An open index of dependabot pull requests across open source projects.

1.2.x: Bump the ruby-deps group across 4 directories with 13 updates

Open
Number: #353
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 5
Created: October 07, 2025 at 03:10 PM UTC
(8 months ago)
Updated: October 07, 2025 at 04:17 PM UTC
(8 months ago)
Labels:
dependencies ruby
Description:

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps the ruby-deps group with 1 update in the / directory: rack.
Bumps the ruby-deps group with 4 updates in the /examples/camping directory: rack, rackup, rexml and rubyzip.
Bumps the ruby-deps group with 8 updates in the /examples/rails7 directory:

Package From To
rack 2.2.18 2.2.19
bigdecimal 3.2.3 3.3.0
globalid 1.2.1 1.3.0
marcel 1.0.4 1.1.0
net-imap 0.5.10 0.5.12
nokogiri 1.18.9 1.18.10
pp 0.6.2 0.6.3
rdoc 6.14.2 6.15.0

Bumps the ruby-deps group with 2 updates in the /examples/sinatra directory: rack and sinatra.

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rackup from 1.0.1 to 2.2.1

Changelog

Sourced from rackup's changelog.

v2.2.1

  • Try to require webrick and rackup/handler/webrick by default, for compatibility with code that expects them to be available.

v2.2.0

  • Remove old rack shims.
  • Remove webrick dependency.

v2.1.0

  • Correctly support streaming responses with webrick.

v2.0.0

  • Initial release and migration of code from rack.
Commits
  • e9814d3 Bump patch version.
  • aa0acac Require the webrick handler when webrick is available (#27)
  • ee4fe54 Update RubyGems to fix Ruby 2.5 psych compatibility issue. (#28)
  • 8d32c96 Backfill releases.md.
  • 3301bdc Add Ruby version guard to bake-releases gem.
  • 7f6d2aa Bump minor version.
  • 76a7320 Move development dependencies to gems.rb.
  • 1f3ece0 Update copyrights.
  • 20d41c6 Automate release notes.
  • 4e72d9d Remove unused rack classes (#10)
  • Additional commits viewable in compare view

Updates rack from 2.2.19 to 3.2.2

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rexml from 3.4.3 to 3.4.4

Release notes

Sourced from rexml's releases.

REXML 3.4.4 - 2025-09-10

Improvement

  • Accept REXML::Document.new("") for backward compatibility
    • GH-296
    • GH-295
    • Patch by NAITOH Jun
    • Reported by Joe Rafaniello

Thanks

  • NAITOH Jun

  • Joe Rafaniello

Changelog

Sourced from rexml's changelog.

3.4.4 - 2025-09-10 {#version-3-4-4}

Improvement

  • Accept REXML::Document.new("") for backward compatibility
    • GH-296
    • GH-295
    • Patch by NAITOH Jun
    • Reported by Joe Rafaniello

Thanks

  • NAITOH Jun

  • Joe Rafaniello

Commits

Updates rubyzip from 3.1.0 to 3.1.1

Release notes

Sourced from rubyzip's releases.

v3.1.1

Version 3.1.1

The 3.1.x line adds AES decryption.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

Changelog

Sourced from rubyzip's changelog.

3.1.1 (2025-09-26)

  • Improve the IO pipeline when decompressing. #649 (which also fixes #647)

Tooling/internal:

  • Improve the DecryptedIo class with various updates and optimizations.
  • Remove the NullDecrypter class.
  • Properly convert the test suite to use minitest.
  • Move all test helper code into separate files.
  • Updates to the Actions CI, including new OS versions.
  • Update rubocop versions and fix resultant cop failures. #646
Commits
  • f87340d Update version number and Changelog for release.
  • 813d96d Add a Rubocop badge to the README.
  • 61c25b0 Reduce the number of YJIT test runs in CI.
  • 69dcb8e Allow Windows CI builds to fail.
  • da44b2c Update OS versions in the Actions CI.
  • fd78455 Use require_relative when pulling in test_helper.
  • 78848c5 Only require test helpers where they are needed.
  • e55f7c9 Move all test helper code into separate files.
  • 5f1fcb2 Remove unnecessary perms from gentestfiles.rb.
  • ceabd03 Remove unnecessary requires from test_helper.rb.
  • Additional commits viewable in compare view

Updates rack from 2.2.18 to 3.2.2

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rackup from 1.0.1 to 2.2.1

Changelog

Sourced from rackup's changelog.

v2.2.1

  • Try to require webrick and rackup/handler/webrick by default, for compatibility with code that expects them to be available.

v2.2.0

  • Remove old rack shims.
  • Remove webrick dependency.

v2.1.0

  • Correctly support streaming responses with webrick.

v2.0.0

  • Initial release and migration of code from rack.
Commits
  • e9814d3 Bump patch version.
  • aa0acac Require the webrick handler when webrick is available (#27)
  • ee4fe54 Update RubyGems to fix Ruby 2.5 psych compatibility issue. (#28)
  • 8d32c96 Backfill releases.md.
  • 3301bdc Add Ruby version guard to bake-releases gem.
  • 7f6d2aa Bump minor version.
  • 76a7320 Move development dependencies to gems.rb.
  • 1f3ece0 Update copyrights.
  • 20d41c6 Automate release notes.
  • 4e72d9d Remove unused rack classes (#10)
  • Additional commits viewable in compare view

Updates rack from 2.2.18 to 3.2.2

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates rack from 2.2.18 to 2.2.19

Changelog

Sourced from rack's changelog.

[2.2.19] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 4c4ea29 Bump patch version.
  • c370dcd Limit amount of retained data when parsing multipart requests
  • d869fed Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates bigdecimal from 3.2.3 to 3.3.0

Release notes

Sourced from bigdecimal's releases.

v3.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/ruby/bigdecimal/compare/v3.2.3...v3.3.0

Changelog

Sourced from bigdecimal's changelog.

3.3.0

Commits
  • 0aa97bb Bump version to 3.3.0 (#437)
  • f718178 Fix precision of x.power(y, prec) when the result is nearly infinity (#439)
  • a267ca7 Improve performance of x**y when y is a huge value (#438)
  • cb2458b Add newline at EOF [ci skip]
  • d93b542 Make internal BigMath method a private method (#432)
  • f107735 Merge pull request #431 from ruby/dependabot/github_actions/step-security/har...
  • 6682fd8 Bump step-security/harden-runner from 2.13.0 to 2.13.1
  • 8ca3249 Fix divmod and modulo by infinity to match Float#divmod and Float#modulo (#429)
  • 34e60a7 BigMath.log(0,n)==-Infinity just like Math.log(0) (#430)
  • 07696bc Update example calculation result in BigMath document (#428)
  • Additional commits viewable in compare view

Updates globalid from 1.2.1 to 1.3.0

Release notes

Sourced from globalid's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: https://github.com/rails/globalid/compare/v1.2.1...v1.3.0

Commits
  • a101021 Prepare for 1.3.0
  • 40b6cd5 Remove deprecation message
  • 26cdc63 Fix test
  • 446a491 Upgrade development dependencies
  • db9b467 Add release workflow
  • 497bf21 Merge pull request #200 from tylerwillingham/twilling/locate-arity-warning-fix
  • b4b3f49 Resolve deprecation warning around #locate arity for custom locator test
  • 8666784 Merge pull request #179 from heka1024/configurable-base-locator
  • 460279d Merge pull request #198 from Earlopain/uri-parser-memo
  • 42ead60 Move uri parser to constant
  • Additional commits viewable in compare view

Updates marcel from 1.0.4 to 1.1.0

Release notes

Sourced from marcel's releases.

v1.1.0

What's Changed

New Contributors

Full Changelog: https://github.com/rails/marcel/compare/v1.0.4...v1.1.0

Commits
  • 3d3c5dc Prepare for version 1.1.0
  • 8730c0a Add release workflow
  • bf9056b Merge pull request #127 from rails/update-tika
  • db67956 Merge pull request #126 from rails/ci
  • 85a6e2e Update tika tables
  • 4ea7fcd Test with Ruby 3.3 and 3.4
  • 7e9dea7 Add devcontainer configuration
  • b7cda87 Merge pull request #104 from alexandergitter/fix-av1-webm
  • a056565 Merge pull request #105 from mark-young-atg/provide_changelog_link_on_rubygems
  • 2b1cc0f Merge pull request #108 from Mth0158/remove-duplicate-method
  • Additional commits viewable in compare view

Updates net-imap from 0.5.10 to 0.5.12

Release notes

Sourced from net-imap's releases.

v0.5.12

What's Changed

TruffleRuby is not (yet) "officially supported" but it seems to work (with a few small caveats). Several tests are still marked as pending, but the rest all pass. #528 protects us from merging PRs that break TruffleRuby and (in some cases) JRuby.

Fixed

Miscellaneous

Full Changelog: https://github.com/ruby/net-imap/compare/v0.5.11...v0.5.12

v0.5.11

What's Changed

Added

Fixed

Other Changes

Documentation

Miscellaneous

New Contributors

Full Changelog: https://github.com/ruby/net-imap/compare/v0.5.10...v0.5.11

Commits
  • bab9dfb 🔖 Bump version to 0.5.12
  • 4ec0f83 🔀 Merge pull request #528 from ruby/add-truffleruby-to-ci
  • ad5eb96 ✅🚧 Run CI with TruffleRuby (experimental for now)
  • 50f83b8 ✅🚧 Mark 2 ConnectionState tests as pending for TruffleRuby
  • 6d42c16 ✅🚧 Mark 1 ::Data test as pending for TruffleRuby
  • 9b9a89c ✅ Add TruffleRuby/JRuby pend/omit test helpers
  • c7a6b43 ✅ Skip simplecov for non-CRuby engines
  • cb4a646 ✅ Test overriding inherited ::Data methods
  • 8c282c0 🐛 Fix loading of Net::IMAP::Config for JRuby
  • b97b414 🔖 Bump version to 0.5.11
  • Additional commits viewable in compare view

Updates nokogiri from 1.18.9 to 1.18.10

Release notes

Sourced from nokogiri's releases.

v1.18.10 / 2025-09-15

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.
  • [CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18
7fb87235d729c74a2be635376d82b1d459230cc17c50300f8e4fcaabc6195344  nokogiri-1.18.10-aarch64-linux-gnu.gem
7e74e58314297cc8a8f1b533f7212d1999dbe2639a9ee6d97b483ea2acc18944  nokogiri-1.18.10-aarch64-linux-musl.gem
51f4f25ab5d5ba1012d6b16aad96b840a10b067b93f35af6a55a2c104a7ee322  nokogiri-1.18.10-arm-linux-gnu.gem
1c6ea754e51cecc85c30ee8ab1e6aa4ce6b6e134d01717e9290e79374a9e00aa  nokogiri-1.18.10-arm-linux-musl.gem
c2b0de30770f50b92c9323fa34a4e1cf5a0af322afcacd239cd66ee1c1b22c85  nokogiri-1.18.10-arm64-darwin.gem
cd431a09c45d84a2f870ba0b7e8f571199b3727d530f2b4888a73639f76510b5  nokogiri-1.18.10-java.gem
64f40d4a41af9f7f83a4e236ad0cf8cca621b97e31f727b1bebdae565a653104  nokogiri-1.18.10-x64-mingw-ucrt.gem
536e74bed6db2b5076769cab5e5f5af0cd1dccbbd75f1b3e1fa69d1f5c2d79e2  nokogiri-1.18.10-x86_64-darwin.gem
ff5ba26ba2dbce5c04b9ea200777fd225061d7a3930548806f31db907e500f72  nokogiri-1.18.10-x86_64-linux-gnu.gem
0651fccf8c2ebbc2475c8b1dfd7ccac3a0a6d09f8a41b72db8c21808cb483385  nokogiri-1.18.10-x86_64-linux-musl.gem
d5cc0731008aa3b3a87b361203ea3d19b2069628cb55e46ac7d84a0445e69cc1  nokogiri-1.18.10.gem
Changelog

Sourced from nokogiri's changelog.

v1.18.10 / 2025-09-15

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.
  • [CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18
Commits
  • 6803740 version bump to v1.18.10
  • 93337de dep: bump vendored libxml2 to v2.13.9 (#3555)
  • 15dde17 ci: work around repeated bundler deadlocks
  • 9906071 dep: bump vendored libxml2 to v2.13.9
  • adf72e3 [v1.18.x] backport libiconv upgrade to v1.18 (#3550)
  • 92cab09 dep: update vendored libiconv to 1.18
  • f1c5ea8 Use mirror site to download libiconv
  • dcd2721 ci: stop testing Ruby 3.1 windows source builds
  • cf856e6 ci: fix the aarch64 segfault by using a more modern qemu
  • 6d77443 Fix errors building Ruby 3.1 on windows
  • Additional commits viewable in compare view

Updates pp from 0.6.2 to 0.6.3

Release notes

Sourced from pp's releases.

v0.6.3

What's Changed

New Contributors

Full Changelog: https://github.com/ruby/pp/compare/v0.6.2...v0.6.3

Commits
Package Dependencies
Ecosystem:
rubygems
Version Change:
2.2.18 → 2.2.19
Update Type:
Patch
Package:
nokogiri
Ecosystem:
rubygems
Version Change:
1.18.9 → 1.18.10
Update Type:
Patch
Package:
bigdecimal
Ecosystem:
rubygems
Version Change:
3.2.3 → 3.3.0
Update Type:
Minor
Package:
net-imap
Ecosystem:
rubygems
Version Change:
0.5.10 → 0.5.12
Update Type:
Patch
Package:
globalid
Ecosystem:
rubygems
Version Change:
1.2.1 → 1.3.0
Update Type:
Minor
Package:
rdoc
Ecosystem:
rubygems
Version Change:
6.14.2 → 6.15.0
Update Type:
Minor
Package:
marcel
Ecosystem:
rubygems
Version Change:
1.0.4 → 1.1.0
Update Type:
Minor
Package:
pp
Ecosystem:
rubygems
Version Change:
0.6.2 → 0.6.3
Update Type:
Patch
Technical Details
ID: 9785267
UUID: 3491907227
Node ID: PR_kwDNQRvOrIRtTA
Host: GitHub
Repository: jruby/jruby-rack