Skip to content

Bump the bundler group across 2 directories with 6 updates#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/docs/bundler-62a1a79789
Open

Bump the bundler group across 2 directories with 6 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/docs/bundler-62a1a79789

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot bot commented on behalf of github Dec 13, 2025

Bumps the bundler group with 1 update in the /docs directory: rexml.
Bumps the bundler group with 4 updates in the / directory: activerecord, sinatra, mqtt and net-imap.

Updates rexml from 3.4.1 to 3.4.2

Release notes

Sourced from rexml's releases.

REXML 3.4.2 - 2025-08-26

Improvement

  • Improved performance.

  • Raise appropriate exception when failing to match start tag in DOCTYPE

  • Deprecate accepting array as an element in XPath.match, first and each

    • GH-252
    • Patch by tomoya ishida

  • Don't call needless encoding_updated

    • GH-259
    • Patch by Sutou Kouhei

  • Reuse XPath::match

  • Cache redundant calls for doctype

  • Use Safe Navigation (&.) from Ruby 2.3

  • Remove redundant return statements

  • Added XML declaration check & Source#skip_spaces method

    • GH-282
    • Patch by NAITOH Jun
    • Reported by Sofi Aberegg

Fixes

  • Fix docs typo
    • GH-248
    • Patch by James Coleman

... (truncated)

Changelog

Sourced from rexml's changelog.

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

  • Improved performance.

  • Raise appropriate exception when failing to match start tag in DOCTYPE

  • Deprecate accepting array as an element in XPath.match, first and each

    • GH-252
    • Patch by tomoya ishida

  • Don't call needless encoding_updated

    • GH-259
    • Patch by Sutou Kouhei

  • Reuse XPath::match

  • Cache redundant calls for doctype

  • Use Safe Navigation (&.) from Ruby 2.3

  • Remove redundant return statements

  • Added XML declaration check & Source#skip_spaces method

    • GH-282
    • Patch by NAITOH Jun
    • Reported by Sofi Aberegg

Fixes

  • Fix docs typo
    • GH-248
    • Patch by James Coleman

... (truncated)

Commits

Updates activerecord from 7.2.2.1 to 7.2.3

Release notes

Sourced from activerecord's releases.

7.2.3

Active Support

  • Fix Enumerable#sole to return the full tuple instead of just the first element of the tuple.

    Olivier Bellone

  • Fix parallel tests hanging when worker processes die abruptly.

    Previously, if a worker process was killed (e.g., OOM killed, kill -9) during parallel test execution, the test suite would hang forever waiting for the dead worker.

    Joshua Young

  • ActiveSupport::FileUpdateChecker does not depend on Time.now to prevent unnecessary reloads with time travel test helpers

    Jan Grodowski

  • Fix ActiveSupport::BroadcastLogger from executing a block argument for each logger (tagged, info, etc.).

    Jared Armstrong

  • Fix ActiveSupport::HashWithIndifferentAccess#transform_keys! removing defaults.

    Hartley McGuire

  • Fix ActiveSupport::HashWithIndifferentAccess#tranform_keys! to handle collisions.

    If the transformation would result in a key equal to another not yet transformed one, it would result in keys being lost.

    Before:

    >> {a: 1, b: 2}.with_indifferent_access.transform_keys!(&:succ)
=> {"c" => 1}

    After:

    >> {a: 1, b: 2}.with_indifferent_access.transform_keys!(&:succ)
=> {"c" => 1, "d" => 2}

    Jason T Johnson, Jean Boussier

  • Fix ActiveSupport::Cache::MemCacheStore#read_multi to handle network errors.

    This method specifically wasn't handling network errors like other codepaths.

... (truncated)

Commits
  • bb2bdef Preparing for 7.2.3 release
  • 40e5415 Sync CHANGELOG
  • 35ad36a Merge pull request #55969 from rails/fix-explain-tests-mysql-9.5
  • 766a8e1 Merge pull request #55925 from flavorjones/flavorjones/shard-swap-prohibition...
  • 31217f6 Merge pull request #55907 from ruyrocha/fix/sqlite3-data-loss
  • 95f14a4 Merge pull request #55332 from zzak/re-54882
  • 8ee0169 Merge pull request #55778 from ianterrell/ianterrell/fix-autosave-changed-via...
  • b14489e Sync CHANGELOG
  • e00df05 Merge pull request #55722 from kozy4324/fix-lease-sticky-flag-timing
  • 1ee7049 Merge pull request #55703 from byroot/hly-fix-query-cache-system-tests-2
  • Additional commits viewable in compare view

Updates sinatra from 3.2.0 to 4.2.0

Changelog

Sourced from sinatra's changelog.

4.2.0 / 2025-10-08

  • New: Add :static_headers setting for custom headers in static file responses (#2089)
  • Fix: Fix regex in etag_matches? to prevent ReDoS (#2121)
  • Fix: PATH_INFO can never be empty (#2114)
  • Fix: Fix malformed Content-Type headers (#2081)
  • Fix: Avoid crash for integer values in content_type parameters (#2078)

4.1.1 / 2024-11-20

  • Fix: Restore WEBrick support (#2067)

4.1.0 / 2024-11-18

  • New: Add host_authorization setting (#2053)
    • Defaults to .localhost, .test and any IP address in development mode.
    • Security: addresses CVE-2024-21510.
  • Fix: Return an instance of Sinatra::IndifferentHash when calling #except (#2044)
  • Fix: Address warning from URI for Ruby 3.4 (#2060)
  • Fix: rackup no longer depends on WEBrick, recommend Puma instead (4a558503)
  • Fix: Zeitwerk 2.7.0+ compatibility (#2050)
  • Fix: Address warning about Hash construction for Ruby 3.4 (#2028)
  • Fix: Declare missing dependencies for Ruby 3.5 (#2032)
  • Fix: Compatibility with --enable-frozen-string-literal (#2033)
  • Fix: Rack 3.1 compatibility (#2035)
    • Don't depend on Rack::Logger
    • Don't delete content-length header when Rack::Files is used

4.0.1 / 2025-05-24

  • Rack 3.1 compatibility (#2035)

  • Fix malformed Content-Type headers (#2081)

  • Avoid crash for integer values in content_type parameters (#2078)

  • Fix compatibility with --enable-frozen-string-literal (#2033)

  • Declare missing dependencies for Ruby 3.5 (#2032)

  • Fix warning about Hash construction. (#2028)

  • Support Zeitwerk 2.7.0+ (#2050)

  • Address URI depreciation (#2060)

#2035: sinatra/sinatra#2035 #2081: sinatra/sinatra#2081 #2078: sinatra/sinatra#2078 #2033: sinatra/sinatra#2033

... (truncated)

Commits

Updates rack from 2.2.17 to 3.2.4

Release notes

Sourced from rack's releases.

v3.2.4

No release notes provided.

v3.0.9.1

What's Changed

Full Changelog: rack/rack@v3.0.9...v3.0.9.1

v3.0.9

What's Changed

  • Fix content-length calcuation in Rack:Response#write #2150

Full Changelog: rack/rack@v3.0.8...v3.0.9

v3.0.8

What's Changed

New Contributors

Full Changelog: rack/rack@v3.0.7...v3.0.8

v3.0.7

What's Changed

Full Changelog: rack/rack@v3.0.6.1...v3.0.7

v3.0.6.1

No release notes provided.

v3.0.4.1

Full Changelog: rack/rack@v3.0.4...v3.0.4.1

v3.0.4

Full Changelog: rack/rack@v3.0.3...v3.0.4

v3.0.3

What's Changed

Full Changelog: rack/rack@v3.0.2...v3.0.3

... (truncated)

Changelog

Sourced from rack's changelog.

[3.2.4] - 2025-11-03

Fixed

  • Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[3.2.3] - 2025-10-10

Security

  • CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
  • CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.2.2] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

[3.2.1] -- 2025-09-02

Added

  • Add support for streaming bodies when using Rack::Events. (#2375, @​unflxw)

Fixed

  • Fix an issue where a NoMethodError would be raised when using Rack::Events with streaming bodies. (#2375, @​unflxw)

[3.2.0] - 2025-07-31

This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.

SPEC Changes

Added

  • Introduce Rack::VERSION constant. (#2199, [@​ioquatix])
  • ISO-2022-JP encoded parts within MIME Multipart sections of an HTTP request body will now be converted to UTF-8. (#2245, @​nappa)
  • Add Rack::Request#query_parser= to allow setting the query parser to use. (#2349, [@​jeremyevans])
  • Add Rack::Request#form_pairs to access form data as raw key-value pairs, preserving duplicate keys. (#2351, [@​matthewd])

Changed

... (truncated)

Commits
  • 4c24539 Bump patch version.
  • 3ba5e4f Allow Multipart head to span read boundary. (#2392)
  • 32bf888 Bump patch version.
  • e179614 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
  • 57277b7 Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
  • 403b74b Normalize adivsories links.
  • fb395bb Fix handling of Errno::EPIPE in multipart tests.
  • bce149b Bump patch version.
  • 3beacfc Limit amount of retained data when parsing multipart requests
  • 589127f Fix denial of service vulnerbilties in multipart parsing
  • Additional commits viewable in compare view

Updates mqtt from 0.6.0 to 0.7.0

Release notes

Sourced from mqtt's releases.

0.7.0

  • TLS hostname verification (#125)
  • Supporting private keys other than RSA (#148)
  • Removed support for ruby 1.8 and 1.9 (#156)
  • Handle instantaneous and unsolicited PUBACKs (#158)
  • Prevent deadlock due to system call error (#159)
  • Added support for timeout when opening a TCPSocket (#163)
  • Switch to URI::DEFAULT_PARSER.unescape() instead of CGI.unescape()
Changelog

Sourced from mqtt's changelog.

Ruby MQTT Version 0.7.0 (2025-10-29)

  • TLS hostname verification (#125)
  • Supporting private keys other than RSA (#148)
  • Removed support for ruby 1.8 and 1.9 (#156)
  • Handle instantaneous and unsolicited PUBACKs (#158)
  • Prevent deadlock due to system call error (#159)
  • Added support for timeout when opening a TCPSocket (#163)
  • Switch to URI::DEFAULT_PARSER.unescape() instead of CGI.unescape()
Commits
  • f99f2c9 Updated NEWS for version 0.7.0
  • a4b9140 Use URI::DEFAULT_PARSER.unescape() instead of CGI.unescape()
  • 6c60e2e Updated NEWS for version 0.7.0
  • 4af412f Added version 0.6.0 to NEWS file
  • 2e44fa1 Bumped version to 0.7.0
  • ffe862b Added support for timeout when opening a TCPSocket. (#163)
  • 29244bb Added testing using ruby 3.5
  • 87a722c Added testing of ruby 3.4
  • 4ae2786 Fix for old versions of Ruby (<2.7) that don't support kwargs
  • 7ca44b4 Rubocop fix
  • Additional commits viewable in compare view

Updates net-imap from 0.5.6 to 0.5.7

Release notes

Sourced from net-imap's releases.

v0.5.7

What's Changed

🔒 Security

This release adds two features to prevent unbounded memory use: the response_handlers keyword argument to Net::IMAP.new (ruby/net-imap#419) so response handlers can be added before the server can send any responses, and the max_response_size config attribute (ruby/net-imap#444, GHSA-j3g3-5qv5-52mj, CVE-2025-43857, reported by @​Masamuneee).

[!NOTE] The default max_response_size is extremely high, to avoid issues with secure connections to trusted servers that are well-behaved. It can be configured more conservatively to guard against untrusted servers (for example, connecting to user-provided hostnames). It is the responsibility of net-imap users to configure their client appropriately for the server they are connecting to.

Added

Documentation

Other Changes

Miscellaneous

Full Changelog: ruby/net-imap@v0.5.6...v0.5.7

Commits
  • 364869b 🔖 Bump version to v0.5.7
  • 10137ba 🔀 Merge pull request #444 from ruby/limit-response-size
  • b6bdee2 ✨ Make max_response_size configurable
  • 0ae8576 ✨ Limit max response size to 512MiB (hard-coded)
  • b32b675 ♻️ Save ResponseReader ivars: @​buff & @​literal_size
  • d28879e 🔀 Merge pull request #433 from ruby/response_reader
  • 18bc621 ♻️ Extract ResponseReader from get_response
  • b1413c6 ✨ Customize SequenceSet YAML serialization
  • d839268 🔀 Merge pull request #429 from ruby/rational-config-versions
  • c7732e6 ♻️ Add default_proc to Config.version_defaults
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the bundler group across 2 directories with 6 updates
544204f 
Bumps the bundler group with 1 update in the /docs directory: [rexml](https://github.com/ruby/rexml).
Bumps the bundler group with 4 updates in the / directory: [activerecord](https://github.com/rails/rails), [sinatra](https://github.com/sinatra/sinatra), [mqtt](https://github.com/njh/ruby-mqtt) and [net-imap](https://github.com/ruby/net-imap).


Updates `rexml` from 3.4.1 to 3.4.2
- [Release notes](https://github.com/ruby/rexml/releases)
- [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md)
- [Commits](ruby/rexml@v3.4.1...v3.4.2)

Updates `activerecord` from 7.2.2.1 to 7.2.3
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.1/activerecord/CHANGELOG.md)
- [Commits](rails/rails@v7.2.2.1...v7.2.3)

Updates `sinatra` from 3.2.0 to 4.2.0
- [Changelog](https://github.com/sinatra/sinatra/blob/main/CHANGELOG.md)
- [Commits](sinatra/sinatra@v3.2.0...v4.2.0)

Updates `rack` from 2.2.17 to 3.2.4
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v2.2.17...v3.2.4)

Updates `mqtt` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/njh/ruby-mqtt/releases)
- [Changelog](https://github.com/njh/ruby-mqtt/blob/main/NEWS.md)
- [Commits](njh/ruby-mqtt@v0.6.0...v0.7.0)

Updates `net-imap` from 0.5.6 to 0.5.7
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](ruby/net-imap@v0.5.6...v0.5.7)

---
updated-dependencies:
- dependency-name: rexml
  dependency-version: 3.4.2
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: activerecord
  dependency-version: 7.2.3
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: sinatra
  dependency-version: 4.2.0
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: rack
  dependency-version: 3.2.4
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: mqtt
  dependency-version: 0.7.0
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: net-imap
  dependency-version: 0.5.7
  dependency-type: direct:production
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Dec 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants