🚨 [security] Update clerk-sdk-ruby 3.3.0 → 5.0.0 (major)#865
Closed
depfu[bot] wants to merge 1 commit intomasterfrom
Closed
🚨 [security] Update clerk-sdk-ruby 3.3.0 → 5.0.0 (major)#865depfu[bot] wants to merge 1 commit intomasterfrom
depfu[bot] wants to merge 1 commit intomasterfrom
Conversation
Contributor
Author
|
Closed in favor of #867. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ clerk-sdk-ruby (3.3.0 → 5.0.0) · Repo · Changelog
Release Notes
5.0.0
4.2.1 (from changelog)
4.2.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
✳️ faraday (2.12.2 → 2.14.0) · Repo · Changelog
Release Notes
2.14.0
2.13.4
2.13.3
2.13.2
2.13.1
2.13.0
2.12.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 26 commits:
Version bump to 2.14.0Fix `Faraday::Response#to_hash` when request is not finished yet (#1639)Use newer Unprocessable Content naming for 422 (#1638)Fixes typo (#1635)Convert strings to UTF-8 (#1624)Bump actions/checkout from 4 to 5 (#1636)Lint: use filter_map (#1637)Version bump to 2.13.4Improve error handling logic and add missing test coverage (#1633)Version bump to 2.13.3Fix type assumption in `Faraday::Error` (#1630)Version bump to 2.13.2Include HTTP method and URL in Faraday::Error messages for improved exception log transparency (#1628)CONTRIBUTING: update socials links to MastodonAdd migrating from rest-client docs section. (#1625)Lint rack_builder.rb: avoid naming a method (#1626)Only load what is required from `cgi` (#1623)CI against Ruby 3.4Version bump to 2.13.1Fix Style/RedundantParentheses in options/env.rb (#1620)Logger middleware default options (#1618)Version bump to 2.13.0feat(ssl options): support SNI hostname (#1615)Version bump to 2.12.3Fix thread safety issue by avoiding mutation of proxy options hash (#1617)removes ruby2_keywords usageRelease Notes
1.3.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 23 commits:
Release 1.3.6Exclude dependabot updates from release notesThreadPoolExecutor `kill` will `wait_for_termination` in JRuby; ensure TimerSet timer thread shuts down cleanlyFlaky test fix: allow ThreadPool to shutdown before asserting completed_task_count (#1098)Allow TimerTask to be safely restarted after shutdown and avoid duplicate tasks (#1001)Mark RubySingleThreadExecutor as a SerialExecutorServiceAsynchronous pruning for RubyThreadPoolExecutor (#1082)Add Joshua Young to the list of maintainers (#1097)Use typed data APIsUse stdatomic.h on recent macOSBump actions/checkout from 5 to 6Fix multi require concurrent/executor/cached_thread_poolAlways fail-fast: false in CIAvoid creating a Fiber while loading the gemBump actions/checkout from 4 to 5Bump actions/upload-pages-artifact from 3 to 4Fix mistakes in MVar documentationCorrect word in readmeFix typoAdd 3.4 in CIRun tests without the C extension in CIFix guards in specs using C extension classesDocument Bundler workaround for releasingRelease Notes
3.4.2
3.4.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 10 commits:
Update ci.yml to allow manual runsVersion bump to 3.4.2Use more conservative net-http version constraint (#53)Bump actions/checkout from 4 to 5 (#51)CI: Fix grammar error in Publish workflowCI: Ensure Rake is available in publish actionv3.4.1CI: Add Ruby 3.4 to build matrixUse Ruby 3.4.4Prepare Trusted Publisher (#50)Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
2.10.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Version 2.10.2 (#703)Backport: Avoid using the same digest across calls (#697) (#701)Simplify CI on 2.10 branch (#702)Fix deprecation messagesRelease Notes
0.9.1
0.9.0
0.8.0
0.7.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Security Advisories 🚨
🚨 URI Credential Leakage Bypass over CVE-2025-27221
Release Notes
1.1.1
1.1.0
1.0.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 71 commits:
v1.1.1Merge pull request #189 from osyoyu/restore-whatwg-email-regexpRe-allow consecutive, leading and trailing dots in EMAIL_REGEXPv1.1.0Merge pull request #187 from ruby/switch-version-codeUse generic version number to VERSION and generate VERSION_CODE from thatExclude dependabot updates from release noteMerge pull request #130 from soda92/improve-error-messageMerge pull request #161 from y-yagi/fix_changing_parserMerge pull request #166 from vivshaw/vivshaw/correct-obsolete-parseMerge pull request #182 from y-yagi/fix_irb_warningUpdate the latest versions of actionsMerge tag 'v1.0.4'Bump up to v1.0.4Merge branch 'CVE-2025-61594-3-4' into HEADAdd a workflow to sync commits to ruby/ruby (#183)Add `irb` to the Gemfile to fix the warningAdd authority accessorClear user info totally at setting any of authority infoMerge pull request #181 from ruby/dependabot/github_actions/step-security/harden-runner-2.13.1Bump step-security/harden-runner from 2.13.0 to 2.13.1Merge pull request #180 from ruby/dependabot/github_actions/actions/upload-pages-artifact-4Bump actions/upload-pages-artifact from 3 to 4Merge pull request #179 from ruby/dependabot/github_actions/actions/checkout-5Bump actions/checkout from 4 to 5Merge pull request #176 from ruby/dependabot/github_actions/step-security/harden-runner-2.13.0Bump step-security/harden-runner from 2.12.2 to 2.13.0Merge pull request #175 from nobu/doc-uri_parser[DOC] Update old use of `URI::Parser`[DOC] Document private visibility too[DOC] Fix referencesMerge pull request #174 from nobu/performance-test-scaleRepeat matching to reduce deviationsTest in exponential scale with rehearsalMerge pull request #173 from nobu/email_regexp-refineImprove performance of `URI::MailTo::EMAIL_REGEXP`Merge pull request #116 from jeremyevans/http-empty-host-reject-20686Merge pull request #172 from nobu/more-checks-in-email_regexpProhibit successive dots in emailMore tests for `check_to`Merge pull request #124 from nlevchuk/prohibit-leading-and-trailing-dots-in-email-regexpMake URI::regexp schemes case sensitive (#38)Fix the message for unexpected argumentPrefer dedicated assertion methodsMerge pull request #168 from ruby/dependabot/github_actions/step-security/harden-runner-2.12.2Bump step-security/harden-runner from 2.12.1 to 2.12.2Merge pull request #167 from nobu/doc-Kernel.URI[DOC] State that uri library is needed to call Kernel#URIMerge pull request #148 from nobu/reserved-char-in-schemeFix a typoUse Lo category chars as escaped charsEscape reserved characters in scheme nameUse GITHUB_TOKEN instead of admin credentialchore(docs): replace reference to the obsolete URI.escape with URI::RFC2396_PARSER.escapeMerge pull request #165 from ruby/dependabot/github_actions/step-security/harden-runner-2.12.1Bump step-security/harden-runner from 2.12.0 to 2.12.1Merge pull request #164 from ruby/fixup-ractor-valueRevert "Alias value or join to take in old Ruby"Use the latest version of assert_ractor for Ractor#valueMerge pull request #163 from ruby/ractor-valueAlias value or join to take in old Ruby`Ractor::Port`Merge pull request #162 from ruby/dependabot/github_actions/step-security/harden-runner-2.12.0Bump step-security/harden-runner from 2.11.1 to 2.12.0Switch a parsing behavior completely when switching a parserMerge pull request #159 from ruby/dependabot/github_actions/step-security/harden-runner-2.11.1Bump step-security/harden-runner from 2.11.0 to 2.11.1Merge pull request #150 from y-yagi/use_fully_qualified_nameMerge pull request #146 from y-yagi/fix_doc_of_escapeMerge pull request #158 from ruby/fixed-gh-pagesUpdate to use the latest version of setup-ruby and bump up to Ruby 3.4🆕 faraday-multipart (added, 1.2.0)
🆕 faraday-retry (added, 2.4.0)
🆕 multipart-post (added, 2.4.1)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands
Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.