Bump the bundler group with 3 updates #680

dependabot · 2024-05-16T20:06:07Z

Bumps the bundler group with 3 updates: activesupport, nokogiri and rexml.

Updates activesupport from 7.0.4.3 to 7.1.3.3

Release notes

Sourced from activesupport's releases.

7.1.3.3

Active Support

No changes.

Active Model

No changes.

Active Record

No changes.

Action View

No changes.

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

No changes.

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 7.1.3.3 (May 16, 2024)

No changes.

Rails 7.1.3.2 (February 21, 2024)

No changes.

Rails 7.1.3.1 (February 21, 2024)

No changes.

Rails 7.1.3 (January 16, 2024)

Handle nil backtrace_locations in ActiveSupport::SyntaxErrorProxy.

Eugene Kenny

Fix ActiveSupport::JSON.encode to prevent duplicate keys.

If the same key exist in both String and Symbol form it could lead to the same key being emitted twice.

Manish Sharma

Fix ActiveSupport::Cache::Store#read_multi when using a cache namespace and local cache strategy.

Mark Oleson

Fix Time.now/DateTime.now/Date.today to return results in a system timezone after #travel_to.

There is a bug in the current implementation of #travel_to: it remembers a timezone of its argument, and all stubbed methods start returning results in that remembered timezone. However, the expected behaviour is to return results in a system timezone.

Aleksei Chernenkov

Fix :unless_exist option for MemoryStore#write (et al) when using a cache namespace.

S. Brent Faulkner

Fix ActiveSupport::Deprecation to handle blaming generated code.

Jean Boussier, fatkodima

... (truncated)

Commits

747a03b Preparing for 7.1.3.3 release
6f0d1ad Preparing for 7.1.3.2 release
c25f0fc Respect raise_on_missing_ in controller
d73ed95 Preparing for 7.1.3.1 release
43037d8 update changelog
36c1591 Preparing for 7.1.3 release
a84622f Sync changelog
894f933 Merge pull request #50764 from eugeneius/syntax_error_proxy_nil_backtrace_loc...
b02f6c9 Merge pull request #48957 from cmaruz/48326
81c8023 Sync changelog
Additional commits viewable in compare view

Updates nokogiri from 1.14.3 to 1.15.6

Release notes

Sourced from nokogiri's releases.

1.15.6 / 2024-03-16

Note

This security release is a backport to the unsupported v1.15.x branch. Current stable is v1.16.x, which addressed the referenced CVE in v1.16.2 on 2024-02-04.

Security

[CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.11.7 from v2.11.6. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.7

sha256 checksums:
d79f713dffff149d60ab272d206a3ca96db2b891ab6a9f65362bfb78aface37a  gems/nokogiri-1.15.6-aarch64-linux.gem
62b5b7b387ec6c61c1ea5f889b7bc579eedd37f265f7cc1dc392484938549f1a  gems/nokogiri-1.15.6-arm-linux.gem
ba93c63f5c03047778abf16c80676fe67e7eb7d871ab0aaa7e2c2dfe4ec20027  gems/nokogiri-1.15.6-arm64-darwin.gem
d24639a546ba58c86d18da1ed124eaecbd45c5ae4c4dec41751b730a2b732ac3  gems/nokogiri-1.15.6-java.gem
e36887d89ec1b080e4a01dd2ff52650003db01d2a5edf5e6ab19e4c0bdb1385f  gems/nokogiri-1.15.6-x64-mingw-ucrt.gem
852c59a398499c8fcb6478d76396dcd50afa8f8902563b76265cd7dc90a731a1  gems/nokogiri-1.15.6-x64-mingw32.gem
19e0a5fbfa4393353fbcf6801f8f62350b6e16f43c907680c5884896858a23a2  gems/nokogiri-1.15.6-x86-linux.gem
9d464bbbaad6721a5a73181165fda67573f64ef2803c3337f6f733603e9d309a  gems/nokogiri-1.15.6-x86-mingw32.gem
32d045cdb0ce097e4543a5e7a79efd13ff05d904e32f4328732149dbea3c7f15  gems/nokogiri-1.15.6-x86_64-darwin.gem
26a79da0377100d6938ae2f1b115230a8a4a4595e35b89164d8495af32091186  gems/nokogiri-1.15.6-x86_64-linux.gem
70ce799b4b3e23b358501f1da3914f70b1c7a113fb12e96a7d53558481146e08  gems/nokogiri-1.15.6.gem
1.15.5 / 2023-11-17

Dependencies

[CRuby] Vendored libxml2 is updated to v2.11.6 from v2.11.5. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.6

[CRuby] Vendored libxslt is updated to v1.1.39 from v1.1.38. For details please see https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.39

sha256 checksums:
6dfa1d9837ddb233e234d56e244560ab1bc545d3d1744478060e18691f44ded7  nokogiri-1.15.5-aarch64-linux.gem
e3ac6608c6e1714bc11ff04e29a43fedf4cac2aea1bd88256cc3b927c06f347f  nokogiri-1.15.5-arm-linux.gem
4d7b15d53c0397d131376a19875aa97dd1c8b404c2c03bd2171f9b77e9592d40  nokogiri-1.15.5-arm64-darwin.gem
5f87e71aaeb4f7479b94698737a0aacea77836b4805c7433b655e9565bd56cfe  nokogiri-1.15.5-java.gem
7612be800909ae51e0a7cfbe1f768757857a9ff0339686814ca67d9bae271ca2  nokogiri-1.15.5-x64-mingw-ucrt.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

1.15.6 / 2024-03-16

Security

[CRuby] Vendored libxml2 is updated to address CVE-2024-25062. See GHSA-xc9x-jj77-9p9j for more information.

Dependencies

[CRuby] Vendored libxml2 is updated to v2.11.7 from v2.11.6. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.7

1.15.5 / 2023-11-17

Dependencies

[CRuby] Vendored libxml2 is updated to v2.11.6 from v2.11.5. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.6

[CRuby] Vendored libxslt is updated to v1.1.39 from v1.1.38. For details please see https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.39

1.15.4 / 2023-08-11

Dependencies

[CRuby] Vendored libxml2 is updated to v2.11.5 from v2.11.4. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.5

Fixed

Fixed a typo in a HTML5 parser error message. #2927 (@anishathalye)

[CRuby] ObjectSpace.memsize_of is now safe to call on Documents with complex DTDs. In previous versions, this debugging method could result in a segfault. [#2923, #2924]

1.15.3 / 2023-07-05

Fixed

Passing an object that is not a kind of XML::Node as the first parameter to CDATA.new now raises a TypeError. Previously this would result in either a segfault (CRuby) or a Java exception (JRuby). #2920

Passing an object that is not a kind of XML::Node as the first parameter to Schema.from_document now raises a TypeError. Previously this would result in either a segfault (CRuby) or a Java exception (JRuby). #2920

[CRuby] Passing an object that is not a kind of XML::Node as the second parameter to Text.new now raises a TypeError. Previously this would result in a segfault. #2920

[CRuby] Replacing a node's children via methods like Node#inner_html=, #children=, and #replace no longer defensively dups the node's next sibling if it is a Text node. This behavior was originally adopted to work around libxml2's memory management (see #283 and #595) but should not have included operations involving xmlAddChild(). #2916

[JRuby] Fixed NPE when serializing an unparented HTML node. [#2559, #2895] (@cbasguti)

1.15.2 / 2023-05-24

Dependencies

[JRuby] Vendored org.nokogiri:nekodtd is updated to v0.1.11.noko2. This is functionally equivalent to v0.1.11.noko1 but restores support for Java 8.

... (truncated)

Commits

7ab6310 version bump to v1.15.6
f8156b4 dep: update libxml to 2.11.7 (branch 1.15.x) (#3154)
9827619 ci: pin to a version of bundler that works across supported rubies
83a2571 dep: bump libxml to v2.11.7
5745d4b version bump to v1.15.5
da2d908 ci: add ruby version to vendored libs cache key (backport) (#3029)
0f56450 ci: add ruby version to vendored libs cache key (#3028)
32b2c35 dep: update libxml to 2.11.5 and libxslt to 1.1.39 (v1.15.x) (#3025)
b8f7e16 ci: skip the BSD builds for now
aa3208b dep: update libxml to 2.11.5 and libxslt to 1.1.39
Additional commits viewable in compare view

Updates rexml from 3.2.5 to 3.2.8

Release notes

Sourced from rexml's releases.

REXML 3.2.8 - 2024-05-16

Fixes

Suppressed a warning

REXML 3.2.7 - 2024-05-16

Improvements

Improve parse performance by using StringScanner.

GH-106

GH-107

GH-108

GH-109

GH-112

GH-113

GH-114

GH-115

GH-116

GH-117

GH-118

GH-119

GH-121

Patch by NAITOH Jun.

Improved parse performance when an attribute has many <s.

GH-124

Fixes

XPath: Fixed a bug of normalize_space(array).

GH-110

GH-111

Patch by flatisland.

XPath: Fixed a bug that wrong position is used with nested path.

GH-110

GH-122

Reported by jcavalieri.

Patch by NAITOH Jun.

Fixed a bug that an exception message can't be generated for invalid encoding XML.

... (truncated)

Changelog

Sourced from rexml's changelog.

3.2.8 - 2024-05-16 {#version-3-2-8}

Fixes

Suppressed a warning

3.2.7 - 2024-05-16 {#version-3-2-7}

Improvements

Improve parse performance by using StringScanner.

GH-106

GH-107

GH-108

GH-109

GH-112

GH-113

GH-114

GH-115

GH-116

GH-117

GH-118

GH-119

GH-121

Patch by NAITOH Jun.

Improved parse performance when an attribute has many <s.

GH-124

Fixes

XPath: Fixed a bug of normalize_space(array).

GH-110

GH-111

Patch by flatisland.

XPath: Fixed a bug that wrong position is used with nested path.

GH-110

GH-122

Reported by jcavalieri.

Patch by NAITOH Jun.

Fixed a bug that an exception message can't be generated for

... (truncated)

Commits

1cf37ba Add 3.2.8 entry
b67081c Remove an unused variable (#128)
94e180e Suppress a warning
d574ba5 ci: install only gems required for running tests (#129)
4670f8f Add missing Thanks section
9ba35f9 Bump version
085def0 Add 3.2.7 entry
4325835 Read quoted attributes in chunks (#126)
e77365e Exclude older than 2.6 on macos-14
bf2c8ed Move development dependencies to Gemfile (#124)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 3 updates: [activesupport](https://github.com/rails/rails), [nokogiri](https://github.com/sparklemotion/nokogiri) and [rexml](https://github.com/ruby/rexml). Updates `activesupport` from 7.0.4.3 to 7.1.3.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v7.1.3.3/activesupport/CHANGELOG.md) - [Commits](rails/rails@v7.0.4.3...v7.1.3.3) Updates `nokogiri` from 1.14.3 to 1.15.6 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.14.3...v1.15.6) Updates `rexml` from 3.2.5 to 3.2.8 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.2.5...v3.2.8) --- updated-dependencies: - dependency-name: activesupport dependency-type: indirect dependency-group: bundler - dependency-name: nokogiri dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-type: indirect dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label May 16, 2024

dependabot bot mentioned this pull request May 16, 2024

Bump the bundler group with 2 updates #679

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the bundler group with 3 updates #680

Bump the bundler group with 3 updates #680

dependabot bot commented on behalf of github May 16, 2024

Bump the bundler group with 3 updates #680

Are you sure you want to change the base?

Bump the bundler group with 3 updates #680

Conversation

dependabot bot commented on behalf of github May 16, 2024

7.1.3.3

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Rails 7.1.3.3 (May 16, 2024)

Rails 7.1.3.2 (February 21, 2024)

Rails 7.1.3.1 (February 21, 2024)

Rails 7.1.3 (January 16, 2024)

1.15.6 / 2024-03-16

Note

Security

Dependencies

1.15.5 / 2023-11-17

Dependencies

1.15.6 / 2024-03-16

Security

Dependencies

1.15.5 / 2023-11-17

Dependencies

1.15.4 / 2023-08-11

Dependencies

Fixed

1.15.3 / 2023-07-05

Fixed

1.15.2 / 2023-05-24

Dependencies

REXML 3.2.8 - 2024-05-16

Fixes

REXML 3.2.7 - 2024-05-16

Improvements

Fixes

3.2.8 - 2024-05-16 {#version-3-2-8}

Fixes

3.2.7 - 2024-05-16 {#version-3-2-7}

Improvements

Fixes