Skip to content

chore(deps): bump the production-dependencies group across 1 directory with 7 updates - #84

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/production-dependencies-b7539c6c96
Open

chore(deps): bump the production-dependencies group across 1 directory with 7 updates#84
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/production-dependencies-b7539c6c96

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 7 updates in the / directory:

Package From To
json 2.19.5 2.20.0
nokogiri 1.19.3 1.19.4
puma 8.0.1 8.0.2
sentry-ruby 6.5.0 6.6.2
kamal 2.11.0 2.12.0
axe-core-rspec 4.11.3 4.12.0
selenium-webdriver 4.43.0 4.45.0

Updates json from 2.19.5 to 2.20.0

Release notes

Sourced from json's releases.

v2.20.0

What's Changed

  • Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
    • The :max_nesting option still defaults to 100.
  • Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
  • Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
  • Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
  • Integrate with Ruby 4.1 ruby_sized_xfree.

Full Changelog: ruby/json@v2.19.8...v2.20.0

v2.19.9

  • Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: ruby/json@v2.19.8...v2.19.9

v2.19.8

What's Changed

  • Fix 1-byte buffer overread on EOS errors.
  • Handle invalid types passed as max_nesting option.

Full Changelog: ruby/json@v2.19.7...v2.19.8

v2.19.7

What's Changed

  • Fix some more edge cases with out of range floats.
  • Ensure the string provided to JSON.parse can't be mutated during parsing.
  • Add missing write barriers in State#dup.
  • Further validate generator depth config.

Full Changelog: ruby/json@v2.19.6...v2.19.7

v2.19.6

What's Changed

  • Cleanly handle overly large depth generator argument.
  • Add missing write barrier in ParserConfig.

Full Changelog: ruby/json@v2.19.5...v2.19.6

Changelog

Sourced from json's changelog.

2026-06-23 (2.20.0)

  • Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
    • The :max_nesting option still defaults to 100.
  • Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
  • Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
  • Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
  • Integrate with Ruby 4.1 ruby_sized_xfree.

2026-06-11 (2.19.9)

  • Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

  • Fix 1-byte buffer overread on EOS errors.
  • Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

  • Fix some more edge cases with out of range floats.
  • Ensure the string provided to JSON.parse can't be mutated during parsing.
  • Add missing write barriers in State#dup.
  • Further validate generator depth config.

2026-05-28 (2.19.6)

  • Cleanly handle overly large depth generator argument.
  • Add missing write barrier in ParserConfig.
Commits
  • 1316292 Release 2.20.0
  • 1443265 Remove useless executable bits
  • 532065c Preserve UTF-8 encoding when reallocating a frozen ResumableParser buffer
  • 7c8af4b Update extconf.rb guard to use RUBY_ENGINE_VERSION
  • 2afd1a9 Cleanup the rb_catch_obj workaround
  • 9892514 Simplify parser_config_init
  • b30a8f8 ResumableParser: eagerly drop the buffer when reaching EOS
  • f08c663 ResumableParser: accept only keyword arguments
  • 9d8efcb Workaround TruffleRuby buggy rb_catch_obj implementation
  • 4bd1e9b ResumableParser: use throw rather than raise for handled EOS
  • Additional commits viewable in compare view

Updates nokogiri from 1.19.3 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem
Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
Commits
  • 8cfb9da version bump to v1.19.4
  • a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
  • 6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
  • f658a54 fix: JRuby NONET bypass in XML::Schema
  • 39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
  • 04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
  • 7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
  • ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
  • 5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
  • 9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
  • Additional commits viewable in compare view

Updates puma from 8.0.1 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)
Commits

Updates sentry-ruby from 6.5.0 to 6.6.2

Changelog

Sourced from sentry-ruby's changelog.

6.6.2

Bug Fixes 🐛

6.6.1

Bug Fixes 🐛

6.6.0

New Features ✨

  • (yabeda) Add sentry-yabeda adapter gem by @​dingsdax in #2925

    There's a new sentry-yabeda gem that integrates Sentry Metrics with Yabeda. Add the new gem to your Gemfile:

    gem "sentry-yabeda"

    Initialize Sentry with metrics enabled. The Yabeda adapter registers itself automatically when sentry-yabeda is required — there's no extra setup:

    Sentry.init do |config|
  config.dsn = ENV["SENTRY_DSN"]
  config.enable_metrics = true
end

  • Add release detection from Kamal deployment by @​t27duck in #2895

Bug Fixes 🐛

Internal Changes 🔧

We made some memory performance and caching improvements with the help of pi-autoresearch. Enjoy the lower overhead!

... (truncated)

Commits
  • 3e2219c release: 6.6.2
  • 7c26095 fix(metrics): Dup attributes in capture_metric (#2965)
  • 3a55ed2 release: 6.6.1
  • 129ada3 fix: guard TelemetryEventBuffer against re-entrant mutex acquisition (#2964)
  • 1754a7f release: 6.6.0
  • af610cd fix(stacktrace): stop leaking internal frame state into event payload (#2962)
  • 427612b fix(tests): proper dummy transport clean up for hub cloning (#2957)
  • 3b64cc2 feat(yabeda): Add sentry-yabeda adapter gem (#2925)
  • f6e0ad1 perf: Use FilenameCache in profilers (#2919)
  • e2a073a perf: Add FilenameCache to cache compute_filename results (#2904)
  • Additional commits viewable in compare view

Updates kamal from 2.11.0 to 2.12.0

Release notes

Sourced from kamal's releases.

v2.12.0

What's Changed

New Contributors

Full Changelog: basecamp/kamal@v2.11.0...v2.12.0

Commits
  • bdefb89 Bump version for 2.12.0
  • 8eb9659 Fix doc formatting for 2.12.0 release
  • 62579aa Merge pull request #1844 from matthewbjones/lock-wait
  • def0eae Add --lock-wait to retry deploy lock acquisition
  • bf22a93 Expect git gc --auto step in push resetting clone test
  • 24d3dbb Merge pull request #1795 from leonvogt/kamal-secrets-path-default
  • bd3e227 Merge pull request #1833 from seeday/main
  • f2671a5 Merge pull request #1860 from creadone/non-ascii-deploy-lock
  • e71bab5 Merge pull request #1874 from basecamp/dependabot/bundler/bundler-f838d46215
  • 583beb8 Merge pull request #1875 from basecamp/fix-aws-secrets-test-stubs
  • Additional commits viewable in compare view

Updates axe-core-rspec from 4.11.3 to 4.12.0

Release notes

Sourced from axe-core-rspec's releases.

Release 4.12.0

Features

Bug Fixes

Changelog

Sourced from axe-core-rspec's changelog.

4.12.0 (2026-06-16)

Features

Bug Fixes

Commits
  • b341e4f chore: release v4.12.0 (#506)
  • aee8d74 chore: RC v4.12.0 (#504)
  • d3e1fd2 chore: RC v4.12.0
  • 96303d0 chore: merge master into develop (#503)
  • d676724 chore(deps-dev): bump addressable from 2.8.5 to 2.9.0 in /packages/axe-core-a...
  • 1acb374 feat: Update axe-core to v4.12.1 (#498)
  • c78eb1f chore(deps-dev): bump addressable from 2.8.5 to 2.9.0 in /packages/axe-core-c...
  • aa0236f feat: remove virtus dependency (#494)
  • c9ac455 chore(deps): bump lodash from 4.17.23 to 4.18.1 (#474)
  • 5ef90f3 chore(deps): bump uuid and conventional-changelog-cli (#483)
  • Additional commits viewable in compare view

Updates selenium-webdriver from 4.43.0 to 4.45.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.45.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

... (truncated)

Changelog

Sourced from selenium-webdriver's changelog.

4.45.0 (2026-06-15)

  • Support CDP versions: v147, v148, v149
  • deprecate curb http client support (#17443)
  • move Ruby bindings to use typescript get attribute atom (#17524)
  • Move atoms to use the typescript versions (#17532)
  • deprecate Chromium Profile classes (#17557)
  • update bazel test tags (#17558)
  • separate concerns between Service, DriverFinder, and Options (#17564)
  • fix using environment variables to set drivers (#17571)
  • create more obvious test guard keywords as aliases (#17636)

4.44.0 (2026-05-12)

  • Support CDP versions: v146, v147, v148
  • Modern Firefox does not like both the -v and --log flags at the same time (#17412)
  • Fix credential issue with private key (#17188)
Commits
  • cd6a3cd [build] Prepare for release of selenium-4.45.0 (#17680)
  • bb741bd [build] Automated Browser Version Update (#17658)
  • f53de51 [rb] run minimize test on linux now that #17644 fixed fluxbox startup
  • 3f37cce [rb] set window state before each window test instead of resetting driver
  • 2bfb990 [rb] skip Safari double_click action tests
  • 6008ae6 [rb] skip double_click action test on Safari
  • bf0edc8 [rb] create more obvious test guard keywords as aliases (#17636)
  • c474d76 [build] Automated Browser Version Update (#17609)
  • 13c5344 [rb] streamline tests on github actions runners (#17550)
  • 79af12b [rb] stabilize tests and remove driver-restart workaround in manager spec
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-dependencies group across 1 director…
4d2a656 
…y with 7 updates

Bumps the production-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [json](https://github.com/ruby/json) | `2.19.5` | `2.20.0` |
| [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.19.3` | `1.19.4` |
| [puma](https://github.com/puma/puma) | `8.0.1` | `8.0.2` |
| [sentry-ruby](https://github.com/getsentry/sentry-ruby) | `6.5.0` | `6.6.2` |
| [kamal](https://github.com/basecamp/kamal) | `2.11.0` | `2.12.0` |
| [axe-core-rspec](https://github.com/dequelabs/axe-core-gems) | `4.11.3` | `4.12.0` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.43.0` | `4.45.0` |



Updates `json` from 2.19.5 to 2.20.0
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v2.19.5...v2.20.0)

Updates `nokogiri` from 1.19.3 to 1.19.4
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.3...v1.19.4)

Updates `puma` from 8.0.1 to 8.0.2
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v8.0.1...v8.0.2)

Updates `sentry-ruby` from 6.5.0 to 6.6.2
- [Release notes](https://github.com/getsentry/sentry-ruby/releases)
- [Changelog](https://github.com/getsentry/sentry-ruby/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-ruby@6.5.0...6.6.2)

Updates `kamal` from 2.11.0 to 2.12.0
- [Release notes](https://github.com/basecamp/kamal/releases)
- [Commits](basecamp/kamal@v2.11.0...v2.12.0)

Updates `axe-core-rspec` from 4.11.3 to 4.12.0
- [Release notes](https://github.com/dequelabs/axe-core-gems/releases)
- [Changelog](https://github.com/dequelabs/axe-core-gems/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-gems@v4.11.3...v4.12.0)

Updates `selenium-webdriver` from 4.43.0 to 4.45.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.43.0...selenium-4.45.0)

---
updated-dependencies:
- dependency-name: json
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: nokogiri
  dependency-version: 1.19.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: puma
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: sentry-ruby
  dependency-version: 6.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: kamal
  dependency-version: 2.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: axe-core-rspec
  dependency-version: 4.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.45.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Jun 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants