🚨 [security] Update activerecord 7.2.2.2 → 7.2.3.1 (patch) by depfu[bot] · Pull Request #57 · sanger/warren

depfu · 2026-03-23T23:20:16Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ activerecord (7.2.2.2 → 7.2.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ connection_pool (2.5.3 → 2.5.5) · Repo · Changelog

Release Notes

2.5.5 (from changelog)

Support ConnectionPool::TimedStack#pop(exception: false) [#207] to avoid using exceptions as control flow.

2.5.4 (from changelog)

Add ability to remove a broken connection from the pool [#204, womblep]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activemodel (indirect, 7.2.2.2 → 7.2.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activesupport (indirect, 7.2.2.2 → 7.2.3.1) · Repo · Changelog

Security Advisories 🚨

🚨 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Impact

NumberToDelimitedConverter used a regular expression with gsub! to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Impact

SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.

Releases

The fixed releases are available at the normal locations.

🚨 Rails Active Support has a possible DoS vulnerability in its number helpers

Impact

Active Support number helpers accept strings containing scientific notation (e.g. 1e10000), which when converted to a string could be expanded into extremely large decimal representations. This can cause excessive memory allocation and CPU consumption when the expanded number is formatted, possibly resulting in a DoS vulnerability.

Releases

The fixed releases are available at the normal locations.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ benchmark (indirect, 0.4.1 → 0.5.0) · Repo

Release Notes

0.5.0

What's Changed

Add Benchmark.ms method and enhance realtime with unit parameter by @nvasilevski in #38

New Contributors

@nvasilevski made their first contribution in #38

Full Changelog: v0.4.1...v0.5.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ bigdecimal (indirect, 3.2.2 → 4.0.1) · Repo · Changelog

Release Notes

4.0.1

What's Changed

Exclude dependabot updates from release note by @hsbt in #474

Remove unused variable (and add test for it) by @tompng in #475

Remove "Which version should you select" section by @tompng in #476

Bump version to v4.0.1 by @tompng in #477

Full Changelog: v4.0.0...v4.0.1

4.0.0

What's Changed

Fix x**y, x.power(y, 0) and x.sqrt(0) calculates huge digits if precision limit is huge by @tompng in #445

Implement major math functions by @tompng in #336

Fix fast-path of frac and _decimal_shift affected by BigDecimal.limit by @tompng in #447

Update the latest versions of actions by @hsbt in #449

Add missing bigmath precision test, add missing indent by @tompng in #450

Make BigMath.exp and log also a module_method by @tompng in #452

Fix incorrect exception when exponent is fractional for Infinity base by @troy-dunamu in #453

Bump step-security/harden-runner from 2.13.1 to 2.13.2 by @dependabot[bot] in #454

Don't use assert_separatly if not needed by @tompng in #455

Bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #456

Bump actions/checkout from 5.0.1 to 6.0.0 by @dependabot[bot] in #457

Add missing BigMath test for jruby by @tompng in #459

Change remainder/modulo/divmod test of +0/-0 type tolerant by @tompng in #460

Cast divmod quotient to int by @mrzasa in #312

Bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #462

Bump step-security/harden-runner from 2.13.2 to 2.13.3 by @dependabot[bot] in #461

Implement BigMath.erf(x, prec) and BigMath.erfc(x, prec) by @tompng in #357

Implement BigMath.gamma and BigMath.lgamma by @tompng in #451

Fix typos + improve copy/paste in readme by @tas50 in #463

Fix inaccurate calculation (last digit) and add a workaround for add/sub hang bug by @tompng in #465

Fix lgamma precision around 1 and 2 by @tompng in #466

Fix lgamma precision when gamma(negative_x).abs nearly equals 1 by @tompng in #467

Implement BigMath.frexp and ldexp with exponent of 10 by @tompng in #448

Bump step-security/harden-runner from 2.13.3 to 2.14.0 by @dependabot[bot] in #468

Better rounding of BigMath.atan(nearly_one, prec) by @tompng in #469

Remove deprecated method BigDecimal#precs by @tompng in #470

Deprecate ludcmp, jacobian and newton by @tompng in #471

Bump version to v4.0.0 by @tompng in #472

New Contributors

@troy-dunamu made their first contribution in #453

@tas50 made their first contribution in #463

Full Changelog: v3.3.1...v4.0.0

3.3.1

What's Changed

Fix modulo/remainder of negative zero by @tompng in #441

Unify all precision validation to be consistent with BigDecimal#add by @tompng in #442

Bump version to 3.3.1 by @tompng in #443

Full Changelog: v3.3.0...v3.3.1

3.3.0

What's Changed

Allow calling Rational#to_d without arguments by @fsateler in #421

Fix test_no_memory_leak failure by @tompng in #424

Change BigMath.sin and cos to always calculate in relative precision. by @tompng in #422

Faster exp calculation by @tompng in #399

Rename assert_relative_precision to assert_converge_in_precision by @tompng in #425

Add support for tangent function by @rhannequin in #231

Make bigdecimal.rb work in JRuby by @tompng in #420

BigMath methods common interface: coerce x, validate prec, check nan error by @tompng in #415

Round result of sqrt and BigMath methods by @tompng in #427

Update example calculation result in BigMath document by @tompng in #428

BigMath.log(0,n)==-Infinity just like Math.log(0) by @tompng in #430

Fix divmod and modulo by infinity to match Float#divmod and Float#modulo by @tompng in #429

Bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in #431

Make internal BigMath method a private method by @tompng in #432

Improve performance of x**y when y is a huge value by @tompng in #438

Fix precision of x.power(y, prec) when the result is nearly infinity by @tompng in #439

Bump version to 3.3.0 by @tompng in #437

New Contributors

@fsateler made their first contribution in #421

Full Changelog: v3.2.3...v3.3.0

3.2.3

What's Changed

Fix sign of bigdecimal**bigint by @tompng in #341

Fix BigMath.atan precision safe margin by @tompng in #320

Fix typo in BigDecimal#scale comment by @timcraft in #348

Allow BigDecimal accept Float without precision by @mrzasa in #314

Fix edgecase segfault of BigDecimal#remainder by @tompng in #349

Fix precision of BigMath.sin(x,prec) and BigMath.cos(x,prec) for large x by @tompng in #346

Fix wrong converge check in VpSqrt by @tompng in #353

Bump step-security/harden-runner from 2.12.0 to 2.12.1 by @dependabot[bot] in #356

Ensure BigMath.sin and BigMath.cos to be within -1..1 by @tompng in #317

Remove BigDecimal_divremain(which has a bug) and use BigDecimal_DoDivmod instead by @tompng in #351

Bump step-security/harden-runner from 2.12.1 to 2.12.2 by @dependabot[bot] in #359

Remove back pointer from Real to VALUE by @tompng in #344

Update docs for #to_d core extensions by @dduugg in #360

Fix compiling issue (when BIGDECIMAL_DEBUG is 1) by @tompng in #363

Use a correct term: engineering notation -> scientific notation by @mame in #365

Fix to_f underflow check when DECDIG is uint16_t by @tompng in #364

Fix VpNumOfChars calculation for the longest case by @tompng in #366

Fix a bug that exponent overflow is ignored in add, sub, mult and div operation by @tompng in #367

Fix dump/load bigdecimal with few or large precs by @tompng in #362

Refactor AddExponent overflow/underflow check by @tompng in #368

Strict BigDecimal("0.1e#{exponent}") exponent overflow/underflow check by @tompng in #369

Add DECDIG=16bit CI workflow by @tompng in #370

Fix wrong multiplying BASE_FIG in precision calculation by @tompng in #372

Remove debug print by @tompng in #375

Remove unused #define macros by @tompng in #376

VpDivd bugfix by @tompng in #374

Fix VpDivd to fully use quotient array by @tompng in #377

Add RB_GC_GUARD to test-only methods by @tompng in #378

Use minimum necessary division precision in BigDecimal_DoDivmod by @tompng in #371

Remove dead code and ineffective optimization path form VpDivd by @tompng in #379

Implement exp, log, power and ** in ruby by @tompng in #347

Remove unused "# define" macros by @tompng in #382

Bump step-security/harden-runner from 2.12.2 to 2.13.0 by @dependabot[bot] in #383

VpFormatSt O(n^2) to O(n) by @tompng in #384

Ignore ndigits passed to BigDecimal(string, ndigits) by @tompng in #385

Better error message for negative**intinite and zero-converge case fix by @tompng in #386

Refactor truncate floor and ceil duplicated part by @tompng in #387

Fix exp log power to raise "Computation results in Infinity/NaN" in EXCEPTION_INFINITY/EXCEPTION_NaN mode by @tompng in #389

Reduce guard obj by @tompng in #390

Remove ENTER and GUARD_OBJ macro by @tompng in #391

Coerce to bigdecimal refactor by @tompng in #392

Coerce rational with the given prec in exp, log and power calculation by @tompng in #393

Unify coerce prec calculation by @tompng in #394

Use bool instead of Qtrue/Qfalse for normal c boolish value by @tompng in #395

Fix adjusting x to 0.3..3 in log calculation by @tompng in #397

missing.h cleanup by @tompng in #396

Hide internal method of BigMath into BigDecimal::Internal by @tompng in #400

Remove gc_compaction test by @tompng in #401

Bump actions/checkout from 4 to 5 by @dependabot[bot] in #402

Fix VpMult result size calculation by @tompng in #403

Fix GetAddSubPrec calculation by @tompng in #406

Fix PrecLimit not restored on exception by @tompng in #405

Fix div,modulo,remainder and divmod precision when prec limit is specified by @tompng in #408

Fix x.fix and x.frac affected by prec limit, Stop -x and x.abs round with prec limit by @tompng in #409

Don't use ZeroWrapLimited. Use unlimited version instead. by @tompng in #410

Fix x / y precision when prec limit is huge by @tompng in #412

Calculate exp, log, pow with the given prec even if prec limit is set by @tompng in #411

Simplify to_i logic by @tompng in #413

Add BigMath::E and BigMath::PI precision test by @tompng in #414

Rewrite BigDecimal#sqrt in ruby with improved Newton's method by @tompng in #381

Update bigdecimal version used in benchmark from 3.0.0 to 3.1.1 by @tompng in #416

Implement BigDecimal#_decimal_shift for internal use by @tompng in #324

In JRuby, don't add sqrt, exp, log, power implemented in ruby by @tompng in #417

Add JRuby minimum ci by @tompng in #418

Bump version to 3.2.3 by @tompng in #419

New Contributors

@timcraft made their first contribution in #348

@dduugg made their first contribution in #360

Full Changelog: v3.2.2...v3.2.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.3.5 → 1.3.6) · Repo · Changelog

Release Notes

1.3.6

What's Changed

Run tests without the C extension in CI by @eregon in #1081

Fix typo in Promise docs by @danieldiekmeier in #1083

Correct word in readme by @wwahammy in #1084

Fix mistakes in MVar documentation by @trinistr in #1087

Fix multi require concurrent/executor/cached_thread_pool by @OuYangJinTing in #1085

Use typed data APIs by @nobu in #1096

Add Joshua Young to the list of maintainers by @eregon in #1097

Asynchronous pruning for RubyThreadPoolExecutor by @joshuay03 in #1082

Mark RubySingleThreadExecutor as a SerialExecutorService by @meineerde in #1070

Allow TimerTask to be safely restarted after shutdown and avoid duplicate tasks by @bensheldon in #1001

Flaky test fix: allow ThreadPool to shutdown before asserting completed_task_count by @bensheldon in #1098

ThreadPoolExecutor#kill will wait_for_termination in JRuby; ensure TimerSet timer thread shuts down cleanly by @bensheldon in #1044

New Contributors

@danieldiekmeier made their first contribution in #1083

@wwahammy made their first contribution in #1084

@trinistr made their first contribution in #1087

@OuYangJinTing made their first contribution in #1085

@nobu made their first contribution in #1096

@joshuay03 made their first contribution in #1082

Full Changelog: v1.3.5...v1.3.6

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.14.7 → 1.14.8) · Repo · Changelog

Release Notes

1.14.8

Full Changelog: v1.14.7...v1.14.8

What's Changed

Remove unused cgi require for Ruby 3.5 compatibility by @Earlopain in #713

Explicitly require pathname by @voxik in #708

CI: Add Ruby 3.4 to CI Matrix by @taketo1113 in #722

Fix: I18n.locale reset in Fiber context by using Thread#thread_variable by @lee266 in #724

CI: Use actions/checkout@v5 by @olleolleolle in #721

Fix compatibility with --enable-frozen-string-literal by @byroot in #726

New Contributors

@Earlopain made their first contribution in #713

@taketo1113 made their first contribution in #722

@lee266 made their first contribution in #724

@byroot made their first contribution in #726

Full Changelog: v1.14.7...v1.14.8

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ minitest (indirect, 5.25.5 → 5.27.0) · Repo · Changelog

Release Notes

5.27.0 (from changelog)

1 major enhancement:

Adding post install message announcing the EOL for minitest 5!

2 minor enhancements:

Removed TestTask::Work#initialize since Queue can now initialize with an Enumerable! AMAZING!

Use Kernel#warn uplevel argument for nicer warnings. (byroot)

5 bug fixes:

Cleaned up option aliasing a tad.

Removed obsolete conditional for prerecord

Removed obsolete guards around Warning.

Removed obsolete version guards for pattern matching assertions.

Switched all internal requires to require_relative.

5.26.2 (from changelog)

5 bug fixes:

Bumped minimum ruby to 3.1.

Alias Spec#name to #inspect for cleaner output in repls.

Fix pathing for Hoe::Minitest initialization to be more generic.

Fixed refute_in_epsilon to use min of abs values. (wtn)

Improved options processing and usage output to be more clear.

5.26.1 (from changelog)

The Ocean Shores, Slightly Less Tipsy Edition!

3 bug fixes:

Add links to API doco in README.

Add missing require thread.

Bumped ruby version to include 4.0 (trunk). (hsbt) (see also 5.14.2)

5.26.0 (from changelog)

The Seattle.rb Nerd Party, Slightly Tipsy Edition!

2 minor enhancements:

Added extra documentation to Minitest::TestTask options.

Make parallelize_me! a no-op when n_threads=1.

9 bug fixes:

Bypass parallel_executor entirely when n_threads=1.

Don’t require rubygems in Rakefile… it is 2025.

Ensure that minitest exits non-zero on Interrupt. (tavianator)

Fix Minitest.run sequence rdoc to include loop vars and read consistently.

Fix call to parallel_executor.shutdown when it isn’t defined.

Removed some 1.8/1.9-based code from the assertions and expectations.

Still fighting with rdoc? Yup. Still fighting with rdoc…

Switched assert_equal’s diff from Tempfile.open to Tempfile.create.

Use Regexp.escape for BASE_RE in case pwd has special chars. (astra_1993)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ timeout (indirect, 0.4.3 → 0.6.1) · Repo · Changelog

Release Notes

0.6.1

What's Changed

add test case for string argument by @t-mangoe in #90

Improve Timeout.timeout documentation formatting and typos by @ybiquitous in #92

[DOC] document the private instance method by @nobu in #94

Compatibility with Fiber scheduler. by @ioquatix in #97

Remove warnings by @etiennebarrie in #99

New Contributors

@t-mangoe made their first contribution in #90

@ybiquitous made their first contribution in #92

@ioquatix made their first contribution in #97

@etiennebarrie made their first contribution in #99

Full Changelog: v0.6.0...v0.6.1

0.6.0

What's Changed

Suppress warnings in two tests by @olleolleolle in #71

Revert "Suppress warnings in two tests" by @nobu in #74

Only the timeout method should be public on the Timeout module by @eregon in #76

support Ractor by @ko1 in #75

Test that Timeout does not expose extra constants by @eregon in #77

Revert "Exclude constantly-failing test on x86_64-darwin" by @ko1 in #79

Reset the interrupt mask when creating the Timeout thread by @eregon in #80

Make Timeout.timeout work in a trap handler on CRuby by @eregon in #81

Skip signal test on windows by @byroot in #82

Add windows to CI matrix by @byroot in #83

Fix failing timeout test by @luke-gruber in #85

Restore original signal handler in test_timeout_in_trap_handler by @eregon in #87

Run on Windows for all versions and remove old excludes by @eregon in #84

New Contributors

@ko1 made their first contribution in #75

@byroot made their first contribution in #82

@luke-gruber made their first contribution in #85

Full Changelog: v0.4.4...v0.6.0

0.5.0

What's Changed

Suppress warnings in two tests by @olleolleolle in #71

Revert "Suppress warnings in two tests" by @nobu in #74

Only the timeout method should be public on the Timeout module by @eregon in #76

support Ractor by @ko1 in #75

Test that Timeout does not expose extra constants by @eregon in #77

New Contributors

@ko1 made their first contribution in #75

Full Changelog: v0.4.4...v0.5.0

0.4.4

What's Changed

Gracefully handle a call to ensure_timeout_thread_created in a signal handler by @eregon in #64

Add a workflow to sync commits to ruby/ruby by @k0kubun in #69

Full Changelog: v0.4.3...v0.4.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Update all of rails to version 7.2.3.1

502bcbc

depfu bot added dependencies Pull requests that update a dependency file Security Update A label to identify dependency updates containing security fixes Technical Debt labels Mar 23, 2026

depfu bot merged commit 738ea24 into develop Mar 23, 2026
4 checks passed

depfu bot deleted the depfu/update/develop/group/rails-7.2.3.1 branch March 23, 2026 23:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] Update activerecord 7.2.2.2 → 7.2.3.1 (patch)#57

🚨 [security] Update activerecord 7.2.2.2 → 7.2.3.1 (patch)#57
depfu[bot] merged 1 commit intodevelopfrom
depfu/update/develop/group/rails-7.2.3.1

depfu bot commented Mar 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

depfu bot commented Mar 23, 2026

What changed?

✳️ activerecord (7.2.2.2 → 7.2.3.1) · Repo · Changelog

✳️ connection_pool (2.5.3 → 2.5.5) · Repo · Changelog

2.5.5 (from changelog)

2.5.4 (from changelog)

↗️ activemodel (indirect, 7.2.2.2 → 7.2.3.1) · Repo · Changelog

↗️ activesupport (indirect, 7.2.2.2 → 7.2.3.1) · Repo · Changelog

Impact

Releases

Impact

Releases

Impact

Releases

↗️ benchmark (indirect, 0.4.1 → 0.5.0) · Repo

What's Changed

New Contributors

↗️ bigdecimal (indirect, 3.2.2 → 4.0.1) · Repo · Changelog

What's Changed

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

↗️ concurrent-ruby (indirect, 1.3.5 → 1.3.6) · Repo · Changelog

What's Changed

New Contributors

↗️ i18n (indirect, 1.14.7 → 1.14.8) · Repo · Changelog

What's Changed

New Contributors

↗️ minitest (indirect, 5.25.5 → 5.27.0) · Repo · Changelog

5.27.0 (from changelog)

5.26.2 (from changelog)

5.26.1 (from changelog)

5.26.0 (from changelog)

↗️ timeout (indirect, 0.4.3 → 0.6.1) · Repo · Changelog

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants