Skip to content
This repository was archived by the owner on Mar 31, 2026. It is now read-only.

Bump the prod-ruby-dependencies group with 8 updates - #219

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/prod-ruby-dependencies-b4c06ad97b
Open

Bump the prod-ruby-dependencies group with 8 updates#219
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/prod-ruby-dependencies-b4c06ad97b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 30, 2026

Copy link
Copy Markdown
Contributor

Bumps the prod-ruby-dependencies group with 8 updates:

Package From To
activeldap 843948e 4f9d478
activesupport 8.0.4.1 8.1.3
grape 2.4.0 3.1.1
net-ldap 0.19.0 0.20.0
puma 6.6.0 7.2.0
rack 3.1.18 3.2.5
rackup 2.2.1 2.3.1
redacting-logger 1.5.0 1.5.1

Updates activeldap from 843948e to 4f9d478

Commits

Updates activesupport from 8.0.4.1 to 8.1.3

Release notes

Sourced from activesupport's releases.

8.1.3

Active Support

  • Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

    When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result.

    Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"}

    After: hash.to_json # => {"custom_123":"value"}

    Dan Sharp

  • Fix inflections to better handle overlapping acronyms.

    ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "USD"
  inflect.acronym "USDC"
end
"USDC".underscore # => "usdc"

    Said Kaldybaev

  • Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

    zzak

Active Model

  • Fix Ruby 4.0 delegator warning when calling inspect on attributes.

    Hammad Khan

  • Fix NoMethodError when deserialising Type::Integer objects marshalled under Rails 8.0.

    The performance optimisation that replaced @range with @max/@min broke Marshal compatibility. Objects serialised under 8.0 (with @range) and deserialised under 8.1 (expecting @max/@min) would crash with undefined method '<=' for nil because Marshal.load restores instance variables without calling initialize.

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.3 (March 24, 2026)

  • Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

    When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result.

    Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"}

    After: hash.to_json # => {"custom_123":"value"}

    Dan Sharp

  • Fix inflections to better handle overlapping acronyms.

    ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "USD"
  inflect.acronym "USDC"
end
"USDC".underscore # => "usdc"

    Said Kaldybaev

  • Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

    zzak

Rails 8.1.2.1 (March 23, 2026)

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

... (truncated)

Commits
  • fa8f081 Preparing for 8.1.3 release
  • 63cef3d Merge branch '8-1-sec' into 8-1-stable
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • ec1a0e2 Improve performance of NumberToDelimitedConverter
  • 50d732a Fix SafeBuffer#% to preserve unsafe status
  • 19dbab5 NumberConverter: reject scientific notation
  • c315744 Merge pull request #56889 from alpaca-tc/support-spring-on-test-environment
  • 2ac86a8 Revert benchmark.rb to a silent shim (#56832)
  • 8e8c955 Merge pull request #56785 from drsharp/dan/fix-json-encoder-bug
  • Additional commits viewable in compare view

Updates grape from 2.4.0 to 3.1.1

Changelog

Sourced from grape's changelog.

3.2.0 (Next)

Features

Fixes

  • #2655: Fix before_each method to handle nil parameter correctly - @​ericproulx.
  • #2660: Fix thread safety: move mutable ParamsScope state (index, params_meeting_dependency) into a per-request ParamScopeTracker stored in Fiber[] - @​ericproulx.
  • #2666: Endpoint cleanup and minor optimizations - @​ericproulx.
  • Your contribution here.

3.1.0 (2026-01-25)

Features

Fixes

3.0.1 (2025-11-24)

... (truncated)

Commits
  • 9332158 Preparing for release, 3.1.1
  • d333204 Merge pull request #2655 from ruby-grape/fix_before_each_no_method_error
  • f31f01d Fix before_each method to handle nil parameter correctly
  • 2bd3145 Preparing for next development iteration, 3.2.0.
  • 61f67c0 Preparing for release, 3.1.0.
  • 17fb0cf Merge pull request #2652 from ruby-grape/refactor_declared_params_handling
  • e055e2f Merge pull request #2651 from dblock/migrate-danger-pr-comment
  • 0fb57db Use a separate class to handle declared params options. The latters are expli...
  • 7d138f2 Migrate Danger to use danger-pr-comment workflow.
  • ebe5476 Merge pull request #2647 from ruby-grape/namespace_route_param_explicit_kwargs
  • Additional commits viewable in compare view

Updates net-ldap from 0.19.0 to 0.20.0

Release notes

Sourced from net-ldap's releases.

v0.20.0

What's Changed

New Contributors

Full Changelog: ruby-ldap/ruby-net-ldap@v0.19.0...v0.20.0

Changelog

Sourced from net-ldap's changelog.

=== Net::LDAP 0.20.0

Commits

Updates puma from 6.6.0 to 7.2.0

Release notes

Sourced from puma's releases.

v7.2.0 - On The Corner

  • Features

    • Add workers :auto (#3827)
    • Make it possible to restrict control server commands to stats (#3787)

  • Bugfixes

    • Don't break if WEB_CONCURRENCY is set to a blank string (#3837)
    • Don't share server between worker 0 and descendants on refork (#3602)
    • Fix phase check race condition in Puma::Cluster#check_workers (#3690)
    • Fix advertising of CLI config before config files are loaded (#3823)

  • Performance

    • 17% faster HTTP parsing through pre-interning env keys (#3825)
    • Implement dsize and dcompact functions for Puma::HttpParser, which makes Puma's C-extension GC-compactible (#3828)

  • Refactor

    • Remove NoMethodError rescue in Reactor#select_loop (#3831)
    • Various cleanups in the C extension (#3814)
    • Monomorphize handle_request return (#3802)

  • Docs

    • Change link to docs/deployment.md in README.md (#3848)
    • Fix formatting for each signal description in signals.md (#3813)
    • Update deployment and Kubernetes docs with Puma configuration tips (#3807)
    • Rename master to main (#3809, #3808, #3800)
    • Fix some minor typos in the docs (#3804)
    • Add GOVERNANCE.md, MAINTAINERS (#3826)
    • Remove Code Climate badge (#3820)
    • Add @​joshuay03 to the maintainer list

  • CI

v7.1.0

7.1.0 / 2025-10-16 - Neon Witch

neon_witch

  • Features

    • Introduce after_worker_shutdown hook (#3707)
    • Reintroduce keepalive "fast inline" behavior. Provides faster (8x on JRuby & 1.4x on Ruby) pipeline processing (#3794)

  • Bugfixes

    • Skip reading zero bytes when request body is buffered (#3795)
    • Fix PUMA_LOG_CONFIG=1 logging twice with prune_bundler enabled (#3778)
    • Fix prune_bundler not showing in PUMA_LOG_CONFIG=1 output (#3779)
    • Guard ThreadPool method call, which may be nil during shutdown (#3791, #3790)
    • Set Thread.current.puma_server in Thread init code, not every request (#3774)
    • Fix race condition while deleting pidfile (#3657)

... (truncated)

Changelog

Sourced from puma's changelog.

7.2.0 / 2026-01-20

  • Features

    • Add workers :auto (#3827)
    • Make it possible to restrict control server commands to stats (#3787)

  • Bugfixes

    • Don't break if WEB_CONCURRENCY is set to a blank string (#3837)
    • Don't share server between worker 0 and descendants on refork (#3602)
    • Fix phase check race condition in Puma::Cluster#check_workers (#3690)
    • Fix advertising of CLI config before config files are loaded (#3823)

  • Performance

    • 17% faster HTTP parsing through pre-interning env keys (#3825)
    • Implement dsize and dcompact functions for Puma::HttpParser, which makes Puma's C-extension GC-compactible (#3828)

  • Refactor

    • Remove NoMethodError rescue in Reactor#select_loop (#3831)
    • Various cleanups in the C extension (#3814)
    • Monomorphize handle_request return (#3802)

  • Docs

    • Change link to docs/deployment.md in README.md (#3848)
    • Fix formatting for each signal description in signals.md (#3813)
    • Update deployment and Kubernetes docs with Puma configuration tips (#3807)
    • Rename master to main (#3809, #3808, #3800)
    • Fix some minor typos in the docs (#3804)
    • Add GOVERNANCE.md, MAINTAINERS (#3826)
    • Remove Code Climate badge (#3820)
    • Add @​joshuay03 to the maintainer list

  • CI

7.1.0 / 2025-10-16

  • Features

    • Introduce after_worker_shutdown hook (#3707)
    • Reintroduce keepalive "fast inline" behavior. Provides faster (8x on JRuby & 1.4x on Ruby) pipeline processing (#3794)

  • Bugfixes

    • Skip reading zero bytes when request body is buffered (#3795)
    • Fix PUMA_LOG_CONFIG=1 logging twice with prune_bundler enabled (#3778)
    • Fix prune_bundler not showing in PUMA_LOG_CONFIG=1 output (#3779)
    • Guard ThreadPool method call, which may be nil during shutdown (#3791, #3790)
    • Set Thread.current.puma_server in Thread init code, not every request (#3774)
    • Fix race condition while deleting pidfile (#3657)

7.0.4 / 2025-09-23

... (truncated)

Commits

Updates rack from 3.1.18 to 3.2.5

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

Security

  • CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
  • CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
  • CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
  • CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

SPEC Changes

Added

  • Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @​codergeek121)
  • Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @​skipkayhil)
  • Add support for streaming bodies when using Rack::Events. (#2375, @​unflxw)
  • Add deflaters option to Rack::Deflater to enable custom compression algorithms like zstd. (#2168, @​alexanderadam)
  • Add Rack::Request#prefetch? for identifying requests with Sec-Purpose: prefetch header set. (#2405, @​glaszig)
  • Add rack.request.trusted_proxy environment key to indicate whether the request is coming from a trusted proxy.

Changed

  • Raise before exceeding a part limit, not after. (#2362, @​matthew-puku)
  • Rack::Deflater now uses a fixed GZip mtime value. (#2372, @​bensheldon)
  • Multipart parser drops support for RFC 2231 filename* parameter (prohibited by RFC 7578) and now properly handles UTF-8 encoded filenames via percent-encoding and direct UTF-8 bytes. (#2398, @​wtn)
  • The query parser now raises Rack::QueryParser::IncompatibleEncodingError if we try to parse params that are not ASCII compatible. (#2416, @​bquorning)

Fixed

[3.2.4] - 2025-11-03

Fixed

  • Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[3.2.3] - 2025-10-10

Security

  • CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
  • CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

... (truncated)

Commits
  • bb5f355 Bump patch version.
  • f9bde3b Prevent directory traversal via root prefix bypass.
  • 93a68f5 XSS injection via malicious filename in Rack::Directory.
  • 3b8b0d2 Fix MockResponse#body when the body is a Proc (#2420)
  • 4c24539 Bump patch version.
  • 3ba5e4f Allow Multipart head to span read boundary. (#2392)
  • 32bf888 Bump patch version.
  • e179614 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
  • 57277b7 Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
  • 403b74b Normalize adivsories links.
  • Additional commits viewable in compare view

Updates rackup from 2.2.1 to 2.3.1

Changelog

Sourced from rackup's changelog.

Releases

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Commits
  • f3fa1d6 Bump patch version.
  • 583c7dc Fix WEBrick SERVER_PORT handling.
  • adc9596 Bump minor version.
  • 8e538be Update the webrick handler to support OPTIONS * requests. (#40)
  • 7a3e190 Update workflows.
  • 5d18f5a Update spec_server.rb
  • c6cdd47 Fix references from Rack::Server to Rackup::Server in comments
  • e3df7cb Provide a 'Changelog' link on rubygems.org/gems/rackup
  • 39d5226 Documentation for how to access handlers programatically.
  • 301b6dd Update releases.md - fixes #29.
  • See full diff in compare view

Updates redacting-logger from 1.5.0 to 1.5.1

Release notes

Sourced from redacting-logger's releases.

v1.5.1

What's Changed

Full Changelog: github/redacting-logger@v1.5.0...v1.5.1

Commits
  • cbfc7de Merge pull request #146 from github/bump
  • 579c44e bump version
  • b6d9d0a Merge pull request #145 from github/dependabot/bundler/bundler-92edaf4459
  • 237c7b5 Merge branch 'main' into dependabot/bundler/bundler-92edaf4459
  • 36c5aac Merge pull request #144 from github/dependabot/bundler/ruby-dependencies-a621...
  • 34095a8 Merge branch 'main' into dependabot/bundler/ruby-dependencies-a62189b0da
  • 2f0e944 Bump rack from 3.1.17 to 3.1.18 in the bundler group across 1 directory
  • 53325aa Merge pull request #143 from github/dependabot/github_actions/github-actions-...
  • 4c4c0aa Bump the ruby-dependencies group across 1 directory with 3 updates
  • 4ea63a5 Merge branch 'main' into dependabot/github_actions/github-actions-0b77ed365c
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the prod-ruby-dependencies group with 8 updates
8a8d7a6 
Bumps the prod-ruby-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [activeldap](https://github.com/activeldap/activeldap) | ``843948e`` | ``4f9d478`` |
| [activesupport](https://github.com/rails/rails) | `8.0.4.1` | `8.1.3` |
| [grape](https://github.com/ruby-grape/grape) | `2.4.0` | `3.1.1` |
| [net-ldap](https://github.com/ruby-ldap/ruby-net-ldap) | `0.19.0` | `0.20.0` |
| [puma](https://github.com/puma/puma) | `6.6.0` | `7.2.0` |
| [rack](https://github.com/rack/rack) | `3.1.18` | `3.2.5` |
| [rackup](https://github.com/rack/rackup) | `2.2.1` | `2.3.1` |
| [redacting-logger](https://github.com/github/redacting-logger) | `1.5.0` | `1.5.1` |


Updates `activeldap` from `843948e` to `4f9d478`
- [Release notes](https://github.com/activeldap/activeldap/releases)
- [Commits](activeldap/activeldap@843948e...4f9d478)

Updates `activesupport` from 8.0.4.1 to 8.1.3
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v8.0.4.1...v8.1.3)

Updates `grape` from 2.4.0 to 3.1.1
- [Changelog](https://github.com/ruby-grape/grape/blob/master/CHANGELOG.md)
- [Commits](ruby-grape/grape@v2.4.0...v3.1.1)

Updates `net-ldap` from 0.19.0 to 0.20.0
- [Release notes](https://github.com/ruby-ldap/ruby-net-ldap/releases)
- [Changelog](https://github.com/ruby-ldap/ruby-net-ldap/blob/master/History.rdoc)
- [Commits](ruby-ldap/ruby-net-ldap@v0.19.0...v0.20.0)

Updates `puma` from 6.6.0 to 7.2.0
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v6.6.0...v7.2.0)

Updates `rack` from 3.1.18 to 3.2.5
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v3.1.18...v3.2.5)

Updates `rackup` from 2.2.1 to 2.3.1
- [Release notes](https://github.com/rack/rackup/releases)
- [Changelog](https://github.com/rack/rackup/blob/main/releases.md)
- [Commits](rack/rackup@v2.2.1...v2.3.1)

Updates `redacting-logger` from 1.5.0 to 1.5.1
- [Release notes](https://github.com/github/redacting-logger/releases)
- [Commits](github/redacting-logger@v1.5.0...v1.5.1)

---
updated-dependencies:
- dependency-name: activeldap
  dependency-version: 4f9d478186f9b3525799594b5da0eea17aaab428
  dependency-type: direct:production
  dependency-group: prod-ruby-dependencies
- dependency-name: activesupport
  dependency-version: 8.1.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-ruby-dependencies
- dependency-name: grape
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-ruby-dependencies
- dependency-name: net-ldap
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-ruby-dependencies
- dependency-name: puma
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-ruby-dependencies
- dependency-name: rack
  dependency-version: 3.2.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-ruby-dependencies
- dependency-name: rackup
  dependency-version: 2.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-ruby-dependencies
- dependency-name: redacting-logger
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-ruby-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Mar 30, 2026
@dependabot
dependabot Bot requested a review from GrantBirki as a code owner March 30, 2026 21:55
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Mar 30, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@GrantBirki GrantBirki Awaiting requested review from GrantBirki GrantBirki is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants