Merge master: security dependency updates - #495
Merged
Conversation
Bumps [rack](https://github.com/rack/rack) from 3.1.14 to 3.1.16. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rack/rack/blob/main/CHANGELOG.md">rack's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference <a href="https://keepachangelog.com/en/1.0.0/">Keep A Changelog</a>.</p> <h2>Unreleased</h2> <h3>SPEC Changes</h3> <ul> <li>Request environment keys must now be strings. <a href="https://redirect.github.com/rack/rack/issues/2310">#2310</a>, [<a href="https://github.com/jeremyevans"><code>@jeremyevans</code></a>])</li> <li>Add <code>nil</code> as a valid return from a Response <code>body.to_path</code> (<a href="https://redirect.github.com/rack/rack/pull/2318">#2318</a>, [<a href="https://github.com/MSP-Greg"><code>@MSP-Greg</code></a>])</li> </ul> <h3>Added</h3> <ul> <li>Introduce <code>Rack::VERSION</code> constant. (<a href="https://redirect.github.com/rack/rack/pull/2199">#2199</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> <li>ISO-2022-JP encoded parts within MIME Multipart sections of an HTTP request body will now be converted to UTF-8. (<a href="https://redirect.github.com/rack/rack/pull/2245">#2245</a>, <a href="https://github.com/nappa"><code>@nappa</code></a>)</li> </ul> <h3>Changed</h3> <ul> <li>Invalid cookie keys will now raise an error. (<a href="https://redirect.github.com/rack/rack/pull/2193">#2193</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> <li><code>Rack::MediaType#params</code> now handles empty strings. (<a href="https://redirect.github.com/rack/rack/pull/2229">#2229</a>, [<a href="https://github.com/jeremyevans"><code>@jeremyevans</code></a>])</li> <li>Avoid unnecessary calls to the <code>ip_filter</code> lambda to evaluate <code>Request#ip</code> (<a href="https://redirect.github.com/rack/rack/pull/2287">#2287</a>, [<a href="https://github.com/willbryant"><code>@willbryant</code></a>])</li> <li>Only calculate <code>Request#ip</code> once per request (<a href="https://redirect.github.com/rack/rack/pull/2292">#2292</a>, [<a href="https://github.com/willbryant"><code>@willbryant</code></a>])</li> </ul> <h3>Deprecated</h3> <ul> <li><code>Rack::Auth::AbstractRequest#request</code> is deprecated without replacement. (<a href="https://redirect.github.com/rack/rack/pull/2229">#2229</a>, [<a href="https://github.com/jeremyevans"><code>@jeremyevans</code></a>])</li> <li><code>Rack::Request#parse_multipart</code> (private method designed to be overridden in subclasses) is deprecated without replacement. (<a href="https://redirect.github.com/rack/rack/pull/2229">#2229</a>, [<a href="https://github.com/jeremyevans"><code>@jeremyevans</code></a>])</li> </ul> <h3>Removed</h3> <ul> <li><code>Rack::Request#values_at</code> is removed. (<a href="https://redirect.github.com/rack/rack/pull/2200">#2200</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> <li><code>Rack::Logger</code> is removed with no replacement. (<a href="https://redirect.github.com/rack/rack/pull/2196">#2196</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> <li>Automatic cache invalidation in <code>Rack::Request#{GET,POST}</code> has been removed. (<a href="https://redirect.github.com/rack/rack/pull/2230">#2230</a>, [<a href="https://github.com/jeremyevans"><code>@jeremyevans</code></a>])</li> <li>Support for <code>CGI::Cookie</code> has been removed. (<a href="https://redirect.github.com/rack/rack/pull/2332">#2332</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> </ul> <h3>Fixed</h3> <ul> <li><code>Rack::RewindableInput::Middleware</code> no longer wraps a nil input. (<a href="https://redirect.github.com/rack/rack/pull/2259">#2259</a>, <a href="https://github.com/tt"><code>@tt</code></a>)</li> <li>Fix <code>NoMethodError</code> in <code>Rack::Request#wrap_ipv6</code> when <code>x-forwarded-host</code> is empty. (<a href="https://redirect.github.com/rack/rack/pull/2270">#2270</a>, <a href="https://github.com/oieioi"><code>@oieioi</code></a>)</li> <li>Fix the specification for <code>SERVER_PORT</code> which was incorrectly documented as required to be an <code>Integer</code> if present - it must be a <code>String</code> containing digits only. (<a href="https://redirect.github.com/rack/rack/pull/2296">#2296</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> <li><code>SERVER_NAME</code> and <code>HTTP_HOST</code> are now more strictly validated according to the relevant specifications. (<a href="https://redirect.github.com/rack/rack/pull/2298">#2298</a>, [<a href="https://github.com/ioquatix"><code>@ioquatix</code></a>])</li> </ul> <h2>[3.1.15] - 2025-05-18</h2> <ul> <li>Optional support for <code>CGI::Cookie</code> if not available. (<a href="https://redirect.github.com/rack/rack/pull/2327">#2327</a>, <a href="https://redirect.github.com/rack/rack/pull/2333">#2333</a>, [<a href="https://github.com/earlopain"><code>@earlopain</code></a>])</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rack/rack/commit/df2f3f2804373acafc429ed9f0770847a9c6b226"><code>df2f3f2</code></a> Bump patch version.</li> <li><a href="https://github.com/rack/rack/commit/aed514df37e33907df3c971ed3ca9a0a20ac2901"><code>aed514d</code></a> Fix ReDoS and consistency in multipart regexes</li> <li><a href="https://github.com/rack/rack/commit/352650a65cc2027191aaaa1b93a302542ceeb638"><code>352650a</code></a> Synchronize changelog.</li> <li><a href="https://github.com/rack/rack/commit/835e15bf9e51846471e3da63ce474f6836ebd203"><code>835e15b</code></a> Bump patch version.</li> <li><a href="https://github.com/rack/rack/commit/bd60f6e13486fafceb0078fa17f535ac24877b3f"><code>bd60f6e</code></a> Feature detect <code>CGI::Cookie</code>. (<a href="https://redirect.github.com/rack/rack/issues/2333">#2333</a>)</li> <li><a href="https://github.com/rack/rack/commit/3c1a46de3f637f08993d83eb341ddae409cc60c5"><code>3c1a46d</code></a> Replace usage of <code>CGI::Cookie</code> (<a href="https://redirect.github.com/rack/rack/issues/2328">#2328</a>)</li> <li><a href="https://github.com/rack/rack/commit/0ac5c574fd6f0db40d930ac7c32e064435f43d37"><code>0ac5c57</code></a> Test on Ruby v3.4.</li> <li>See full diff in <a href="https://github.com/rack/rack/compare/v3.1.14...v3.1.16">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
#449) …, controllers, tests
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: tmfrnz <timo@dumpark.com>
…n permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Bumps [activerecord](https://github.com/rails/rails) from 8.0.2 to 8.0.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rails/rails/releases">activerecord's releases</a>.</em></p> <blockquote> <h2>8.0.2.1</h2> <h2>Active Support</h2> <ul> <li>No changes.</li> </ul> <h2>Active Model</h2> <ul> <li>No changes.</li> </ul> <h2>Active Record</h2> <ul> <li> <p>Call inspect on ids in RecordNotFound error</p> <p>[CVE-2025-55193]</p> <p><em>Gannon McGibbon</em>, <em>John Hawthorn</em></p> </li> </ul> <h2>Action View</h2> <ul> <li>No changes.</li> </ul> <h2>Action Pack</h2> <ul> <li>No changes.</li> </ul> <h2>Active Job</h2> <ul> <li>No changes.</li> </ul> <h2>Action Mailer</h2> <ul> <li>No changes.</li> </ul> <h2>Action Cable</h2> <ul> <li>No changes.</li> </ul> <h2>Active Storage</h2> <pre><code>Remove dangerous transformations <p>[CVE-2025-24293] </code></pre></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rails/rails/blob/v8.0.2.1/activerecord/CHANGELOG.md">activerecord's changelog</a>.</em></p> <blockquote> <h2>Rails 8.0.2.1 (August 13, 2025)</h2> <ul> <li> <p>Call inspect on ids in RecordNotFound error</p> <p>[CVE-2025-55193]</p> <p><em>Gannon McGibbon</em>, <em>John Hawthorn</em></p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rails/rails/commit/b0c813bc7b61c71dd21ee3a6c6210f6d14030f71"><code>b0c813b</code></a> Preparing for 8.0.2.1 release</li> <li><a href="https://github.com/rails/rails/commit/a6d50aeaaa98613c42133f22308d7ddaf0e5556e"><code>a6d50ae</code></a> Update CHANGELOGs</li> <li><a href="https://github.com/rails/rails/commit/568c0bc2f1e74c65d150a84b89a080949bf9eb9b"><code>568c0bc</code></a> Call inspect on ids in RecordNotFound error</li> <li>See full diff in <a href="https://github.com/rails/rails/compare/v8.0.2...v8.0.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [rexml](https://github.com/ruby/rexml) from 3.4.1 to 3.4.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/rexml/releases">rexml's releases</a>.</em></p> <blockquote> <h2>REXML 3.4.2 - 2025-08-26</h2> <h3>Improvement</h3> <ul> <li> <p>Improved performance.</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/244">GH-244</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/245">GH-245</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/246">GH-246</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/249">GH-249</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/256">GH-256</a></li> <li>Patch by NAITOH Jun</li> </ul> </li> <li> <p>Raise appropriate exception when failing to match start tag in DOCTYPE</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/247">GH-247</a></li> <li>Patch by NAITOH Jun</li> </ul> </li> <li> <p>Deprecate accepting array as an element in XPath.match, first and each</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/252">GH-252</a></li> <li>Patch by tomoya ishida</li> </ul> </li> <li> <p>Don't call needless encoding_updated</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/259">GH-259</a></li> <li>Patch by Sutou Kouhei</li> </ul> </li> <li> <p>Reuse XPath::match</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/263">GH-263</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Cache redundant calls for doctype</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/264">GH-264</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Use Safe Navigation (&.) from Ruby 2.3</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/265">GH-265</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Remove redundant return statements</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/266">GH-266</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Added XML declaration check & Source#skip_spaces method</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/282">GH-282</a></li> <li>Patch by NAITOH Jun</li> <li>Reported by Sofi Aberegg</li> </ul> </li> </ul> <h3>Fixes</h3> <ul> <li>Fix docs typo <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/248">GH-248</a></li> <li>Patch by James Coleman</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ruby/rexml/blob/master/NEWS.md">rexml's changelog</a>.</em></p> <blockquote> <h2>3.4.2 - 2025-08-26 {#version-3-4-2}</h2> <h3>Improvement</h3> <ul> <li> <p>Improved performance.</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/244">GH-244</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/245">GH-245</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/246">GH-246</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/249">GH-249</a></li> <li><a href="https://redirect.github.com/ruby/rexml/issues/256">GH-256</a></li> <li>Patch by NAITOH Jun</li> </ul> </li> <li> <p>Raise appropriate exception when failing to match start tag in DOCTYPE</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/247">GH-247</a></li> <li>Patch by NAITOH Jun</li> </ul> </li> <li> <p>Deprecate accepting array as an element in XPath.match, first and each</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/252">GH-252</a></li> <li>Patch by tomoya ishida</li> </ul> </li> <li> <p>Don't call needless encoding_updated</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/259">GH-259</a></li> <li>Patch by Sutou Kouhei</li> </ul> </li> <li> <p>Reuse XPath::match</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/263">GH-263</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Cache redundant calls for doctype</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/264">GH-264</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Use Safe Navigation (&.) from Ruby 2.3</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/265">GH-265</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Remove redundant return statements</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/266">GH-266</a></li> <li>Patch by pboling</li> </ul> </li> <li> <p>Added XML declaration check & Source#skip_spaces method</p> <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/282">GH-282</a></li> <li>Patch by NAITOH Jun</li> <li>Reported by Sofi Aberegg</li> </ul> </li> </ul> <h3>Fixes</h3> <ul> <li>Fix docs typo <ul> <li><a href="https://redirect.github.com/ruby/rexml/issues/248">GH-248</a></li> <li>Patch by James Coleman</li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/rexml/commit/f36916fe1c66b8cdc1fe482263115625e084d8fe"><code>f36916f</code></a> Add 3.4.2 entry (<a href="https://redirect.github.com/ruby/rexml/issues/284">#284</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/5859bdeac792687eaf93d8e8f0b7e3c1e2ed5c23"><code>5859bde</code></a> Added XML declaration check & <code>Source#skip_spaces</code> method (<a href="https://redirect.github.com/ruby/rexml/issues/282">#282</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/1d876e3bf658b7b4ec7c3372867521695e8eb023"><code>1d876e3</code></a> Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/ruby/rexml/issues/283">#283</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/c87bda8bb8773da7e5a0faf9f16ff165eb052a35"><code>c87bda8</code></a> Remove ostruct from dev deps (<a href="https://redirect.github.com/ruby/rexml/issues/281">#281</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/c60ae027a3c20f359fdf76fa41ae64d22313f482"><code>c60ae02</code></a> Remove bundler from dev deps (<a href="https://redirect.github.com/ruby/rexml/issues/277">#277</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/9b084d78708638cedff54743edc0907c4bd6574a"><code>9b084d7</code></a> Fix & Deprecate REXML::Text#text_indent (<a href="https://redirect.github.com/ruby/rexml/issues/275">#275</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/04a589a61bf4e366abee8764ee74b03f4aecc4aa"><code>04a589a</code></a> Fix a bug that XPath can't be used for no document element (<a href="https://redirect.github.com/ruby/rexml/issues/268">#268</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/66232eaf680d0937ae59bea285cdb8e4d3d88a93"><code>66232ea</code></a> Remove redundant return statements (<a href="https://redirect.github.com/ruby/rexml/issues/266">#266</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/63f3e9772595a64b036953f0ab026d2ea5560a3b"><code>63f3e97</code></a> Use Safe Navigation (&.) from Ruby 2.3 (<a href="https://redirect.github.com/ruby/rexml/issues/265">#265</a>)</li> <li><a href="https://github.com/ruby/rexml/commit/d427fc5914fcc17d7247c5ff9099ee38639d6702"><code>d427fc5</code></a> Avoid redundant calls for doctype (<a href="https://redirect.github.com/ruby/rexml/issues/264">#264</a>)</li> <li>Additional commits viewable in <a href="https://github.com/ruby/rexml/compare/v3.4.1...v3.4.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [rack](https://github.com/rack/rack) from 3.1.16 to 3.1.18. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rack/rack/blob/main/CHANGELOG.md">rack's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference <a href="https://keepachangelog.com/en/1.0.0/">Keep A Changelog</a>.</p> <h2>Unreleased</h2> <h3>Security</h3> <ul> <li><a href="https://github.com/advisories/GHSA-r657-rxjc-j557">CVE-2025-61780</a> Improper handling of headers in <code>Rack::Sendfile</code> may allow proxy bypass.</li> <li><a href="https://github.com/advisories/GHSA-6xw4-3v39-52mm">CVE-2025-61919</a> Unbounded read in <code>Rack::Request</code> form parsing can lead to memory exhaustion.</li> </ul> <h3>SPEC Changes</h3> <ul> <li>Define <code>rack.response_finished</code> callback arguments more strictly. (<a href="https://redirect.github.com/rack/rack/pull/2365">#2365</a>, <a href="https://github.com/skipkayhil"><code>@skipkayhil</code></a>)</li> </ul> <h3>Added</h3> <ul> <li>Add <code>Rack::Files#assign_headers</code> to allow overriding how the configured file headers are set. (<a href="https://redirect.github.com/rack/rack/pull/2377">#2377</a>, <a href="https://github.com/codergeek121"><code>@codergeek121</code></a>)</li> <li>Add support for <code>rack.response_finished</code> to <code>Rack::TempfileReaper</code>. (<a href="https://redirect.github.com/rack/rack/pull/2363">#2363</a>, <a href="https://github.com/skipkayhil"><code>@skipkayhil</code></a>)</li> <li>Add support for streaming bodies when using <code>Rack::Events</code>. (<a href="https://redirect.github.com/rack/rack/blob/main/redirect.github.com/rack/rack/pull/2375">#2375</a>, <a href="https://github.com/unflxw"><code>@unflxw</code></a>)</li> </ul> <h3>Changed</h3> <ul> <li>Raise before exceeding a part limit, not after. (<a href="https://redirect.github.com/rack/rack/pull/2362">#2362</a>, <a href="https://github.com/matthew-puku"><code>@matthew-puku</code></a>)</li> <li>Rack::Deflater now uses a fixed GZip mtime value. (<a href="https://redirect.github.com/rack/rack/pull/2372">#2372</a>, <a href="https://github.com/bensheldon"><code>@bensheldon</code></a>)</li> </ul> <h2>[3.2.2] - 2025-10-07</h2> <h3>Security</h3> <ul> <li><a href="https://github.com/advisories/GHSA-wpv5-97wm-hp9c">CVE-2025-61772</a> Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)</li> <li><a href="https://github.com/advisories/GHSA-w9pc-fmgc-vxvw">CVE-2025-61771</a> Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)</li> <li><a href="https://github.com/advisories/GHSA-p543-xpfm-54cp">CVE-2025-61770</a> Unbounded multipart preamble buffering enables DoS (memory exhaustion)</li> </ul> <h2>[3.2.1] -- 2025-09-02</h2> <h3>Added</h3> <ul> <li>Add support for streaming bodies when using <code>Rack::Events</code>. (<a href="https://redirect.github.com/rack/rack/blob/main/redirect.github.com/rack/rack/pull/2375">#2375</a>, <a href="https://github.com/unflxw"><code>@unflxw</code></a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fix an issue where a <code>NoMethodError</code> would be raised when using <code>Rack::Events</code> with streaming bodies. (<a href="https://redirect.github.com/rack/rack/blob/main/redirect.github.com/rack/rack/pull/2375">#2375</a>, <a href="https://github.com/unflxw"><code>@unflxw</code></a>)</li> </ul> <h2>[3.2.0] - 2025-07-31</h2> <p>This release continues Rack's evolution toward a cleaner, more efficient foundation while maintaining backward compatibility for most applications. The breaking changes primarily affect deprecated functionality, so most users should experience a smooth upgrade with improved performance and standards compliance.</p> <h3>SPEC Changes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rack/rack/commit/96cf07879a084e4488d705ed093395e86bb554f5"><code>96cf078</code></a> Bump patch version.</li> <li><a href="https://github.com/rack/rack/commit/cbd541e8a3d0c5830a3c9a30d3718ce2e124f9db"><code>cbd541e</code></a> Unbounded read in <code>Rack::Request</code> form parsing can lead to memory exhaustion.</li> <li><a href="https://github.com/rack/rack/commit/7e69f65eefe9cd2868df9f9f3b0977b86f93523a"><code>7e69f65</code></a> Improper handling of proxy headers in <code>Rack::Sendfile</code> may allow proxy bypass.</li> <li><a href="https://github.com/rack/rack/commit/db6bc0f64f24a3aa1aa83223da112e25333b049a"><code>db6bc0f</code></a> Normalize adivsories links.</li> <li><a href="https://github.com/rack/rack/commit/ad81f80d4bc2db6e3ba15c5b1d3b23205f7c5810"><code>ad81f80</code></a> Fix handling of <code>Errno::EPIPE</code> in multipart tests.</li> <li><a href="https://github.com/rack/rack/commit/8d141b301dd1eeda363d87d61499fe21dd90f4a5"><code>8d141b3</code></a> Bump patch version.</li> <li><a href="https://github.com/rack/rack/commit/f224f93bb3f16e9b968493fbd7bac751e66d2fdc"><code>f224f93</code></a> Limit amount of retained data when parsing multipart requests</li> <li><a href="https://github.com/rack/rack/commit/e08f78c656c9394d6737c022bde087e0f33336fd"><code>e08f78c</code></a> Fix denial of service vulnerbilties in multipart parsing</li> <li><a href="https://github.com/rack/rack/commit/02ffd94d6d82dec107dbf387d54bd6c4208a294e"><code>02ffd94</code></a> Add changelog for v3.1.16</li> <li>See full diff in <a href="https://github.com/rack/rack/compare/v3.1.16...v3.1.18">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [uri](https://github.com/ruby/uri) from 1.0.3 to 1.0.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/uri/releases">uri's releases</a>.</em></p> <blockquote> <h2>v1.0.4</h2> <h3>Security fixes</h3> <ul> <li><a href="https://www.ruby-lang.org/en/news/2025/10/07/uri-cve-2025-61594/">CVE-2025-61594</a></li> </ul> <hr /> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/uri/compare/v1.0.3...v1.0.4">https://github.com/ruby/uri/compare/v1.0.3...v1.0.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/uri/commit/e5074739c3f28e03a26f6a1daa2a051fdbc3e774"><code>e507473</code></a> Bump up to v1.0.4</li> <li><a href="https://github.com/ruby/uri/commit/d3116ca66a3b1c97dc7577f9d2d6e353f391cd6a"><code>d3116ca</code></a> Merge branch 'CVE-2025-61594-3-4' into HEAD</li> <li><a href="https://github.com/ruby/uri/commit/6c6449e15ffae7027bfe83134f0419f682e0b1ad"><code>6c6449e</code></a> Add authority accessor</li> <li><a href="https://github.com/ruby/uri/commit/5cec76b9e8777764344fd4aee140e309ad207b68"><code>5cec76b</code></a> Clear user info totally at setting any of authority info</li> <li>See full diff in <a href="https://github.com/ruby/uri/compare/v1.0.3...v1.0.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [faraday](https://github.com/lostisland/faraday) from 2.9.0 to 2.14.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lostisland/faraday/releases">faraday's releases</a>.</em></p> <blockquote> <h2>v2.14.1</h2> <h2>Security Note</h2> <p>This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.</p> <h2>What's Changed</h2> <ul> <li>Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1642">lostisland/faraday#1642</a></li> <li>Add RFC document for Options architecture refactoring plan by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1644">lostisland/faraday#1644</a></li> <li>Bump actions/checkout from 5 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lostisland/faraday/pull/1655">lostisland/faraday#1655</a></li> <li>Explicit top-level namespace reference by <a href="https://github.com/c960657"><code>@c960657</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1657">lostisland/faraday#1657</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/lostisland/faraday/pull/1642">lostisland/faraday#1642</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lostisland/faraday/compare/v2.14.0...v2.14.1">https://github.com/lostisland/faraday/compare/v2.14.0...v2.14.1</a></p> <h2>v2.14.0</h2> <h2>What's Changed</h2> <h3>New features ✨</h3> <ul> <li>Use newer <code>UnprocessableContent</code> naming for 422 by <a href="https://github.com/tylerhunt"><code>@tylerhunt</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1638">lostisland/faraday#1638</a></li> </ul> <h3>Fixes 🐞</h3> <ul> <li>Convert strings to UTF-8 by <a href="https://github.com/c960657"><code>@c960657</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1624">lostisland/faraday#1624</a></li> <li>Fix <code>Response#to_hash</code> when response not finished yet by <a href="https://github.com/yykamei"><code>@yykamei</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1639">lostisland/faraday#1639</a></li> </ul> <h3>Misc/Docs 📄</h3> <ul> <li>Lint: use <code>filter_map</code> by <a href="https://github.com/olleolleolle"><code>@olleolleolle</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1637">lostisland/faraday#1637</a></li> <li>Bump <code>actions/checkout</code> from v4 to v5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/lostisland/faraday/pull/1636">lostisland/faraday#1636</a></li> <li>Fixes documentation by <a href="https://github.com/dharamgollapudi"><code>@dharamgollapudi</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1635">lostisland/faraday#1635</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/c960657"><code>@c960657</code></a> made their first contribution in <a href="https://redirect.github.com/lostisland/faraday/pull/1624">lostisland/faraday#1624</a></li> <li><a href="https://github.com/dharamgollapudi"><code>@dharamgollapudi</code></a> made their first contribution in <a href="https://redirect.github.com/lostisland/faraday/pull/1635">lostisland/faraday#1635</a></li> <li><a href="https://github.com/tylerhunt"><code>@tylerhunt</code></a> made their first contribution in <a href="https://redirect.github.com/lostisland/faraday/pull/1638">lostisland/faraday#1638</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lostisland/faraday/compare/v2.13.4...v2.14.0">https://github.com/lostisland/faraday/compare/v2.13.4...v2.14.0</a></p> <h2>v2.13.4</h2> <h2>What's Changed</h2> <ul> <li>Improve error handling logic and add missing test coverage by <a href="https://github.com/iMacTia"><code>@iMacTia</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1633">lostisland/faraday#1633</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/lostisland/faraday/compare/v2.13.3...v2.13.4">https://github.com/lostisland/faraday/compare/v2.13.3...v2.13.4</a></p> <h2>v2.13.3</h2> <h2>What's Changed</h2> <ul> <li>Fix type assumption in <code>Faraday::Error</code> by <a href="https://github.com/iMacTia"><code>@iMacTia</code></a> in <a href="https://redirect.github.com/lostisland/faraday/pull/1630">lostisland/faraday#1630</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lostisland/faraday/commit/16cbd38ef252d25dedf416a4d2510a2f3db10c87"><code>16cbd38</code></a> Version bump to 2.14.1</li> <li><a href="https://github.com/lostisland/faraday/commit/a6d3a3a0bf59c2ab307d0abd91bc126aef5561bc"><code>a6d3a3a</code></a> Merge commit from fork</li> <li><a href="https://github.com/lostisland/faraday/commit/b23f710d28c0dba169470f568df4017a1e8beea7"><code>b23f710</code></a> Explicit top-level namespace reference (<a href="https://redirect.github.com/lostisland/faraday/issues/1657">#1657</a>)</li> <li><a href="https://github.com/lostisland/faraday/commit/49ba4ac3a7359baed634c12a82386f6c8c717ea8"><code>49ba4ac</code></a> Bump actions/checkout from 5 to 6 (<a href="https://redirect.github.com/lostisland/faraday/issues/1655">#1655</a>)</li> <li><a href="https://github.com/lostisland/faraday/commit/51a49bc99d7df6f724d250d64771e1d710576df7"><code>51a49bc</code></a> Ensure Claude reads the guidelines and allow to plan in a gitignored .ai/PLAN...</li> <li><a href="https://github.com/lostisland/faraday/commit/894f65cab8f04bcf35e84a2dfd9fc0286dbce340"><code>894f65c</code></a> Add RFC document for Options architecture refactoring plan (<a href="https://redirect.github.com/lostisland/faraday/issues/1644">#1644</a>)</li> <li><a href="https://github.com/lostisland/faraday/commit/397e3ded0c5166313bb22f1c0221b36b6023fd0f"><code>397e3de</code></a> Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot ...</li> <li><a href="https://github.com/lostisland/faraday/commit/d98c65cfc254ea2898386e4359428527122abec3"><code>d98c65c</code></a> Update Faraday-specific AI agent guidelines</li> <li><a href="https://github.com/lostisland/faraday/commit/56c18ecb718e30c5a3a0dea9bd2361912af9013c"><code>56c18ec</code></a> Add AI agent guidelines specific to Faraday repository</li> <li><a href="https://github.com/lostisland/faraday/commit/3201a42957d37efc968ee8834ba9b50ed5dde54a"><code>3201a42</code></a> Version bump to 2.14.0</li> <li>Additional commits viewable in <a href="https://github.com/lostisland/faraday/compare/v2.9.0...v2.14.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [rack](https://github.com/rack/rack) from 3.1.18 to 3.1.21. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rack/rack/blob/main/CHANGELOG.md">rack's changelog</a>.</em></p> <blockquote> <h2>[3.1.21] - 2026-04-01</h2> <h3>Security</h3> <ul> <li><a href="https://github.com/advisories/GHSA-7mqq-6cf9-v2qp">CVE-2026-34763</a> Root directory disclosure via unescaped regex interpolation in <code>Rack::Directory</code>.</li> <li><a href="https://github.com/advisories/GHSA-v569-hp3g-36wr">CVE-2026-34230</a> Avoid O(n^2) algorithm in <code>Rack::Utils.select_best_encoding</code> which could lead to denial of service.</li> <li><a href="https://github.com/advisories/GHSA-qfgr-crr9-7r49">CVE-2026-32762</a> Forwarded header semicolon injection enables Host and Scheme spoofing.</li> <li><a href="https://github.com/advisories/GHSA-vgpv-f759-9wx3">CVE-2026-26961</a> Raise error for multipart requests with multiple boundary parameters.</li> <li><a href="https://github.com/advisories/GHSA-q4qf-9j86-f5mh">CVE-2026-34786</a> <code>Rack::Static</code> <code>header_rules</code> bypass via URL-encoded path mismatch.</li> <li><a href="https://github.com/advisories/GHSA-q2ww-5357-x388">CVE-2026-34831</a> <code>Content-Length</code> mismatch in <code>Rack::Files</code> error responses.</li> <li><a href="https://github.com/advisories/GHSA-x8cg-fq8g-mxfx">CVE-2026-34826</a> Multipart byte range processing allows denial of service via excessive overlapping ranges.</li> <li><a href="https://github.com/advisories/GHSA-g2pf-xv49-m2h5">CVE-2026-34835</a> <code>Rack::Request</code> accepts invalid Host characters, enabling host allowlist bypass.</li> <li><a href="https://github.com/advisories/GHSA-qv7j-4883-hwh7">CVE-2026-34830</a> <code>Rack::Sendfile</code> header-based <code>X-Accel-Mapping</code> regex injection enables unauthorized <code>X-Accel-Redirect</code>.</li> <li><a href="https://github.com/advisories/GHSA-h2jq-g4cq-5ppq">CVE-2026-34785</a> <code>Rack::Static</code> prefix matching can expose unintended files under the static root.</li> <li><a href="https://github.com/advisories/GHSA-8vqr-qjwx-82mw">CVE-2026-34829</a> Multipart parsing without <code>Content-Length</code> header allows unbounded chunked file uploads.</li> <li><a href="https://github.com/advisories/GHSA-v6x5-cg8r-vv6x">CVE-2026-34827</a> Multipart header parsing allows denial of service via escape-heavy quoted parameters.</li> </ul> <h2>[3.1.20] - 2026-02-16</h2> <h3>Security</h3> <ul> <li><a href="https://github.com/advisories/GHSA-whrj-4476-wvmp">CVE-2026-25500</a> XSS injection via malicious filename in <code>Rack::Directory</code>.</li> <li><a href="https://github.com/advisories/GHSA-mxw3-3hh2-x2mh">CVE-2026-22860</a> Directory traversal via root prefix bypass in <code>Rack::Directory</code>.</li> </ul> <h2>[3.1.19] - 2025-11-03</h2> <h3>Fixed</h3> <ul> <li>Multipart parser: limit MIME header size check to the unread buffer region to avoid false <code>multipart mime part header too large</code> errors when previously read data accumulates in the scan buffer. (<a href="https://redirect.github.com/rack/rack/pull/2392">#2392</a>, <a href="https://github.com/alpaca-tc"><code>@alpaca-tc</code></a>, <a href="https://github.com/willnet"><code>@willnet</code></a>, <a href="https://github.com/krororo"><code>@krororo</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rack/rack/commit/ae8431120e66e92d1885ab8ec0a553d9cad5ec13"><code>ae84311</code></a> Bump patch version.</li> <li><a href="https://github.com/rack/rack/commit/87961c306df1894fb5efaa57d29179091b4bc194"><code>87961c3</code></a> Fix typo in test.</li> <li><a href="https://github.com/rack/rack/commit/fd1c23dc762225e68b50d392142e6a6bf54bf9af"><code>fd1c23d</code></a> Add <code>logger</code> to gemfile.</li> <li><a href="https://github.com/rack/rack/commit/c59d924f215e41ae8ce1bae1633c34f1ca64b182"><code>c59d924</code></a> Fix test expectation.</li> <li><a href="https://github.com/rack/rack/commit/176f468e0d575e2f4d7583ff95f30bb53360e3fe"><code>176f468</code></a> Add Ruby v4.0 to the test matrix.</li> <li><a href="https://github.com/rack/rack/commit/28569342665fee07f161f0974826eb85c1244533"><code>2856934</code></a> Drop EOL Rubies from external tests.</li> <li><a href="https://github.com/rack/rack/commit/17ce7836be1523a7b453f3c06fe070ad7c954708"><code>17ce783</code></a> Limit the number of quoted escapes during multipart parsing</li> <li><a href="https://github.com/rack/rack/commit/367a2a0ec6fbef605c9412dadfd5763b7867441f"><code>367a2a0</code></a> Add Content-Length size check in Rack::Multipart::Parser</li> <li><a href="https://github.com/rack/rack/commit/a17cb99b3440a4db09fb920407adf5ead127704c"><code>a17cb99</code></a> Fix root prefix bug in Rack::Static</li> <li><a href="https://github.com/rack/rack/commit/59a0966a484f2903833fa3e4c81919d3c645738d"><code>59a0966</code></a> Only do a simple substitution on the x-accel-mapping paths</li> <li>Additional commits viewable in <a href="https://github.com/rack/rack/compare/v3.1.18...v3.1.21">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [bcrypt](https://github.com/bcrypt-ruby/bcrypt-ruby) from 3.1.20 to 3.1.22. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/bcrypt-ruby/bcrypt-ruby/releases">bcrypt's releases</a>.</em></p> <blockquote> <h2>v3.1.22</h2> <h2>What's Changed</h2> <ul> <li>Move compilation after bundle install by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/291">bcrypt-ruby/bcrypt-ruby#291</a></li> <li>Add TruffleRuby in CI by <a href="https://github.com/tjschuck"><code>@tjschuck</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/293">bcrypt-ruby/bcrypt-ruby#293</a></li> <li>fix env url by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/294">bcrypt-ruby/bcrypt-ruby#294</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/bcrypt-ruby/bcrypt-ruby/compare/v3.1.21...v3.1.22">https://github.com/bcrypt-ruby/bcrypt-ruby/compare/v3.1.21...v3.1.22</a></p> <h2>v3.1.21</h2> <h2>What's Changed</h2> <ul> <li>Provide a 'Changelog' link on rubygems.org/gems/bcrypt by <a href="https://github.com/mark-young-atg"><code>@mark-young-atg</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/274">bcrypt-ruby/bcrypt-ruby#274</a></li> <li>Support ruby 3.3 and 3.4.0-preview1 by <a href="https://github.com/m-nakamura145"><code>@m-nakamura145</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/276">bcrypt-ruby/bcrypt-ruby#276</a></li> <li>Mark as ractor-safe by <a href="https://github.com/mohamedhafez"><code>@mohamedhafez</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/280">bcrypt-ruby/bcrypt-ruby#280</a></li> <li>Add == gotcha that can be unintuitive at first by <a href="https://github.com/federicoaldunate"><code>@federicoaldunate</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/279">bcrypt-ruby/bcrypt-ruby#279</a></li> <li>Constant compare by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/282">bcrypt-ruby/bcrypt-ruby#282</a></li> <li>try to modernize CI by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/287">bcrypt-ruby/bcrypt-ruby#287</a></li> <li>Try to deal with flaky tests by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/288">bcrypt-ruby/bcrypt-ruby#288</a></li> <li>Configure trusted publishing by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/289">bcrypt-ruby/bcrypt-ruby#289</a></li> <li>bump version by <a href="https://github.com/tenderlove"><code>@tenderlove</code></a> in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/290">bcrypt-ruby/bcrypt-ruby#290</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mark-young-atg"><code>@mark-young-atg</code></a> made their first contribution in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/274">bcrypt-ruby/bcrypt-ruby#274</a></li> <li><a href="https://github.com/m-nakamura145"><code>@m-nakamura145</code></a> made their first contribution in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/276">bcrypt-ruby/bcrypt-ruby#276</a></li> <li><a href="https://github.com/mohamedhafez"><code>@mohamedhafez</code></a> made their first contribution in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/280">bcrypt-ruby/bcrypt-ruby#280</a></li> <li><a href="https://github.com/federicoaldunate"><code>@federicoaldunate</code></a> made their first contribution in <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/pull/279">bcrypt-ruby/bcrypt-ruby#279</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/bcrypt-ruby/bcrypt-ruby/compare/v3.1.20...v3.1.21">https://github.com/bcrypt-ruby/bcrypt-ruby/compare/v3.1.20...v3.1.21</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/bcrypt-ruby/bcrypt-ruby/blob/master/CHANGELOG">bcrypt's changelog</a>.</em></p> <blockquote> <p>3.1.22 Mar 18 2026</p> <ul> <li>[CVE-2026-33306] Fix integer overflow in Java extension</li> </ul> <p>3.1.21 Dec 31 2025</p> <ul> <li>Use constant time comparisons</li> <li>Mark as Ractor safe</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/831ce64cb0a9502130fa93a28bfd9527a5fa45c4"><code>831ce64</code></a> Merge commit from fork</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/32e687ec5f62baad01a62e4634e41d97f8432a61"><code>32e687e</code></a> bump version update changelog</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/5faa2748331d3edc661c127ef2fbb3afcb6b02a4"><code>5faa274</code></a> Fix integer overflow in JRuby BCrypt rounds calculation</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/aafc0332ac1aa0d774f2c864439596436f92d18d"><code>aafc033</code></a> Merge pull request <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/issues/294">#294</a> from bcrypt-ruby/fix-publishing</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/01f947a66ad8c5e20d8c89d9adbc7e3bd49afb70"><code>01f947a</code></a> fix env url</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/92ca1d67deeb8e64dbe779396c52b177e307bc43"><code>92ca1d6</code></a> Merge pull request <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/issues/293">#293</a> from bcrypt-ruby/truffleruby-ci-alt-implementation</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/4d1d95b8ec624d0cf8ed1099402a7edd2f308da2"><code>4d1d95b</code></a> Add TruffleRuby in CI</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/36a04a2278fae3b38100912ff489b86cd0984b8a"><code>36a04a2</code></a> Merge pull request <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/issues/291">#291</a> from tenderlove/fix-publishing</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/01cc68835f0bcdd7ef16de477471c112adb417da"><code>01cc688</code></a> Move compilation after bundle install</li> <li><a href="https://github.com/bcrypt-ruby/bcrypt-ruby/commit/82e6c4c6cf81912768c68d721372e78330ff2c92"><code>82e6c4c</code></a> Merge pull request <a href="https://redirect.github.com/bcrypt-ruby/bcrypt-ruby/issues/290">#290</a> from tenderlove/bump</li> <li>Additional commits viewable in <a href="https://github.com/bcrypt-ruby/bcrypt-ruby/compare/v3.1.20...v3.1.22">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actionview](https://github.com/rails/rails) from 8.0.2.1 to 8.0.4.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rails/rails/releases">actionview's releases</a>.</em></p> <blockquote> <h2>8.0.4.1</h2> <h2>Active Support</h2> <ul> <li> <p>Reject scientific notation in NumberConverter</p> <p>[CVE-2026-33176]</p> <p><em>Jean Boussier</em></p> </li> <li> <p>Fix <code>SafeBuffer#%</code> to preserve unsafe status</p> <p>[CVE-2026-33170]</p> <p><em>Jean Boussier</em></p> </li> <li> <p>Improve performance of NumberToDelimitedConverter</p> <p>[CVE-2026-33169]</p> <p><em>Jean Boussier</em></p> </li> </ul> <h2>Active Model</h2> <ul> <li>No changes.</li> </ul> <h2>Active Record</h2> <ul> <li>No changes.</li> </ul> <h2>Action View</h2> <ul> <li> <p>Skip blank attribute names in tag helpers to avoid generating invalid HTML.</p> <p>[CVE-2026-33168]</p> <p><em>Mike Dalessio</em></p> </li> </ul> <h2>Action Pack</h2> <ul> <li>No changes.</li> </ul> <h2>Active Job</h2> <ul> <li>No changes.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rails/rails/commit/a79efed95797b196575a98845dc989e3106a9acb"><code>a79efed</code></a> Preparing for 8.0.4.1 release</li> <li><a href="https://github.com/rails/rails/commit/ac7979b1183bd659779245eaf2850f666cb8aafe"><code>ac7979b</code></a> Update changelog</li> <li><a href="https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924"><code>c79a07d</code></a> Skip blank attribute names in Action View tag helpers</li> <li><a href="https://github.com/rails/rails/commit/624fe3cdb9ab774ff598af29f408425178da6677"><code>624fe3c</code></a> Preparing for 8.0.4 release</li> <li><a href="https://github.com/rails/rails/commit/2f3eb21bd6da9a4935314d4a0663c473c4d33700"><code>2f3eb21</code></a> Sync CHANGELOG</li> <li><a href="https://github.com/rails/rails/commit/9ab450a023290ff50ed37c8561880a78dabbf19a"><code>9ab450a</code></a> Merge pull request <a href="https://redirect.github.com/rails/rails/issues/55490">#55490</a> from Earlopain/bump-rubocop</li> <li><a href="https://github.com/rails/rails/commit/95bee6a4c8132b4caf53e073f7b01ce5cdeed4a6"><code>95bee6a</code></a> Merge pull request <a href="https://redirect.github.com/rails/rails/issues/55738">#55738</a> from skipkayhil/hm-nkxzsnnrqqlyrotw</li> <li><a href="https://github.com/rails/rails/commit/529f933fc8b13114d308dd0752f76a9e293c8537"><code>529f933</code></a> Preparing for 8.0.3 release</li> <li><a href="https://github.com/rails/rails/commit/6409b24dd20ee4076ec3dbefba9edc3376bf13f1"><code>6409b24</code></a> Merge pull request <a href="https://redirect.github.com/rails/rails/issues/55719">#55719</a> from skipkayhil/hm-fix-label-for-namespace</li> <li><a href="https://github.com/rails/rails/commit/0160f42886e2ebeb7a0680f073b870326f14c12a"><code>0160f42</code></a> Sync CHANGELOGs</li> <li>Additional commits viewable in <a href="https://github.com/rails/rails/compare/v8.0.2.1...v8.0.4.1">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [rack-session](https://github.com/rack/rack-session) from 2.1.1 to 2.1.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rack/rack-session/releases">rack-session's releases</a>.</em></p> <blockquote> <h2>v2.1.2</h2> <ul> <li><a href="https://github.com/advisories/GHSA-33qg-7wpp-89cq">CVE-2026-39324</a> Don't fall back to unencrypted coder if encryptors are present.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rack/rack-session/blob/main/releases.md">rack-session's changelog</a>.</em></p> <blockquote> <h2>v2.1.2</h2> <ul> <li><a href="https://github.com/advisories/GHSA-33qg-7wpp-89cq">CVE-2026-39324</a> Don't fall back to unencrypted coder if encryptors are present.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rack/rack-session/commit/504367b59caf7ec78127785cc6351f46be14f8ca"><code>504367b</code></a> Bump patch version.</li> <li><a href="https://github.com/rack/rack-session/commit/f43638cb3a4d15c3ecaf59e67a04b47fda08eeac"><code>f43638c</code></a> Don't fall back to unencrypted coder if encryptors are present.</li> <li><a href="https://github.com/rack/rack-session/commit/dadcfe60f193e8d8540bec6b95ca75bed8e5fd7e"><code>dadcfe6</code></a> Bump actions/checkout from 4 to 5 (<a href="https://redirect.github.com/rack/rack-session/issues/54">#54</a>)</li> <li><a href="https://github.com/rack/rack-session/commit/4eb9ea83b372e319c65a8c2bcfe87e8be942cf9b"><code>4eb9ea8</code></a> Add top level session spec to validate existing formats.</li> <li><a href="https://github.com/rack/rack-session/commit/8f94577c1d11b746692974f1417acff2856060cb"><code>8f94577</code></a> Add rails to external tests.</li> <li><a href="https://github.com/rack/rack-session/commit/38ea47da9937afb4f2140b3c23866e3791a46eaf"><code>38ea47d</code></a> Allow the v2 encryptor to serialize messages with <code>Marshal</code> (<a href="https://redirect.github.com/rack/rack-session/issues/44">#44</a>)</li> <li><a href="https://github.com/rack/rack-session/commit/43f2e3a46393b51473bb90f54e61189465ae759d"><code>43f2e3a</code></a> Fix compatibility with older Rubies.</li> <li><a href="https://github.com/rack/rack-session/commit/6a060b806399bff4961eaf6bf89535395c95549c"><code>6a060b8</code></a> Support UTF-8 data when using the JSON serializer (<a href="https://redirect.github.com/rack/rack-session/issues/39">#39</a>)</li> <li><a href="https://github.com/rack/rack-session/commit/8ce0146a7079332d9c58a43e418acb1ecf904ef6"><code>8ce0146</code></a> Fix <code>auth_tag</code> retrieval on JRuby (<a href="https://redirect.github.com/rack/rack-session/issues/32">#32</a>)</li> <li><a href="https://github.com/rack/rack-session/commit/77271850efd977897d02903bfde8ed51e4137a68"><code>7727185</code></a> Add AEAD encryption (<a href="https://redirect.github.com/rack/rack-session/issues/23">#23</a>)</li> <li>See full diff in <a href="https://github.com/rack/rack-session/compare/v2.1.1...v2.1.2">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.8.6 to 2.9.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md">addressable's changelog</a>.</em></p> <blockquote> <h2>Addressable 2.9.0 <!-- raw HTML omitted --></h2> <ul> <li>fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)</li> </ul> <h2>Addressable 2.8.10 <!-- raw HTML omitted --></h2> <ul> <li>fixes ReDoS vulnerability in Addressable::Template#match</li> </ul> <h2>Addressable 2.8.9 <!-- raw HTML omitted --></h2> <ul> <li>Reduce gem size by excluding test files (<a href="https://redirect.github.com/sporkmonger/addressable/issues/569">#569</a>)</li> <li>No need for bundler as development dependency (<a href="https://redirect.github.com/sporkmonger/addressable/issues/571">#571</a>, <a href="https://github.com/sporkmonger/addressable/commit/5fc1d93">5fc1d93</a>)</li> <li>idna/pure: stop building the useless <code>COMPOSITION_TABLE</code> (removes the <code>Addressable::IDNA::COMPOSITION_TABLE</code> constant) (<a href="https://redirect.github.com/sporkmonger/addressable/issues/564">#564</a>)</li> </ul> <p><a href="https://redirect.github.com/sporkmonger/addressable/issues/569">#569</a>: <a href="https://redirect.github.com/sporkmonger/addressable/pull/569">sporkmonger/addressable#569</a> <a href="https://redirect.github.com/sporkmonger/addressable/issues/571">#571</a>: <a href="https://redirect.github.com/sporkmonger/addressable/pull/571">sporkmonger/addressable#571</a> <a href="https://redirect.github.com/sporkmonger/addressable/issues/564">#564</a>: <a href="https://redirect.github.com/sporkmonger/addressable/pull/564">sporkmonger/addressable#564</a></p> <h2>Addressable 2.8.8 <!-- raw HTML omitted --></h2> <ul> <li>Replace the <code>unicode.data</code> blob by a ruby constant (<a href="https://redirect.github.com/sporkmonger/addressable/issues/561">#561</a>)</li> <li>Allow <code>public_suffix</code> 7 (<a href="https://redirect.github.com/sporkmonger/addressable/issues/558">#558</a>)</li> </ul> <p><a href="https://redirect.github.com/sporkmonger/addressable/issues/561">#561</a>: <a href="https://redirect.github.com/sporkmonger/addressable/pull/561">sporkmonger/addressable#561</a> <a href="https://redirect.github.com/sporkmonger/addressable/issues/558">#558</a>: <a href="https://redirect.github.com/sporkmonger/addressable/pull/558">sporkmonger/addressable#558</a></p> <h2>Addressable 2.8.7 <!-- raw HTML omitted --></h2> <ul> <li>Allow <code>public_suffix</code> 6 (<a href="https://redirect.github.com/sporkmonger/addressable/issues/535">#535</a>)</li> </ul> <p><a href="https://redirect.github.com/sporkmonger/addressable/issues/535">#535</a>: <a href="https://redirect.github.com/sporkmonger/addressable/pull/535">sporkmonger/addressable#535</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sporkmonger/addressable/commit/0c3e8589b23d4402903a9b4e1fdeba4e43c52ca4"><code>0c3e858</code></a> Revving version and changelog</li> <li><a href="https://github.com/sporkmonger/addressable/commit/91915c1f7aafa3e2c9f42e2f4e21d948c7a861b8"><code>91915c1</code></a> Fixing additional vulnerable paths</li> <li><a href="https://github.com/sporkmonger/addressable/commit/a091e39ff02fc321b21dea3a0df585bef2ba3744"><code>a091e39</code></a> Add many more adversarial test cases to ensure we don't have any ReDoS regres...</li> <li><a href="https://github.com/sporkmonger/addressable/commit/463a819665a3b85ce5ce894c90bd7bfa3b9d2e15"><code>463a819</code></a> Regenerate gemspec on newer rubygems</li> <li><a href="https://github.com/sporkmonger/addressable/commit/0afcb0b9672bee301e5e96ed850fec05b2fcabb0"><code>0afcb0b</code></a> Improve from O(n^2) to O(n)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/c87f768f22ab00376ed2f8cb106f59c9d0652d3a"><code>c87f768</code></a> Fix a ReDoS vulnerability in URI template matching</li> <li><a href="https://github.com/sporkmonger/addressable/commit/0d7e9b259fb0940d1a85064b04f678a7984409a5"><code>0d7e9b2</code></a> Fix links for 2.8.9 in CHANGELOG (<a href="https://redirect.github.com/sporkmonger/addressable/issues/573">#573</a>)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/e2091200b31553f19248eb871f071852409796f8"><code>e209120</code></a> Update version, gemspec, and CHANGELOG for 2.8.9 (<a href="https://redirect.github.com/sporkmonger/addressable/issues/572">#572</a>)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/387587492b6536748ed12a11c3fdb44a48885f28"><code>3875874</code></a> Reduce gem size by excluding test files (<a href="https://redirect.github.com/sporkmonger/addressable/issues/569">#569</a>)</li> <li><a href="https://github.com/sporkmonger/addressable/commit/3e57cc6018f94231aabb47fd341acd1b40f1e71a"><code>3e57cc6</code></a> CI: back to <code>windows-2022</code> for MRI job</li> <li>Additional commits viewable in <a href="https://github.com/sporkmonger/addressable/compare/addressable-2.8.6...addressable-2.9.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impactoss/impactoss-server/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [net-imap](https://github.com/ruby/net-imap) from 0.5.7 to 0.5.14. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/ruby/net-imap/releases">net-imap's releases</a>.</em></p> <blockquote> <h2>v0.5.14</h2> <h2>What's Changed</h2> <h3>🔒 Security</h3> <p>This release contains fixes for <strong>multiple vulnerabilities</strong> concerning <em><strong><code>STARTTLS</code> stripping</strong></em>, argument validation, and denial of service attacks.</p> <blockquote> <p>[!WARNING] <a href="https://redirect.github.com/ruby/net-imap/pull/665">ruby/net-imap#665</a> fixes a <code>STARTTLS</code> stripping vulnerability (GHSA-vcgp-9326-pqcp). Without this fix, a man-in-the-middle attacker can cause <code>Net::IMAP#starttls</code> to return "successfully", <strong><em>without starting TLS</em></strong>.</p> </blockquote> <blockquote> <p>[!IMPORTANT] Argument validation is significantly improved. Several command injection vulnerabilities have been fixed: <a href="https://redirect.github.com/ruby/net-imap/pull/662">ruby/net-imap#662</a> fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px). <a href="https://redirect.github.com/ruby/net-imap/pull/662">ruby/net-imap#662</a> fixes CRLF/command/argument injection via the <code>attr</code> argument to <code>#store</code>/<code>#uid_store</code> (GHSA-hm49-wcqc-g2xg) <a href="https://redirect.github.com/ruby/net-imap/pull/662">ruby/net-imap#662</a> fixes CRLF/command/argument injection via the <code>storage_limit</code> argument to <code>#setquota</code> (GHSA-hm49-wcqc-g2xg). <a href="https://redirect.github.com/ruby/net-imap/pull/662">ruby/net-imap#662</a> fixes CRLF/command injection via <code>RawData</code> (GHSA-hm49-wcqc-g2xg):</p> <ul> <li><code>#search</code> and <code>#uid_search</code> send <code>criteria</code> as raw data, when it is a String</li> <li><code>#fetch</code> and <code>#uid_fetch</code> send <code>attr</code> as raw data, when it is a String. When <code>attr</code> is an Array, its String members are sent as raw data.</li> </ul> </blockquote> <blockquote> <p>[!CAUTION] <code>RawData</code> does not defend against <em>other</em> forms of argument injection! It is an intentionally low-level API.</p> </blockquote> <blockquote> <p>[!NOTE] Two denial of service vulnerabilities have been addressed. These are generally only relevant when connecting to an <em>untrusted hostile server</em> (or without TLS).</p> <p><a href="https://redirect.github.com/ruby/net-imap/pull/650">ruby/net-imap#650</a> fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw). <a href="https://redirect.github.com/ruby/net-imap/pull/656">ruby/net-imap#656</a> adds a configurable <code>max_iterations</code> count for <code>SCRAM-*</code> authentication (GHSA-87pf-fpwv-p7m7).</p> </blockquote> <h3>Added</h3> <ul> <li>🔒 Add <code>ScramAuthenticator#max_iterations</code> (backports <a href="https://redirect.github.com/ruby/net-imap/issues/654">#654</a>) in <a href="https://redirect.github.com/ruby/net-imap/pull/656">ruby/net-imap#656</a>, reported by <a href="https://github.com/Masamuneee"><code>@Masamuneee</code></a></li> </ul> <h3>Fixed</h3> <ul> <li>🔒 Fix STARTTLS stripping vulnerability (backports <a href="https://redirect.github.com/ruby/net-imap/issues/664">#664</a>) in <a href="https://redirect.github.com/ruby/net-imap/pull/665">ruby/net-imap#665</a>, reported by <a href="https://github.com/Masamuneee"><code>@Masamuneee</code></a></li> <li>🔒 Fix CRLF injection vulnerabilities (backports <a href="https://redirect.github.com/ruby/net-imap/issues/657">#657</a>, <a href="https://redirect.github.com/ruby/net-imap/issues/658">#658</a>, <a href="https://redirect.github.com/ruby/net-imap/issues/659">#659</a>, <a href="https://redirect.github.com/ruby/net-imap/issues/660">#660</a>, <a href="https://redirect.github.com/ruby/net-imap/issues/636">#636</a>, <a href="https://redirect.github.com/ruby/net-imap/issues/661">#661</a>) in <a href="https://redirect.github.com/ruby/net-imap/pull/662">ruby/net-imap#662</a>, reported by <a href="https://github.com/manunio"><code>@manunio</code></a></li> <li>⚡ Much faster ResponseReader performance (backports <a href="https://redirect.github.com/ruby/net-imap/issues/642">#642</a>) in <a href="https://redirect.github.com/ruby/net-imap/pull/650">ruby/net-imap#650</a>, reported by <a href="https://github.com/Masamuneee"><code>@Masamuneee</code></a></li> <li>🐛 Config <code>version_defaults</code> should be attr_reader (backports <a href="https://redirect.github.com/ruby/net-imap/issues/594">#594</a>) by <a href="https://github.com/nevans"><code>@nevans</code></a> in <a href="https://redirect.github.com/ruby/net-imap/pull/631">ruby/net-imap#631</a></li> <li>🐛 Wait to continue RawData literals (backports <a href="https://redirect.github.com/ruby/net-imap/issues/660">#660</a>) by <a href="https://github.com/nevans"><code>@nevans</code></a> in <a href="https://redirect.github.com/ruby/net-imap/pull/662">ruby/net-imap#662</a></li> </ul> <h3>Other Changes</h3> <ul> <li>♻️ Improve internal literal sending (partially backports <a href="https://redirect.github.com/ruby/net-imap/issues/616">#616</a>, <a href="https://redirect.github.com/ruby/net-imap/issues/649">#649</a>) by <a href="https://github.com/nevans"><code>@nevans</code></a> in <a href="https://redirect.github.com/ruby/net-imap/pull/652">ruby/net-imap#652</a></li> </ul> <h3>Miscellaneous</h3> <ul> <li>✅ Fix Data polyfill tests for ruby 4.1 by <a href="https://github.com/nevans"><code>@nevans</code></a> in <a href="https://redirect.github.com/ruby/net-imap/pull/632">ruby/net-imap#632</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/ruby/net-imap/compare/v0.5.13...v0.5.14">https://github.com/ruby/net-imap/compare/v0.5.13...v0.5.14</a></p> <h2>v0.5.13</h2> <h2>What's Changed</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ruby/net-imap/commit/4063bc1d1d3e21046544ed7a2c131e5f886bab01"><code>4063bc1</code></a> 🔖 Bump version to 0.5.14</li> <li><a href="https://github.com/ruby/net-imap/commit/f79d35bf5833f186e81044c57c843eda30c873da"><code>f79d35b</code></a> 🔀 Merge pull request <a href="https://redirect.github.com/ruby/net-imap/issues/665">#665</a> from ruby/backport/v0.5/STARTTLS-stripping</li> <li><a href="https://github.com/ruby/net-imap/commit/b3ad198bdecd7f8f1342bf2f0191bc5261130383"><code>b3ad198</code></a> 🍒 pick 24d5c773d: 🔒🥅 Handle tagged "OK" to incomplete command [backport <a href="https://redirect.github.com/ruby/net-imap/issues/664">#664</a>]</li> <li><a href="https://github.com/ruby/net-imap/commit/7a233c57fdf319ad8f238072a60c27948dd44e89"><code>7a233c5</code></a> 🍒 pick 62eea6ffe: 🔒🥅 Ensure STARTTLS tagged response was handled [backport <a href="https://redirect.github.com/ruby/net-imap/issues/664">#664</a>]</li> <li><a href="https://github.com/ruby/net-imap/commit/a530fa7d0efba9e02aa88ea9b9835e4d5e58f308"><code>a530fa7</code></a> 🍒 pick 46636cae8: ❌🔒 Add failing test for STARTTLS stripping [backport <a href="https://redirect.github.com/ruby/net-imap/issues/664">#664</a>]</li> <li><a href="https://github.com/ruby/net-imap/commit/6bf02aef7e0b5931010c36e377f79a71636b306b"><code>6bf02ae</code></a> 🔀 Merge pull request <a href="https://redirect.github.com/ruby/net-imap/issues/662">#662</a> from ruby/backport/v0.5/raw_data-warnings</li> <li><a href="https://github.com/ruby/net-imap/commit/fa478c561a53b7e6306a0a6669ed944c91020715"><code>fa478c5</code></a> 🍒 pick be32e712e: 📚 Improve documentation of RawData arguments [backports <a href="https://redirect.github.com/ruby/net-imap/issues/661">#661</a>]</li> <li><a href="https://github.com/ruby/net-imap/commit/ca0ca5da35944b141bf5a7dce3f267a9acbff897"><code>ca0ca5d</code></a> 🍒 pick 47c72186d: 🐛 Validate RawData and wait to continue literals [backports...</li> <li><a href="https://github.com/ruby/net-imap/commit/3116c7d5be14e0b5257237da21de7ed5a59f4233"><code>3116c7d</code></a> 🍒 pick 0ec4fd351: 🥅 Validate <code>#setquota</code> storage limit argument [backports <a href="https://redirect.github.com/ruby/net-imap/issues/659">#659</a>]</li> <li><a href="https://github.com/ruby/net-imap/commit/bbe901afebfa56d8d24923daae4dd8c33a6db9fd"><code>bbe901a</code></a> 🍒 pick 0ea729c78: 📚 Update QUOTA rdoc, params, attrs to match RFCs [backports...</li> <li>Additional commits viewable in <a href="https://github.com/ruby/net-imap/compare/v0.5.7...v0.5.14">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings nz-justice-development up to date with master, including security-related dependency updates: