Skip to content

Bump the bundler group across 1 directory with 6 updates#10

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/bundler-81e7742201
Open

Bump the bundler group across 1 directory with 6 updates#10
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/bundler-81e7742201

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Dec 11, 2024

Copy link
Copy Markdown

Bumps the bundler group with 2 updates in the / directory: actionmailer and rexml.

Updates actionmailer from 7.0.8.1 to 7.0.8.5

Release notes

Sourced from actionmailer's releases.

7.0.8.5

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Avoid regex backtracking in HTTP Token authentication

    [CVE-2024-47887]

  • Avoid regex backtracking in query parameter filtering

    [CVE-2024-41128]

Active Job

  • No changes.

Action Mailer

Action Cable

  • No changes.

Active Storage

... (truncated)

Commits

Updates actionpack from 7.0.8.1 to 7.0.8.5

Release notes

Sourced from actionpack's releases.

7.0.8.5

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Avoid regex backtracking in HTTP Token authentication

    [CVE-2024-47887]

  • Avoid regex backtracking in query parameter filtering

    [CVE-2024-41128]

Active Job

  • No changes.

Action Mailer

Action Cable

  • No changes.

Active Storage

... (truncated)

Commits

Updates actiontext from 7.0.8.1 to 7.0.8.5

Release notes

Sourced from actiontext's releases.

7.0.8.5

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Avoid regex backtracking in HTTP Token authentication

    [CVE-2024-47887]

  • Avoid regex backtracking in query parameter filtering

    [CVE-2024-41128]

Active Job

  • No changes.

Action Mailer

Action Cable

  • No changes.

Active Storage

... (truncated)

Commits
  • f61f4ef Preparing for 7.0.8.5 release
  • d666c96 Update CHANGELOGs
  • 30abd6b Merge pull request #52962 from rails/rm-releser
  • 727b094 ActionText: Avoid backtracing in plain_text_for_blockquote_node
  • ec7f253 Preparing for 7.0.8.4 release
  • f12d5ae update changelog
  • 08bc3ce Preparing for 7.0.8.3 release
  • 73fac32 Keep actiontext depending on trix 1.3.1
  • 83e6a75 Merge pull request #51851 from skipkayhil/hm-fix-7-0-trix
  • 7c8d2a1 Preparing for 7.0.8.2 release
  • Additional commits viewable in compare view

Updates nokogiri from 1.14.3 to 1.17.1

Release notes

Sourced from nokogiri's releases.

v1.17.1 / 2024-12-10

Fixed

b3fce09bddfab61ae587f83af97bf0d0834352bcd23ad99831f2993d978627bd  nokogiri-1.17.1-aarch64-linux.gem
0e79badf832783e81439c3211562ed904a5c8eaaa0038c8fdfdb3778e873f3d0  nokogiri-1.17.1-arm64-darwin.gem
b8e9909ff893b257a58066e6bfc39456be18b87f4af1e22ca18d7c0dbc9925e5  nokogiri-1.17.1-arm-linux.gem
910fe0f194db99677f7ddb21b19a1d071ceffc4a0e39d44c08736d9b1e558cfc  nokogiri-1.17.1.gem
baf2cf6785f83c8cb3cdc427d0eb8b7f91d76748bfeb6c2612ce639e82c1ecee  nokogiri-1.17.1-java.gem
601a8bca523bf2b1a576c728ad4901c57263d0c29e4f9e6d2abe654c6a929841  nokogiri-1.17.1-x64-mingw32.gem
299ab9cd2c4ce882112e79fc31f82915920cb3e54ba526287e86d9a5fbfafebe  nokogiri-1.17.1-x64-mingw-ucrt.gem
94bcacacd123379229a8ece0d31c38af36d0ef6f86f399d5813be5ca0f566c88  nokogiri-1.17.1-x86_64-darwin.gem
2234250605b03433747e8d21de947b38b79f33a4280930e58bec179fd95d415d  nokogiri-1.17.1-x86_64-linux.gem
d09565316ffc8f8bb522bd6d1b460dec2a57d23d6e479c2d0d49d9ccbb11076c  nokogiri-1.17.1-x86-linux.gem
8f720dd62bf5d3791aa67f933085be5d2a2ab06afc120d4f210f40a5d184fafb  nokogiri-1.17.1-x86-mingw32.gem

v1.17.0 / 2024-12-08

Dependencies

Notable changes

SAX Parsers

The XML and HTML4 SAX parsers have received a lot of attention in this release, and we've fixed multiple long-standing bugs with encoding and entity handling. In addition, libxml2 v2.13 has also made some underlying fixes and improvements to encoding and entity handling.

We're shipping these fixes in a minor release because we firmly believe the resulting behavior is correct and standards-compliant, however applications that have been depending on the buggy behavior may be impacted.

If your application relies on the SAX parsers, and in particular if you're SAX-parsing documents with parsed entities or incorrect encoding declarations, please read the changelog below carefully.

Fragment parsing

Document fragment parsing has been improved, particularly with respect to handling malformed fragments or fragments with implicit namespace prefixes. Namespace reconciliation still isn't where we want it to be, but it's an improvement.

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.17.1 / 2024-12-10

Fixed

v1.17.0 / 2024-12-08

Dependencies

Notable changes

SAX Parsers

The XML and HTML4 SAX parsers have received a lot of attention in this release, and we've fixed multiple long-standing bugs with encoding and entity handling. In addition, libxml2 v2.13 has also made some underlying fixes and improvements to encoding and entity handling.

We're shipping these fixes in a minor release because we firmly believe the resulting behavior is correct and standards-compliant, however applications that have been depending on the buggy behavior may be impacted.

If your application relies on the SAX parsers, and in particular if you're SAX-parsing documents with parsed entities or incorrect encoding declarations, please read the changelog below carefully.

Fragment parsing

Document fragment parsing has been improved, particularly with respect to handling malformed fragments or fragments with implicit namespace prefixes. Namespace reconciliation still isn't where we want it to be, but it's an improvement.

HTML5 fragment parsing now allows the context node to be specified as a context: keyword argument to the HTML5::DocumentFragment.parse and .new methods, which should allow for more flexible sanitization and future support for the draft HTML Sanitizer API in downstream libraries.

Error handling

In scenarios where multiple errors could be reported by the underlying parser, the errors will be aggregated into a single Nokogiri::XML::SyntaxError that is raised. Previously only the final error reported by libxml2 was raised (which was often misleading if it was only a warning and not the fatal error).

Schema validation

We've resolved many long-standing bugs in the various schema classes, validation methods, and their error reporting. Behavior is now consistent across schema types and input types, as well as parser backends (Xerces and libxml2).

Keyword arguments

The following methods now accept keyword arguments in addition to positional arguments, and use ... parameter forwarding when possible:

... (truncated)

Commits
  • e4bae8a version bump to v1.17.1
  • 12244fe fix: Node#dup adds the new node to the document's node cache (backport to v1....
  • 7bf2fc1 fix: Node#dup adds the new node to the document's node cache
  • 765754c doc: update CHANGELOG bullet lists to render with mkdocs
  • 076d647 doc: extract older changelog entries into misc/CHANGELOG-archive.md
  • c7b75ef version bump to v1.17.0
  • e8e8ffe Nokogiri::XSLT() uses parameter forwarding (#3356)
  • 3b8fd7e Nokogiri::XML() and Nokogiri::XML.parse() support argument forwarding (#3332)
  • 92d2e4b {XML,HTML4,HTML5}::{Document,DocumentFragment}{.parse,#initialize} take keywo...
  • a77e1bb Nokogiri::XSLT() uses parameter forwarding
  • Additional commits viewable in compare view

Updates rack from 2.2.6.4 to 2.2.10

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

v2.2.8

What's Changed

New Contributors

Full Changelog: rack/rack@v2.2.7...v2.2.8

v2.2.7

What's Changed

New Contributors

Full Changelog: rack/rack@v2.2.6.4...v2.2.7

Changelog

Sourced from rack's changelog.

[2.2.10] - 2024-10-14

[2.2.9] - 2023-03-21

  • Return empty when parsing a multi-part POST with only one end delimiter. (#2104, [@​alpaca-tc])

[2.2.8] - 2023-07-31

[2.2.7] - 2023-03-13

Commits

Updates rexml from 3.2.5 to 3.3.9

Release notes

Sourced from rexml's releases.

REXML 3.3.9 - 2024-10-24

Improvements

  • Improved performance.

Fixes

  • Fixed a parse bug for text only invalid XML.

  • Fixed a parse bug that &#0x...; is accepted as a character reference.

Thanks

  • NAITOH Jun

REXML 3.3.8 - 2024-09-29

Improvements

  • SAX2: Improve parse performance.

Fixes

  • Fixed a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported.
    • GH-208
    • Patch by KITAITI Makoto

Thanks

  • NAITOH Jun

  • KITAITI Makoto

REXML 3.3.7 - 2024-09-04

Improvements

  • Added local entity expansion limit methods

... (truncated)

Changelog

Sourced from rexml's changelog.

3.3.9 - 2024-10-24 {#version-3-3-9}

Improvements

  • Improved performance.

Fixes

  • Fixed a parse bug for text only invalid XML.

  • Fixed a parse bug that &#0x...; is accepted as a character reference.

Thanks

  • NAITOH Jun

3.3.8 - 2024-09-29 {#version-3-3-8}

Improvements

  • SAX2: Improve parse performance.

Fixes

  • Fixed a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported.
    • GH-208
    • Patch by KITAITI Makoto

Thanks

  • NAITOH Jun

  • KITAITI Makoto

3.3.7 - 2024-09-04 {#version-3-3-7}

Improvements

  • Added local entity expansion limit methods

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the bundler group across 1 directory with 6 updates
0cdc7a8 
Bumps the bundler group with 2 updates in the / directory: [actionmailer](https://github.com/rails/rails) and [rexml](https://github.com/ruby/rexml).


Updates `actionmailer` from 7.0.8.1 to 7.0.8.5
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.0.0.1/actionmailer/CHANGELOG.md)
- [Commits](rails/rails@v7.0.8.1...v7.0.8.5)

Updates `actionpack` from 7.0.8.1 to 7.0.8.5
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.0.0.1/actionpack/CHANGELOG.md)
- [Commits](rails/rails@v7.0.8.1...v7.0.8.5)

Updates `actiontext` from 7.0.8.1 to 7.0.8.5
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.0.0.1/actiontext/CHANGELOG.md)
- [Commits](rails/rails@v7.0.8.1...v7.0.8.5)

Updates `nokogiri` from 1.14.3 to 1.17.1
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.14.3...v1.17.1)

Updates `rack` from 2.2.6.4 to 2.2.10
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v2.2.6.4...v2.2.10)

Updates `rexml` from 3.2.5 to 3.3.9
- [Release notes](https://github.com/ruby/rexml/releases)
- [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md)
- [Commits](ruby/rexml@v3.2.5...v3.3.9)

---
updated-dependencies:
- dependency-name: actionmailer
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: actionpack
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: actiontext
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: nokogiri
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: rack
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: rexml
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Dec 11, 2024
This was referenced Dec 11, 2024
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants