependencies#1226
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update all non-major bundler dependencies#1226renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## staging #1226 +/- ##
========================================
Coverage 77.59% 77.59%
========================================
Files 54 54
Lines 1406 1406
========================================
Hits 1091 1091
Misses 315 315 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
6 times, most recently
from
798ae9a to
87d76d0
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
9 times, most recently
from
354ff24 to
5635ee4
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
4782a50 to
5ce8e84
Compare
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
a2ffd1b to
17a6987
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
220dace to
b2a9253
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
5 times, most recently
from
e247aa9 to
ca69050
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
6 times, most recently
from
1f83c9b to
7771100
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
cb74aca to
af714f9
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
2eae179 to
dd0716e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
b479dfd to
af052e7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
5 times, most recently
from
cfcdbca to
02d1898
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
2 times, most recently
from
b13fec2 to
b09f88b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
'~> 1.21.1'→'~> 1.24.6''~> 8.0.1'→'~> 8.0.5''~> 8.1'→'~> 8.1', '>= 8.1.3''~> 2.1.1'→'~> 2.1.3''~>1.15.0'→'~>1.16.0''~> 3.6.0'→'~> 3.8.0''~> 1.2.6'→'~> 1.2.10''~> 2.14.1'→'~> 2.15.1''~> 4.18.0'→'~> 4.19.0''~> 3.1', '>= 3.1.5'→'~> 3.2', '>= 3.2.1''~> 7.2.3'→'~> 7.2.3', '>= 7.2.3.1''~> 8.0.2'→'~> 8.0.4''~> 1.84.0'→'~> 1.88.2''~> 2.34', '>= 2.34.3'→'~> 2.36''~> 3.9'→'~> 3.10', '>= 3.10.2''~> 6.3'→'~> 6.6', '>= 6.6.2''~> 6.3'→'~> 6.6', '>= 6.6.2''~> 6.3'→'~> 6.6', '>= 6.6.2''~> 8.0.10'→'~> 8.1.6''~> 6.0.1'→'~> 6.0.2''~> 4.4.0'→'~> 4.7.0''~> 0.9.10'→'~> 0.9.11''~> 4.2.1'→'~> 4.3.0'Release Notes
presidentbeef/brakeman (brakeman)
v8.0.5Compare Source
quote_schema_nameto safe quote method list (Zsolt Kozaroczy)compact_blank/compacton permitted params (Arpit Jain)text(Arpit Jain).rawcalls (Federico Franco)TemplateAliasProcessor#template_namearity (viralpraxis)v8.0.4Compare Source
--ensure-latestv8.0.3Compare Source
polymorphic_nameSQLi false positive (Fredrico Franco)--ensure-latestv8.0.2Compare Source
flyerhzm/bullet (bullet)
v8.1.3Compare Source
v8.1.2Compare Source
belongs_towhose*_typecolumn is nil. ActiveRecord short-circuits the reader to nil without issuing SQL, so the access cannot represent an N+1 query and preloading would be a no-op.Set#<<corruption inUnusedEagerLoading#add_eager_loadingssplit branchv8.1.1Compare Source
djezzzl/database_consistency (database_consistency)
v2.1.3Compare Source
MissingDependentDestroyCheckerto support composite keys. Thanks Andy Allan for reporting this!v2.1.2Compare Source
ForeignKeyTypeCheckerto support composite keys. Thanks Quentin de Metz for reporting this!MissingUniqueIndexCheckerto support composite keys. Thanks Andy Allan for reporting this!devise-i18n/devise-i18n (devise-i18n)
v1.16.0Compare Source
d13ef8941003bf. Translations of this string are unaffected.faker-ruby/faker (faker)
v3.8.0Compare Source
Enabling lazy load
This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.
Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:
1 - Set lazy load as a Faker Config
Faker::Config.lazy_loading = true2 - Set lazy load as an environment variable
FAKER_LAZY_LOAD = 1We hope you get to see the improvement by enabling it. Please file a bug report for any issues!
Thanks to @jeremyevans for the mentoring, and to @thdaraujo for pairing and code reviews.
Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0
v3.7.1Compare Source
Enabling lazy load
This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.
Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:
1 - Set lazy load as a Faker Config
Faker::Config.lazy_loading = true2 - Set lazy load as an environment variable
FAKER_LAZY_LOAD = 1We hope you get to see the improvement by enabling it. Please file a bug report for any issues!
Thanks to @jeremyevans for the mentoring, and to @thdaraujo for pairing and code reviews.
Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0
v3.6.1Compare Source
It's almost Spring time in the Northern hemisphere 🌸
Security, performance improvements and bug fixes
ja/address.ymlwith a 7-digit format by @thdaraujo in #3201Update development dependencies
New Contributors
Full Changelog: faker-ruby/faker@v3.6.0...v3.6.1
Studiosity/grover (grover)
v1.2.10Compare Source
Fixed
v1.2.9Compare Source
Added
v1.2.8Compare Source
Added
v1.2.7Compare Source
Added
rails/jbuilder (jbuilder)
v2.15.1Compare Source
What's Changed
New Contributors
Full Changelog: rails/jbuilder@v2.15.0...v2.15.1
v2.15.0Compare Source
What's Changed
KeyFormatteron cache hits by @moberegger in #607array!andset!by @moberegger in #604:unprocessable_contentfor scaffolds with Rack 3.1 or higher by @taketo1113 in #603_map_collectionby @moberegger in #612New Contributors
Full Changelog: rails/jbuilder@v2.14.1...v2.15.0
mollie/mollie-api-ruby (mollie-api-ruby)
v4.19.0Compare Source
c61808e) Allow bigdecimal 4.xomniauth/omniauth-identity (omniauth-identity)
v3.2.1Compare Source
Added
Changed
binstubs, and development dependency floors with
kettle-jemv7.0.0.anonymous_loaderruntime dependency floor to>= 0.1.3.auth-sanitizerto>= 0.2.3, soOmniAuth Identity consumers get hash and nested-attribute inspect redaction
fixes plus downstream RBS duplicate-declaration fixes, and switched isolated
sanitizer loading to the released
anonymous_loadergem.version_gemandappraisal2dependency floors toversion_gem>= 1.1.14 andappraisal2>= 3.1.4.Fixed
Restored ORM-specific spec rake tasks and made optional ORM spec files avoid
loading unavailable adapter gems when the matching appraisal does not include them.
Package configured license files in gem release file lists.
v3.2.0Compare Source
Added
OmniAuth::Identity::VERSIONas the traditional public versionconstant, in addition to
OmniAuth::Identity::Version::VERSION.Changed
and development dependency floors from the current kettle-jem template.
so concurrent callers do not race while reading or updating authentication
keys, ROM adapter settings, or BCrypt minimum-cost mode.
Fixed
kettle-testruns skip CouchDB, MongoDB, and RethinkDB adapterspecs by default unless the matching service adapter environment variable is enabled.
Security
auth-sanitizerintegration so identity model#inspectoutputfilters password-related attributes by default.
rails/rails (rails)
v7.2.3.1: 7.2.3.1Compare Source
Active Support
Reject scientific notation in NumberConverter
[CVE-2026-33176]
Jean Boussier
Fix
SafeBuffer#%to preserve unsafe status[CVE-2026-33170]
Jean Boussier
Improve performance of NumberToDelimitedConverter
[CVE-2026-33169]
Jean Boussier
Active Model
Active Record
Action View
Skip blank attribute names in tag helpers to avoid generating invalid HTML.
[CVE-2026-33168]
Mike Dalessio
Action Pack
Active Job
Action Mailer
Action Cable
Active Storage
Filter user supplied metadata in DirectUploadController
[CVE-2026-33173]
Jean Boussier
Configurable maxmimum streaming chunk size
Makes sure that byte ranges for blobs don't exceed 100mb by default.
Content ranges that are too big can result in denial of service.
[CVE-2026-33174]
Gannon McGibbon
Limit range requests to a single range
[CVE-2026-33658]
Jean Boussier
Prevent path traversal in
DiskService.DiskService#path_fornow raises anInvalidKeyErrorwhen passed keys with dot segments (".",".."), or if the resolved path is outside the storage root directory.
#path_foralso now consistently raisesInvalidKeyErrorif the key is invalid in any way, forexample containing null bytes or having an incompatible encoding. Previously, the exception
raised may have been
ArgumentErrororEncoding::CompatibilityError.DiskControllernow explicitly rescuesInvalidKeyErrorwith appropriate HTTP status codes.[CVE-2026-33195]
Mike Dalessio
Prevent glob injection in
DiskService#delete_prefixed.Escape glob metacharacters in the resolved path before passing to
Dir.glob.Note that this change breaks any existing code that is relying on
delete_prefixedto expandglob metacharacters. This change presumes that is unintended behavior (as other storage services
do not respect these metacharacters).
[CVE-2026-33202]
Mike Dalessio
Action Mailbox
Action Text
Railties
Guides
rspec/rspec-rails (rspec-rails)
v8.0.4Compare Source
Full Changelog
Released to relax version constraint for rspec to allow 4.0.0.beta1.
v8.0.3Compare Source
Full Changelog
Bug Fixes:
lookup_context. (Stephen Nelson, #2749)rails statslooks for specs using application root rather than working directory.(Marvin Tangpos, #2879)
rubocop/rubocop (rubocop)
v1.88.2Compare Source
Bug fixes
Lint/ToJSON, which did not flag singletondef self.to_jsondefinitions. ([@bbatsov][])Lint/UnreachableCode, which only flagged the first statement after a flow-of-control statement instead of every unreachable statement that followed it. ([@bbatsov][])Lint/UselessNumericOperation, which only flagged bare method-call receivers and ignored local variables, instance/class/global variables, and constants (e.g.@x + 0,CONST * 1). ([@bbatsov][])Lint/Voidwhere safe-navigation calls to nonmutating methods (e.g.x&.sort) were not flagged whenCheckForMethodsWithNoSideEffectsis enabled. ([@bbatsov][])Style/ArrayIntersectwith the block form usinginclude?(e.g.array1.any? { |e| array2.include?(e) }), which was only detected formember?. ([@bbatsov][])Style/CollectionCompact, which did not flaggrep_v(nil)/grep_v(NilClass)on a safe-navigation call (e.g.array&.grep_v(nil)). ([@bbatsov][])Style/DefWithParentheseswith a single-line definition whose body follows a semicolon (e.g.def foo(); end), where the parentheses can be safely omitted. ([@bbatsov][])Style/MixinUsagewhen including multiple modules in one statement. ([@bbatsov][])Style/ModuleFunctionwhen the module body is a single statement. ([@bbatsov][])Style/RedundantCurrentDirectoryInPathwith double-quoted strings containing interpolation. ([@bbatsov][])Style/RedundantHeredocDelimiterQuoteswith double-quoted delimiters whose body contains interpolation or escapes. ([@bbatsov][])Gemspec/DuplicatedAssignmentwith multiple specifications. ([@bbatsov][])Layout/CommentIndentationwith a comment above an inline access modifier (e.g.private def foo) whenLayout/AccessModifierIndentationis configured withEnforcedStyle: outdent. ([@grk][])Style/InvertibleUnlessConditionwith a multi-statement begin condition. ([@bbatsov][])Style/ArgumentsForwardingandStyle/MethodDefParentheseswhen autocorrection conflicts while adding parentheses to method definition arguments. ([@koic][])Lint/ToJSONthat produced invalid Ruby (def to_json(*_args)()) when the method had explicit empty parentheses. ([@bbatsov][])Style/MethodCallWithoutArgsParentheseswhen empty parentheses span multiple lines and the method call has a block. ([@koic][])Style/HashConversionwith a splat argument, which previously produced an invalid hash literal. ([@bbatsov][])Style/HashLookupMethodwith safe navigation, where the suggested bracket form would be the unreadablehash&.[](key). ([@bbatsov][])Style/IdenticalConditionalBranchesthat hoisted the moved expression to column zero instead of matching the surrounding indentation. ([@bbatsov][])Style/InvertibleUnlessConditionwith mixed&&/||conditions, which lost the required parentheses when inverting. ([@bbatsov][])Style/TrivialAccessorswhenAllowPredicates: falseis set and a trivial reader is defined as a predicate class method. ([@koic][])Layout/LineLengthwithSplitStringswhen an over-long string is indented under a multi-line parent. ([@bbatsov][])Style/MissingRespondToMissingwhenmethod_missingis defined at the top level or alongside sibling classes. ([@bbatsov][])Layout/ElseAlignmentwhen usingelsewithin a block that is part of a larger expression. ([@koic][])Layout/MultilineMethodCallIndentationwhen a method chain is nested inside a parenthesized argument list or a grouped expression within a hash pair value. ([@koic][])Style/StructInheritanceautocorrect dropping leading indentation when class is inside a module or namespace. ([@amckinnie][])Style/DocumentationMethodignoringAllowedMethodsfor inline modifier defs. ([@bbatsov][])Style/LambdaCallwhen the argument list contains a comment, which the autocorrect would have dropped. ([@bbatsov][])Changes
on_new_investigation,on_investigation_end, andon_other_fileonly to cops that refine them, and by skippingafter_*dispatch when no cop needs it. ([@bbatsov][])Lint/Debuggerperformance on code without debugger calls. ([@bbatsov][])Lint/NumericOperationWithConstantResultautocorrect as unsafe because it drops the operands, discarding their side effects and silencing cases where the result is not actually constant (e.g.x / xraises whenxis0). ([@bbatsov][])AllowedPatterns,ForbiddenPatterns, andAllowedMethodsby compiling the configured patterns only once. ([@bbatsov][])Style/IfUnlessModifierand other modifier cops on files with many comments or conditionals. ([@bbatsov][])v1.88.1Compare Source
Bug fixes
Bundler/GemCommentwith a non-literal gem option key. ([@bbatsov][])Layout/ClassStructurewhen a class body is a single safe-navigation call (e.g.test&.private_methods(def foo; end)). ([@bbatsov][])Gemspec/DevelopmentDependencieswhenAllowedGemsis nil. ([@bbatsov][])Metrics/MethodLengthwith an anonymousdefine_method. ([@bbatsov][])Naming/InclusiveLanguagewith nil or emptyFlaggedTerms. ([@bbatsov][])Security/IoMethodswith a non-string-literal argument. ([@bbatsov][])Style/EmptyStringInsideInterpolationwith a modifier conditional. ([@bbatsov][])Style/OpenStructUsewith a bareOpenStructroot node. ([@bbatsov][])Style/TrailingUnderscoreVariablewhen a nested destructuring group consists only of underscore variables. ([@bbatsov][])Security/MarshalLoadwith a proc argument. ([@bbatsov][])Style/MethodDefParentheseswith named rest arguments underEnforcedStyle: require_no_parentheses. ([@bbatsov][])Style/MultilineMethodSignaturewhere a signature that fits on one line was skipped because the multi-line source length was measured instead of the collapsed width. ([@bbatsov][])Style/OptionalArgumentswith singleton methods. ([@bbatsov][])Style/RedundantFilterChainwith numbered-parameter blocks. ([@bbatsov][])Lint/ToEnumArgumentswhen a braced hash is passed to keyword parameters (e.g.to_enum(:m, { required: required })), which raisesArgumentErrorwhen the enumerator is used. ([@RedZapdos123][])Naming/FileNamewhen a class or module name contains multiple consecutiveAllowedAcronyms. ([@camallen][])Style/DirEmptywith a block. ([@bbatsov][])Style/EmptyLiteralwith numbered anditblock parameters. ([@bbatsov][])Style/EnvHome. ([@bbatsov][])Style/InlineCommentwithrubocop:tododirectives. ([@bbatsov][])Style/MultilineIfThen. ([@bbatsov][])Style/NumericPredicatewhen an allowed method encloses a numbered-parameter oritblock. ([@bbatsov][])Style/OptionHashwhen the options hash is forwarded with an explicitsuper. ([@bbatsov][])Style/RedundantFormatwith a lone format sequence. ([@bbatsov][])Style/RedundantSelfwith a rescue exception variable. ([@bbatsov][])Style/Semicolonwith a semicolon inside a string literal. ([@bbatsov][])Layout/ConditionPositionthat dropped a body statement sharing the condition's line via a semicolon. ([@bbatsov][])Layout/EmptyCommentthat deleted a heredoc when removing an empty comment trailing its opener. ([@bbatsov][])Layout/EmptyLineBetweenDefsthat inserted a blank line inside a heredoc body when an endless method's body was a heredoc. ([@bbatsov][])Layout/SpaceAroundOperatorsthat turned**=and/=compound assignments into**//, dropping the assignment. ([@bbatsov][])Naming/MemoizedInstanceVariableName. ([@bbatsov][])Naming/RescuedExceptionsVariableName. ([@bbatsov][])Style/DataInheritancewith a brace block. ([@bbatsov][])Style/EmptyCaseConditionas ayield/superargument. ([@bbatsov][])Style/EmptyCaseConditionwith low-precedencewhenvalues. ([@bbatsov][])Style/EmptyClassDefinitionwith a namespaced constant. ([@bbatsov][])Style/EmptyHeredoc. ([@bbatsov][])Style/EvenOdd. ([@bbatsov][])Style/ExactRegexpMatchwith a single quote. ([@bbatsov][])Style/FileNull. ([@bbatsov][])Style/For. ([@bbatsov][])Style/FormatStringwith a low-precedence argument. ([@bbatsov][])Style/FormatStringwith a splat argument. ([@bbatsov][])Style/HashSlice. ([@bbatsov][])Style/HashSyntaxwith a multi-pair bracelessreturn. ([@bbatsov][])Style/IfWithSemicolonthat changed semantics when the condition was an assignment, by parenthesizing it in the resulting ternary. ([@bbatsov][])Style/KeywordArgumentsMergingwith a block-pass argument. ([@bbatsov][])Style/KeywordParametersOrderthat inserted a spurious blank line when a keyword optional parameter already trailed the parameters list. ([@bbatsov][])Style/MapIntoArraywith a block-pass argument. ([@bbatsov][])Style/MethodCallWithoutArgsParentheseswithit()in a numbered block. ([@bbatsov][])Style/MinMaxComparisonwithunless. ([@bbatsov][])Style/MultilineMemoizationwithrescue/ensure. ([@bbatsov][])Style/MultilineMethodSignature. ([@bbatsov][])Style/NilLambdawhen a non-lambda proc returnsnilwithreturn. ([@bbatsov][])Style/ParallelAssignmentwith a%ielement needing quoting. ([@bbatsov][])Style/ParallelAssignmentwith a%welement needing escaping. ([@bbatsov][])Style/PercentLiteralDelimitersthat produced invalid Ruby for a%ssymbol whose content contains the preferred delimiter. ([@bbatsov][])Style/PerlBackrefsthat rewrote$+/$LAST_PAREN_MATCHto the non-equivalentRegexp.last_match(-1); these are no longer flagged. ([@bbatsov][])Style/RedundantExceptionthat changed the exception message when raisingRuntimeErrorwith anilmessage. ([@bbatsov][])Style/RedundantFormatwith anilargument. ([@bbatsov][])Style/RedundantLineContinuationthat corrupted an earlier line when removing a line continuation at the end of a multi-line file. ([@bbatsov][])Style/RedundantRegexpEscapethat stripped a necessary\@​/\$escape after#in%r{}/%r//literals, enabling unintended interpolation. ([@bbatsov][])Configuration
📅 Schedule: (in timezone Europe/Amsterdam)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.