Repository navigation
Update bundler non-major dependencies to v4.25.0 - #316
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 9, 2026 21:27
60551d8 to
3318f4b
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 10, 2026 13:01
3318f4b to
07d0aa1
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 13, 2026 04:40
07d0aa1 to
ccc9475
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 15, 2026 01:36
ccc9475 to
54712b7
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 15, 2026 20:49
54712b7 to
f07dfc1
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 16, 2026 13:30
f07dfc1 to
8a7e287
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 16, 2026 17:14
8a7e287 to
5c4f21f
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 18, 2026 05:43
5c4f21f to
62a683d
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 19, 2026 10:18
62a683d to
3d6be55
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 21, 2026 09:18
3d6be55 to
263d8f0
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 23, 2026 14:11
263d8f0 to
d523fe2
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 23, 2026 18:13
d523fe2 to
693174d
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 25, 2026 13:58
693174d to
d8883fc
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
from
March 26, 2026 09:26
d8883fc to
68eab63
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
6 times, most recently
from
April 16, 2026 09:41
910bb4e to
55ac502
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
5 times, most recently
from
April 22, 2026 21:17
6913954 to
1a7cdfb
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
11 times, most recently
from
April 30, 2026 11:41
59777fc to
1e76e7e
Compare
renovate
Bot
force-pushed
the
renovate/bundler-minor-patch
branch
6 times, most recently
from
May 8, 2026 20:27
467a399 to
78f76e7
Compare
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR body was truncated due to platform limits.
This PR contains the following updates:
4.24.0→4.25.01.24.6→1.26.03.6.1→3.7.02.6.7→2.6.122.1.4→2.2.043.6.1→43.8.11.6.3→1.7.01.89.0→1.92.13.0.0→3.1.01.7.0→1.8.00.40.0→0.41.01.26.1→1.27.02.36.0→2.38.06.2.1→6.3.14.46.0→4.51.01.0.3→1.3.23.26.2→3.34.0Release Notes
drwl/annotaterb (annotaterb)
v4.25.0Compare Source
Full Changelog
Fixed bugs:
format_markdown: true, annotations get written duplicated into models that already have annotations. #355Closed issues:
Merged pull requests:
routesoption #393 (OdenTakashi)rails/bootsnap (bootsnap)
v1.26.0Compare Source
Coverageconstant being defined, but without it being the true stdlibcoveragemodule.bootsnap precompilethat could generate a corrupted cache entry if an already cached YAML file was modifiedwithout changing its size.
Bootsnap.instrumentationraised an error.v1.25.0Compare Source
Improve YAML parsing cache to more efficiently handle
Time,DateandDateTime.Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the
serialized instruction sequences that are cached, but enabling it (via
--yjit,RUBYOPT, orRubyVM::YJIT.enable) adds a+YJITmarker toRUBY_DESCRIPTION(+YJIT <token>onYJIT_SUPPORTbuilds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT
was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.
Fix
CompileCache::Native.fetchand.precompilereading a non-Stringpath argument (e.g. aPathname)with
RSTRING_PTR. Regression from 1.24.0.CanCanCommunity/cancancan (cancancan)
v3.7.0Compare Source
ControllerResourceLoader,ControllerResourceBuilder,ControllerResourceFinder,ControllerResourceNameFinderandControllerResourceSanitizermodules intoCanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass ofCanCan::ControllerResourceinstead. ([@coorasse][])alias_action,clear_aliased_actionsandmerge:can?kept using the aliases expanded by a previous check, soclear_aliased_actionsdid not removecan :readfromcan?(:index, Model). ([@coorasse][]):manage, which granted every action, or to itself, which looped forever. ([@coorasse][])permitted_attributesfor a rule without attributes, remove every attribute with acannotrule without attributes, including those that are not columns, and accept a hash subject instead of raising aTypeError. WARNING:permitted_attributesno longer returns:id, and with a composite primary key none of its columns are returned. ([@coorasse][])load_and_authorize_resourceand theskip_*methods:load_and_authorize_resource 'article'treated the resource as a parent and authorized:showon the class instead of the action on the record. ([@coorasse][])authorize!('index', post)did not use the message defined forread. ([@coorasse][])can?, asaccessible_byalready did:cannot :read, Post, state: :drafton a string column no longer allowscan?(:read, draft). WARNING: acanrule with a symbol now also allows records whose string attribute has the same name. ([@bruno-costanzo][])can?('destroy', user)ignoredcannot :destroy, Userwhencan :managewas defined, andskip_authorize_resource except: 'destroy'also skipped the authorization ofdestroy. WARNING: a String action now goes through the aliases like a Symbol action, socan?('show', order)andauthorize!(action_name, order)are allowed bycan :read, Orderand may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action,permissionsreturns symbols, and a block rule without a subject receives the action as a symbol. ([@bruno-costanzo][])can?(:index, parent => Model)because of acannotrule with conditions on the model, ascan?(:index, Model)already did:load_and_authorize_resourcefailed on theindexof a nested resource. ([@coorasse][])accessible_bythe table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with ahas_many :throughassociation, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. ([@coorasse][])/books/%20ran the action with anilresource, authorized only against the class, instead of raisingActiveRecord::RecordNotFound. ([@bruno-costanzo][])nilin an array of enum values incan?, asaccessible_byalready did:can :read, Post, status: [nil, :published]now allows a post without a status. ([@jtagle2][], [@coorasse][])CanCan::ModelAdapters::Strategies::Baseasaccessible_by_strategy, so the SQL generated byaccessible_bycan be customized with your own strategy. ([@cb341][], [@coorasse][])can?andaccessible_byconsistent forcannotrules and single table inheritance: acannotrule on a subclass keeps its precedence inaccessible_by, records with NULL in a column of acannotcondition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING:accessible_byreturns more records when acannotrule has conditions on a nullable column, andcan?on an STI base class no longer fails because a subclass is forbidden. ([@coorasse][], [@0llirocks][], [@kevinluo201][])accessible_bywith rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. ([@takayamaki][], [@sjoulbak][])can?: the selected column, or the primary key, is checked with a query, asaccessible_byalready did. ([@olistik][])canrules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. ([@coorasse][])with_accessible_by_strategythread safe: the strategy chosen in the block no longer leaks into concurrent requests. ([@NikosVlagoidis][], [@coorasse][])group.posts.accessible_by(ability)returned the posts of every group matched by the scope. WARNING:accessible_bycalled on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped bymergeare applied again, so a condition on a subquery likewhere(category: Category.where(...))is not turned intoIS NULL, and the conditions of a default scope removed byunscopein the rule stay removed. ([@coorasse][])cannotsupports the:allsubject. ([@jaredbeck][])changelog_urito the gemspec, so rubygems.org links to the changelog. ([@mark-young-atg][])disallowed_attributesto retrieve the attributes forbidden bycannotrules. ([@mswiszcz][])throughoption. ([@coorasse][])through_associationtogether withsingletonwhen loading a resource. ([@cgunther][])accessible_bywhen the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. ([@daveallie][])accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. ([@bruno-costanzo][])has_many :throughassociation inaccessible_by: the association was rewritten into its through and source associations and its scope was dropped, soaccessible_byreturned records thatcan?denies. WARNING:accessible_byreturns fewer records for a rule on ahas_many :throughassociation with a scope. ([@bruno-costanzo][])docsfolder as plain Markdown. ([@coorasse][])v3.6.2Compare Source
cancan_skipperbetween controller subclasses:skip_authorize_resourceandskip_load_resourcein a subclass no longer apply to the superclass or sibling controllers. ([@bruno-costanzo][])lease_connectioninstead of the deprecatedconnectionon Rails 7.2+. ([@benaitcheson][])rmosolgo/graphql-ruby (graphql)
v2.6.12Compare Source
Security: This version contains a patch for GHSA-965v-9v76-5hg2
Bug fixes
Visibility::Profile#preload: preload more type information #5748 #5758Visibility::Profile: freeze hashes when fully loaded #5750Dataloader: give nested dataloader calls their own state #5760RelationConnection: reject invalid cursors #5752current_fieldandcurrent_argumentsfor list item dataloader fibers #5759Execution::Next: Don't call.sizeon non-Array list results #5765Parser: fix source locations after multibyte input #5771RelationConnection: fix detection of AsyncDataloader to avoid duplicate queries #5773v2.6.11Compare Source
Bug fixes
data_collectionconfigurationQuery#resultwhenas_default: true#5742lazy?check when schema doesn't useresolve_lazyfor Partials on scalars #5740loads:: correctly type-check loaded objects whenloads:is aloads:-only Object type #5745v2.6.10Compare Source
New features
Execution::Next: Adddataload: { ..., method: }shorthand #5706Bug fixes
AsyncDataloader: Avoid ClosedError race in old fibers #5702AsyncDataloader: fix nested dataloader runs #5703FieldsWillMerge#5704AsyncDataloader: Fix ActiveRecord relation loads in connections #5708Execution::Next: handle SystemStackErrors #5705Float: reject non-finite values #5713v2.6.9Compare Source
Security
v2.6.8Compare Source
New features
quirks_mode: true) #5699Bug fixes
Execution::Next: fix no-method error in mutations #5698omniauth/omniauth (omniauth)
v2.2.0Compare Source
Added
full_hostoption for each strategy, as a string or a proc that takes the Rack env. It takes precedence overOmniAuth.config.full_host. (#835)sig/.originas a form field, and howSameSitesession cookies affect the callback in the README. (#909, #1075, #1048, #1149)Changed
omniauth.paramsnow includes params posted to the request phase's form, not just its query string, so they survive the POST-only request phase introduced in 2.0. Theauthenticity_tokenparam is never included (see CVE-2017-18076 under 1.3.2). If your request form posts other fields, they now appear inomniauth.paramsand are stored in the session until the callback. (#975)OmniAuth::Builderbuilds its middleware stack on the first request and reuses it, instead of rebuilding every strategy on every request. Providers added after the first request are ignored. (#1083, #970)Strategy#callsends a request that isn't on the strategy's request or callback path straight to the app, instead of duplicating the strategy for it. It still duplicates it in test mode, with another_phase, with path lambdas, or when the strategy overrides how#call!dispatches. Methods patched directly ontoOmniAuth::Strategy, rather than overridden in a subclass, aren't detected, so a patched#call!no longer runs for requests outside the strategy's paths. (#1172)lib,sig, the license, the README, the changelog, and the security policy.Fixed
before_callback_phasehook for mocked failures in test mode, as for real callbacks. (#1043, #1171)/auth/:provider/callback.json. (#618, #1170)uid,info,credentials, orextraonObject. (#898, #1169)nameto the info hash subsets returned byslice,except,select, andreject. (#892, #1168)//auth/:providerfrom a misconfigured proxy reaches the strategy. (#1079)Security
full_hostis set, OmniAuth builds the callback URL it sends to the provider from the request'sHost,X-Forwarded-Host, orForwardedheader, which a client can forge. The newOmniAuth.config.allowed_hosts, a list of strings and regexps, makes the request and callback phases fail withinvalid_hostunless the request's host matches one of them. Untilfull_hostorallowed_hostsis set, the request phase logs a warning. The README'sfull_hostexample, which copied theHostheader, is fixed. (GHSA-m27g-v28p-f9fx, CVE-2026-63183)request_validation_phasebefore writingomniauth.paramsto the session, so a cross-site POST rejected by the authenticity check can no longer store attacker-controlled params. (#1162)ged/ruby-pg (pg)
v1.7.0Compare Source
Added:
:typenamefor its parameter casting. #726This allows to generate SQL strings with embedded parameters for easier debugging.
Removed:
This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.
:static_symbolresult field names. #691Fixes:
rubocop/rubocop (rubocop)
v1.92.1Compare Source
Bug fixes
Layout/HashAlignmentwith a key spanning multiple lines. ([@koic][])Style/ClassAndModuleChildrenwhen compacting a namespace that contains another compactable one. ([@Starlexxx][])Style/ClassMethodsDefinitionswith a nestedclass << self. ([@Starlexxx][])Style/EmptyStringInsideInterpolationwith nested conditionals. ([@koic][])Style/RedundantInterpolationUnfreezewith an unfrozen string interpolated into another one. ([@Starlexxx][])Style/RescueModifierwith a rescue modifier in the rescue body of another one. ([@Starlexxx][])Layout/ClassStructurewith code after a heredoc. ([@koic][])Layout/DotPositionwith a dot removed by another cop. ([@koic][])Layout/HeredocArgumentClosingParenthesiswithLayout/MultilineMethodCallBraceLayout. ([@koic][])Layout/LineLengthwith an unparenthesized method definition. ([@koic][])Layout/MultilineHashBraceLayoutwith a nested literal. ([@koic][])Layout/MultilineMethodCallIndentationwith a single-line block. ([@koic][])Layout/SingleLineBlockChainwithStyle/RedundantSort. ([@koic][])Lint/AmbiguousRegexpLiteralwith a regexp hash key. ([@koic][])Lint/SymbolConversionwith hash value omission. ([@koic][])Naming/RescuedExceptionsVariableNamewithStyle/HashSyntax. ([@koic][])Style/AccessModifierDeclarationswithStyle/EndlessMethod. ([@Starlexxx][])Style/AccessModifierDeclarationswith an endless method command body. ([@Starlexxx][])Style/AccessModifierDeclarationswith an endless method with ado...endblock body. ([@koic][])Style/AndOrwith a safe navigation command call. ([@Starlexxx][])Style/AndOrwithStyle/ReturnNil. ([@koic][])Style/ArgumentsForwardingwhen another call forwards anonymous arguments without the block. ([@Starlexxx][])Style/ArgumentsForwardingwith index assignment and setter methods. ([@koic][])Style/CollectionQueryingwhencountis used without a block. ([@Starlexxx][], [@wwenrr][])Style/CombinableLoopswithLayout/BlockEndNewline. ([@Starlexxx][])Style/CombinableLoopswithLayout/RedundantLineBreak. ([@koic][])Style/ConcatArrayLiteralswith a multiline call without parentheses. ([@koic][])Style/EmptyStringInsideInterpolationwith a command call. ([@koic][])Style/EndlessMethodwith a command body in a method definition passed as an argument. ([@Starlexxx][])Style/EndlessMethodwith ado...endblock body in a method definition passed as an argument. ([@koic][])Style/EndlessMethodwith a negated command call. ([@koic][])Style/EndlessMethodwithStyle/GuardClause. ([@koic][])Style/EndlessMethodwithStyle/RaiseArgs. ([@Starlexxx][])Style/Forwith a numbered oritblock. ([@koic][])Style/Forwith block parameters invalid as loop variables. ([@koic][])Style/ForwithStyle/ItBlockParameter. ([@koic][])Style/GuardClausewith a heredoc in a multiline guard clause. ([@Starlexxx][])Style/GuardClausewith a heredoc in the kept branch. ([@Starlexxx][])Style/HashAsLastArrayItemwithStyle/TrailingCommaInArrayLiteral. ([@Starlexxx][])Style/IfUnlessModifierwith a heredoc in the condition. ([@koic][])Style/Lambdawith extra spacing before the block. ([@koic][])Style/MethodCallWithArgsParentheseswith a trailing comma. ([@koic][])Style/MethodCallWithArgsParentheseswith a parenthesized argument. ([@koic][])Style/MethodCallWithArgsParentheseswith an assignment used as an argument. ([@koic][])Style/MethodDefParentheseswithLayout/LineLength. ([@koic][])Style/MixinGroupingwith parenthesized arguments. ([@koic][])Style/MutableConstantwith an omitted hash value. ([@koic][])Style/MutableConstantwithRecursive: trueandStyle/HashAsLastArrayItem. ([@koic][])Style/RaiseArgsdropping required parentheses. ([@Starlexxx][])Style/RedundantInterpolationUnfreezewithLayout/MultilineMethodCallBraceLayout. ([@koic][])Style/RedundantInterpolationUnfreezewith a comment. ([@koic][])Style/RedundantSelfAssignmentBranchwith assignment used as value. ([@koic][])Style/RedundantSortwith a line break before the accessor. ([@koic][])Style/RequireOrderwithout a trailing newline. ([@koic][])Style/SendWithLiteralMethodNamewithLayout/MultilineMethodArgumentLineBreaks. ([@koic][])Style/StructInheritancewithStyle/MethodCallWithArgsParentheses. ([@koic][])Style/SymbolProcwithStyle/TrailingCommaInArguments. ([@koic][])Layout/ArgumentAlignmentwith a binary operator. ([@koic][])Layout/EmptyLineAfterMultilineConditionwith a statement on the condition line. ([@koic][])Layout/EmptyLineAfterMultilineConditionwithrescue. ([@koic][])Layout/EmptyLinesAroundBlockBodywith block arguments on the next line. ([@koic][])Layout/EndAlignmentwith a conditional in a method argument. ([@koic][])Layout/FirstArgumentIndentationwith a multiline hash first argument. ([@koic][])Layout/FirstArrayElementLineBreakwithLayout/SpaceInsideArrayLiteralBracketscompact style. ([[@Starlexxx](https://redirect.github.com/StarlexConfiguration
📅 Schedule: (UTC)
* 0-4,22-23 * * 1-5)* * * * 0,6)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.