Bump the bundler group across 1 directory with 7 updates #6

dependabot · 2024-03-21T22:43:04Z

Bumps the bundler group with 2 updates in the / directory: rails and puma.

Updates rails from 7.0.4.3 to 7.0.8.1

Release notes

7.0.8.1

Active Support

No changes.

Active Model

No changes.

Active Record

No changes.

Action View

No changes.

Action Pack

Fix possible XSS vulnerability with the translate method in controllers

CVE-2024-26143

Active Job

No changes.

Action Mailer

No changes.

Action Cable

No changes.

... (truncated)

Commits

506462a Preparing for 7.0.8.1 release
030cd01 update changelog
4c83b33 fix XSS vulnerability when using translation
723f545 Merge pull request #48869 from brunoprietog/disable-session-active-storage-pr...
fc734f2 Preparing for 7.0.8 release
af486be Merge pull request #44370 from mohits/patch-1
72bad1a Upgrade stringio to 3.0.8 to make sure guides CI pass
d230670 Force upgrade bundler to invalidate Bundler cache on CI
d84000d Require job used in this test file
3c17dab We expect queue adapters to be objects, no classes
Additional commits viewable in compare view

Updates puma from 5.6.4 to 5.6.8

Release notes

Sourced from puma's releases.

5.6.7

Security Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.5 / 2022-08-23

Bugfixes

NullIO#closed should return false (#2883)

Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)

[jruby] Fix TLS verification hang (#2890, #2729)

extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)

MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)

Fix rack.after_reply exceptions breaking connections (#2861, #2856)

Escape SSL cert and filenames (#2855)

Fail hard if SSL certs or keys are invalid (#2848)

Fail hard if SSL certs or keys cannot be read by user (#2847)

Fix build with Opaque DH in LibreSSL 3.5. (#2838)

Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)

Fix Puma::StateFile#load incompatibility (#2810)

Changelog

Sourced from puma's changelog.

5.6.8 / 2024-01-08

Security

Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

5.6.7 / 2023-08-18

Security

Address HTTP request smuggling vulnerabilities with zero-length Content Length header and trailer fields (GHSA-68xg-gqqm-vgj8)

5.6.6 / 2023-06-21

Bugfix

Prevent loading with rack 3 (#3166)

5.6.5 / 2022-08-23

Feature

Puma::ControlCLI - allow refork command to be sent as a request (#2868, #2866)

Bugfixes

NullIO#closed should return false (#2883)

[jruby] Fix TLS verification hang (#2890, #2729)

extconf.rb - don't use pkg_config('openssl') if '--with-openssl-dir' is used (#2885, #2839)

MiniSSL - detect SSL_CTX_set_dh_auto (#2864, #2863)

Fix rack.after_reply exceptions breaking connections (#2861, #2856)

Escape SSL cert and filenames (#2855)

Fail hard if SSL certs or keys are invalid (#2848)

Fail hard if SSL certs or keys cannot be read by user (#2847)

Fix build with Opaque DH in LibreSSL 3.5. (#2838)

Pre-existing socket file removed when TERM is issued after USR2 (if puma is running in cluster mode) (#2817)

Fix Puma::StateFile#load incompatibility (#2810)

Commits

1293573 5.6.8
bbb880f Merge pull request from GHSA-c2f4-cvqm-65w2
78393bf 5.6.7
7405a21 Merge pull request from GHSA-68xg-gqqm-vgj8
d33424b 5.6.7 release note [ci skip]
f8c7b23 5.6.6
08af1b5 5.6.6 release note
6dac5d9 Prevent loading with rack 3 (#3166)
0892558 Fix and update 5-6-stable CI, two backports (#3167)
3a6ea4f Release note fix for 5.6.5
Additional commits viewable in compare view

Updates actionpack from 7.0.4.3 to 7.0.8.1

Release notes

Sourced from actionpack's releases.

7.0.8.1

Active Support

No changes.

Active Model

No changes.

Active Record

No changes.

Action View

No changes.

Action Pack

Fix possible XSS vulnerability with the translate method in controllers

CVE-2024-26143

Active Job

No changes.

Action Mailer

No changes.

Action Cable

No changes.

... (truncated)

Commits

506462a Preparing for 7.0.8.1 release
030cd01 update changelog
4c83b33 fix XSS vulnerability when using translation
fc734f2 Preparing for 7.0.8 release
f9175db Fix webdrivers on 7-0-stable branch for issue #48973. (#48977)
ed9f292 Merge tag 'v7.0.7.2' into 7-0-stable
3668b4b Preparing for 7.0.7.2 release
2294b8b Bumping version
2766c93 Merge branch '7-0-sec' into 7-0-stable
c92caef Preparing for 7.0.7.1 release
Additional commits viewable in compare view

Updates activestorage from 7.0.4.3 to 7.0.8.1

Release notes

Sourced from activestorage's releases.

7.0.8.1

Active Support

No changes.

Active Model

No changes.

Active Record

No changes.

Action View

No changes.

Action Pack

Fix possible XSS vulnerability with the translate method in controllers

CVE-2024-26143

Active Job

No changes.

Action Mailer

No changes.

Action Cable

No changes.

... (truncated)

Commits

506462a Preparing for 7.0.8.1 release
030cd01 update changelog
723f545 Merge pull request #48869 from brunoprietog/disable-session-active-storage-pr...
fc734f2 Preparing for 7.0.8 release
3668b4b Preparing for 7.0.7.2 release
2294b8b Bumping version
c92caef Preparing for 7.0.7.1 release
936587d updating version / changelog
522c86f Preparing for 7.0.7 release
593893c Preparing for 7.0.6 release
Additional commits viewable in compare view

Updates activesupport from 7.0.4.3 to 7.0.8.1

Release notes

Sourced from activesupport's releases.

7.0.8.1

Active Support

No changes.

Active Model

No changes.

Active Record

No changes.

Action View

No changes.

Action Pack

Fix possible XSS vulnerability with the translate method in controllers

CVE-2024-26143

Active Job

No changes.

Action Mailer

No changes.

Action Cable

No changes.

... (truncated)

Commits

506462a Preparing for 7.0.8.1 release
030cd01 update changelog
fc734f2 Preparing for 7.0.8 release
7bf0e43 Fix TimeWithZone#to_s being overriden with ENV set
f5fd433 Document how to remove to_s deprecation warnings when defaul format is changed
ed9f292 Merge tag 'v7.0.7.2' into 7-0-stable
3668b4b Preparing for 7.0.7.2 release
2294b8b Bumping version
2766c93 Merge branch '7-0-sec' into 7-0-stable
c92caef Preparing for 7.0.7.1 release
Additional commits viewable in compare view

Updates nokogiri from 1.14.4 to 1.16.3

Release notes

Sourced from nokogiri's releases.

v1.16.3 / 2024-03-15

Dependencies

[CRuby] Vendored libxml2 is updated to v2.12.6 from v2.12.5. (@flavorjones)

Changed

[CRuby] XML::Reader sets the @encoding instance variable during reading if it is not passed into the initializer. Previously, it would remain nil. The behavior of Reader#encoding has not changed. This works around changes to how libxml2 reports the encoding used in v2.12.6.

sha256 checksums:
3d806263a0548e5163ff256655d78a87998fa83a5ae256b83c14a1a97731e824  nokogiri-1.16.3-aarch64-linux.gem
cfb923c02bde065005e2521f0a6883c63cf305cb899a9dd4c74897731bb2af1d  nokogiri-1.16.3-arm-linux.gem
5d3268558c002fa493e33076798cfda1df8effbd5363060dc41595cfebb1cf90  nokogiri-1.16.3-arm64-darwin.gem
6bf0918233959c7d5e703061ada0f436544612397475a866aa314071f02bfabb  nokogiri-1.16.3-java.gem
656f163dd287671c3a28157a2e853ee1a36afeb3f4185a78af863f3980efc58d  nokogiri-1.16.3-x64-mingw-ucrt.gem
7330f65cf2f8fa442327112b6515b4988f396d23010d33571714fd2ac0648fb9  nokogiri-1.16.3-x64-mingw32.gem
08d8a369940fa2309379cd8af1e7b3cc702b0115d3ddd197cfa7b33daedfd541  nokogiri-1.16.3-x86-linux.gem
cd26e99fa6388cd73c8892bb99ac98af162fe83c8f71c6473dfeba7aac76bcb9  nokogiri-1.16.3-x86-mingw32.gem
bc22786f4db4c32a5587e3b77a106408148d3bb1602dd0b52c0f5c968c42d17d  nokogiri-1.16.3-x86_64-darwin.gem
47a3330e41b49a100225b6fab490b2dc43410931e01e791886e0c2998412e8cb  nokogiri-1.16.3-x86_64-linux.gem
498aa253ccd5b89a0fa5c4c82b346d22176fc865f4a12ef8da642064d1d3e248  nokogiri-1.16.3.gem
v1.16.2 / 2024-02-04

Security

[CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.12.5 from v2.12.4. (@flavorjones)

sha256 checksums:
69ba15d2a2498324489ed63850997f0b8f684260114ea81116d3082f16551d2d  nokogiri-1.16.2-aarch64-linux.gem
6a05ce42e3587a40cf8936ece0beaa5d32922254215d2e8cf9ad40588bb42e57  nokogiri-1.16.2-arm-linux.gem
c957226c8e36b31be6a3afb8602e2128282bf8b40ea51016c4cd21aa2608d3f8  nokogiri-1.16.2-arm64-darwin.gem
122652bfc338cd8a54a692ac035e245e41fd3b8283299202ca26e7a7d50db310  nokogiri-1.16.2-java.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.16.3 / 2024-03-15

Dependencies

[CRuby] Vendored libxml2 is updated to v2.12.6 from v2.12.5. (@flavorjones)

Changed

[CRuby] XML::Reader sets the @encoding instance variable during reading if it is not passed into the initializer. Previously, it would remain nil. The behavior of Reader#encoding has not changed. This works around changes to how libxml2 reports the encoding used in v2.12.6.

v1.16.2 / 2024-02-04

Security

[CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.12.5 from v2.12.4. (@flavorjones)

v1.16.1 / 2024-02-03

Dependencies

[CRuby] Vendored libxml2 is updated to v2.12.4 from v2.12.3. (@flavorjones)

Fixed

[CRuby] XML::Reader defaults the encoding to UTF-8 if it's not specified in either the document or as a method parameter. Previously non-ASCII characters were serialized as NCRs in this case. #2891 (@flavorjones)

[CRuby] Restored support for compilation by GCC versions earlier than 4.6, which was broken in v1.15.0 (540e9aee). #3090 (@adfoster-r7)

[CRuby] Patched upstream libxml2 to allow parsing HTML5 in the context of a namespaced node (e.g., foreign content like MathML). [#3112, #3116] (@flavorjones)

[CRuby] Fixed a small memory leak in libgumbo (HTML5 parser) when the maximum tree depth limit is hit. [#3098, #3100] (@stevecheckoway)

v1.16.0 / 2023-12-27

Notable Changes

Ruby

This release introduces native gem support for Ruby 3.3.

This release ends support for Ruby 2.7, for which upstream support ended 2023-03-31.

... (truncated)

Commits

80fb608 version bump to v1.16.3
710bd96 dep: update libxml 2.12.6 (branch v1.16.x) (#3151)
461a96e fix: Reader#read sets @encoding if it is unset
801f978 dep: update libxml2 to v2.12.6
673756f version bump to v1.16.2
74ffd67 dep: update libxml to 2.12.5 (branch v1.16.x) (#3122)
0d4018d dep: update libxml2 to v2.12.5
f33a25f dep: remove patch from #3112 which has been released upstream
e994168 version bump to v1.16.1
77ea2f2 dev: add files to manifest ignore list
Additional commits viewable in compare view

Updates rack from 2.2.7 to 2.2.9

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

v2.2.8

What's Changed

Limit file extension length of multipart tempfiles (2.2 backport) by @dentarg in rack/rack#2075

CHANGELOG: Add missing 2.2.7 by @tisba in rack/rack#2081

Update cookie.rb by @dchandekstark in rack/rack#2092

Prefer ubuntu-latest for testing. by @ioquatix in rack/rack#2095

Fix inefficient assert pattern in Rack::Lint [2-2-stable] by @skipkayhil in rack/rack#2101

Regenerate SPEC [2-2-stable] by @skipkayhil in rack/rack#2102

New Contributors

@tisba made their first contribution in rack/rack#2081

@dchandekstark made their first contribution in rack/rack#2092

Full Changelog: rack/rack@v2.2.7...v2.2.8

Commits

b1deebd Bump patch version.
f7d40f9 Merge branch '2-2-sec' into 2-2-stable
e830011 bump version
d9c163a Avoid 2nd degree polynomial regexp in MediaType
6245768 Return an empty array when ranges are too large
e4c1177 Fixing ReDoS in header parsing
fdb12cb backport #2104 (#2121)
99057e6 Update CHANGELOG for 2.2.8 (#2107)
3314622 Adds missing 2.2.8 to CHANGELOG.md (#2106)
f169ff7 Bump patch version.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 2 updates in the / directory: [rails](https://github.com/rails/rails) and [puma](https://github.com/puma/puma). Updates `rails` from 7.0.4.3 to 7.0.8.1 - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v7.0.4.3...v7.0.8.1) Updates `puma` from 5.6.4 to 5.6.8 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/master/History.md) - [Commits](puma/puma@v5.6.4...v5.6.8) Updates `actionpack` from 7.0.4.3 to 7.0.8.1 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.1.3.2/actionpack/CHANGELOG.md) - [Commits](rails/rails@v7.0.4.3...v7.0.8.1) Updates `activestorage` from 7.0.4.3 to 7.0.8.1 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.1.3.2/activestorage/CHANGELOG.md) - [Commits](rails/rails@v7.0.4.3...v7.0.8.1) Updates `activesupport` from 7.0.4.3 to 7.0.8.1 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.1.3.2/activesupport/CHANGELOG.md) - [Commits](rails/rails@v7.0.4.3...v7.0.8.1) Updates `nokogiri` from 1.14.4 to 1.16.3 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.14.4...v1.16.3) Updates `rack` from 2.2.7 to 2.2.9 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.7...v2.2.9) --- updated-dependencies: - dependency-name: rails dependency-type: direct:production dependency-group: bundler-security-group - dependency-name: puma dependency-type: direct:production dependency-group: bundler-security-group - dependency-name: actionpack dependency-type: indirect dependency-group: bundler-security-group - dependency-name: activestorage dependency-type: indirect dependency-group: bundler-security-group - dependency-name: activesupport dependency-type: indirect dependency-group: bundler-security-group - dependency-name: nokogiri dependency-type: indirect dependency-group: bundler-security-group - dependency-name: rack dependency-type: indirect dependency-group: bundler-security-group ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Mar 21, 2024

This was referenced Mar 21, 2024

Bump the bundler group across 1 directories with 6 updates #3

Closed

Bump the bundler group across 1 directory with 3 updates #5

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the bundler group across 1 directory with 7 updates #6

Bump the bundler group across 1 directory with 7 updates #6

Uh oh!

dependabot bot commented on behalf of github Mar 21, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the bundler group across 1 directory with 7 updates #6

Are you sure you want to change the base?

Bump the bundler group across 1 directory with 7 updates #6

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 21, 2024

7.0.8.1

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

5.6.7

5.6.5 / 2022-08-23

5.6.8 / 2024-01-08

5.6.7 / 2023-08-18

5.6.6 / 2023-06-21

5.6.5 / 2022-08-23

7.0.8.1

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

7.0.8.1

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

7.0.8.1

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

v1.16.3 / 2024-03-15

Dependencies

Changed

v1.16.2 / 2024-02-04

Security

Dependencies

v1.16.3 / 2024-03-15

Dependencies

Changed

v1.16.2 / 2024-02-04

Security

Dependencies

v1.16.1 / 2024-02-03

Dependencies

Fixed

v1.16.0 / 2023-12-27

Notable Changes

Ruby

v2.2.8.1

What's Changed

v2.2.8

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant