Skip to content

Bump the bundler group across 1 directory with 8 updates#100

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-0916d38ae4
Open

Bump the bundler group across 1 directory with 8 updates#100
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-0916d38ae4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026

Bumps the bundler group with 4 updates in the / directory: avo, actionpack, bcrypt and ruby-lsp.

Updates avo from 3.26.0 to 3.30.3

Release notes

Sourced from avo's releases.

Release v3.30.3

Release notes

For more information and the release video check out the full release page

🐛 Bug Fixes

Release v3.30.2

Release notes

For more information and the release video check out the full release page

Release v3.30.1

Release notes

For more information and the release video check out the full release page

🐛 Bug Fixes

🤖 Maintenance

Release v3.30.0

Release notes

For more information and the release video check out the full release page

✨ Enhancements

🐛 Bug Fixes

  • fix: update filter logic to apply reactive filters on associations @​Paul-Bob (#4274)
  • fix: ensure allowinput properly syncs edits in datetime fields @​panacotar (#4267)
  • fix: don't render parent record on has_one field when on parent record's show view @​Paul-Bob (#4256)
  • fix: date picker filter closes when flatpickr data navigation is interacted with @​Paul-Bob (#4255)
  • fix: key_value field truncates keys and values containing double quotes @​Paul-Bob (#4254)
  • fix: add disconnect() cleanup to Stimulus controllers @​rickychilcott (#4249)

... (truncated)

Commits

Updates actionpack from 8.1.1 to 8.1.2.1

Release notes

Sourced from actionpack's releases.

8.1.2.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 8.1.2.1 (March 23, 2026)

  • No changes.

Rails 8.1.2 (January 08, 2026)

  • Add config.action_controller.live_streaming_excluded_keys to control execution state sharing in ActionController::Live.

    When using ActionController::Live, actions are executed in a separate thread that shares state from the parent thread. This new configuration allows applications to opt-out specific state keys that should not be shared.

    This is useful when streaming inside a connected_to block, where you may want the streaming thread to use its own database connection context.

    # config/application.rb
config.action_controller.live_streaming_excluded_keys = [:active_record_connected_to_stack]

    By default, all keys are shared.

    Eileen M. Uchitelle

  • Fix IpSpoofAttackError message to include Forwarded header content.

    Without it, the error message may be misleading.

    zzak

Commits
  • 1db4b89 Preparing for 8.1.2.1 release
  • 6752711 Fix XSS in debug exceptions copy-to-clipboard
  • d7c8ae6 Preparing for 8.1.2 release
  • df98a0d Merge pull request #56440 from zzak/ac-live-streaming-keys-typo
  • 0f8014a [8-1-stable] Minitest 6 support
  • 991ccf3 Merge pull request #56393 from rails/add-exclude-keys-to-live-controller
  • 662609d Merge pull request #56252 from callmesangio/fix-testing-docs
  • 81dca9c Merge pull request #56285 from markokajzer/main
  • c98c994 Merge pull request #56256 from zzak/re-56186
  • 4388688 Fix redirect_test leaking subscription state
  • Additional commits viewable in compare view

Updates actionview from 8.1.1 to 8.1.2.1

Release notes

Sourced from actionview's releases.

8.1.2.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

... (truncated)

Changelog

Sourced from actionview's changelog.

Rails 8.1.2.1 (March 23, 2026)

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Rails 8.1.2 (January 08, 2026)

  • Fix file_field to join mime types with a comma when provided as Array

    file_field(:article, :image, accept: ['image/png', 'image/gif', 'image/jpeg'])

    Now behaves likes:

    file_field(:article, :image, accept: 'image/png,image/gif,image/jpeg')

    Bogdan Gusiev

  • Fix strict locals parsing to handle multiline definitions.

    Said Kaldybaev

  • Fix content_security_policy_nonce error in mailers when using content_security_policy_nonce_auto setting.

    The content_security_policy_nonce helper is provided by ActionController::ContentSecurityPolicy, and it relies on request.content_security_policy_nonce. Mailers lack both the module and the request object.

    Jarrett Lusso

Commits
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • e91694b Update CHANGELOG (8.1 only)
  • 63f5ad8 Skip blank attribute names in Action View tag helpers
  • d7c8ae6 Preparing for 8.1.2 release
  • 27aa94f Merge pull request #56389 from bogdan/semantic-file-input-accept
  • 7cf18e0 Merge pull request #56316 from shivabhusal/support-closing_parenthesis-in-nex...
  • 160db66 Merge pull request #56270 from Saidbek/fix-multiline-strict-locals-parsing
  • 386004e Add CHANGELOG entry for #56050
  • dc94813 Merge pull request #56050 from jclusso/fix-stylesheet-tag-nonce-mailer
  • See full diff in compare view

Updates activestorage from 8.1.1 to 8.1.2.1

Release notes

Sourced from activestorage's releases.

8.1.2.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.2.1 (March 23, 2026)

  • Filter user supplied metadata in DirectUploadController

    [CVE-2026-33173]

    Jean Boussier

  • Configurable maxmimum streaming chunk size

    Makes sure that byte ranges for blobs don't exceed 100mb by default. Content ranges that are too big can result in denial of service.

    [CVE-2026-33174]

    Gannon McGibbon

  • Limit range requests to a single range

    [CVE-2026-33658]

    Jean Boussier

  • Prevent path traversal in DiskService.

    DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".", ".."), or if the resolved path is outside the storage root directory.

    #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for example containing null bytes or having an incompatible encoding. Previously, the exception raised may have been ArgumentError or Encoding::CompatibilityError.

    DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

    [CVE-2026-33195]

    Mike Dalessio

  • Prevent glob injection in DiskService#delete_prefixed.

    Escape glob metacharacters in the resolved path before passing to Dir.glob.

    Note that this change breaks any existing code that is relying on delete_prefixed to expand glob metacharacters. This change presumes that is unintended behavior (as other storage services do not respect these metacharacters).

    [CVE-2026-33202]

    Mike Dalessio

... (truncated)

Commits
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • 8c9676b Prevent glob injection in ActiveStorage DiskService#delete_prefixed
  • 9b06fbc Prevent path traversal in ActiveStorage DiskService
  • d9502f5 Active Storage: Filter user supplied metadata in DirectUploadController
  • 85ec5b1 ActiveStorage::Streaming limit range requests to a single range
  • 42012ea Configurable maxmimum streaming chunk size
  • d7c8ae6 Preparing for 8.1.2 release
  • 5283514 Merge pull request #56012 from jmalcic/restore-default-adc-for-gcs-iam-client
  • 350c13c Merge pull request #56125 from zzak/re-56069
  • See full diff in compare view

Updates activesupport from 8.1.1 to 8.1.2.1

Release notes

Sourced from activesupport's releases.

8.1.2.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.2.1 (March 23, 2026)

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Rails 8.1.2 (January 08, 2026)

  • Make delegate and delegate_missing_to work in BasicObject subclasses.

    Rafael Mendonça França

  • Fix Inflectors when using a locale that fallbacks to :en.

    Said Kaldybaev

  • Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings.

    Previously the returned string would sometime be encoded in US-ASCII, which in some cases may be problematic.

    Now the method consistently always return UTF-8 strings.

    Jean Boussier

  • Fix TimeWithZone#xmlschema when wrapping a DateTime instance in local time.

    Previously it would return an invalid time.

    Dmytro Rymar

  • Implement LocalCache strategy on ActiveSupport::Cache::MemoryStore. The memory store needs to respond to the same interface as other cache stores (e.g. ActiveSupport::NullStore).

    Mikey Gough

... (truncated)

Commits
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • ec1a0e2 Improve performance of NumberToDelimitedConverter
  • 50d732a Fix SafeBuffer#% to preserve unsafe status
  • 19dbab5 NumberConverter: reject scientific notation
  • d7c8ae6 Preparing for 8.1.2 release
  • 3ea2701 CHANGELOG sync
  • 0f8014a [8-1-stable] Minitest 6 support
  • 991ccf3 Merge pull request #56393 from rails/add-exclude-keys-to-live-controller
  • c86465f Merge pull request #56353 from rails/rmf-delegation-basic-object
  • Additional commits viewable in compare view

Updates addressable from 2.8.7 to 2.9.0

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

  • fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

  • fixes ReDoS vulnerability in Addressable::Template#match

Addressable 2.8.9

  • Reduce gem size by excluding test files (#569)
  • No need for bundler as development dependency (#571, 5fc1d93)
  • idna/pure: stop building the useless COMPOSITION_TABLE (removes the Addressable::IDNA::COMPOSITION_TABLE constant) (#564)

#569: sporkmonger/addressable#569 #571: sporkmonger/addressable#571 #564: sporkmonger/addressable#564

Addressable 2.8.8

  • Replace the unicode.data blob by a ruby constant (#561)
  • Allow public_suffix 7 (#558)

#561: sporkmonger/addressable#561 #558: sporkmonger/addressable#558

Commits
  • 0c3e858 Revving version and changelog
  • 91915c1 Fixing additional vulnerable paths
  • a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
  • 463a819 Regenerate gemspec on newer rubygems
  • 0afcb0b Improve from O(n^2) to O(n)
  • c87f768 Fix a ReDoS vulnerability in URI template matching
  • 0d7e9b2 Fix links for 2.8.9 in CHANGELOG (#573)
  • e209120 Update version, gemspec, and CHANGELOG for 2.8.9 (#572)
  • 3875874 Reduce gem size by excluding test files (#569)
  • 3e57cc6 CI: back to windows-2022 for MRI job
  • Additional commits viewable in compare view

Updates bcrypt from 3.1.20 to 3.1.22

Release notes

Sourced from bcrypt's releases.

v3.1.22

What's Changed

Full Changelog: bcrypt-ruby/bcrypt-ruby@v3.1.21...v3.1.22

v3.1.21

What's Changed

New Contributors

Full Changelog: bcrypt-ruby/bcrypt-ruby@v3.1.20...v3.1.21

Changelog

Sourced from bcrypt's changelog.

3.1.22 Mar 18 2026

3.1.21 Dec 31 2025

  • Use constant time comparisons
  • Mark as Ractor safe
Commits
  • 831ce64 Merge commit from fork
  • 32e687e bump version update changelog
  • 5faa274 Fix integer overflow in JRuby BCrypt rounds calculation
  • aafc033 Merge pull request #294 from bcrypt-ruby/fix-publishing
  • 01f947a fix env url
  • 92ca1d6 Merge pull request #293 from bcrypt-ruby/truffleruby-ci-alt-implementation
  • 4d1d95b Add TruffleRuby in CI
  • 36a04a2 Merge pull request #291 from tenderlove/fix-publishing
  • 01cc688 Move compilation after bundle install
  • 82e6c4c Merge pull request #290 from tenderlove/bump
  • Additional commits viewable in compare view

Updates ruby-lsp from 0.24.1 to 0.26.9

Release notes

Sourced from ruby-lsp's releases.

v0.26.9

🐛 Bug Fixes

v0.26.8

🐛 Bug Fixes

📦 Other Changes

v0.26.7

🐛 Bug Fixes

📦 Other Changes

v0.26.6

🐛 Bug Fixes

📦 Other Changes

v0.26.5

✨ Enhancements

... (truncated)

Commits
  • 29ecc8d Merge commit from fork
  • f6d9ee4 Bump version to v0.26.9
  • 97f817d Remove --branch flag from server
  • 9e53e7e Merge commit from fork
  • eb746d3 Bump extension version to v0.10.2
  • 8834520 Merge pull request #4030 from Shopify/use-prism-parser
  • e4026ea Use Prism parser for Sorbet
  • 81843e7 Bump Sorbet to 0.6.13055
  • b61a594 Remove rubyLsp.branch setting
  • 8c1e9b6 Merge pull request #4028 from Shopify/dependabot/npm_and_yarn/vscode/minor-an...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the bundler group across 1 directory with 8 updates
4b26b58 
Bumps the bundler group with 4 updates in the / directory: [avo](https://github.com/avo-hq/avo), [actionpack](https://github.com/rails/rails), [bcrypt](https://github.com/bcrypt-ruby/bcrypt-ruby) and [ruby-lsp](https://github.com/Shopify/ruby-lsp).


Updates `avo` from 3.26.0 to 3.30.3
- [Release notes](https://github.com/avo-hq/avo/releases)
- [Changelog](https://github.com/avo-hq/avo/blob/main/RELEASE.MD)
- [Commits](avo-hq/avo@v3.26.0...v3.30.3)

Updates `actionpack` from 8.1.1 to 8.1.2.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3/actionpack/CHANGELOG.md)
- [Commits](rails/rails@v8.1.1...v8.1.2.1)

Updates `actionview` from 8.1.1 to 8.1.2.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3/actionview/CHANGELOG.md)
- [Commits](rails/rails@v8.1.1...v8.1.2.1)

Updates `activestorage` from 8.1.1 to 8.1.2.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3/activestorage/CHANGELOG.md)
- [Commits](rails/rails@v8.1.1...v8.1.2.1)

Updates `activesupport` from 8.1.1 to 8.1.2.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v8.1.1...v8.1.2.1)

Updates `addressable` from 2.8.7 to 2.9.0
- [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md)
- [Commits](sporkmonger/addressable@addressable-2.8.7...addressable-2.9.0)

Updates `bcrypt` from 3.1.20 to 3.1.22
- [Release notes](https://github.com/bcrypt-ruby/bcrypt-ruby/releases)
- [Changelog](https://github.com/bcrypt-ruby/bcrypt-ruby/blob/master/CHANGELOG)
- [Commits](bcrypt-ruby/bcrypt-ruby@v3.1.20...v3.1.22)

Updates `ruby-lsp` from 0.24.1 to 0.26.9
- [Release notes](https://github.com/Shopify/ruby-lsp/releases)
- [Commits](Shopify/ruby-lsp@v0.24.1...v0.26.9)

---
updated-dependencies:
- dependency-name: avo
  dependency-version: 3.30.3
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: actionpack
  dependency-version: 8.1.2.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: actionview
  dependency-version: 8.1.2.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: activestorage
  dependency-version: 8.1.2.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: activesupport
  dependency-version: 8.1.2.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: addressable
  dependency-version: 2.9.0
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: bcrypt
  dependency-version: 3.1.22
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: ruby-lsp
  dependency-version: 0.26.9
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants