Skip to content

Bump the dependencies group across 1 directory with 18 updates - #336

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/dependencies-6293bb21a0
Open

Bump the dependencies group across 1 directory with 18 updates#336
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/dependencies-6293bb21a0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 6 updates in the / directory:

Package From To
json 2.19.4 2.21.1
action_text-trix 2.1.18 2.1.19
globalid 1.3.0 1.4.0
mail 2.9.0 2.9.1
marcel 1.1.0 1.2.1
websocket-driver 0.8.1 0.8.2

Updates json from 2.19.4 to 2.21.1

Release notes

Sourced from json's releases.

v2.21.0

What's Changed

  • JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
  • Added #empty? and #partial_value? methods on JSON::ResumableParser.
  • Numerous correctness and performance fixes for JSON::ResumableParser.
  • Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
  • Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

Full Changelog: ruby/json@v2.20.0...v2.21.0

v2.20.0

What's Changed

  • Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
    • The :max_nesting option still defaults to 100.
  • Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
  • Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
  • Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
  • Integrate with Ruby 4.1 ruby_sized_xfree.

Full Changelog: ruby/json@v2.19.8...v2.20.0

v2.19.9

  • Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: ruby/json@v2.19.8...v2.19.9

v2.19.8

What's Changed

  • Fix 1-byte buffer overread on EOS errors.
  • Handle invalid types passed as max_nesting option.

Full Changelog: ruby/json@v2.19.7...v2.19.8

v2.19.7

What's Changed

  • Fix some more edge cases with out of range floats.
  • Ensure the string provided to JSON.parse can't be mutated during parsing.
  • Add missing write barriers in State#dup.
  • Further validate generator depth config.

Full Changelog: ruby/json@v2.19.6...v2.19.7

v2.19.6

What's Changed

... (truncated)

Changelog

Sourced from json's changelog.

2026-07-13 (2.21.1)

  • Fix a compilation issue on Window and Microsoft Visual C++.

2026-07-12 (2.21.0)

  • JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
  • Added #empty? and #partial_value? methods on JSON::ResumableParser.
  • Numerous correctness and performance fixes for JSON::ResumableParser.
  • Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
  • Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

2026-06-23 (2.20.0)

  • Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
    • The :max_nesting option still defaults to 100.
  • Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
  • Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
  • Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
  • Integrate with Ruby 4.1 ruby_sized_xfree.

2026-06-11 (2.19.9)

  • Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

  • Fix 1-byte buffer overread on EOS errors.
  • Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

  • Fix some more edge cases with out of range floats.
  • Ensure the string provided to JSON.parse can't be mutated during parsing.
  • Add missing write barriers in State#dup.
  • Further validate generator depth config.

2026-05-28 (2.19.6)

  • Cleanly handle overly large depth generator argument.
  • Add missing write barrier in ParserConfig.

2026-05-04 (2.19.5)

  • Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.
Commits
  • fd61def Release 2.21.1
  • db70b14 Rely on Ruby's HAVE_BUILTIN___BUILTIN_CLZLL
  • 9be0e8e Release 2.21.0
  • d1299d4 Avoid re-decoding an incomplete number on every ResumableParser chunk
  • cc010c4 Fix ResumableParser losing tokens before a feed-boundary suspension
  • 0864e83 Add JSON::ResumableParser#partial_value? and #empty?
  • 9dbfeb8 Fix ResumableParser treating unterminated line comments as complete
  • ea008e8 Add a sort_keys option to the generator.
  • 94c1af2 Fix ResumableParser#partial_value SEGV on incomplete nested containers
  • faa5572 Fix a few inconsistencies in readme
  • Additional commits viewable in compare view

Updates action_text-trix from 2.1.18 to 2.1.19

Release notes

Sourced from action_text-trix's releases.

v2.1.19

Dependencies

Full Changelog: basecamp/trix@v2.1.18...v2.1.19

Commits

Updates concurrent-ruby from 1.3.7 to 1.3.8

Release notes

Sourced from concurrent-ruby's releases.

v1.3.8

What's Changed

New Contributors

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.7...v1.3.8

Changelog

Sourced from concurrent-ruby's changelog.

Release v1.3.8 (19 July 2026)

concurrent-ruby:

Commits
  • 0b88d5f Release 1.3.8
  • 0f83a98 Allow to use Concurrent::Map#compute_if_absent in a Ractor (#1109)
  • cc5a32f Programatically set the backtrace_location on exception:
  • See full diff in compare view

Updates crass from 1.0.6 to 1.0.7

Release notes

Sourced from crass's releases.

v1.0.7

Security

  • High: Fixed a denial of service vulnerability in which a large numeric exponent could consume disproportionate CPU and memory before the value was clamped. Exponents are now bounded before 10**exponent is computed. (GHSA-6wmf-3r64-vcwv)

  • Moderate: Fixed a scenario in which deeply nested simple blocks or functions could exhaust the Ruby stack and raise SystemStackError, or could result in excessive memory usage. Parser nesting is now limited to a configurable maximum depth via a new option (:maximum_depth, with a conservative default of 25). Constructs nested more deeply are discarded as an :error node with the value "maximum-depth-exceeded". (GHSA-6jxj-px6v-747w)

  • Moderate: Fixed a scenario in which a long run of adjacent comments could exhaust the Ruby stack and raise SystemStackError. Discarded comments are now skipped iteratively rather than recursively. (GHSA-wwpr-jff3-395c)

  • Moderate: Fixed a denial of service vulnerability in which inputs containing many non-ASCII characters could cause excessive CPU usage due to inefficient handling of multi-byte characters during tokenization. (GHSA-8vfg-2r28-hvhj)

Changelog

Sourced from crass's changelog.

1.0.7 (2026-06-25)

Security

  • High: Fixed a denial of service vulnerability in which a large numeric exponent could consume disproportionate CPU and memory before the value was clamped. Exponents are now bounded before 10**exponent is computed. (GHSA-6wmf-3r64-vcwv)

  • Moderate: Fixed a scenario in which deeply nested simple blocks or functions could exhaust the Ruby stack and raise SystemStackError, or could result in excessive memory usage. Parser nesting is now limited to a configurable maximum depth via a new option (:maximum_depth, with a conservative default of 25). Constructs nested more deeply are discarded as an :error node with the value "maximum-depth-exceeded". (GHSA-6jxj-px6v-747w)

  • Moderate: Fixed a scenario in which a long run of adjacent comments could exhaust the Ruby stack and raise SystemStackError. Discarded comments are now skipped iteratively rather than recursively. (GHSA-wwpr-jff3-395c)

  • Moderate: Fixed a denial of service vulnerability in which inputs containing many non-ASCII characters could cause excessive CPU usage due to inefficient handling of multi-byte characters during tokenization. (GHSA-8vfg-2r28-hvhj)

Commits
  • cfd5daa Release 1.0.7
  • da29664 Fix inefficient handling of non-ASCII characters during tokenization
  • 25d78cc Prevent a long run of adjacent comments from exhausting the stack
  • cf68287 Limit recursion depth to prevent stack overflow and memory exhaustion
  • ea6726b Prevent resource exhaustion denial of service via excessively large exponents
  • 2b87347 Bump version to 1.0.7
  • 0d3be20 Update CI workflow dependencies
  • a3cc4f7 Update CI test matrix
  • 846de61 Upgrade minitest and rake
  • b51a88e Merge pull request #18 from stoivo/main
  • Additional commits viewable in compare view

Updates erb from 6.0.4 to 6.0.6

Release notes

Sourced from erb's releases.

v6.0.6

What's Changed

New Contributors

Full Changelog: ruby/erb@v6.0.5...v6.0.6

v6.0.5

What's Changed

New Contributors

Full Changelog: ruby/erb@v6.0.4...v6.0.5

Changelog

Sourced from erb's changelog.

6.0.6

  • Fix -h CLI option

6.0.5

  • Avoid overridable method dispatch in the initialization guard
Commits
  • 488683a Version 6.0.6
  • 0f9a6d6 Fix -h CLI option (#126)
  • 37daba6 Fix documentation typos and code examples (#125)
  • 37c941c Version 6.0.5
  • ce08ffb Hide ERB init guard internals from RDoc
  • 4bf35f1 Avoid dispatch in ERB initialization guard
  • fbe832a Fix wrong receiver in eoutvar example for #src (#123)
  • ba3086d Bump actions/checkout from 6 to 7
  • e559839 Add a job to aggregate test results
  • cc48728 Bump lewagon/wait-on-check-action from 1.7.0 to 1.8.0
  • Additional commits viewable in compare view

Updates globalid from 1.3.0 to 1.4.0

Release notes

Sourced from globalid's releases.

v1.4.0

What's Changed

New Contributors

Full Changelog: rails/globalid@v1.3.0...v1.4.0

Commits
  • c81267b Release 1.4.0
  • ce280b7 Frozen string literals
  • 9325789 Merge pull request #203 from xijo/support_model_class_override_for_custom_loc...
  • 241657b Allow custom locators to override model class derivation
  • dc5bc56 Merge pull request #204 from paulRbr/dont-constantize-model-when-not-needed
  • 2649897 Don't try to constantize GID's class too soon
  • 018ccf1 Merge pull request #202 from Drowze/swappable-uri-parser
  • 0f2efb5 Change the underlying URI parser (from RFC2396 to RFC3986)
  • 4fd30dd Merge pull request #206 from rosa/fetch
  • 948503f Add GlobalID::Locator.fetch with distinct not-found and unavailable errors
  • Additional commits viewable in compare view

Updates i18n from 1.14.8 to 1.15.2

Release notes

Sourced from i18n's releases.

v1.15.2

What's Changed

Full Changelog: ruby-i18n/i18n@v1.15.1...v1.15.2

v1.15.1

What's Changed

New Contributors

Full Changelog: ruby-i18n/i18n@v1.15.0...v1.15.1

v1.15.0

What's Changed

New Contributors

Full Changelog: ruby-i18n/i18n@v1.14.8...v1.15.0

Commits

Updates loofah from 2.25.1 to 2.25.2

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
  • Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

  • Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
  • Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
  • Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones
Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
  • Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

  • Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
  • Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
  • Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones
Commits
  • 2706d7e version bump to v2.25.2
  • 1afde0c Merge pull request #308 from flavorjones/security-2252
  • f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
  • 5e91af8 Update allowed_uri? to handle named whitespace character references
  • 20867b9 Properly restrict SVG href attributes
  • 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
  • b07713d test: do not run in verbose mode
  • babe7a8 doc: update CHANGELOG
  • a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
  • b52f4b0 version bump to 2.25.2.beta1
  • Additional commits viewable in compare view

Updates mail from 2.9.0 to 2.9.1

Release notes

Sourced from mail's releases.

2.9.1

What's Changed

Full Changelog: mikel/mail@2.9.0...2.9.1

Commits

Updates marcel from 1.1.0 to 1.2.1

Release notes

Sourced from marcel's releases.

v1.2.1

  • Revert BMP images type to just image/bmp instead of image/bmp;format=compressed. The later is more precise, but cause backward compatibility issues with Active Storage.

Full Changelog: rails/marcel@v1.2.0...v1.2.1

v1.2.0

What's Changed

New Contributors

Full Changelog: rails/marcel@v1.1.1...v1.2.0

v1.1.1

What's Changed

New Contributors

Full Changelog: rails/marcel@v1.1.0...v1.1.1

Commits
  • b0625d3 Release 1.2.1
  • 65a6a56 Merge pull request #148 from rails/bmp-raw-type
  • f065e38 Release 1.2.0
  • 8bf7690 Prefer audio/ogg instead of audio/opus
  • 5d74035 Merge pull request #136 from alexanderadam/fix/remove_trailing_mime_type_spac...
  • 17549db Add hprof to allowed regexp types
  • 5cab19b Always run generate_tables.rb
  • 9f9833c Remove trailign type name in all tables
  • 5a3fbac remove trailing mime type spaces & hprof fixture
  • 9f11bea Merge pull request #133 from alexanderadam/fix/p8_detection_issue_90
  • Additional commits viewable in compare view

Updates minitest from 6.0.5 to 6.0.6

Changelog

Sourced from minitest's changelog.

=== 6.0.6 / 2026-04-30

  • 2 bug fixes:

    • Fix using assert_equal/same/nil w/ BasicObject by comparing w/ nil == exp. (mtasaka)
    • Removed private Assertions#_where as it is no longer used.
Commits
  • f6180b0 prepped for release
  • 23bc7f2 - Removed private Assertions#_where as it is no longer used.
  • c471347 - Fix using assert_equal/same/nil w/ BasicObject by comparing w/ nil == exp...
  • See full diff in compare view

Updates net-imap from 0.6.4.1 to 0.6.6

Release notes

Sourced from net-imap's releases.

v0.6.6

What's Changed

Fixed

  • 🐛 Fix incorrect regexp for testing if string is quotable by @​nevans in ruby/net-imap#723 This bug was introduced by v0.6.5 as part of #712. It causes some valid string arguments (which should be sent as IMAP literal values) to raise a DataFormatError exception (without sending).

Full Changelog: ruby/net-imap@v0.6.5...v0.6.6

v0.6.5

What's Changed

Added

Fixed

Other Changes

Miscellaneous

Full Changelog: ruby/net-imap@v0.6.4.1...v0.6.5

Commits
  • 7cc1dd0 🔖 Bump version to 0.6.6
  • 416ada4 🐛 Fix bug in #712, testing if string is quotable
  • 8fb3029 🔖 Bump version to 0.6.5
  • adfe70d 🔀 Merge pull request #721 from ruby/fix-simplecov-upgrade
  • e38a03d ✅ Change CI simplecov minimum coverage handling
  • 74cd627 ✅ Update simplecov groups so nothing is ungrouped
  • f4afcc7 ✅ Update simplecov config for v1.0 syntax
  • ce44000 ✅ Move simplecov config into .simplecov
  • 8e0c450 ⬆️ Bump step-security/harden-runner from 2.19.4 to 2.20.0
  • fd526d8 simplecov-{html,json} have been incorporated in SimpleCov 1.0.0
  • Additional commits viewable in compare view

Updates nokogiri from 1.19.3 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
  • [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
  • [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
  • [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem
Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

  • [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
  • [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
  • [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 fo...

    Description has been truncated

@dependabot
Bump the dependencies group across 1 directory with 18 updates
a88d955 
Bumps the dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [json](https://github.com/ruby/json) | `2.19.4` | `2.21.1` |
| [action_text-trix](https://github.com/basecamp/trix) | `2.1.18` | `2.1.19` |
| [globalid](https://github.com/rails/globalid) | `1.3.0` | `1.4.0` |
| [mail](https://github.com/mikel/mail) | `2.9.0` | `2.9.1` |
| [marcel](https://github.com/rails/marcel) | `1.1.0` | `1.2.1` |
| [websocket-driver](https://github.com/faye/websocket-driver-ruby) | `0.8.1` | `0.8.2` |



Updates `json` from 2.19.4 to 2.21.1
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v2.19.4...v2.21.1)

Updates `action_text-trix` from 2.1.18 to 2.1.19
- [Release notes](https://github.com/basecamp/trix/releases)
- [Commits](basecamp/trix@v2.1.18...v2.1.19)

Updates `concurrent-ruby` from 1.3.7 to 1.3.8
- [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases)
- [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md)
- [Commits](ruby-concurrency/concurrent-ruby@v1.3.7...v1.3.8)

Updates `crass` from 1.0.6 to 1.0.7
- [Release notes](https://github.com/rgrove/crass/releases)
- [Changelog](https://github.com/rgrove/crass/blob/main/HISTORY.md)
- [Commits](rgrove/crass@v1.0.6...v1.0.7)

Updates `erb` from 6.0.4 to 6.0.6
- [Release notes](https://github.com/ruby/erb/releases)
- [Changelog](https://github.com/ruby/erb/blob/master/NEWS.md)
- [Commits](ruby/erb@v6.0.4...v6.0.6)

Updates `globalid` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/rails/globalid/releases)
- [Commits](rails/globalid@v1.3.0...v1.4.0)

Updates `i18n` from 1.14.8 to 1.15.2
- [Release notes](https://github.com/ruby-i18n/i18n/releases)
- [Changelog](https://github.com/ruby-i18n/i18n/blob/master/CHANGELOG.md)
- [Commits](ruby-i18n/i18n@v1.14.8...v1.15.2)

Updates `loofah` from 2.25.1 to 2.25.2
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md)
- [Commits](flavorjones/loofah@v2.25.1...v2.25.2)

Updates `mail` from 2.9.0 to 2.9.1
- [Release notes](https://github.com/mikel/mail/releases)
- [Changelog](https://github.com/mikel/mail/blob/master/CHANGELOG.rdoc)
- [Commits](mikel/mail@2.9.0...2.9.1)

Updates `marcel` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/rails/marcel/releases)
- [Commits](rails/marcel@v1.1.0...v1.2.1)

Updates `minitest` from 6.0.5 to 6.0.6
- [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc)
- [Commits](minitest/minitest@v6.0.5...v6.0.6)

Updates `net-imap` from 0.6.4.1 to 0.6.6
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](ruby/net-imap@v0.6.4.1...v0.6.6)

Updates `nokogiri` from 1.19.3 to 1.19.4
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.3...v1.19.4)

Updates `pp` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/ruby/pp/releases)
- [Commits](ruby/pp@v0.6.3...v0.6.4)

Updates `rails-html-sanitizer` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/rails/rails-html-sanitizer/releases)
- [Changelog](https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md)
- [Commits](rails/rails-html-sanitizer@v1.7.0...v1.7.1)

Updates `rdoc` from 7.2.0 to 8.0.0
- [Release notes](https://github.com/ruby/rdoc/releases)
- [Changelog](https://github.com/ruby/rdoc/blob/master/History.rdoc)
- [Commits](ruby/rdoc@v7.2.0...v8.0.0)

Updates `websocket-driver` from 0.8.1 to 0.8.2
- [Changelog](https://github.com/faye/websocket-driver-ruby/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-ruby@0.8.1...0.8.2)

Updates `zeitwerk` from 2.7.5 to 2.8.2
- [Changelog](https://github.com/fxn/zeitwerk/blob/main/CHANGELOG.md)
- [Commits](fxn/zeitwerk@v2.7.5...v2.8.2)

---
updated-dependencies:
- dependency-name: json
  dependency-version: 2.21.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: action_text-trix
  dependency-version: 2.1.19
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: concurrent-ruby
  dependency-version: 1.3.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: crass
  dependency-version: 1.0.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: erb
  dependency-version: 6.0.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: globalid
  dependency-version: 1.4.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: i18n
  dependency-version: 1.15.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: loofah
  dependency-version: 2.25.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: mail
  dependency-version: 2.9.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: marcel
  dependency-version: 1.2.1
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: minitest
  dependency-version: 6.0.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: net-imap
  dependency-version: 0.6.6
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: nokogiri
  dependency-version: 1.19.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: pp
  dependency-version: 0.6.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: rails-html-sanitizer
  dependency-version: 1.7.1
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: rdoc
  dependency-version: 8.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: websocket-driver
  dependency-version: 0.8.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: zeitwerk
  dependency-version: 2.8.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies ruby Pull requests that update ruby code labels Jul 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants