From 9c3976a6b847a890bebb302a828a3914c4257df2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 05:14:39 +0000 Subject: [PATCH 1/2] Bump the minor-and-patch group across 1 directory with 4 updates Bumps the minor-and-patch group with 4 updates in the / directory: [solid_queue](https://github.com/rails/solid_queue), [solid_cable](https://github.com/rails/solid_cable), [pagy](https://github.com/ddnexus/pagy) and [csv](https://github.com/ruby/csv). Updates `solid_queue` from 1.4.0 to 1.5.0 - [Release notes](https://github.com/rails/solid_queue/releases) - [Commits](https://github.com/rails/solid_queue/compare/v1.4.0...v1.5.0) Updates `solid_cable` from 4.0.0 to 4.0.2 - [Release notes](https://github.com/rails/solid_cable/releases) - [Commits](https://github.com/rails/solid_cable/compare/v4.0.0...v4.0.2) Updates `pagy` from 43.6.0 to 43.6.1 - [Release notes](https://github.com/ddnexus/pagy/releases) - [Changelog](https://github.com/ddnexus/pagy/blob/master/docs/CHANGELOG.md) - [Commits](https://github.com/ddnexus/pagy/compare/43.6.0...43.6.1) Updates `csv` from 3.3.5 to 3.3.6 - [Release notes](https://github.com/ruby/csv/releases) - [Changelog](https://github.com/ruby/csv/blob/main/NEWS.md) - [Commits](https://github.com/ruby/csv/compare/v3.3.5...v3.3.6) --- updated-dependencies: - dependency-name: solid_queue dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: solid_cable dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pagy dependency-version: 43.6.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: csv dependency-version: 3.3.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] --- Gemfile.lock | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 1431d91..c656cb9 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -123,7 +123,7 @@ GEM childprocess (5.1.0) logger (~> 1.5) chronic (0.10.2) - concurrent-ruby (1.3.7) + concurrent-ruby (1.3.8) config (5.6.1) deep_merge (~> 1.2, >= 1.2.1) ostruct @@ -132,7 +132,7 @@ GEM bigdecimal rexml crass (1.0.7) - csv (3.3.5) + csv (3.3.6) date (3.5.1) debug (1.11.1) irb (~> 1.10) @@ -149,7 +149,7 @@ GEM devise (> 3.5.2, < 5) rails (>= 4.2.0, < 8.2) drb (2.2.3) - erb (6.0.5) + erb (6.0.6) erb_lint (0.9.0) activesupport better_html (>= 2.0.1) @@ -158,7 +158,7 @@ GEM rubocop (>= 1) smart_properties erubi (1.13.1) - et-orbi (1.4.0) + et-orbi (1.4.1) tzinfo faraday (2.14.3) faraday-net_http (>= 2.0, < 3.5) @@ -294,7 +294,7 @@ GEM childprocess (>= 0.6.3, < 6) iniparse (~> 1.4) rexml (>= 3.3.9) - pagy (43.6.0) + pagy (43.6.1) json uri yaml @@ -321,7 +321,7 @@ GEM nio4r (~> 2.0) pundit (2.5.2) activesupport (>= 3.0.0) - raabro (1.4.0) + raabro (1.5.0) racc (1.8.1) rack (3.2.6) rack-attack (6.8.0) @@ -365,7 +365,7 @@ GEM zeitwerk (~> 2.6) rainbow (3.1.1) rake (13.4.2) - rbs (4.0.3) + rbs (4.1.1) logger prism (>= 1.6.0) tsort @@ -432,7 +432,7 @@ GEM faraday (>= 0.17.5, < 3.a) jwt (>= 1.5, < 4.0) smart_properties (1.17.0) - solid_cable (4.0.0) + solid_cable (4.0.2) actioncable (>= 7.2) activejob (>= 7.2) activerecord (>= 7.2) @@ -441,7 +441,7 @@ GEM activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) - solid_queue (1.4.0) + solid_queue (1.5.0) activejob (>= 7.1) activerecord (>= 7.1) concurrent-ruby (>= 1.3.1) From 25eee9aaeb9bc872959a443543cbad4e4bb66024 Mon Sep 17 00:00:00 2001 From: dadachi Date: Thu, 6 Aug 2026 17:34:49 +0900 Subject: [PATCH 2/2] Bump rails to 8.1.3.1 to fix activestorage CVE-2026-66066 `bin/bundler-audit` was failing CI on the Dependabot group PR (#92): activestorage 8.1.3 is affected by CVE-2026-66066 (arbitrary file read and remote code execution in variant processing), fixed in 8.1.3.1. Ran `bundle update rails`, which also picks up the transitive bumps that came with the Dependabot group update. Verified: bin/rubocop, erb_lint, bin/brakeman, bin/bundler-audit, and bin/rails test (438 runs, 916 assertions, 0 failures) all pass. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01GFnQcLwkMc3z1HqPZTb5V2 --- Gemfile.lock | 116 +++++++++++++++++++++++++-------------------------- 1 file changed, 58 insertions(+), 58 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index c656cb9..6edd932 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -12,29 +12,29 @@ GEM railties (>= 8.0) action_text-trix (2.1.19) railties - actioncable (8.1.3) - actionpack (= 8.1.3) - activesupport (= 8.1.3) + actioncable (8.1.3.1) + actionpack (= 8.1.3.1) + activesupport (= 8.1.3.1) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (8.1.3) - actionpack (= 8.1.3) - activejob (= 8.1.3) - activerecord (= 8.1.3) - activestorage (= 8.1.3) - activesupport (= 8.1.3) + actionmailbox (8.1.3.1) + actionpack (= 8.1.3.1) + activejob (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) mail (>= 2.8.0) - actionmailer (8.1.3) - actionpack (= 8.1.3) - actionview (= 8.1.3) - activejob (= 8.1.3) - activesupport (= 8.1.3) + actionmailer (8.1.3.1) + actionpack (= 8.1.3.1) + actionview (= 8.1.3.1) + activejob (= 8.1.3.1) + activesupport (= 8.1.3.1) mail (>= 2.8.0) rails-dom-testing (~> 2.2) - actionpack (8.1.3) - actionview (= 8.1.3) - activesupport (= 8.1.3) + actionpack (8.1.3.1) + actionview (= 8.1.3.1) + activesupport (= 8.1.3.1) nokogiri (>= 1.8.5) rack (>= 2.2.4) rack-session (>= 1.0.1) @@ -42,36 +42,36 @@ GEM rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) useragent (~> 0.16) - actiontext (8.1.3) + actiontext (8.1.3.1) action_text-trix (~> 2.1.15) - actionpack (= 8.1.3) - activerecord (= 8.1.3) - activestorage (= 8.1.3) - activesupport (= 8.1.3) + actionpack (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (8.1.3) - activesupport (= 8.1.3) + actionview (8.1.3.1) + activesupport (= 8.1.3.1) builder (~> 3.1) erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (8.1.3) - activesupport (= 8.1.3) + activejob (8.1.3.1) + activesupport (= 8.1.3.1) globalid (>= 0.3.6) - activemodel (8.1.3) - activesupport (= 8.1.3) - activerecord (8.1.3) - activemodel (= 8.1.3) - activesupport (= 8.1.3) + activemodel (8.1.3.1) + activesupport (= 8.1.3.1) + activerecord (8.1.3.1) + activemodel (= 8.1.3.1) + activesupport (= 8.1.3.1) timeout (>= 0.4.0) - activestorage (8.1.3) - actionpack (= 8.1.3) - activejob (= 8.1.3) - activerecord (= 8.1.3) - activesupport (= 8.1.3) + activestorage (8.1.3.1) + actionpack (= 8.1.3.1) + activejob (= 8.1.3.1) + activerecord (= 8.1.3.1) + activesupport (= 8.1.3.1) marcel (~> 1.0) - activesupport (8.1.3) + activesupport (8.1.3.1) base64 bigdecimal concurrent-ruby (~> 1.0, >= 1.3.1) @@ -149,7 +149,7 @@ GEM devise (> 3.5.2, < 5) rails (>= 4.2.0, < 8.2) drb (2.2.3) - erb (6.0.6) + erb (6.0.7) erb_lint (0.9.0) activesupport better_html (>= 2.0.1) @@ -211,7 +211,7 @@ GEM prism (>= 1.3.0) rdoc (>= 4.0.0) reline (>= 0.4.2) - json (2.21.1) + json (2.21.2) jsonapi-serializer (2.2.0) activesupport (>= 4.2) jwt (3.2.0) @@ -262,7 +262,7 @@ GEM bigdecimal (>= 3.1, < 5) net-http (0.9.1) uri (>= 0.11.1) - net-imap (0.6.4.1) + net-imap (0.6.6) date net-protocol net-pop (0.1.2) @@ -333,20 +333,20 @@ GEM rack (>= 1.3) rackup (2.3.1) rack (>= 3) - rails (8.1.3) - actioncable (= 8.1.3) - actionmailbox (= 8.1.3) - actionmailer (= 8.1.3) - actionpack (= 8.1.3) - actiontext (= 8.1.3) - actionview (= 8.1.3) - activejob (= 8.1.3) - activemodel (= 8.1.3) - activerecord (= 8.1.3) - activestorage (= 8.1.3) - activesupport (= 8.1.3) + rails (8.1.3.1) + actioncable (= 8.1.3.1) + actionmailbox (= 8.1.3.1) + actionmailer (= 8.1.3.1) + actionpack (= 8.1.3.1) + actiontext (= 8.1.3.1) + actionview (= 8.1.3.1) + activejob (= 8.1.3.1) + activemodel (= 8.1.3.1) + activerecord (= 8.1.3.1) + activestorage (= 8.1.3.1) + activesupport (= 8.1.3.1) bundler (>= 1.15.0) - railties (= 8.1.3) + railties (= 8.1.3.1) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -354,9 +354,9 @@ GEM rails-html-sanitizer (1.7.1) loofah (~> 2.25, >= 2.25.2) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (8.1.3) - actionpack (= 8.1.3) - activesupport (= 8.1.3) + railties (8.1.3.1) + actionpack (= 8.1.3.1) + activesupport (= 8.1.3.1) irb (~> 1.13) rackup (>= 1.0.0) rake (>= 12.2) @@ -365,7 +365,7 @@ GEM zeitwerk (~> 2.6) rainbow (3.1.1) rake (13.4.2) - rbs (4.1.1) + rbs (4.1.2) logger prism (>= 1.6.0) tsort @@ -494,7 +494,7 @@ GEM xpath (3.2.0) nokogiri (~> 1.8) yaml (0.4.0) - zeitwerk (2.8.2) + zeitwerk (2.8.3) PLATFORMS aarch64-linux