Skip to content

Bump the ruby-minor-patch group across 1 directory with 14 updates#3604

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-minor-patch-cb52a6aa19
Open

Bump the ruby-minor-patch group across 1 directory with 14 updates#3604
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-minor-patch-cb52a6aa19

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor

Bumps the ruby-minor-patch group with 13 updates in the / directory:

Package From To
bootsnap 1.23.0 1.24.6
kamal 2.11.0 2.12.0
thruster 0.1.20 0.1.23
view_component 4.7.0 4.12.0
devise 5.0.3 5.0.4
loofah 2.25.1 2.25.2
rails-html-sanitizer 1.7.0 1.7.1
nokogiri 1.19.2 1.19.4
activerecord-session_store 2.2.0 2.3.0
sentry-ruby 6.5.0 6.6.2
twilio-ruby 7.10.5 7.10.7
bullet 8.1.0 8.1.3
selenium-webdriver 4.43.0 4.46.0

Updates bootsnap from 1.23.0 to 1.24.6

Release notes

Sourced from bootsnap's releases.

v1.24.4

What's Changed

  • Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
  • Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
  • Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
  • Avoid leaking a private method in Object when testing for Parse.y bugs.

Full Changelog: rails/bootsnap@v1.24.3...v1.24.4

v1.24.3

  • Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

Full Changelog: rails/bootsnap@v1.24.2...v1.24.3

v1.24.2

What's Changed

  • Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

Full Changelog: rails/bootsnap@v1.24.1...v1.24.2

v1.24.1

What's Changed

  • Fix encoding of Ruby source files loaded when BOOTSNAP_READONLY is set. Files would incorectly be loaded in ASCII-8BIT causing literal strings outside the pure ASCII range to have ASCII-8BIT encoding instead of UTF-8. This bug was introduced in 1.24.0.

Full Changelog: rails/bootsnap@v1.24.0...v1.24.1

v1.24.0

What's Changed

  • Added a hook API to customize Ruby compilation.

Full Changelog: rails/bootsnap@v1.23.0...v1.24.0

Changelog

Sourced from bootsnap's changelog.

1.24.6

  • Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

1.24.5

  • No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

1.24.4

  • Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
  • Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
  • Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
  • Avoid leaking a private method in Object when testing for Parse.y bugs.

1.24.3

  • Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

1.24.2

  • Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

1.24.1

  • Fix encoding of Ruby source files loaded when BOOTSNAP_READONLY is set. Files would incorectly be loaded in ASCII-8BIT causing literal strings outside the pure ASCII range to have ASCII-8BIT encoding instead of UTF-8. This bug was introduced in 1.24.0.

1.24.0

  • Added a hook API to customize Ruby compilation.
Commits
  • 026e183 Release 1.24.6
  • 263e346 Merge pull request #556 from byroot/remove-canary
  • 7c31cd8 Check for [Bug #22023] by checking Ruby version rather than a canary
  • 54eba76 Merge pull request #554 from byroot/namespace-overflow
  • fe963d5 bs_cache_path: account for namespace length
  • 7b42db6 Merge pull request #553 from arpitjain099/chore/declare-workflow-perms
  • 113b184 ci: add permissions: contents: read to ci
  • d6ca050 Release 1.24.5
  • 579aa0e Merge pull request #552 from byroot/fix-bootsnap-config
  • 2884e89 Only load config file is directed to by .setup
  • Additional commits viewable in compare view

Updates kamal from 2.11.0 to 2.12.0

Release notes

Sourced from kamal's releases.

v2.12.0

What's Changed

New Contributors

Full Changelog: basecamp/kamal@v2.11.0...v2.12.0

Commits
  • bdefb89 Bump version for 2.12.0
  • 8eb9659 Fix doc formatting for 2.12.0 release
  • 62579aa Merge pull request #1844 from matthewbjones/lock-wait
  • def0eae Add --lock-wait to retry deploy lock acquisition
  • bf22a93 Expect git gc --auto step in push resetting clone test
  • 24d3dbb Merge pull request #1795 from leonvogt/kamal-secrets-path-default
  • bd3e227 Merge pull request #1833 from seeday/main
  • f2671a5 Merge pull request #1860 from creadone/non-ascii-deploy-lock
  • e71bab5 Merge pull request #1874 from basecamp/dependabot/bundler/bundler-f838d46215
  • 583beb8 Merge pull request #1875 from basecamp/fix-aws-secrets-test-stubs
  • Additional commits viewable in compare view

Updates thruster from 0.1.20 to 0.1.23

Changelog

Sourced from thruster's changelog.

v0.1.22 / 2026-06-29

  • Build with Go 1.26.4
  • Exclude image types from compression (#137)

v0.1.21 / 2026-05-17

  • Build with Go 1.26.3
Commits
  • 168dc1f Update version & changelog
  • 900411c Merge pull request #140 from rafafloresta/bump-go-1.26.5-security
  • 2eb7870 Bump Go to 1.26.5 to fix crypto/tls ECH de-anonymization (CVE-2026-42505)
  • 3acd601 Merge pull request #138 from basecamp/version-0.1.22
  • 43dfae9 Version 0.1.22
  • 6c45e38 Merge pull request #137 from basecamp/compression-exclude-image-types
  • 33ea926 Exclude image types from compression
  • 043a28e Merge pull request #136 from basecamp/check-fmt-in-ci
  • 22e7ee8 Check formatting during CI
  • c64f358 Merge pull request #135 from basecamp/go-1-26-4
  • Additional commits viewable in compare view

Updates view_component from 4.7.0 to 4.12.0

Release notes

Sourced from view_component's releases.

4.12.0

  • Fix stale render context on reused component instances. A ViewComponent::Base instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via ||=. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. #render_in now resets these ivars on every call so each render derives its context from the current view.

    Joel Hawksley

  • Fix HTML-safety bypass in around_render. ViewComponent::Base#around_render could return HTML-unsafe strings that bypassed the escaping applied to normal #call return values, creating an XSS risk. The vulnerability was amplified in ViewComponent::Collection#render_in, which joined per-item results and unconditionally marked the output html_safe. HTML-unsafe strings returned from around_render are now escaped (with a warning) and Collection#render_in now uses safe_join so unsafe per-item output is escaped instead of laundered into a SafeBuffer. Joel Hawksley

4.11.0

  • Update render_in signature to accept **_ for compatibility with Rails #50623.

    Joel Hawksley

  • Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

    Artin Boghosian

4.10.0

  • Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

    Joel Hawksley

  • Fix yielded content rendered at wrong location when using form helpers.

    Joel Hawksley, Markus

4.9.0

  • Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

    Joel Hawksley

  • Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

    Joel Hawksley

  • Add yard-lint to CI.

    Joel Hawksley

4.8.0

  • Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

    Joel Hawksley, GitHub Copilot

Changelog

Sourced from view_component's changelog.

4.12.0

  • Fix stale render context on reused component instances. A ViewComponent::Base instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via ||=. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. #render_in now resets these ivars on every call so each render derives its context from the current view.

    Joel Hawksley

  • Fix HTML-safety bypass in around_render. ViewComponent::Base#around_render could return HTML-unsafe strings that bypassed the escaping applied to normal #call return values, creating an XSS risk. The vulnerability was amplified in ViewComponent::Collection#render_in, which joined per-item results and unconditionally marked the output html_safe. HTML-unsafe strings returned from around_render are now escaped (with a warning) and Collection#render_in now uses safe_join so unsafe per-item output is escaped instead of laundered into a SafeBuffer.

    Joel Hawksley

4.11.0

  • Update render_in signature to accept **_ for compatibility with Rails #50623.

    Joel Hawksley

  • Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

    Artin Boghosian

4.10.0

  • Fix NameError: uninitialized constant ViewComponent::SystemTestControllerNefariousPathError when booting in the test environment with eager_load = true.

    Joel Hawksley

  • Fix yielded content rendered at wrong location when using form helpers.

    Joel Hawksley, Markus

4.9.0

  • Fix path traversal vulnerability in ViewComponentsSystemTestController where sibling directories sharing a string prefix with the allowed temp directory could bypass the path containment check. The start_with? check has been replaced with a separator-aware prefix check, and nefarious path errors now return a 404 instead of an unhandled exception.

    Joel Hawksley

  • Fix preview route vulnerability where inherited methods on ViewComponent::Preview (such as render_with_template) could be invoked via the preview URL, allowing arbitrary internal Rails templates to be rendered with attacker-controlled locals and request parameters. render_args now raises AbstractController::ActionNotFound for any example not explicitly declared on the preview subclass.

    Joel Hawksley

  • Add yard-lint to CI.

    Joel Hawksley

4.8.0

  • Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

    Joel Hawksley, GitHub Copilot

Commits

Updates devise from 5.0.3 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

Commits
  • 9ea459d Release v5.0.4 with sec fix for timeoutable
  • 025fe21 Merge commit from fork
  • 7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
  • 605de86 Update links to https [ci skip]
  • 5e3a8bf Bundle update
  • 5d20277 Cleanup old Rails.version check for db migration path
  • 4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
  • See full diff in compare view

Updates loofah from 2.25.1 to 2.25.2

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
  • Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

  • Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
  • Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
  • Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones
Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
  • Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

  • Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
  • Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
  • Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones
Commits
  • 2706d7e version bump to v2.25.2
  • 1afde0c Merge pull request #308 from flavorjones/security-2252
  • f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
  • 5e91af8 Update allowed_uri? to handle named whitespace character references
  • 20867b9 Properly restrict SVG href attributes
  • 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
  • b07713d test: do not run in verbose mode
  • babe7a8 doc: update CHANGELOG
  • a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
  • b52f4b0 version bump to 2.25.2.beta1
  • Additional commits viewable in compare view

Updates rails-html-sanitizer from 1.7.0 to 1.7.1

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.1 / 2026-07-15

  • SVG reference elements now restrict both href and xlink:href to local references.

    Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

    This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

    Mike Dalessio @​flavorjones

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.7.1 / 2026-07-15

  • SVG reference elements now restrict both href and xlink:href to local references.

    Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

    This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

    Mike Dalessio

Commits
  • 4f37e3d version bump to v1.7.1
  • b4673b9 Merge pull request #223 from rails/svg-href-local-ref
  • 74dcb80 Properly restrict SVG href attributes
  • 11ee440 Adjust data: URI mediatype tests for loofah 2.25.2 (#222)
  • bc9622c Harden GitHub Actions workflows (#220)
  • 3459ffd dep(dev): update nokogiri (#219)
  • 8aa4bb2 build(deps-dev): bump concurrent-ruby from 1.3.6 to 1.3.7 (#218)
  • 4ddc0c7 dep(dev): update development dependencies (#217)
  • f87abb4 Merge pull request #215 from yuri-zubov/reduce-gem-size
  • 527b317 Reduce gem size by excluding test files
  • See full diff in compare view

Updates nokogiri from 1.19.2 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem

v1.19.3 / 2026-04-27

Fixed / Security

  • Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
  • [CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.
46b89e5d7b9e844c2ee360794240c6ea2a4e6fa0c5892a4ed487db621224b639  nokogiri-1.19.3-aarch64-linux-gnu.gem
8392dfdcd21be7a94dbbe9ccc138dea01b97b24cb2dc02a114ca98bfb1d9a0b7  nokogiri-1.19.3-aarch64-linux-musl.gem
3919d5ffc334ad778a4a9eb88fda7dcb8b1fb58c8a52ac640c6dcd2f038e774f  nokogiri-1.19.3-arm-linux-gnu.gem
9ce1cb6346bb9c67b1550eb537aa183ead91e4b6eadb2f36ade02d8dd2a79fb6  nokogiri-1.19.3-arm-linux-musl.gem
71b9bd424b1b7abc18b05052a1a3cfd3627abdca62be280854cc411791357e42  nokogiri-1.19.3-arm64-darwin.gem
40ea6ebf5cf2005dae1dee26dd557d3afb41fb6de6c9764aca8cf06fdb841db1  nokogiri-1.19.3-java.gem
8bb7132cad356c879a1286eaabcb5e68326cb2490317984280fbc62f456d506a  nokogiri-1.19.3-x64-mingw-ucrt.gem
</tr></table>

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

v1.19.3 / 2026-04-27

Fixed / Security

  • Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
  • [CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.
Commits
  • 8cfb9da version bump to v1.19.4
  • a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
  • 6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
  • f658a54 fix: JRuby NONET bypass in XML::Schema
  • 39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
  • 04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
  • 7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
  • ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
  • 5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
  • 9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
  • Additional commits viewable in compare view

Updates activerecord-session_store from 2.2.0 to 2.3.0

Release notes

Sourced from activerecord-session_store's releases.

Version 2.3.0

What's Changed

New Contributors

Full Changelog: rails/activerecord-session_store@v2.2.0...v2.3.0

Commits
  • 74011f1 Avoid ruby warning
  • f53dce2 Prepare for 2.3.0
  • 2cfdc4e Merge pull request #166 from chaffeqa/patch-1
  • aab23c9 Add tests to make sure an empty save isn't made
  • d6a5e5e Update active_record_store.rb
  • e548d59 Optimization: prevent empty COMMIT calls
  • 6aa1ffe Merge PR #161
  • 07fd8cb Use model reference from env when it is available
  • d2dcde9 Merge pull request #222
  • 121f9ff Default to request's cookies_same_site_protection option
  • Additional commits viewable in compare view

Updates sentry-ruby from 6.5.0 to 6.6.2

Changelog

Sourced from sentry-ruby's changelog.

6.6.2

Bug Fixes 🐛

6.6.1

Bug Fixes 🐛

6.6.0

Ne...

Description has been truncated

@dependabot
Bump the ruby-minor-patch group across 1 directory with 14 updates
9463646 
Bumps the ruby-minor-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bootsnap](https://github.com/rails/bootsnap) | `1.23.0` | `1.24.6` |
| [kamal](https://github.com/basecamp/kamal) | `2.11.0` | `2.12.0` |
| [thruster](https://github.com/basecamp/thruster) | `0.1.20` | `0.1.23` |
| [view_component](https://github.com/viewcomponent/view_component) | `4.7.0` | `4.12.0` |
| [devise](https://github.com/heartcombo/devise) | `5.0.3` | `5.0.4` |
| [loofah](https://github.com/flavorjones/loofah) | `2.25.1` | `2.25.2` |
| [rails-html-sanitizer](https://github.com/rails/rails-html-sanitizer) | `1.7.0` | `1.7.1` |
| [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.19.2` | `1.19.4` |
| [activerecord-session_store](https://github.com/rails/activerecord-session_store) | `2.2.0` | `2.3.0` |
| [sentry-ruby](https://github.com/getsentry/sentry-ruby) | `6.5.0` | `6.6.2` |
| [twilio-ruby](https://github.com/twilio/twilio-ruby) | `7.10.5` | `7.10.7` |
| [bullet](https://github.com/flyerhzm/bullet) | `8.1.0` | `8.1.3` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.43.0` | `4.46.0` |



Updates `bootsnap` from 1.23.0 to 1.24.6
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](rails/bootsnap@v1.23.0...v1.24.6)

Updates `kamal` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/basecamp/kamal/releases)
- [Commits](basecamp/kamal@v2.11.0...v2.12.0)

Updates `thruster` from 0.1.20 to 0.1.23
- [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md)
- [Commits](basecamp/thruster@v0.1.20...v0.1.23)

Updates `view_component` from 4.7.0 to 4.12.0
- [Release notes](https://github.com/viewcomponent/view_component/releases)
- [Changelog](https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md)
- [Commits](ViewComponent/view_component@v4.7.0...v4.12.0)

Updates `devise` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/heartcombo/devise/releases)
- [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md)
- [Commits](heartcombo/devise@v5.0.3...v5.0.4)

Updates `loofah` from 2.25.1 to 2.25.2
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md)
- [Commits](flavorjones/loofah@v2.25.1...v2.25.2)

Updates `rails-html-sanitizer` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/rails/rails-html-sanitizer/releases)
- [Changelog](https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md)
- [Commits](rails/rails-html-sanitizer@v1.7.0...v1.7.1)

Updates `nokogiri` from 1.19.2 to 1.19.4
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.2...v1.19.4)

Updates `activerecord-session_store` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/rails/activerecord-session_store/releases)
- [Changelog](https://github.com/rails/activerecord-session_store/blob/main/CHANGELOG.md)
- [Commits](rails/activerecord-session_store@v2.2.0...v2.3.0)

Updates `sentry-ruby` from 6.5.0 to 6.6.2
- [Release notes](https://github.com/getsentry/sentry-ruby/releases)
- [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-ruby@6.5.0...6.6.2)

Updates `sentry-rails` from 6.5.0 to 6.6.2
- [Release notes](https://github.com/getsentry/sentry-ruby/releases)
- [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-ruby@6.5.0...6.6.2)

Updates `twilio-ruby` from 7.10.5 to 7.10.7
- [Release notes](https://github.com/twilio/twilio-ruby/releases)
- [Changelog](https://github.com/twilio/twilio-ruby/blob/main/CHANGES.md)
- [Commits](twilio/twilio-ruby@7.10.5...7.10.7)

Updates `bullet` from 8.1.0 to 8.1.3
- [Changelog](https://github.com/flyerhzm/bullet/blob/main/CHANGELOG.md)
- [Commits](flyerhzm/bullet@8.1.0...8.1.3)

Updates `selenium-webdriver` from 4.43.0 to 4.46.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.43.0...selenium-4.46.0)

---
updated-dependencies:
- dependency-name: bootsnap
  dependency-version: 1.24.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
- dependency-name: kamal
  dependency-version: 2.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
- dependency-name: thruster
  dependency-version: 0.1.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: view_component
  dependency-version: 4.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
- dependency-name: devise
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: loofah
  dependency-version: 2.25.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: rails-html-sanitizer
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: nokogiri
  dependency-version: 1.19.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: activerecord-session_store
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
- dependency-name: sentry-ruby
  dependency-version: 6.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
- dependency-name: sentry-rails
  dependency-version: 6.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
- dependency-name: twilio-ruby
  dependency-version: 7.10.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: bullet
  dependency-version: 8.1.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ruby-minor-patch
- dependency-name: selenium-webdriver
  dependency-version: 4.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants