chore(deps): update dependency rdoc to v6 [security] by sc-renovate[bot] · Pull Request #37 · soundcloud/cando

sc-renovate · 2026-06-01T08:30:29Z

This PR contains the following updates:

Package	Change	Age	Confidence
rdoc (source, changelog)	`"~> 4.1.1"` → `"~> 6.1.0"`

GitHub Vulnerability Alerts

CVE-2021-31799

In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.

Severity

CVSS Score: 7.0 / 10 (High)
Vector String: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Release Notes

ruby/rdoc (rdoc)

What's Changed

Correction to include regexp_handling in list of loaded files by @poloka in #682

New Contributors

@poloka made their first contribution in #682

Full Changelog: ruby/rdoc@v6.1.0...v6.1.1

`v6.1.0`

Compare Source

What's Changed

Retrieve embdoc body by @aycabta in #622
Use JRuby 9.1.17.0 and remove JRuby from allow_failures by @aycabta in #623
Add support for 'Raises' lines in TomDoc parser by @nbeyer in #611
Link to a class method when using dot by @aycabta in #629
Fix random NameError of RipperStateLex by @aycabta in #631
Allow #+, #-, #' to be cross referenced by @TheSmartnik in #632
add test to display_name by @masakazutakewaka in #634
Treat "if" with EXPR_MID as postfix "if" by @aycabta in #635
Use original method notation by @aycabta in #633
Behavior of "include" or "extend" as a method by @aycabta in #637
Coordinate test_parse_comment_method with other test methods by @aycabta in #638
Use Struct for each token by @aycabta in #639
Enable --line-numbers option by @aycabta in #630
Fix indent and typo from moveTimout to moveTimeout. by @junaruga in #643
Split RDoc::VERSION from rdoc.rb. by @hsbt in #644
Bump versions on Travis CI by @hsbt in #645
Fixup #634, fixes #647 by @hsbt in #648
Added Rubocop task after file generation. by @hsbt in #650
Removed deprecated file of inline.rb by @hsbt in #649
Support mutable/immutable heredoc by @aycabta in #642
Speeding up RDoc by 85% in CRuby documents generation by @aycabta in #640
Rename the name "special" with "regexp handling" by @aycabta in #652
Improve language in "alias for" comment for ri by @stomar in #659
Mark up code inside link text as by @nobu in #660


Ignore dynamically added methods by @nobu in #661
Move ruby-head to allow_failures in .travis.yml by @aycabta in #664
Use Ruby 2.3.8, 2.4.5, and 2.5.3 by @aycabta in #662
Use JRuby 9.2.3.0 by @aycabta in #666
Use JRuby 9.2.4.1 by @aycabta in #677
Set UTF-8 to use Unicode property by @aycabta in #672
add ruby 2.5 to appveyor by @colby-swandale in #663
Add AppVeyor badge to README.md by @aycabta in #678
Use VT100 sequence to erase previos line by @nobu in #670
Log full lines unless output is a tty by @nobu in #671
Fix wrong use of =~ by @nobu in #674
Reduce 1 char from progress output for Windows by @aycabta in #669
Place expression next line of else by @nobu in #675
Remove Time.now from test for comparison of timestamp by @aycabta in #679
Support blockquote by @nobu in #676
Fix random test failure by Bundler integration by @k0kubun in #680


New Contributors

@TheSmartnik made their first contribution in #632
@masakazutakewaka made their first contribution in #634
@junaruga made their first contribution in #643
@colby-swandale made their first contribution in #663
@k0kubun made their first contribution in #680

Full Changelog: ruby/rdoc@v6.0.4...v6.1.0
v6.0.4
Compare Source
What's Changed

fix regexp introduced at recent RDoc update (r62924). by @hsbt in #617
Set the store attribute for newly created modules by @robin850 in #614

Full Changelog: ruby/rdoc@v6.0.3...v6.0.4
v6.0.3
Compare Source
What's Changed

Use Minitest 5 by @hsbt in #606
Added workaround for Ruby core repository. by @hsbt in #609
Expand temp dir used by File.realpath.  by @hsbt in #610
Cleanup minitest deprecation warnings about assert_nil by @nbeyer in #612

Full Changelog: ruby/rdoc@v6.0.2...v6.0.3
v6.0.2
Compare Source
What's Changed

Use 2.5.0 and more latest Ruby versions by @aycabta in #575
Fix --width option of ri by @aycabta in #581
Use File.open instead of Kernel#open. by @hsbt in #583
created.rid: use SOURCE_DATE_EPOCH by @bmwiedemann in #570
Fix separated tests by @aycabta in #584
Treat '::' token as EXPR_DOT by @aycabta in #577
Fix method name characters by @aycabta in #582
Fix method line number by @aycabta in #580
Check nil text token by @aycabta in #586
RDoc::Store#load_class supports RDoc::SingleClass by @aycabta in #589
Fix AnyMethod#is_alias_for for nil singleton by @aycabta in #590
Fix #tokens_to_s method for token streams by @robin850 in #592
Do not store current timestamps in gz headers by @bmwiedemann in #569
Support aliased-method by @aycabta in #591
Fix showing syntax error line by @aycabta in #572
Remove needless json dependency by @hsbt in #574
Removed unused task for ruby core and hoe task by @hsbt in #594
Fixed broken test with autoload on JRuby by @hsbt in #593
Remove rdoc/test_case from release gem by @hsbt in #595
Ignore constants discovered in passing by @aycabta in #599
Remove date field from gemspec. by @hsbt in #602
Override .document by --exclude option by @aycabta in #603
Use JRuby 9.1.16.0 by @aycabta in #604

New Contributors

@bmwiedemann made their first contribution in #570

Full Changelog: ruby/rdoc@v6.0.1...v6.0.2
v6.0.1.1
Compare Source
Full Changelog: ruby/rdoc@v6.0.1...v6.0.1.1
v6.0.1
Compare Source
What's Changed

Use JRuby 9.1.15.0 on .travis.yml by @aycabta in #567
Bypass ERB's Ruby syntax error by @aycabta in #573

Full Changelog: ruby/rdoc@v6.0.0...v6.0.1
v6.0.0
Compare Source
What's Changed

Use Ruby 2.4.1 for Travis CI by @aycabta in #443
Add appveyor.yml by @aycabta in #444
Remove offset from CodeObject by @aycabta in #445
Use NOBENCHMARK env by @aycabta in #447
Improve ri --help and --version options handling by @stomar in #448
Remove unused use_cache default option for ri by @stomar in #449
Update to latest versions of Ruby 2.2, 2.3, JRuby 1.7 and 9k by @aycabta in #453
Add ruby_version 24 and 24-x64 to appveyor.yml by @aycabta in #454
Add tests for lib/rdoc/parser/ruby.rb by @aycabta in #456
Add test for lower-case class name warning by @aycabta in #457
Add test for scan visibility count by @aycabta in #459
Add test for require dynamic string by @aycabta in #458
Add test_parse_method_bracket by @aycabta in #463
Add test for postfix if/unless/while/until by @aycabta in #460
Support rational and imaginary by @aycabta in #461
Move collecting up tokens for a symbol to RubyLex by @aycabta in #462
Add hash rocket '=>' token by @aycabta in #464
Handle TkDREGEXP as regexp in HTML by @aycabta in #468
Fix seek position by @aycabta in #465
Support %i and %I literal by @aycabta in #472
Stop dropping continuing backslash by @aycabta in #471
Handle "[]" and "[]=" after "." as method by @aycabta in #466
Handle JSON-style hash key as symbol by @aycabta in #467
Handle "#{}" as dynamic string by @aycabta in #469
Handle redefinable operators as identifier by @aycabta in #470
Fix for "\n" after backslash escape by @aycabta in #473
Support lambda literal by @aycabta in #476
Fix "!" after constant handling, it's identifier by @aycabta in #482
Fix percent string literal with operator by @aycabta in #478
Fix n-ary detecting condition for rational and imaginary by @aycabta in #481
Fix complex condition in for/while/until by @aycabta in #480
Fix heredoc by @aycabta in #479
Drop under Ruby 2.2 by @aycabta in #483
Fix symbol handle in args of yield/super/defined? by @aycabta in #493
Support safe navigation operator by @aycabta in #487
Fix escape in string by @aycabta in #474
Fix handling hash rocket after symbol by @aycabta in #477
Fix creation of symbol token by @aycabta in #488
Fix postfix if/unless/while/until after heredoc by @aycabta in #485
Separate "foo!=bar" to "foo", "!=" and "bar" by @aycabta in #489
Fix opassign by @aycabta in #490
Handle TkPLUS or TkMINUS and number as TkINTEGER by @aycabta in #495
Fix postfix :nodoc: by @aycabta in #496
Fix escape behavior in single quote string literal by @aycabta in #486
Support escaped character literal by @aycabta in #492
Fix handling embdoc and unnecessary blank line in  by @aycabta in #494
Support ENCODING as keyword by @aycabta in #499
Support quoted symbol for JSON-style hash literal by @aycabta in #498
homepage in the gemspec points at non-existent page by @amatsuda in #503
Fix backtick handling by @aycabta in #475
Fix for symbol detection when nested method by @aycabta in #491
Fix regexp literal in oneliner by @aycabta in #497
Context#each_section yields only #display? items by @aycabta in #502
Fix postfix if after escaped newline by @aycabta in #484
Fix % literal with the same sign of original by @aycabta in #500
Support constant visibility by @rhenium in #506
Do not require rdoc from rdoc.gemspec by @rhenium in #505
Use IO.console.winsize instead of IO.console_size for JRuby 9k by @aycabta in #508
Supports multi-line constant body with escaped newline by @aycabta in #507
Fix constant assignment as alias with Hash by @aycabta in #509
Fix handling "rescue" inside paren  by @aycabta in #510
Fix JSON-style Hash literal for args of method by @aycabta in #511
Update JRuby to 9.1.13.0 by @aycabta in #514
Use "bundle exec" in .travis.yml for JRuby test by @aycabta in #515
Use Ripper for lexical analyser by @aycabta in #512
Workaround for JRuby console size.  by @hsbt in #518
Removed magic comment for encoding. by @hsbt in #519
Remove unnecessary comment for HTML class table by @aycabta in #520
Refactor TestRDocParserRuby by @aycabta in #524
Refactor parse_constant by @aycabta in #522
Clean warnings in tests by @aycabta in #525
Fix variable expansion in yield by @aycabta in #526
Escape yield parameters by @aycabta in #528
Remove lib/rdoc/ruby_token.rb by @aycabta in #529
Fix typo by @y-yagi in #531
Fix broken links by @tnir in #532
Skip the same of outside of nested namespace by @aycabta in #523
Use Ruby 2.4.2, 2.3.5, 2.2.8 by @aycabta in #536
Remove needless library lock with gem methods. by @hsbt in #538
Remove RDoc::Parser.process_directive by @aycabta in #537
Add trunk to appveyor, change ubygems to rubygems by @MSP-Greg in #535
Fix CodeFence with unintended Array for format by @aycabta in #530
Support did_you_mean by @aycabta in #533
Use tr_s instead of tr and squeeze by @znz in #540
Removed useless method related RubyToken. by @hsbt in #539
Fix for Ruby 2.5 warnings in tests by @aycabta in #543
Fix for warnings on Ruby 2.5 in ERB binding by @aycabta in #544
Support :args: directive before method by @aycabta in #541
Handle all definitions per file in Ruby by @aycabta in #542
Avoid a trailing whitespace in generated markdown.rb by @stomar in #548
Don't use lex_state emulation on Ruby 2.5 or later by @aycabta in #546
Support Ripper::Lexer::State by @aycabta in #550
Bump JRuby version to 9.1.14.0 by @aycabta in #552
Fix tag in table_of_contents.html by @aycabta in #549
Update markdown.kpeg by @aycabta in #559
Add lib/rdoc/markdown/literals.rb to .gitignore by @aycabta in #560
Suppress "assigned but unused variable" warning by @pocke in #561
Remove old token name by @aycabta in #554
Remove remove_private_comment by @aycabta in #563
Use ParseError that is auto-generated by KPeg by @aycabta in #564
Use Enumerable#chunk after drop Ruby 1.8 by @aycabta in #562
Use File.expand_path outside temp_dir by @aycabta in #557
Remove unnecessary condition of RDoc::TokenStream.to_html by @aycabta in #553
Add ruby-title class to method name in HTML by @aycabta in #555
Fix test_parse_instance_operation_method for ruby-title by @aycabta in #565
Fix --dry-run option by @aycabta in #556
Use frozen_string_literal: true by @aycabta in #551

New Contributors

@rhenium made their first contribution in #506
@y-yagi made their first contribution in #531
@tnir made their first contribution in #532

Full Changelog: ruby/rdoc@v5.1.0...v6.0.0
v5.1.0
Compare Source
What's Changed

Run test with latest stable versions by @ojiry in #434
CI against ruby 2.4.0 by @amatsuda in #436
Update CodeClimate badge by @toshimaru in #438
fix an issue that rdoc fails when running on Windows with RUBYOPT=-U by @dogatana in #430
Parse ruby 2.1 <visibility> def method definition by @amatsuda in #435
Suppress warnings in eval by @nobu in #440

New Contributors

@ojiry made their first contribution in #434
@toshimaru made their first contribution in #438
@dogatana made their first contribution in #430

Full Changelog: ruby/rdoc@v5.0.0...v5.1.0
v5.0.1
Compare Source
Full Changelog: ruby/rdoc@v5.0.0...v5.0.1
v5.0.0
Compare Source
What's Changed

Fix broken links to assets.  Fixes #359. by @awood in #360
Improve expand class name by @nurse in #400
Performance improvement by @mame in #397
Fix travis failure by @hsbt in #407
Removed hoe-travis from Rakefile by @hsbt in #408
Remove hoe from development by @zzak in #396
Retry mame's pull request for Performance Improvement by @hsbt in #404
Ignore frozen_string_literal magic comment (Fixes #389) by @jeremyevans in #406
Prepare to release RDoc 5 by @hsbt in #419
fix NotFoundError with left-hand match class like String and StringIO by @hsbt in #420
Removed code for Ruby 1.8  by @hsbt in #421
Cleanup code targeted Ruby 1.8  by @hsbt in #423
Fix rdoc generation task on rdoc by @hsbt in #424
Restore options after option parsing by @hsbt in #426

New Contributors

@awood made their first contribution in #360
@nurse made their first contribution in #400

Full Changelog: ruby/rdoc@v4.2.2...v5.0.0
v4.3.0
Compare Source
Full Changelog: ruby/rdoc@v4.2.2...v4.3.0
v4.2.2
Compare Source
Full Changelog: ruby/rdoc@v4.2.1...v4.2.2
v4.2.1
Compare Source
Full Changelog: ruby/rdoc@v4.2.0...v4.2.1
v4.2.0
Compare Source
Full Changelog: ruby/rdoc@v4.1.1...v4.2.0
v4.1.2
Compare Source
Full Changelog: ruby/rdoc@v4.1.1...v4.1.2



Configuration
📅 Schedule: (UTC)

Branch creation

""


Automerge

At any time (no schedule defined)



🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.


 If you want to rebase/retry this PR, check this box


This PR has been generated by Renovate Bot.

sc-renovate · 2026-06-01T08:30:34Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

Writing lockfile to /tmp/renovate/repos/github/soundcloud/cando/Gemfile.lock
Fetching gem metadata from http://rubygems.org/.........
Resolving dependencies...

Could not find compatible versions

Because the current Bundler version (4.0.10) does not satisfy bundler ~> 1.0
  and Gemfile depends on bundler ~> 1.0,
  version solving has failed.

Your bundle requires a different version of Bundler than the one you're running.
Install the necessary version with `gem install bundler:1.17.3` and rerun
bundler using `bundler _1.17.3_ lock --update rdoc`

chore(deps): update dependency rdoc to v6 [security]

d06c1d8

sc-renovate Bot added dependencies Pull requests that update a dependency file renovate labels Jun 1, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency rdoc to v6 [security]#37

chore(deps): update dependency rdoc to v6 [security]#37
sc-renovate[bot] wants to merge 1 commit into
masterfrom
renovate/rubygems-rdoc-vulnerability

sc-renovate Bot commented Jun 1, 2026 •

edited

Loading

Uh oh!

sc-renovate Bot commented Jun 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

sc-renovate Bot commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Severity

Release Notes

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

sc-renovate Bot commented Jun 1, 2026

⚠️ Artifact update problem

File name: Gemfile.lock

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

sc-renovate Bot commented Jun 1, 2026 •

edited

Loading