chore(deps): update all non-major bundler dependencies - #1226
Open
renovate[bot] wants to merge 1 commit into
Open
chore(deps): update all non-major bundler dependencies#1226renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## staging #1226 +/- ##
========================================
Coverage 77.59% 77.59%
========================================
Files 54 54
Lines 1406 1406
========================================
Hits 1091 1091
Misses 315 315 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
6 times, most recently
from
February 7, 2026 04:51
798ae9a to
87d76d0
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
9 times, most recently
from
February 17, 2026 23:58
354ff24 to
5635ee4
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
February 23, 2026 21:27
4782a50 to
5ce8e84
Compare
Contributor
Author
|
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
March 2, 2026 14:54
a2ffd1b to
17a6987
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
March 9, 2026 09:47
220dace to
b2a9253
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
5 times, most recently
from
April 17, 2026 15:51
e247aa9 to
ca69050
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
6 times, most recently
from
April 29, 2026 00:54
1f83c9b to
7771100
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
May 8, 2026 06:03
cb74aca to
af714f9
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
4 times, most recently
from
May 15, 2026 21:46
2eae179 to
dd0716e
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
3 times, most recently
from
May 22, 2026 15:38
b479dfd to
af052e7
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
5 times, most recently
from
May 30, 2026 10:11
cfcdbca to
02d1898
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch-bundler
branch
2 times, most recently
from
June 2, 2026 17:08
b13fec2 to
b09f88b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
'~> 1.21.1'→'~> 1.25.0''~> 8.0.1'→'~> 8.0.6''~> 8.1'→'~> 8.1', '>= 8.1.3''~> 2.1.1'→'~> 2.1.3''~>1.15.0'→'~>1.16.0''~> 3.6.0'→'~> 3.8.0''~> 1.2.6'→'~> 1.2.10''~> 2.14.1'→'~> 2.15.1''~> 4.18.0'→'~> 4.19.0''~> 3.1', '>= 3.1.5'→'~> 3.2', '>= 3.2.1''~> 7.2.3'→'~> 7.2.3', '>= 7.2.3.2''~> 8.0.2'→'~> 8.0.4''~> 1.84.0'→'~> 1.90.0''~> 1.26', '>= 1.26.1'→'~> 1.27''~> 2.34', '>= 2.34.3'→'~> 2.37''~> 3.9'→'~> 3.10', '>= 3.10.2''~> 6.3'→'~> 6.7''~> 6.3'→'~> 6.7''~> 6.3'→'~> 6.7''~> 8.0.10'→'~> 8.1.7''~> 6.0.1'→'~> 6.0.2''~> 4.4.0'→'~> 4.7.0''~> 0.9.10'→'~> 0.9.11''~> 4.2.1'→'~> 4.3.0'Release Notes
presidentbeef/brakeman (brakeman)
v8.0.6Compare Source
v8.0.5Compare Source
quote_schema_nameto safe quote method list (Zsolt Kozaroczy)compact_blank/compacton permitted params (Arpit Jain)text(Arpit Jain).rawcalls (Federico Franco)TemplateAliasProcessor#template_namearity (viralpraxis)v8.0.4Compare Source
--ensure-latestv8.0.3Compare Source
polymorphic_nameSQLi false positive (Fredrico Franco)--ensure-latestv8.0.2Compare Source
flyerhzm/bullet (bullet)
v8.1.3Compare Source
v8.1.2Compare Source
belongs_towhose*_typecolumn is nil. ActiveRecord short-circuits the reader to nil without issuing SQL, so the access cannot represent an N+1 query and preloading would be a no-op.Set#<<corruption inUnusedEagerLoading#add_eager_loadingssplit branchv8.1.1Compare Source
djezzzl/database_consistency (database_consistency)
v2.1.3Compare Source
MissingDependentDestroyCheckerto support composite keys. Thanks Andy Allan for reporting this!v2.1.2Compare Source
ForeignKeyTypeCheckerto support composite keys. Thanks Quentin de Metz for reporting this!MissingUniqueIndexCheckerto support composite keys. Thanks Andy Allan for reporting this!devise-i18n/devise-i18n (devise-i18n)
v1.16.0Compare Source
d13ef8941003bf. Translations of this string are unaffected.faker-ruby/faker (faker)
v3.8.0Compare Source
Enabling lazy load
This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.
Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:
1 - Set lazy load as a Faker Config
Faker::Config.lazy_loading = true2 - Set lazy load as an environment variable
FAKER_LAZY_LOAD = 1We hope you get to see the improvement by enabling it. Please file a bug report for any issues!
Thanks to @jeremyevans for the mentoring, and to @thdaraujo for pairing and code reviews.
Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0
v3.7.1Compare Source
Enabling lazy load
This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.
Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:
1 - Set lazy load as a Faker Config
Faker::Config.lazy_loading = true2 - Set lazy load as an environment variable
FAKER_LAZY_LOAD = 1We hope you get to see the improvement by enabling it. Please file a bug report for any issues!
Thanks to @jeremyevans for the mentoring, and to @thdaraujo for pairing and code reviews.
Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0
v3.6.1Compare Source
It's almost Spring time in the Northern hemisphere 🌸
Security, performance improvements and bug fixes
ja/address.ymlwith a 7-digit format by @thdaraujo in #3201Update development dependencies
New Contributors
Full Changelog: faker-ruby/faker@v3.6.0...v3.6.1
Studiosity/grover (grover)
v1.2.10Compare Source
Fixed
v1.2.9Compare Source
Added
v1.2.8Compare Source
Added
v1.2.7Compare Source
Added
rails/jbuilder (jbuilder)
v2.15.1Compare Source
What's Changed
New Contributors
Full Changelog: rails/jbuilder@v2.15.0...v2.15.1
v2.15.0Compare Source
What's Changed
KeyFormatteron cache hits by @moberegger in #607array!andset!by @moberegger in #604:unprocessable_contentfor scaffolds with Rack 3.1 or higher by @taketo1113 in #603_map_collectionby @moberegger in #612New Contributors
Full Changelog: rails/jbuilder@v2.14.1...v2.15.0
mollie/mollie-api-ruby (mollie-api-ruby)
v4.19.0Compare Source
c61808e) Allow bigdecimal 4.xomniauth/omniauth-identity (omniauth-identity)
v3.2.1Compare Source
Added
Changed
binstubs, and development dependency floors with
kettle-jemv7.0.0.anonymous_loaderruntime dependency floor to>= 0.1.3.auth-sanitizerto>= 0.2.3, soOmniAuth Identity consumers get hash and nested-attribute inspect redaction
fixes plus downstream RBS duplicate-declaration fixes, and switched isolated
sanitizer loading to the released
anonymous_loadergem.version_gemandappraisal2dependency floors toversion_gem>= 1.1.14 andappraisal2>= 3.1.4.Fixed
Restored ORM-specific spec rake tasks and made optional ORM spec files avoid
loading unavailable adapter gems when the matching appraisal does not include them.
Package configured license files in gem release file lists.
v3.2.0Compare Source
Added
OmniAuth::Identity::VERSIONas the traditional public versionconstant, in addition to
OmniAuth::Identity::Version::VERSION.Changed
and development dependency floors from the current kettle-jem template.
so concurrent callers do not race while reading or updating authentication
keys, ROM adapter settings, or BCrypt minimum-cost mode.
Fixed
kettle-testruns skip CouchDB, MongoDB, and RethinkDB adapterspecs by default unless the matching service adapter environment variable is enabled.
Security
auth-sanitizerintegration so identity model#inspectoutputfilters password-related attributes by default.
rails/rails (rails)
v7.2.3.2: 7.2.3.2Compare Source
Active Support
Active Model
Active Record
Action View
Action Pack
Active Job
Action Mailer
Action Cable
Active Storage
Disable libvips's unfuzzed image loaders and savers.
libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only
safe for trusted content. Active Storage will call
Vips.block_untrusted(true)to disable themwhile booting. An application that needs a specific loader or saver may re-enable it in an
initializer.
This is a breaking change for applications that process image types with an unfuzzed loader or
saver. Variant transformation of BMP, ICO, and PSD attachments will raise
Vips::Error, andanalysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer
record
widthandheight. Requesting an unfuzzed output format, typically FITS, JXL, oranything delegated to ImageMagick, will also raise
Vips::Error. Attaching, storing, anddownloading are unchanged.
An application seeing
Vips::Errorraised during image transformation may wish to remove theaffected content types from
config.active_storage.variable_content_typesin an initializer.Active Storage will then treat those attachments as not variable and will not generate variants
for them. This most often matters to an application that transforms images during a request
rather than in a background job, where the failure surfaces as an error response instead of a
failed job.
Applications using the
:mini_magickvariant processor will see no change in how theirattachments are processed, but the loaders and savers will be disabled process-wide whenever
ruby-vips is installed, and the version requirements below will still apply. Such an application
may remove ruby-vips from its Gemfile to avoid both.
The minimum supported version of libvips is now 8.13, and the minimum supported version of
ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted
operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise
a
RuntimeErrorwhile booting rather than run in an unsecurable environment.[GHSA-xr9x-r78c-5hrm]
[CVE-2026-66066]
Mike Dalessio
Action Mailbox
Action Text
Railties
Guides
v7.2.3.1: 7.2.3.1Compare Source
Active Support
Reject scientific notation in NumberConverter
[CVE-2026-33176]
Jean Boussier
Fix
SafeBuffer#%to preserve unsafe status[CVE-2026-33170]
Jean Boussier
Improve performance of NumberToDelimitedConverter
[CVE-2026-33169]
Jean Boussier
Active Model
Active Record
Action View
Skip blank attribute names in tag helpers to avoid generating invalid HTML.
[CVE-2026-33168]
Mike Dalessio
Action Pack
Active Job
Action Mailer
Action Cable
Active Storage
Filter user supplied metadata in DirectUploadController
[CVE-2026-33173]
Jean Boussier
Configurable maxmimum streaming chunk size
Makes sure that byte ranges for blobs don't exceed 100mb by default.
Content ranges that are too big can result in denial of service.
[CVE-2026-33174]
Gannon McGibbon
Limit range requests to a single range
[CVE-2026-33658]
Jean Boussier
Prevent path traversal in
DiskService.DiskService#path_fornow raises anInvalidKeyErrorwhen passed keys with dot segments (".",".."), or if the resolved path is outside the storage root directory.
#path_foralso now consistently raisesInvalidKeyErrorif the key is invalid in any way, forexample containing null bytes or having an incompatible encoding. Previously, the exception
raised may have been
ArgumentErrororEncoding::CompatibilityError.DiskControllernow explicitly rescuesInvalidKeyErrorwith appropriate HTTP status codes.[CVE-2026-33195]
Mike Dalessio
Prevent glob injection in
DiskService#delete_prefixed.Escape glob metacharacters in the resolved path before passing to
Dir.glob.Note that this change breaks any existing code that is relying on
delete_prefixedto expandglob metacharacters. This change presumes that is unintended behavior (as other storage services
do not respect these metacharacters).
[CVE-2026-33202]
Mike Dalessio
Action Mailbox
Action Text
Railties
Guides
rspec/rspec-rails (rspec-rails)
v8.0.4Compare Source
Full Changelog
Released to relax version constraint for rspec to allow 4.0.0.beta1.
v8.0.3Compare Source
Full Changelog
Bug Fixes:
lookup_context. (Stephen Nelson, #2749)rails statslooks for specs using application root rather than working directory.(Marvin Tangpos, #2879)
rubocop/rubocop (rubocop)
v1.90.0Compare Source
New features
AllowTrailingCommentoption toStyle/DisableCopsWithinSourceCodeDirective. ([@bbatsov][])disable-nextdirectives scoped to the following statement. ([@bbatsov][])--display-suppressedoption to also report offenses suppressed by directive comments, including their--justification in the JSON formatter. ([@bbatsov][])Lint/ArgumentMismatchcop. ([@bbatsov][])Lint/SuperArgumentMismatchcop. ([@bbatsov][])Style/TimeNowcop. ([@Starlexxx][])NumberOfEmptyLinesoption toLayout/EmptyLineAfterMagicCommentto configure the minimum number of empty lines required after magic comments. ([@alejofraga][])--report-unused-todo-entriesto catch rotting todo files. ([@bbatsov][])Style/DirectiveScopecop to flagdisable/enablepairs and disable-onlypush/popscopes that wrap a single statement and can usedisable-nextinstead. ([@bbatsov][])Lint/RedundantCopEnableDirectiveflag# rubocop:popdirectives without a matching# rubocop:push. ([@bbatsov][])Bug fixes
Lint/NameTypoandLint/UnusedPrivateMethodon string literals with invalid encoding. ([@bbatsov][])Lint/OutOfRangeRegexpRefwhen a preceding element access with a non-string literal argument (e.g.hash[:key]) discarded the tracked capture count. ([@koic][])--disable-uncorrectable. ([@bbatsov][])workspace/executeCommandrequest has no document URI in its arguments. ([@koic][])Naming/BinaryOperatorParameterName. ([@bbatsov][])Style/Samplewhenshuffleis given arandom:argument; the offense is still reported but no longer autocorrected, sinceshuffleandsampleconsume a seeded generator differently and would select different elements. ([@koic][])Layout/FirstArgumentIndentationwhenEnforcedStyle: with_fixed_indentationis specified forLayout/ArgumentAlignmentandLayout/FirstMethodArgumentLineBreakis enabled withAllowMultilineFinalElement: true. ([@Starlexxx][])RuboCop::Cop::IgnoredMethodsandRuboCop::Cop::IgnoredPatternbeing unreachable afterrequire 'rubocop'. ([@SeanLF][])Layout/ExtraSpacing. ([@Starlexxx][])Layout/LineLengthwhen a constant path likeHttp::UploadedFilematchesURISchemescase-insensitively. ([@koic][])Lint/UselessConstantScopingwhen assigning withClass.new,Module.new,Struct.new, orData.defineafterprivate. ([@pdobb][])Layout/MultilineMethodCallIndentationwhen a line has multiple single-line blocks before a multiline block. ([@koic][])Lint/ConstantReassignmentwhen a constant is assigned in compact-style namespaces (e.g.module A::B). ([@alex-tan][])Lint/RedundantSafeNavigationwhenInferNonNilReceiveris enabled and the receiver name is rebound by a nested block (itor a shadowed block parameter). ([@koic][])RuboCop::Cop::Registry#freezeto freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@koic][])Lint/DuplicateMethodshonorsilence_redefinition_of_methodandredefine_methodas intentional redefinitions. ([@bbatsov][])--display-suppressedreporting aniljustificationwhen the offense is loaded from the result cache. ([@corsonknowles][])Layout/ClassStructureautocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@koic][])Lint/NameTyporegistering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@HoneyryderChuck][])Lint/UnusedPrivateMethodretaining every pastproject_indexobject it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such asrubocop --server. ([@bquorning][])Lint/UselessMethodDefinitionfalse positive for methods with**kwargs. ([@bbatsov][])--lspand--mcpbeing silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@koic][])Excludesettings. ([@bbatsov][])Layout/LineLengthMaxwhen exemptions likeAllowedPatternsmatched the result. ([@bbatsov][])AllCops does not support TargetRailsVersion parameterwhen a plugin declares a customAllCopskey with a nil value and another plugin is loaded after it. ([@koic][])Style/StringConcatenationautocorrect. ([@bbatsov][])rubocop .(and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower thanrubocopin projects with large ignored trees. ([@bbatsov][])Lint/RedundantCopDisableDirectiveandLint/RedundantCopEnableDirectiveleaving a directive's--reason behind when removing the directive. ([@corsonknowles][])Lint/UnusedPrivateMethodfor private definitions of Ruby runtime hooks likeinheritedandconst_missing. ([@bbatsov][])Lint/MissingCopEnableDirectivesuggest# rubocop:popinstead of# rubocop:enablefor an unclosed# rubocop:push. ([@bbatsov][])Lint/UnusedPrivateMethodwhen a method name is composed with an interpolated symbol or string prefix. ([@bbatsov][])Changes
AllowedCrossFilePathsoption toLint/DuplicateMethodsto skip cross-file duplicates in configured paths. ([@bbatsov][])AllowedNamesandAllowedPatternsoptions toLint/UnusedPrivateMethod. ([@bbatsov][])StyleGuidemetadata for 21 cops and fix four broken style guide links. ([@bbatsov][])Lint/DeprecatedReferenceperformance by short-circuitingdeprecated?. ([@connorshea][])Lint/NameTypoperformance by deferring the literal-name scan. ([@connorshea][])AllowForAlignmentto no longer treat a same-indentation line beyond the enclosing block as an alignment anchor forLayout/ExtraSpacing,Layout/SpaceAroundOperators, andLayout/SpaceBeforeFirstArg. ([@koic][])<testcase>elements only for cops enabled for each inspected file, instead of all cops. ([@koic][])Layout/SpaceAroundOperatorsaware of endless method definitions. ([@koic][])Lint/CopDirectiveSyntaxcatch keyword typos and unknown cop names. ([@bbatsov][])v1.89.0Compare Source
New features
DelegatingMethodsoption toLint/DuplicateMethodsto register customdelegate-shaped methods. ([@bbatsov][])DisallowedCopsconfiguration option toStyle/DisableCopsWithinSourceCodeDirective. ([@hammadxcm][])AllowYARDCommentBlockSeparatoroption toLayout/LeadingCommentSpace. ([@koic][])Lint/DeprecatedReferencecop to detect references to methods and constants documented as@deprecated, powered by the project index. ([@bbatsov][])Lint/NameTypocop. ([@bbatsov][])Lint/UnusedPrivateMethodcop for project-wide dead-code detection via the project index (disabled by default). ([@bbatsov][])Style/DisableCopsWithinSourceCodeDirectiveimpossible to disable via directive comments when explicitly enabled withEnabled: true. ([@rafaelfranca][])textDocument/codeActionrequests in the built-in language server, so LSP clients that request code actions (Eglot, Helix, Flycheck, ...) can apply RuboCop's autocorrects, not only clients that read them off the published diagnostic. ([@bbatsov][])NewCopsin department configuration to enable pending cops per department, including cops added up to a specific version (e.g.Style: NewCops: '1.19'). ([@koic][])Layout/IndentationWidthandStyle/ClassAndModuleChildren. ([@ioquatix][], [@koic][])Bug fixes
Lint/ToEnumArgumentswhen explicit extra keyword arguments are passed (e.g.def m(x:); to_enum(:m, x: x, y: 1); end), which raisesArgumentErrorwhen the enumerator is used. ([@RedZapdos123][])Layout/HashAlignmentwhen usingEnforcedHashRocketStyle: tableand a hash key spans multiple lines. ([@dduugg][])Lint/UselessAssignmentwith modifier conditions. ([@bbatsov][])Lint/Voidwith setter methods. ([@bbatsov][])Naming/VariableNumberwhen using an empty symbol hash key. ([@koic][])Style/MutableConstantwithData.define. ([@bbatsov][])Style/MissingRespondToMissingwhenrespond_to_missing?is defined in a reopening of the class andUseProjectIndexis enabled. ([@bbatsov][])Lint/LiteralAsConditionwhen a literal condition has an empty branch. ([@koic][])Lint/UselessRuby2Keywordswhenruby2_keywordsis used with a symbol but no method definition is found. ([@koic][])Metrics/MethodLengthwhen a method contains a heredoc and__ENCODING__. ([@koic][])Style/ArrayIntersectcop when the block-based check callsmember?/include?without an explicit receiver. ([@dduugg][])Style/NegativeArrayIndexcop. ([@viralpraxis][])Style/RedundantFormatwhen a format string uses a positional argument number beyond the 64-bit range. ([@koic][])Style/RedundantFormatwhen the argument for a positional variable width is missing. ([@koic][])Lint/LiteralInInterpolation. ([@bbatsov][])Style/ArrayIntersectwhen using safe navigationnone?with a block. ([@koic][])Style/MultipleComparisonthat dropped an allowed method comparison appearing between the compared values. ([@bbatsov][])Style/RedundantFileExtensionInRequirethat produced invalid Ruby when a backslash precConfiguration
📅 Schedule: (in timezone Europe/Amsterdam)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.