Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the bundler group across 1 directory with 7 updates #4398

Closed
wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 3, 2024

Bumps the bundler group with 7 updates in the / directory:

Package From To
puma 6.4.2 6.4.3
dotenv-rails 3.1.2 3.1.4
sidekiq 6.5.5 7.3.6
nokogiri 1.16.7 1.16.8
rubocop-govuk 5.0.2 5.0.4
rexml 3.3.3 3.3.9
fugit 1.11.0 1.11.1

Updates puma from 6.4.2 to 6.4.3

Release notes

Sourced from puma's releases.

6.4.3

  • Security
    • Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). (CVE-2024-45614/GHSA-9hf4-67fc-4vf4)
Changelog

Sourced from puma's changelog.

6.4.3 / 2024-09-19

  • Security
    • Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). (CVE-2024-45614/GHSA-9hf4-67fc-4vf4)
Commits

Updates dotenv-rails from 3.1.2 to 3.1.4

Release notes

Sourced from dotenv-rails's releases.

3.1.4

What's Changed

New Contributors

Full Changelog: bkeepers/dotenv@v3.1.3...v3.1.4

3.1.3

What's Changed

New Contributors

Full Changelog: bkeepers/dotenv@v3.1.2...v3.1.3

Changelog

Sourced from dotenv-rails's changelog.

3.1.4

New Contributors

Full Changelog: bkeepers/dotenv@v3.1.3...v3.1.4

3.1.3

New Contributors

Full Changelog: bkeepers/dotenv@v3.1.2...v3.1.3

Commits

Updates sidekiq from 6.5.5 to 7.3.6

Changelog

Sourced from sidekiq's changelog.

7.3.6

  • Forward compatibility fixes for Ruby 3.4
  • Filtering in the Web UI now works via GET so you can bookmark a filtered view. #6497

7.3.5

  • Reimplement retry_all and kill_all API methods to use ZPOPMIN, approximately 30-60% faster. #6481
  • Add preload testing binary at examples/testing/sidekiq_boot to verify your Rails app boots correctly with Sidekiq Enterprise's app preloading.
  • Fix circular require with ActiveJob adapter #6477
  • Fix potential race condition leading to incorrect serialized values for CurrentAttributes #6475
  • Restore missing elapsed time when default job logging is disabled

7.3.4

  • Fix FrozenError when starting Sidekiq #6470

7.3.3

  • Freeze global configuration once boot is complete, to avoid configuration race conditions [#6466, #6465]
  • Sidekiq now warns if a job iteration takes longer than the -t timeout setting (defaults to 25 seconds)
  • Iteration callbacks now have easy access to job arguments via the arguments method:
def on_stop
  p arguments # => `[123, "string", {"key" => "value"}]`
  id, str, hash = arguments
end
  • Iterable jobs can be cancelled via Sidekiq::Client#cancel!:
c = Sidekiq::Client.new
jid = c.push("class" => SomeJob, "args" => [123])
c.cancel!(jid) # => true
  • Take over support for ActiveJob's :sidekiq adapter [#6430, fatkodima]
  • Ensure CurrentAttributes are in scope when creating batch callbacks #6455
  • Add Sidekiq.gem_version API.
  • Update Ukranian translations

7.3.2

  • Adjust ActiveRecord batch iteration to restart an interrupted batch from the beginning. Each batch should be processed as a single transaction in order to be idempotent. #6405
  • Fix typo in Sidekiq::DeadSet#kill #6397

... (truncated)

Commits

Updates nokogiri from 1.16.7 to 1.16.8

Release notes

Sourced from nokogiri's releases.

v1.16.8 / 2024-12-02

Fixed

  • [CRuby] When serializing HTML5 documents, properly escape foreign content "style" elements. Normally, a "style" tag contains raw text that does not need entity-escaping, but when it appears in either SVG or MathML foreign content, the "style" tag is now correctly escaped when serialized. @​flavorjones

sha256 checksums:

b1d41cd9abf4180adef496cc8c9fcb5b2e38d39f5e23c8a2445362226a5df6b8  nokogiri-1.16.8-aarch64-linux.gem
b7aa4e8533a720e432d09b52a2ec089b55cf3ee66c916b44a0d9b6608df7bf8c  nokogiri-1.16.8-arm64-darwin.gem
8cbd2971624fc073b9430d86475da031903494dcb83c2339e13f7f22a4de6fad  nokogiri-1.16.8-arm-linux.gem
dece4bf9a663b2d6b6e874716297ad414c95be694656972d54049bd088f752a1  nokogiri-1.16.8.gem
8652028e72a38f2221c810550d03c91682b414e06f6271149139a9042cf727e6  nokogiri-1.16.8-java.gem
861e2d7f24b0c7f5ea2a26e6d99af7e727d7641f0eab27b9b6c51b8a0666c805  nokogiri-1.16.8-x64-mingw32.gem
23c9a8ae47afa2973cbca9e3d38c16f40ff336919f961802c4a3a5e39c767138  nokogiri-1.16.8-x64-mingw-ucrt.gem
6c40d7dc444f752634bf6ee8b53a55c3cfca3f9df52be46b8abcc559ccd49e47  nokogiri-1.16.8-x86_64-darwin.gem
ed7b1f80713ac968dd93fe2b96fc3df6e448b73bd02dd77d5fc89ba92a1ed6d9  nokogiri-1.16.8-x86_64-linux.gem
f97760e6320166d48234029bed9e999521a888376bd2b7e04f4c054537154f16  nokogiri-1.16.8-x86-linux.gem
ea48d7415b89f5dd3ff5a8f82bb2ec56fdc3431444381143fe90bb418eb9ea35  nokogiri-1.16.8-x86-mingw32.gem
Changelog

Sourced from nokogiri's changelog.

v1.16.8 / 2024-12-02

Fixed

  • [CRuby] When serializing HTML5 documents, properly escape foreign content "style" elements. Normally, a "style" tag contains raw text that does not need entity-escaping, but when it appears in either SVG or MathML foreign content, the "style" tag is now correctly escaped when serialized. @​flavorjones
Commits
  • 7aaf1aa version bump to v1.16.8
  • 973ea98 fix: escape foreign style tag content when serializing HTML5 (v1.16.x) (#3349)
  • 573a087 doc: update CHANGELOG
  • 02572e8 fix: escape foreign style tag content when serializing HTML5
  • See full diff in compare view

Updates rubocop-govuk from 5.0.2 to 5.0.4

Changelog

Sourced from rubocop-govuk's changelog.

5.0.4

  • Update dependencies

5.0.3

  • Update dependencies: rubocop from 1.64.1 to 1.68.0, rubocop-ast from 1.31.3 to 1.26.1, rubocop-rails from 2.25.1 to 2.27.0, rubocop-rspec from 3.0.1 to 3.2.0
Commits
  • 4abd6de Merge pull request #435 from alphagov/release-5.0.4
  • 4d9f8ae Merge pull request #436 from alphagov/dependabot/bundler/rubocop-ast-eq-1.36.2
  • 8886b44 Update rubocop-ast requirement from = 1.36.1 to = 1.36.2
  • 7634f16 Release v5.0.4
  • 5c90ef9 Merge pull request #434 from alphagov/dependabot/bundler/rubocop-eq-1.69.0
  • 860d69d Update rubocop requirement from = 1.68.0 to = 1.69.0
  • 6bbc49d Merge pull request #433 from alphagov/new-release
  • 8b599f5 Release v5.0.3
  • a822e10 Merge pull request #431 from alphagov/dependabot/bundler/rubocop-ast-eq-1.36.1
  • 8b911b7 Update rubocop-ast requirement from = 1.35.0 to = 1.36.1
  • Additional commits viewable in compare view

Updates rexml from 3.3.3 to 3.3.9

Release notes

Sourced from rexml's releases.

REXML 3.3.9 - 2024-10-24

Improvements

  • Improved performance.

Fixes

  • Fixed a parse bug for text only invalid XML.

  • Fixed a parse bug that &#0x...; is accepted as a character reference.

Thanks

  • NAITOH Jun

REXML 3.3.8 - 2024-09-29

Improvements

  • SAX2: Improve parse performance.

Fixes

  • Fixed a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported.
    • GH-208
    • Patch by KITAITI Makoto

Thanks

  • NAITOH Jun

  • KITAITI Makoto

REXML 3.3.7 - 2024-09-04

Improvements

  • Added local entity expansion limit methods

... (truncated)

Changelog

Sourced from rexml's changelog.

3.3.9 - 2024-10-24 {#version-3-3-9}

Improvements

  • Improved performance.

Fixes

  • Fixed a parse bug for text only invalid XML.

  • Fixed a parse bug that &#0x...; is accepted as a character reference.

Thanks

  • NAITOH Jun

3.3.8 - 2024-09-29 {#version-3-3-8}

Improvements

  • SAX2: Improve parse performance.

Fixes

  • Fixed a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported.
    • GH-208
    • Patch by KITAITI Makoto

Thanks

  • NAITOH Jun

  • KITAITI Makoto

3.3.7 - 2024-09-04 {#version-3-3-7}

Improvements

  • Added local entity expansion limit methods

... (truncated)

Commits

Updates rubocop-govuk from 5.0.2 to 5.0.4

Changelog

Sourced from rubocop-govuk's changelog.

5.0.4

  • Update dependencies

5.0.3

  • Update dependencies: rubocop from 1.64.1 to 1.68.0, rubocop-ast from 1.31.3 to 1.26.1, rubocop-rails from 2.25.1 to 2.27.0, rubocop-rspec from 3.0.1 to 3.2.0
Commits
  • 4abd6de Merge pull request #435 from alphagov/release-5.0.4
  • 4d9f8ae Merge pull request #436 from alphagov/dependabot/bundler/rubocop-ast-eq-1.36.2
  • 8886b44 Update rubocop-ast requirement from = 1.36.1 to = 1.36.2
  • 7634f16 Release v5.0.4
  • 5c90ef9 Merge pull request #434 from alphagov/dependabot/bundler/rubocop-eq-1.69.0
  • 860d69d Update rubocop requirement from = 1.68.0 to = 1.69.0
  • 6bbc49d Merge pull request #433 from alphagov/new-release
  • 8b599f5 Release v5.0.3
  • a822e10 Merge pull request #431 from alphagov/dependabot/bundler/rubocop-ast-eq-1.36.1
  • 8b911b7 Update rubocop-ast requirement from = 1.35.0 to = 1.36.1
  • Additional commits viewable in compare view

Updates fugit from 1.11.0 to 1.11.1

Changelog

Sourced from fugit's changelog.

fugit 1.11.1 released 2024-08-15

  • Prevent nat parsing chocking on long input (> 256 chars), gh-104
Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
rubocop-govuk [> 3.14.0, < 4]
puma [< 5.7, > 5.6.2]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Dec 3, 2024
@dependabot dependabot bot force-pushed the dependabot/bundler/bundler-4f5079c50a branch from 6dbe134 to 0811edc Compare December 3, 2024 14:25
@dependabot dependabot bot force-pushed the dependabot/bundler/bundler-4f5079c50a branch from 0811edc to 521faa2 Compare December 4, 2024 09:15
@dependabot dependabot bot force-pushed the dependabot/bundler/bundler-4f5079c50a branch from 521faa2 to c60b8d7 Compare December 4, 2024 13:11
@sarahcrack
Copy link
Collaborator

We cannot update group via dependabot: unable to bump sidekiq due to redis issue but may be able to bump each one manually/locally

Bumps the bundler group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [puma](https://github.com/puma/puma) | `6.4.2` | `6.4.3` |
| [dotenv-rails](https://github.com/bkeepers/dotenv) | `3.1.2` | `3.1.4` |
| [sidekiq](https://github.com/sidekiq/sidekiq) | `6.5.5` | `7.3.6` |
| [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.16.7` | `1.16.8` |
| [rubocop-govuk](https://github.com/alphagov/rubocop-govuk) | `5.0.2` | `5.0.4` |
| [rexml](https://github.com/ruby/rexml) | `3.3.3` | `3.3.9` |
| [fugit](https://github.com/floraison/fugit) | `1.11.0` | `1.11.1` |



Updates `puma` from 6.4.2 to 6.4.3
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](puma/puma@v6.4.2...v6.4.3)

Updates `dotenv-rails` from 3.1.2 to 3.1.4
- [Release notes](https://github.com/bkeepers/dotenv/releases)
- [Changelog](https://github.com/bkeepers/dotenv/blob/main/Changelog.md)
- [Commits](bkeepers/dotenv@v3.1.2...v3.1.4)

Updates `sidekiq` from 6.5.5 to 7.3.6
- [Changelog](https://github.com/sidekiq/sidekiq/blob/main/Changes.md)
- [Commits](sidekiq/sidekiq@v6.5.5...v7.3.6)

Updates `nokogiri` from 1.16.7 to 1.16.8
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.16.7...v1.16.8)

Updates `rubocop-govuk` from 5.0.2 to 5.0.4
- [Changelog](https://github.com/alphagov/rubocop-govuk/blob/main/CHANGELOG.md)
- [Commits](alphagov/rubocop-govuk@v5.0.2...v5.0.4)

Updates `rexml` from 3.3.3 to 3.3.9
- [Release notes](https://github.com/ruby/rexml/releases)
- [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md)
- [Commits](ruby/rexml@v3.3.3...v3.3.9)

Updates `rubocop-govuk` from 5.0.2 to 5.0.4
- [Changelog](https://github.com/alphagov/rubocop-govuk/blob/main/CHANGELOG.md)
- [Commits](alphagov/rubocop-govuk@v5.0.2...v5.0.4)

Updates `fugit` from 1.11.0 to 1.11.1
- [Changelog](https://github.com/floraison/fugit/blob/master/CHANGELOG.md)
- [Commits](floraison/fugit@v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: puma
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: dotenv-rails
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: sidekiq
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: nokogiri
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: rubocop-govuk
  dependency-type: direct:development
  dependency-group: bundler
- dependency-name: rexml
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: rubocop-govuk
  dependency-type: direct:development
  dependency-group: bundler
- dependency-name: fugit
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/bundler/bundler-4f5079c50a branch from c60b8d7 to 4eaf24b Compare December 4, 2024 14:23
Copy link

github-actions bot commented Dec 4, 2024

@sarahcrack sarahcrack closed this Jan 6, 2025
Copy link
Contributor Author

dependabot bot commented on behalf of github Jan 6, 2025

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot dependabot bot deleted the dependabot/bundler/bundler-4f5079c50a branch January 6, 2025 13:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file Do Not Merge ruby Pull requests that update Ruby code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant