Skip to content

🚨 [security] [ruby] Update rails 7.2.3 → 8.1.2 (major)#2670

Closed
depfu[bot] wants to merge 1 commit intodevelopfrom
depfu/update/group/rails-8.1.2
Closed

🚨 [security] [ruby] Update rails 7.2.3 → 8.1.2 (major)#2670
depfu[bot] wants to merge 1 commit intodevelopfrom
depfu/update/group/rails-8.1.2

Conversation

@depfu
Copy link
Copy Markdown
Contributor

@depfu depfu bot commented Jan 15, 2026 •
edited
Loading

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actioncable (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

8.0.1 (from changelog)

  • Ensure the Postgresql adapter always use a dedicated connection even during system tests.

    Fix an issue with the Action Cable Postgresql adapter causing deadlock or various weird pg client error during system tests.

    Jean Boussier

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailbox (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailer (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

8.0.1 (from changelog)

  • No changes.

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionpack (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 Possible Content Security Policy bypass in Action Dispatch

There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.

Impact

Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases

The fixed releases are available at the normal locations.

Workarounds

Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits

Thanks to ryotak for the report!

Release Notes

8.0.1 (from changelog)

  • Add ActionDispatch::Request::Session#store method to conform Rack spec.

    Yaroslav

8.0.0.1 (from changelog)

  • Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

    [CVE-2024-54133]

    Gannon McGibbon

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actiontext (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

8.0.1 (from changelog)

  • No changes.

8.0.0.1 (from changelog)

  • Update vendored trix version to 2.1.10

    John Hawthorn

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionview (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 Rails has a possible XSS vulnerability in its Action View tag helpers

Impact

When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

Releases

The fixed releases are available at the normal locations.

🚨 Rails has a possible XSS vulnerability in its Action View tag helpers

Impact

When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

Releases

The fixed releases are available at the normal locations.

Release Notes

8.0.1 (from changelog)

  • Fix a crash in ERB template error highlighting when the error occurs on a line in the compiled template that is past the end of the source template.

    Martin Emde

  • Improve reliability of ERB template error highlighting. Fix infinite loops and crashes in highlighting and improve tolerance for alternate ERB handlers.

    Martin Emde

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activejob (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

8.0.1 (from changelog)

  • Avoid crashing in Active Job logger when logging enqueueing errors

    ActiveJob.perform_all_later could fail with a TypeError when all provided jobs failed to be enqueueed.

    Efstathios Stivaros

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activemodel (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

8.0.1 (from changelog)

  • No changes.

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activerecord (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 Active Record logging vulnerable to ANSI escape injection

This vulnerability has been assigned the CVE identifier CVE-2025-55193

Impact

The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

Releases

The fixed releases are available at the normal locations.

Credits

Thanks to lio346 from Unit 515 of OPSWAT for reporting this vulnerability

Release Notes

8.0.1 (from changelog)

  • Fix removing foreign keys with :restrict action for MySQ

    fatkodima

  • Fix a race condition in ActiveRecord::Base#method_missing when lazily defining attributes.

    If multiple thread were concurrently triggering attribute definition on the same model, it could result in a NoMethodError being raised.

    Jean Boussier

  • Fix MySQL default functions getting dropped when changing a column's nullability.

    Bastian Bartmann

  • Fix add_unique_constraint/add_check_constraint/add_foreign_key to be revertible when given invalid options.

    fatkodima

  • Fix asynchronous destroying of polymorphic belongs_to associations.

    fatkodima

  • Fix insert_all to not update existing records.

    fatkodima

  • NOT VALID constraints should not dump in create_table.

    Ryuta Kamizono

  • Fix finding by nil composite primary key association.

    fatkodima

  • Properly reset composite primary key configuration when setting a primary key.

    fatkodima

  • Fix Mysql2Adapter support for prepared statements

    Using prepared statements with MySQL could result in a NoMethodError exception.

    Jean Boussier, Leo Arnold, zzak

  • Fix parsing of SQLite foreign key names when they contain non-ASCII characters

    Zacharias Knudsen

  • Fix parsing of MySQL 8.0.16+ CHECK constraints when they contain new lines.

    Steve Hill

  • Ensure normalized attribute queries use IS NULL consistently for nil and normalized nil values.

    Joshua Young

  • Fix sum when performing a grouped calculation.

    User.group(:friendly).sum no longer worked. This is fixed.

    Edouard Chin

  • Restore back the ability to pass only database name to DATABASE_URL.

    fatkodima

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • Fix support for query_cache: false in database.yml.

    query_cache: false would no longer entirely disable the Active Record query cache.

    zzak

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activestorage (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Impact

Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

Impact

Active Storage's proxy controller does not limit the number of byte ranges in an HTTP Range header. A request with thousands of small ranges causes disproportionate CPU usage compared to a normal request for the same file, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has possible content type bypass via metadata in direct uploads

Impact

Active Storage's DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has possible Path Traversal in DiskService

Impact

Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has possible glob injection in its DiskService

Impact

Active Storage's DiskService#delete_prefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Impact

When serving files through Active Storage's Blobs::ProxyController, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. bytes=0-) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has possible content type bypass via metadata in direct uploads

Impact

Active Storage's DirectUploadsController accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a malicious direct-upload client could set these flags.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Impact

When serving files through Active Storage's Blobs::ProxyController, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. bytes=0-) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has possible Path Traversal in DiskService

Impact

Active Storage's DiskService#path_for does not validate that the resolved filesystem path remains within the storage root directory. If a blob key containing path traversal sequences (e.g. ../) is used, it could allow reading, writing, or deleting arbitrary files on the server. Blob keys are expected to be trusted strings, but some applications could be passing user input as keys and would be affected.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Storage has possible glob injection in its DiskService

Impact

Active Storage's DiskService#delete_prefixed passes blob keys directly to Dir.glob without escaping glob metacharacters. If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters, it may be possible to delete unintended files from the storage directory.

Releases

The fixed releases are available at the normal locations.

🚨 Active Storage allowed transformation methods that were potentially unsafe

Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

This has been assigned the CVE identifier CVE-2025-24293.

Versions Affected: >= 5.2.0
Not affected: < 5.2.0
Fixed Versions: 7.1.5.2, 7.2.2.2, 8.0.2.1

Impact

This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

<%= image_tag blob.variant(params[:t] => params[:v]) %>

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong ImageMagick security policy deployed.

Credits

Thank you lio346 from Unit 515 of OPSWAT for reporting this!

Release Notes

8.0.1 (from changelog)

  • No changes.

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activesupport (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Impact

NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Impact

SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible DoS vulnerability in its number helpers

Impact

Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Impact

NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Impact

SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible DoS vulnerability in its number helpers

Impact

Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

Release Notes

8.0.1 (from changelog)

  • Fix a bug in ERB::Util.tokenize that causes incorrect tokenization when ERB tags are preceeded by multibyte characters.

    Martin Emde

  • Restore the ability to decorate methods generated by class_attribute.

    It always has been complicated to use Module#prepend or an alias method chain to decorate methods defined by class_attribute, but became even harder in 8.0.

    This capability is now supported for both reader and writer methods.

    Jean Boussier

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ net-imap (indirect, 0.5.12 → 0.6.3) · Repo · Changelog

Release Notes

0.6.3

What's Changed

Added

  • 🥅 Add parser state and #detailed_message to ResponseParseError by @nevans in #599
    • 🥅💄 Support (monochrome) highlights in parse error details by @nevans in #603
    • 🥅💄 Auto-highlight parse error detailed_message using TERM and FORCE_COLOR by @nevans in #607
    • 🥅💄 Add color highlights to parse error details (default honors NO_COLOR) by @nevans in #609
  • 🔧 Add Config#overrides? (opposite of #inherited?) by @nevans in #610
  • 🔧 Add recursive Config#inherits_defaults? by @nevans in #611

Fixed

  • 🐛 Parse resp-text with invalid resp-text-code by @nevans in #601
  • 🐛 Config.version_defaults should be read only by @nevans in #594

Other Changes

  • 🥅 Only print parser debug for unhandled errors by @nevans in #600
  • ♻️ Don't hardcode parser deprecation warning uplevel by @nevans in #602
  • ♻️ Simplify Config::AttrAccessors a little by @nevans in #606
  • ♻️ Set Config[:default] as alias of Config[VERSION] by @nevans in #608

Fixes for unreleased code:

  • 🐛 Return ResponseText from resp-text fallback by @nevans in #605
  • 🐛 Fix parse error parser_backtrace (for ruby <= 3.3) by @nevans in #604

Miscellaneous

  • Delete test/net/imap/test_data_lite.rb by @nobu in #593
  • ⬆️ Bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #596
  • Bump step-security/harden-runner from 2.14.1 to 2.14.2 by @dependabot[bot] in #598

Full Changelog: v0.6.2...v0.6.3

0.6.2

What's Changed

Fixed

Full Changelog: v0.6.1...v0.6.2

0.6.1

What's Changed

Fixed

  • 🐛 Fix SequenceSet#max(n) when cardinality < n <= size by @nevans in #580

Miscellaneous

  • ⬆️ Bump step-security/harden-runner from 2.13.3 to 2.14.0 by @dependabot[bot] in #579

Full Changelog: v0.6.0...v0.6.1

0.6.0

What's Changed

Breaking Changes

  • 🔧 Update default config for v0.6 by @nevans in #539
    • responses_without_block changed from :warn to :frozen_dup
    • parser_use_deprecated_uidplus_data changed from :up_to_max_size to false (and is deprecated)
    • parser_max_deprecated_uidplus_data_size changed from 100 to 0 (and is deprecated)
  • 🔥 Use psych (>= 5.2.5) for encoding Data objects by @nevans in #543
    This changes the YAML tag for Data subclasses from ruby/object:Net::IMAP::DataSubclass to ruby/data:Net::IMAP::DataSubclass. YAML dumped by earlier net-imap versions may not load correctly. Psych >= 5.2.5 is required to dump these objects correctly.
  • 💥 Require ruby >= 3.2 (drop support for 3.1) by @nevans in #538
  • 💥✨ Change SequenceSet#size to count * and repeated numbers by @nevans in #564
    SequenceSet is used to represent both sorted sets and ordered lists (which may contain duplicates). Members are non-zero UInt32 numbers, but "*" has special meaning as "the number corresponding to the last mailbox entry". So there are four different ways to count the members of a SequenceSet.
    Previously, #size was an alias for #count. Now it differs in both relevant aspects.
    * is a unique member * is treated like 2³² - 1
    distinct set members #cardinality #count
    ordered list, including duplicates #size #count_with_duplicates
  • 🔥 Remove deprecated UIDPlusData class by @nevans in #540
    UIDPlusData was deprecated by v0.5.6. AppendUIDData or CopyUIDData will always be returned instead.
  • 🔥 Delete deprecated MessageSet by @nevans in #573
    MessageSet was deprecated by v0.5.0. Use SequenceSet instead.
  • 💥 Do not include OpenSSL and OpenSSL::SSL modules into Net::IMAP by @nevans in #533
    This only affects the ability to use OpenSSL constants from the Net::IMAP namespace.
  • 💥 Don't set verify_callback to VerifyCallbackProc by @nevans in #534
    This functionality was never documented and is redundant with the verify_callback option.

Deprecated

  • Deprecated config options for UIDPlusData in #540
    The parser_use_deprecated_uidplus_data and parser_max_deprecated_uidplus_data_size config options will be removed in v0.7.0. They are kept for backward compatibility, but they do not affect response parser results. When parser_use_deprecated_uidplus_data is changed from the default value (false), deprecation warnings are printed when parsing APPENDUID or COPYUID response codes.

Added

  • 🔒 Add when_capabilities_cached option for Config#sasl_ir by @nevans in #561
  • Net::IMAP::Config improvements
    • 🔍 Improve Config#inspect output by @nevans in #546
    • 🔍 Improve Config#pretty_print (for Kernel::pp) by @nevans in #547
    • 🔧 Update Config#inherited? for any number of args by @nevans in #552
  • Net::IMAP::SequenceSet improvements
    • ✨ Add SequenceSet#intersect! for in-place set AND by @nevans in #549
    • ✨ Add SequenceSet#xor! for in-place set XOR by @nevans in #550
    • ♻️ Coalesce entries in SequenceSet#append by @nevans in #553
    • ✨ Add SequenceSet#normalized? by @nevans in #558
    • ✨ Add SequenceSet#cardinality method by @nevans in #563
    • 💥✨ Change SequenceSet#size to count * and repeated numbers by @nevans in #564
  • Net::IMAP::NumValidator improvements
    • 🏷️ Support mod-sequence-valzer (RFC4551) in NumValidator by @nevans in #570
    • 🏷️ Add NumValidator.coerce_{type} methods by @nevans in #571

Documentation

  • 📚 Improve rdoc example for #uid_fetch with partial by @nevans in #532
  • 📚 Document SearchResult/ESearchResult compatibility by @nevans in #559
  • 📚 Minor rdoc formatting fixes by @nevans in #560

Other Changes

  • 🔥 Drop Data polyfill by @nevans in #541
    This was only used for ruby 3.1, which is no longer supported. So this is not considered a breaking change.
  • ♻️ Refactor Config.versioned_defaults to reduce merge conflcts by @nevans in #544
  • Improved Net::IMAP::SequenceSet performance
    • ⚡️ Don't memoize SequenceSet#string on normalized sets by @nevans in #554
    • ⚡ Faster SequenceSet#normalize when frozen by @nevans in #556
    • ⚡️ Faster SequenceSet#full? by @nevans in #565
    • ⚡️ Slightly faster SequenceSet#xor by @nevans in #567
    • ⚡ Avoid allocating arrays for SequenceSet bsearch (♻️ extract abstract strategy methods) by @nevans in #569
    • ♻️ Rename SequenceSet internals by @nevans in #562
    • ♻️ Reorganize SequenceSet internals by @nevans in #568

Miscellaneous

  • ✅ Stop using deprecated UIDPlusData in tests by @nevans in #542
  • ⬆️ Bump step-security/harden-runner from 2.13.1 to 2.13.2 by @dependabot[bot] in #548
  • 🐛 Fix workflow to deploy RDoc to GitHub pages by @nevans in #551
  • ⬆️ Bump actions/checkout from 5 to 6 by @dependabot[bot] in #555
  • 📦 Update release.yml for github_actions label by @nevans in #557
  • ⬆️ Bump step-security/harden-runner from 2.13.2 to 2.13.3 by @dependabot[bot] in #566
  • 🔖 Release 0.6 by @nevans in #574
  • Workarounds for "Publishing gem fails with digest gem activation failure" issue #576
    • 📦 Use latest rubygems/bundler to release gem by @nevans in #575
    • 📦 Drop digest from Gemfile by @nevans in #577

Full Changelog: v0.5.12...v0.6.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ railties (indirect, 7.2.3 → 8.1.2) · Repo · Changelog

Release Notes

8.0.1 (from changelog)

  • Skip generation system tests related code for CI when --skip-system-test is given.

    fatkodima

  • Don't add bin/thrust if thruster is not in Gemfile.

    Étienne Barrié

  • Don't install a package for system test when applications don't use it.

    y-yagi

8.0.0.1 (from changelog)

  • No changes.

8.0.0 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ timeout (indirect, 0.5.0 → 0.6.1) · Repo · Changelog

Release Notes

0.6.1

What's Changed

New Contributors

Full Changelog: v0.6.0...v0.6.1

0.6.0

What's Changed

  • Suppress warnings in two tests by @olleolleolle in #71
  • Revert "Suppress warnings in two tests" by @nobu in #74
  • Only the timeout method should be public on the Timeout module by @eregon in #76
  • support Ractor by @ko1 in #75
  • Test that Timeout does not expose extra constants by @eregon in #77
  • Revert "Exclude constantly-failing test on x86_64-darwin" by @ko1 in #79
  • Reset the interrupt mask when creating the Timeout thread by @eregon in #80
  • Make Timeout.timeout work in a trap handler on CRuby by @eregon in #81
  • Skip signal test on windows by @byroot in #82
  • Add windows to CI matrix by @byroot in #83
  • Fix failing timeout test by @luke-gruber in #85
  • Restore original signal handler in test_timeout_in_trap_handler by @eregon in #87
  • Run on Windows for all versions and remove old excludes by @eregon in #84

New Contributors

Full Changelog: v0.4.4...v0.6.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 action_text-trix (added, 2.1.18)

🆕 uri (added, 1.1.1)

🗑️ benchmark (removed)

🗑️ cgi (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the dependencies Pull requests that update a dependency file label Jan 15, 2026
@depfu depfu bot mentioned this pull request Jan 15, 2026
Closed
@depfu depfu bot force-pushed the depfu/update/group/rails-8.1.2 branch from 5955b3a to 52667dd Compare January 23, 2026 19:00
@depfu depfu bot changed the title 🚨 [security] [ruby] Update rails 7.2.2.2 → 8.1.2 (major) 🚨 [security] [ruby] Update rails 7.2.3 → 8.1.2 (major) Jan 23, 2026
@depfu depfu bot force-pushed the depfu/update/group/rails-8.1.2 branch from 52667dd to 0b6239f Compare January 26, 2026 19:15
@depfu depfu bot force-pushed the depfu/update/group/rails-8.1.2 branch from 0b6239f to f533724 Compare March 30, 2026 19:05
@depfu
Copy link
Copy Markdown
Contributor Author

depfu bot commented Mar 31, 2026

Closed in favor of #2768.

@depfu depfu bot closed this Mar 31, 2026
@depfu depfu bot deleted the depfu/update/group/rails-8.1.2 branch March 31, 2026 20:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants