chore(deps): update all non-major bundler dependencies - #1226
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update all non-major bundler dependencies#1226renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## staging #1226 +/- ##
========================================
Coverage 77.59% 77.59%
========================================
Files 54 54
Lines 1406 1406
========================================
Hits 1091 1091
Misses 315 315 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
6 times, most recently
from
February 7, 2026 04:51
798ae9a to
87d76d0
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
9 times, most recently
from
February 17, 2026 23:58
354ff24 to
5635ee4
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
February 23, 2026 21:27
4782a50 to
5ce8e84
Compare
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
March 2, 2026 14:54
a2ffd1b to
17a6987
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
March 9, 2026 09:47
220dace to
b2a9253
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
5 times, most recently
from
April 17, 2026 15:51
e247aa9 to
ca69050
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
6 times, most recently
from
April 29, 2026 00:54
1f83c9b to
7771100
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
May 8, 2026 06:03
cb74aca to
af714f9
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
May 15, 2026 21:46
2eae179 to
dd0716e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
May 22, 2026 15:38
b479dfd to
af052e7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
5 times, most recently
from
May 30, 2026 10:11
cfcdbca to
02d1898
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
2 times, most recently
from
June 2, 2026 17:08
b13fec2 to
b09f88b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
'~> 1.21.1'→'~> 1.24.6''~> 8.0.1'→'~> 8.0.5''~> 8.1'→'~> 8.1', '>= 8.1.3''~> 2.1.1'→'~> 2.1.3''~>1.15.0'→'~>1.16.0''~> 3.6.0'→'~> 3.8.0''~> 1.2.6'→'~> 1.2.10''~> 2.14.1'→'~> 2.15.1''~> 4.18.0'→'~> 4.19.0''~> 3.1', '>= 3.1.5'→'~> 3.2', '>= 3.2.1''~> 7.2.3'→'~> 7.2.3', '>= 7.2.3.2''~> 8.0.2'→'~> 8.0.4''~> 1.84.0'→'~> 1.89.0''~> 2.34', '>= 2.34.3'→'~> 2.36''~> 3.9'→'~> 3.10', '>= 3.10.2''~> 6.3'→'~> 6.7''~> 6.3'→'~> 6.7''~> 6.3'→'~> 6.7''~> 8.0.10'→'~> 8.1.6''~> 6.0.1'→'~> 6.0.2''~> 4.4.0'→'~> 4.7.0''~> 0.9.10'→'~> 0.9.11''~> 4.2.1'→'~> 4.3.0'Release Notes
presidentbeef/brakeman (brakeman)
v8.0.5Compare Source
quote_schema_nameto safe quote method list (Zsolt Kozaroczy)compact_blank/compacton permitted params (Arpit Jain)text(Arpit Jain).rawcalls (Federico Franco)TemplateAliasProcessor#template_namearity (viralpraxis)v8.0.4Compare Source
--ensure-latestv8.0.3Compare Source
polymorphic_nameSQLi false positive (Fredrico Franco)--ensure-latestv8.0.2Compare Source
flyerhzm/bullet (bullet)
v8.1.3Compare Source
v8.1.2Compare Source
belongs_towhose*_typecolumn is nil. ActiveRecord short-circuits the reader to nil without issuing SQL, so the access cannot represent an N+1 query and preloading would be a no-op.Set#<<corruption inUnusedEagerLoading#add_eager_loadingssplit branchv8.1.1Compare Source
djezzzl/database_consistency (database_consistency)
v2.1.3Compare Source
MissingDependentDestroyCheckerto support composite keys. Thanks Andy Allan for reporting this!v2.1.2Compare Source
ForeignKeyTypeCheckerto support composite keys. Thanks Quentin de Metz for reporting this!MissingUniqueIndexCheckerto support composite keys. Thanks Andy Allan for reporting this!devise-i18n/devise-i18n (devise-i18n)
v1.16.0Compare Source
d13ef8941003bf. Translations of this string are unaffected.faker-ruby/faker (faker)
v3.8.0Compare Source
Enabling lazy load
This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.
Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:
1 - Set lazy load as a Faker Config
Faker::Config.lazy_loading = true2 - Set lazy load as an environment variable
FAKER_LAZY_LOAD = 1We hope you get to see the improvement by enabling it. Please file a bug report for any issues!
Thanks to @jeremyevans for the mentoring, and to @thdaraujo for pairing and code reviews.
Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0
v3.7.1Compare Source
Enabling lazy load
This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.
Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:
1 - Set lazy load as a Faker Config
Faker::Config.lazy_loading = true2 - Set lazy load as an environment variable
FAKER_LAZY_LOAD = 1We hope you get to see the improvement by enabling it. Please file a bug report for any issues!
Thanks to @jeremyevans for the mentoring, and to @thdaraujo for pairing and code reviews.
Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0
v3.6.1Compare Source
It's almost Spring time in the Northern hemisphere 🌸
Security, performance improvements and bug fixes
ja/address.ymlwith a 7-digit format by @thdaraujo in #3201Update development dependencies
New Contributors
Full Changelog: faker-ruby/faker@v3.6.0...v3.6.1
Studiosity/grover (grover)
v1.2.10Compare Source
Fixed
v1.2.9Compare Source
Added
v1.2.8Compare Source
Added
v1.2.7Compare Source
Added
rails/jbuilder (jbuilder)
v2.15.1Compare Source
What's Changed
New Contributors
Full Changelog: rails/jbuilder@v2.15.0...v2.15.1
v2.15.0Compare Source
What's Changed
KeyFormatteron cache hits by @moberegger in #607array!andset!by @moberegger in #604:unprocessable_contentfor scaffolds with Rack 3.1 or higher by @taketo1113 in #603_map_collectionby @moberegger in #612New Contributors
Full Changelog: rails/jbuilder@v2.14.1...v2.15.0
mollie/mollie-api-ruby (mollie-api-ruby)
v4.19.0Compare Source
c61808e) Allow bigdecimal 4.xomniauth/omniauth-identity (omniauth-identity)
v3.2.1Compare Source
Added
Changed
binstubs, and development dependency floors with
kettle-jemv7.0.0.anonymous_loaderruntime dependency floor to>= 0.1.3.auth-sanitizerto>= 0.2.3, soOmniAuth Identity consumers get hash and nested-attribute inspect redaction
fixes plus downstream RBS duplicate-declaration fixes, and switched isolated
sanitizer loading to the released
anonymous_loadergem.version_gemandappraisal2dependency floors toversion_gem>= 1.1.14 andappraisal2>= 3.1.4.Fixed
Restored ORM-specific spec rake tasks and made optional ORM spec files avoid
loading unavailable adapter gems when the matching appraisal does not include them.
Package configured license files in gem release file lists.
v3.2.0Compare Source
Added
OmniAuth::Identity::VERSIONas the traditional public versionconstant, in addition to
OmniAuth::Identity::Version::VERSION.Changed
and development dependency floors from the current kettle-jem template.
so concurrent callers do not race while reading or updating authentication
keys, ROM adapter settings, or BCrypt minimum-cost mode.
Fixed
kettle-testruns skip CouchDB, MongoDB, and RethinkDB adapterspecs by default unless the matching service adapter environment variable is enabled.
Security
auth-sanitizerintegration so identity model#inspectoutputfilters password-related attributes by default.
rails/rails (rails)
v7.2.3.2: 7.2.3.2Compare Source
Active Support
Active Model
Active Record
Action View
Action Pack
Active Job
Action Mailer
Action Cable
Active Storage
Disable libvips's unfuzzed image loaders and savers.
libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only
safe for trusted content. Active Storage will call
Vips.block_untrusted(true)to disable themwhile booting. An application that needs a specific loader or saver may re-enable it in an
initializer.
This is a breaking change for applications that process image types with an unfuzzed loader or
saver. Variant transformation of BMP, ICO, and PSD attachments will raise
Vips::Error, andanalysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer
record
widthandheight. Requesting an unfuzzed output format, typically FITS, JXL, oranything delegated to ImageMagick, will also raise
Vips::Error. Attaching, storing, anddownloading are unchanged.
An application seeing
Vips::Errorraised during image transformation may wish to remove theaffected content types from
config.active_storage.variable_content_typesin an initializer.Active Storage will then treat those attachments as not variable and will not generate variants
for them. This most often matters to an application that transforms images during a request
rather than in a background job, where the failure surfaces as an error response instead of a
failed job.
Applications using the
:mini_magickvariant processor will see no change in how theirattachments are processed, but the loaders and savers will be disabled process-wide whenever
ruby-vips is installed, and the version requirements below will still apply. Such an application
may remove ruby-vips from its Gemfile to avoid both.
The minimum supported version of libvips is now 8.13, and the minimum supported version of
ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted
operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise
a
RuntimeErrorwhile booting rather than run in an unsecurable environment.[GHSA-xr9x-r78c-5hrm]
[CVE-2026-66066]
Mike Dalessio
Action Mailbox
Action Text
Railties
Guides
v7.2.3.1: 7.2.3.1Compare Source
Active Support
Reject scientific notation in NumberConverter
[CVE-2026-33176]
Jean Boussier
Fix
SafeBuffer#%to preserve unsafe status[CVE-2026-33170]
Jean Boussier
Improve performance of NumberToDelimitedConverter
[CVE-2026-33169]
Jean Boussier
Active Model
Active Record
Action View
Skip blank attribute names in tag helpers to avoid generating invalid HTML.
[CVE-2026-33168]
Mike Dalessio
Action Pack
Active Job
Action Mailer
Action Cable
Active Storage
Filter user supplied metadata in DirectUploadController
[CVE-2026-33173]
Jean Boussier
Configurable maxmimum streaming chunk size
Makes sure that byte ranges for blobs don't exceed 100mb by default.
Content ranges that are too big can result in denial of service.
[CVE-2026-33174]
Gannon McGibbon
Limit range requests to a single range
[CVE-2026-33658]
Jean Boussier
Prevent path traversal in
DiskService.DiskService#path_fornow raises anInvalidKeyErrorwhen passed keys with dot segments (".",".."), or if the resolved path is outside the storage root directory.
#path_foralso now consistently raisesInvalidKeyErrorif the key is invalid in any way, forexample containing null bytes or having an incompatible encoding. Previously, the exception
raised may have been
ArgumentErrororEncoding::CompatibilityError.DiskControllernow explicitly rescuesInvalidKeyErrorwith appropriate HTTP status codes.[CVE-2026-33195]
Mike Dalessio
Prevent glob injection in
DiskService#delete_prefixed.Escape glob metacharacters in the resolved path before passing to
Dir.glob.Note that this change breaks any existing code that is relying on
delete_prefixedto expandglob metacharacters. This change presumes that is unintended behavior (as other storage services
do not respect these metacharacters).
[CVE-2026-33202]
Mike Dalessio
Action Mailbox
Action Text
Railties
Guides
rspec/rspec-rails (rspec-rails)
v8.0.4Compare Source
Full Changelog
Released to relax version constraint for rspec to allow 4.0.0.beta1.
v8.0.3Compare Source
Full Changelog
Bug Fixes:
lookup_context. (Stephen Nelson, #2749)rails statslooks for specs using application root rather than working directory.(Marvin Tangpos, #2879)
rubocop/rubocop (rubocop)
v1.89.0Compare Source
New features
DelegatingMethodsoption toLint/DuplicateMethodsto register customdelegate-shaped methods. ([@bbatsov][])DisallowedCopsconfiguration option toStyle/DisableCopsWithinSourceCodeDirective. ([@hammadxcm][])AllowYARDCommentBlockSeparatoroption toLayout/LeadingCommentSpace. ([@koic][])Lint/DeprecatedReferencecop to detect references to methods and constants documented as@deprecated, powered by the project index. ([@bbatsov][])Lint/NameTypocop. ([@bbatsov][])Lint/UnusedPrivateMethodcop for project-wide dead-code detection via the project index (disabled by default). ([@bbatsov][])Style/DisableCopsWithinSourceCodeDirectiveimpossible to disable via directive comments when explicitly enabled withEnabled: true. ([@rafaelfranca][])textDocument/codeActionrequests in the built-in language server, so LSP clients that request code actions (Eglot, Helix, Flycheck, ...) can apply RuboCop's autocorrects, not only clients that read them off the published diagnostic. ([@bbatsov][])NewCopsin department configuration to enable pending cops per department, including cops added up to a specific version (e.g.Style: NewCops: '1.19'). ([@koic][])Layout/IndentationWidthandStyle/ClassAndModuleChildren. ([@ioquatix][], [@koic][])Bug fixes
Lint/ToEnumArgumentswhen explicit extra keyword arguments are passed (e.g.def m(x:); to_enum(:m, x: x, y: 1); end), which raisesArgumentErrorwhen the enumerator is used. ([@RedZapdos123][])Layout/HashAlignmentwhen usingEnforcedHashRocketStyle: tableand a hash key spans multiple lines. ([@dduugg][])Lint/UselessAssignmentwith modifier conditions. ([@bbatsov][])Lint/Voidwith setter methods. ([@bbatsov][])Naming/VariableNumberwhen using an empty symbol hash key. ([@koic][])Style/MutableConstantwithData.define. ([@bbatsov][])Style/MissingRespondToMissingwhenrespond_to_missing?is defined in a reopening of the class andUseProjectIndexis enabled. ([@bbatsov][])Lint/LiteralAsConditionwhen a literal condition has an empty branch. ([@koic][])Lint/UselessRuby2Keywordswhenruby2_keywordsis used with a symbol but no method definition is found. ([@koic][])Metrics/MethodLengthwhen a method contains a heredoc and__ENCODING__. ([@koic][])Style/ArrayIntersectcop when the block-based check callsmember?/include?without an explicit receiver. ([@dduugg][])Style/NegativeArrayIndexcop. ([@viralpraxis][])Style/RedundantFormatwhen a format string uses a positional argument number beyond the 64-bit range. ([@koic][])Style/RedundantFormatwhen the argument for a positional variable width is missing. ([@koic][])Lint/LiteralInInterpolation. ([@bbatsov][])Style/ArrayIntersectwhen using safe navigationnone?with a block. ([@koic][])Style/MultipleComparisonthat dropped an allowed method comparison appearing between the compared values. ([@bbatsov][])Style/RedundantFileExtensionInRequirethat produced invalid Ruby when a backslash preceded the.rbextension. ([@bbatsov][])Lint/Voidto no longer autocorrect a constant used in a void context, since removing it can change behavior through constant autoloading side effects. ([@bbatsov][])Lint/InheritExceptionwhenExceptionis inherited indirectly through a project class (UseProjectIndex). ([@bbatsov][])Lint/AmbiguousAssignmentwhen using attribute or index assignment. ([@sngsmz][])Layout/ClassStructurewhen class body elements are wrapped inbeginblocks. ([@koic][])Layout/ClassStructurewhen usingprivate_class_methodorpublic_class_methoddef modifiers. ([@koic][])Style/ArrayIntersectwhen the receiver ofinclude?in a block is not an array literal. ([@koic][])Style/MultilineIfThenwhen using the Prism parser engine and anelsifwithoutthenfollows a branch usingthenwith a body on the same line. ([@koic][])Lint/DuplicateMethodsfor anonymous classes (Class.new) passed as arguments to the same named-receiver method call (e.g.T.cast). EachClass.newblock is an independent class, so methods defined in different blocks should not be treated as duplicates. ([@rafaelfranca][])Style/RedundantConstantBaseinside namespaces when the constant provably resolves identically without::(UseProjectIndex). ([@bbatsov][])Style/LambdaandStyle/SymbolProcproducing a syntax error like->(x)(&:method)when both cops run onlambda { |x| x.method }. ([@koic][])UseProjectIndex). ([@bbatsov][])Layout/LineLengthautocorrection for endless methods with block bodies. ([@hervetatche][])Lint/ConstantReassignmentwhen a built-in constant name is assigned andUseProjectIndexis enabled. ([@bbatsov][])Style/ClassAndModuleChildrenignoringEnforcedStyleForClassesandEnforcedStyleForModules, and skip autocorrection when mixed per-type styles make the result ambiguous. ([@bbatsov][])Layout/MultilineMethodCallIndentationwhen a line has multiple chained calls before a single-line block. ([@hammadxcm][])Style/RedundantLineContinuationby verifying backslash removal against a reparse of the source instead of hand-written grammar rules. ([@bbatsov][])Naming/PredicatePrefixandNaming/AccessorMethodNamewhen the method overrides an ancestor method defined in the project (UseProjectIndex). ([@bbatsov][])Style/StaticClasswhen the class is subclassed elsewhere in the project (UseProjectIndex). ([@bbatsov][])Style/MethodCallWithArgsParenthesesomit_parenthesesstyle by verifying each omission by reparsing before registering an offense. ([@bbatsov][])Changes
Style/Documentationto accept a reopened class or module documented at another definition site whenUseProjectIndexis enabled. ([@bbatsov][])rubocop-i18nto suggested extensions. ([@tejasbubane][])executeCommandProviderand the supported code action kinds in the language server's capabilities, so clients can discover therubocop.formatAutocorrectsandrubocop.formatAutocorrectsAllcommands. ([@bbatsov][])AllCops/UseProjectIndexis enabled. ([@bbatsov][])Lint/AmbiguousBlockAssociationto detectdo...endblocks likely intended for enumerable methods in arguments. ([@hammadxcm][])Layout/LineLengthperformance on files with large collection literals. ([@koic][])Style/ConditionalAssignmentskip cases it cannot safely rewrite instead of emitting invalid code or erroring on unusual branch shapes. ([@bbatsov][])Style/IfUnlessModifieroffense message when the condition is part of a larger expression. ([@rafa-el-souza][])Style/DisableCopsWithinSourceCodeDirectiveperformance on largeAllowedCopsandDisallowedCopslists by matching directives against memoized sets instead of rebuilding an array lookup per comment. ([@corsonknowles][])Style/RedundantLineContinuationperformance on files with many adjacent string literals joined by line continuations. ([@koic][])Lint/DuplicateMethodsto detect duplicates across files whenUseProjectIndexis enabled. ([@bbatsov][])Style/IfUnlessModifier,Style/WhileUntilModifier,Style/GuardClause, and other modifier cops respectLayout/LineLengthexemptions (allowed patterns, cop directives, allowed URIs) when checking whether the modifier form fits on one line. ([@bbatsov][])Lint/SafeNavigationChainautocorrection as unsafe. ([@koic][])Lint/ConstantResolutionto report only genuinely ambiguous constants whenUseProjectIndexis enabled. ([@bbatsov][])Style/RedundantAssignmentoffenses when there are comments between assignment and reference. ([@lovro-bikic][])Style/ClassAndModuleChildrenautocorrection to consult the project index for the namespace kind and definition sites whenUseProjectIndexis enabled. ([@bbatsov][])Lint/MissingSuperto skip the constructor offense when the project index shows no ancestor definesinitialize(UseProjectIndex). ([@bbatsov][])Style/Copyrightto validateAutocorrectNoticeonly when autocorrection is requested (-a/-A), so plain inspection no longer raises a warning. ([@koic][])Layout/RedundantLineBreakto verify each correction by reparsing before registering an offense. ([@bbatsov][])Style/RedundantParenthesesto verify each correction by reparsing before registering an offense. ([@bbatsov][])Style/SoleNestedConditionalto only register an offense when its correction is verified to parse. ([@bbatsov][])v1.88.2Compare Source
Bug fixes
Lint/ToJSON, which did not flag singletondef self.to_jsondefinitions. ([@bbatsov][])Lint/UnreachableCode, which only flagged the first statement after a flow-of-control statement instead of every unreachable statement that followed it. ([@bbatsov][])Lint/UselessNumericOperation, which only flagged bare method-call receivers and ignored local variables, instance/class/global variables, and constants (e.g.@x + 0,CONST * 1). ([@bbatsov][])Lint/Voidwhere safe-navigation calls to nonmutating methods (e.g.x&.sort) were not flagged whenCheckForMethodsWithNoSideEffectsis enabled. ([@bbatsov][])Style/ArrayIntersectwith the block form usinginclude?(e.g.array1.any? { |e| array2.include?(e) }), which was only detected formember?. ([@bbatsov][])Style/CollectionCompact, which did not flaggrep_v(nil)/grep_v(NilClass)on a safe-navigation call (e.g.array&.grep_v(nil)). ([@bbatsov][])Style/DefWithParentheseswith a single-line definition whose body follows a semicolon (e.g.def foo(); end), where the parentheses can be safely omitted. ([@bbatsov][])Style/MixinUsagewhen including multiple modules in one statement. ([@bbatsov][])Style/ModuleFunctionwhen the module body is a single statement. ([@bbatsov][])Style/RedundantCurrentDirectoryInPathwith double-quoted strings containing interpolation. ([@bbatsov][])Style/RedundantHeredocDelimiterQuoteswith double-quoted delimiters whose body contains interpoConfiguration
📅 Schedule: (in timezone Europe/Amsterdam)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.