Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github May 28, 2025

Bumps rack-protection, sprockets, rack, omniauth, omniauth-github, omniauth-oauth2, omniauth-google-oauth2, pry-byebug, sidekiq, byebug, sassc-embedded and rqrcode. These dependencies needed to be updated together.
Updates rack-protection from 3.2.0 to 4.1.1

Changelog

Sourced from rack-protection's changelog.

4.1.1 / 2024-11-20

  • Fix: Restore WEBrick support (#2067)

4.1.0 / 2024-11-18

  • New: Add host_authorization setting (#2053)
    • Defaults to .localhost, .test and any IP address in development mode.
    • Security: addresses CVE-2024-21510.
  • Fix: Return an instance of Sinatra::IndifferentHash when calling #except (#2044)
  • Fix: Address warning from URI for Ruby 3.4 (#2060)
  • Fix: rackup no longer depends on WEBrick, recommend Puma instead (4a558503)
  • Fix: Zeitwerk 2.7.0+ compatibility (#2050)
  • Fix: Address warning about Hash construction for Ruby 3.4 (#2028)
  • Fix: Declare missing dependencies for Ruby 3.5 (#2032)
  • Fix: Compatibility with --enable-frozen-string-literal (#2033)
  • Fix: Rack 3.1 compatibility (#2035)
    • Don't depend on Rack::Logger
    • Don't delete content-length header when Rack::Files is used

4.0.1 / 2025-05-24

  • Rack 3.1 compatibility (#2035)

  • Fix malformed Content-Type headers (#2081)

  • Avoid crash for integer values in content_type parameters (#2078)

  • Fix compatibility with --enable-frozen-string-literal (#2033)

  • Declare missing dependencies for Ruby 3.5 (#2032)

  • Fix warning about Hash construction. (#2028)

  • Support Zeitwerk 2.7.0+ (#2050)

  • Address URI depreciation (#2060)

#2035: sinatra/sinatra#2035 #2081: sinatra/sinatra#2081 #2078: sinatra/sinatra#2078 #2033: sinatra/sinatra#2033 #2032: sinatra/sinatra#2032 #2028: sinatra/sinatra#2028 #2050: sinatra/sinatra#2050 #2060: sinatra/sinatra#2060

4.0.0. / 2024-01-19

  • New: Add support for Rack 3 (#1857)

... (truncated)

Commits

Updates sprockets from 3.7.5 to 4.2.2

Release notes

Sourced from sprockets's releases.

4.2.1

What's Changed

New Contributors

Full Changelog: rails/sprockets@v4.2.0...v4.2.1

4.2.0

What's Changed

New Contributors

Full Changelog: rails/sprockets@v4.1.1...v4.2.0

v4.1.1

  • Fix Sprockets::Server to return response headers to compatible with with Rack::Lint 2.0.

Full Changelog: rails/sprockets@v4.1.0...v4.1.1

v4.1.0

What's Changed

... (truncated)

Changelog

Sourced from sprockets's changelog.

4.2.2

  • Added missing dependency on logger. #813
  • Fix URI::RFC3986_PARSER warnings. #812
  • Removed dependency on base64. #810

4.2.1

  • Fix for precompile issues when multiple extensions map to the same MIME type (eg. .jpeg / .jpg). #781
  • Fix application/css-sourcemap+json charset #764
  • Fix compatibility with Rack 2 applications. #790

4.2.0

  • Rack 3 compatibility. #758
  • Fix thread safety of Sprockets::CachedEnvironment and Sprockets::Cache::MemoryStore. #771
  • Add support for Rack 3.0. Headers set by sprockets will now be lower case. #758
  • Make Sprockets::Utils.module_include thread safe on JRuby. #759
  • Fix typo in asset.rb file. #768

4.1.1

  • Fix Sprockets::Server to return response headers to be compatible with Rack::Lint 2.0.

4.1.0

  • Allow age to be altered in asset:clean rake task.
  • Fix Sprockets::Server to return lower-cased response headers to comply with Rack::Lint 3.0. #744
  • Adding new directive depend_on_directory #668
  • Fix application/js-sourcemap+json charset #669
  • Fix CachedEnvironment caching nil values #723
  • Process *.jst.ejs.erb files with ERBProcessor #674
  • Fix cache key for coffee script processor to be dependent on the filename #670

4.0.3

  • Fix Manifest#find yielding from a Promise causing issue on Ruby 3.1.0-dev. #720
  • Better detect the ERB version to avoid deprecation warnings. #719
  • Allow assets already fingerprinted to be served through Sprockets::Server
  • Do not fingerprint files that already contain a valid digest in their name
  • Remove remaining support for Ruby < 2.4.#672

4.0.2

  • Fix etag and digest path compilation that were generating string with invalid digest since 4.0.1.

4.0.1

  • Fix for Ruby 2.7 keyword arguments warning in base.rb. #660
  • Fix for when x_sprockets_linecount is missing from a source map.

... (truncated)

Commits
  • 4dff018 Release 4.2.2
  • 2fe13f2 Merge pull request #812 from yahonda/uri_rfc3986_parser_escape_and_unescape_a...
  • 19b056c Merge pull request #813 from yahonda/add_logger
  • ceac1ce Merge pull request #811 from yahonda/bump_rake
  • e87e7c6 Add logger as dependency to address warnings against Ruby 3.4.0dev
  • 9386ae4 Address warning: URI::RFC3986_PARSER warnings against ruby 3.4.0dev
  • 8b47cd5 Bump rake version 13 or higher to suppress ostruct warnings
  • 37b8468 Merge pull request #799 from m-nakamura145/update-ci-matrix
  • e4686d5 Merge pull request #810 from tricknotes/drop-base64
  • b8eaeef Drop base64 gem from dependency
  • Additional commits viewable in compare view

Updates rack from 2.2.10 to 3.1.15

Release notes

Sourced from rack's releases.

v3.0.9.1

What's Changed

Full Changelog: rack/rack@v3.0.9...v3.0.9.1

v3.0.9

What's Changed

  • Fix content-length calcuation in Rack:Response#write #2150

Full Changelog: rack/rack@v3.0.8...v3.0.9

v3.0.8

What's Changed

New Contributors

Full Changelog: rack/rack@v3.0.7...v3.0.8

v3.0.7

What's Changed

Full Changelog: rack/rack@v3.0.6.1...v3.0.7

v3.0.6.1

No release notes provided.

v3.0.4.1

Full Changelog: rack/rack@v3.0.4...v3.0.4.1

v3.0.4

Full Changelog: rack/rack@v3.0.3...v3.0.4

v3.0.3

What's Changed

Full Changelog: rack/rack@v3.0.2...v3.0.3

v3.0.2

Full Changelog: rack/rack@v3.0.1...v3.0.2

Changelog

Sourced from rack's changelog.

[3.1.15] - 2025-05-18

[3.1.14] - 2025-05-06

Security

  • CVE-2025-46727 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion.

[3.1.13] - 2025-04-13

[3.1.12] - 2025-03-11

Security

[3.1.11] - 2025-03-04

Security

[3.1.10] - 2025-02-12

Security

[3.1.9] - 2025-01-31

Fixed

[3.1.8] - 2024-10-14

Fixed

[3.1.7] - 2024-07-11

Fixed

  • Do not remove escaped opening/closing quotes for content-disposition filenames. (#2229, [@​jeremyevans])
  • Fix encoding setting for non-binary IO-like objects in MockRequest#env_for. (#2227, [@​jeremyevans])

... (truncated)

Commits

Updates omniauth from 1.9.2 to 2.1.3

Release notes

Sourced from omniauth's releases.

v2.1.3

What's Changed

New Contributors

Full Changelog: omniauth/omniauth@v2.1.2...v2.1.3

v2.1.2

What's Changed

New Contributors

Full Changelog: omniauth/omniauth@v2.1.1...v2.1.2

v2.1.1

What's Changed

New Contributors

Full Changelog: omniauth/omniauth@v2.1.0...v2.1.1

v2.1.0

This release adds Ruby 3.0+ support.

Due to kwarg changes in ruby 3, we have bumped the minimum required version of Rack to 2.2.3, which is where ruby3 support was added.

Releasing as a minor as dependency resolution should fail at install if an application is locked to a rack below new minimum.

... (truncated)

Commits
  • 78d4e1d Prepare for next release
  • e23567a Merge pull request #1134 from TastyPi/env-override
  • c2ebe5b Merge pull request #1136 from mame/avoid-uri-abs_uri
  • 35f69b1 Merge pull request #1137 from TastyPi/patch-1
  • 2d93b53 Exclude (macos, 2.5) from tests
  • 767a8b0 Avoid using URI::ABS_URI
  • 44c02d0 Delete session omniauth.origin even if unused
  • 2632419 Do not override omniauth.origin in environment in test mode
  • d014c0e Merge pull request #1128 from enomotodev/ruby-3.3
  • 0c8e471 Test against Ruby 3.3
  • Additional commits viewable in compare view

Updates omniauth-github from 1.4.0 to 2.0.1

Release notes

Sourced from omniauth-github's releases.

Require OmniAuth 2.0.0

As of v2.0.0 of this gem, it will require OmniAuth 2.0.0. This is due to changes that came with OmniAuth that required a breaking change in this gem. Because we changed the strategy's code, you should not need to change any omniauth-github specific code.

You should refer to OmniAuth's v2.0.0 release and/or the v2.0 upgrade guide when upgrading OmniAuth to v2.0.

Commits
  • 0ac46b5 Release 2.0.1
  • fa3e9cf Merge pull request #102 from jessieay/master
  • 684a74a Upgrade omniauth-oauth2 dependency
  • 1633cbb Merge pull request #100 from petergoldstein/feature/add_modern_rubies
  • 23cfa75 Add Ruby 2.7, 3.0, and 3.1 to the CI matrix
  • d2d9e01 Merge pull request #96 from gogainda/patch-1
  • 4ac10c7 Update ruby.yml
  • f4e28d9 Update ruby.yml
  • 027b861 Update ruby.yml
  • 1f77226 Merge pull request #95 from BobbyMcWho/chores-2020-01-12
  • Additional commits viewable in compare view

Updates omniauth-oauth2 from 1.7.3 to 1.8.0

Release notes

Sourced from omniauth-oauth2's releases.

v1.8.0

v1.8.0

  • Relaxes allowed versions of the oauth2 gem. #146
  • Requires omniauth ~> 2.0 #152
Changelog

Sourced from omniauth-oauth2's changelog.

v1.8.0

  • Relaxes allowed versions of the oauth2 gem. #146
  • Requires omniauth ~> 2.0 #152

Please see https://github.com/omniauth/omniauth-oauth2/releases for changelog prior to 1.8.0

Commits

Updates omniauth-google-oauth2 from 0.8.2 to 1.2.1

Release notes

Sourced from omniauth-google-oauth2's releases.

Release v1.2.1

Added

Deprecated

  • Nothing.

Removed

  • Support for jwt < 2.9.2.

Fixed

  • Nothing.

Release v1.2.0

Added

  • jwt 2.9.0 support for their updated claims code.
  • 'smart' image resizing option.

Deprecated

  • Nothing.

Removed

  • Ruby 2.3 and 2.4 support.
  • Support for jwt < 2.9.0.

Fixed

  • Fixed image sizing code.
  • Rubocop configuration updates.

Release v1.1.3

Added

Deprecated

  • Nothing.

Removed

  • Nothing.

Fixed

  • Documentation typos.
  • Rubocop configuration updates.

Release v1.1.2

Added

  • Add support for enable_granular_consent option (#455)

Deprecated

  • Nothing.

... (truncated)

Changelog

Sourced from omniauth-google-oauth2's changelog.

1.2.1 - 2025-01-18

Added

Deprecated

  • Nothing.

Removed

  • Support for jwt < 2.9.2.

Fixed

  • Nothing.

1.2.0 - 2024-09-15

Added

  • jwt 2.9.0 support for their updated claims code.

Deprecated

  • Nothing.

Removed

  • Ruby 2.3 and 2.4 support.
  • Support for jwt < 2.9.0.

Fixed

  • Fixed image sizing code.
  • Rubocop configuration updates.

1.1.3 - 2024-08-29

Added

  • Updated to use POST instead of GET for tokeninfo endpoint.

Deprecated

  • Nothing.

Removed

  • Nothing.

Fixed

  • Documentation typos.
  • Rubocop configuration updates.

1.1.2 - 2024-03-28

Added

  • Add support for enable_granular_consent option (#455)

... (truncated)

Commits

Updates pry-byebug from 3.10.1 to 3.11.0

Release notes

Sourced from pry-byebug's releases.

3.11.0

Added

  • Byebug 12 compatibility, with Ruby 3.1, 3.2, and 3.3 support (#434).
  • Support for pry 0.15 (#428).

Removed

  • Support for Ruby 2.7, and 3.0. Pry-byebug no longer installs on these platforms (#433).
Changelog

Sourced from pry-byebug's changelog.

3.11.0 (2025-03-28)

Added

  • Byebug 12 compatibility, with Ruby 3.1, 3.2, and 3.3 support (#434).
  • Support for pry 0.15 (#428).

Removed

  • Support for Ruby 2.7, and 3.0. Pry-byebug no longer installs on these platforms (#433).
Commits
  • 458c74b Merge pull request #437 from deivid-rodriguez/release/3.11.0
  • 9c71dba Merge pull request #442 from deivid-rodriguez/tweak-ci-config
  • c9f94d8 Use stable job names
  • b631339 Use default Bundler flags
  • 6f1ba74 Bump tested rubies (#441)
  • 1e33f9a Bump actions/checkout from 2 to 4 (#440)
  • e362d32 Merge pull request #439 from deivid-rodriguez/dependabot-tweaks
  • e3a4656 Let Dependabot upgrade github actions
  • 0fdb262 Switch Dependabot frequency to monthly
  • 5250d97 Fix RuboCop warnings (#438)
  • Additional commits viewable in compare view

Updates sidekiq from 6.5.12 to 7.3.9

Changelog

Sourced from sidekiq's changelog.

7.3.9

  • Only require activejob if necessary #6584 You might get uninitialized constant Sidekiq::ActiveJob if you require 'sidekiq' before require 'rails'.
  • Fix iterable job cancellation #6589
  • Web UI accessibility improvements #6604

7.3.8

  • Fix dead tag links #6554
  • Massive Web UI performance improvement, some pages up to 15x faster #6555

7.3.7

  • Backport Sidekiq::Web.configure for compatibility with 8.0 #6532
  • Backport url_params(key) and route_params(key) for compatibility with 8.0 #6532
  • Various fixes for UI filtering #6508
  • Tune inspect for internal S::Components to keep size managable #6553

7.3.6

  • Forward compatibility fixes for Ruby 3.4
  • Filtering in the Web UI now works via GET so you can bookmark a filtered view. #6497

7.3.5

  • Reimplement retry_all and kill_all API methods to use ZPOPMIN, approximately 30-60% faster. #6481
  • Add preload testing binary at examples/testing/sidekiq_boot to verify your Rails app boots correctly with Sidekiq Enterprise's app preloading.
  • Fix circular require with ActiveJob adapter #6477
  • Fix potential race condition leading to incorrect serialized values for CurrentAttributes #6475
  • Restore missing elapsed time when default job logging is disabled

7.3.4

  • Fix FrozenError when starting Sidekiq #6470

7.3.3

... (truncated)

Commits

Updates byebug from 11.1.3 to 12.0.0

Release notes

Sourced from byebug's releases.

12.0.0

Changed

  • #690: break without any arguments now sets a breakpoint on the current line, just like gdb ([@​sergioro9].

Fixed

  • #741: Small consistency issues in help messages.
  • #743: untracevar command crashing when giving a non existent global variable.
  • #744: Another punctuation tweak in enable breakpoints help message.
  • #736: Skip warning about $SAFE global variable on ruby 2.7 when listing global variables.

Added

Removed

  • Support for MRI 2.4, 2.5, 2.6, 2.7, and 3.0. Byebug no longer installs on this platform.

... (truncated)

Changelog

Sourced from byebug's changelog.

[12.0.0] - 2025-03-25

Changed

  • #690: break without any arguments now sets a breakpoint on the current line, just like gdb ([@​sergioro9].

Fixed

  • #741: Small consistency issues in help messages.
  • #743: untracevar command crashing when giving a non existent global variable.
  • #744: Another punctuation tweak in enable breakpoints help message.
  • #736: Skip warning about $SAFE global variable on ruby 2.7 when listing global variables.

Added

Removed

  • Support for MRI 2.4, 2.5, 2.6, 2.7, and 3.0. Byebug no longer installs on this platform.
Commits
  • d17f48b Merge pull request #855 from deivid-rodriguez/release/12.0.0
  • 3103035 Get ready for 12.0.0 release
  • a5f7249 Merge pull request #850 from deivid-rodriguez/updates
  • 625e212 Upgrade rubocop related gems and fix new offenses
  • 5493f3e Add official support for Ruby 3.1, 3.2, and 3.3
  • 10893e6 Remove unnecessary cache action from Windows workflow
  • b6eeffb Add faraday-retry to fix test warnings
  • 98259a5 Bump pry to 0.15.2
  • 1f6ab2e Bump yard to 0.9.37
  • 3e4162e bundle update rake
  • Additional commits viewable in compare view

Updates sassc-embedded from 1.77.7 to 1.80.4

Commits
  • ec41a44 v1.80.4
  • 39d8f5b Convert nil to sass null instead of empty sass string
  • daa94a2 Use short style name as default
  • 1b81694 Eagerly convert syntax to symbol
  • a4cacf9 Encode sourcemap with template encoding like sassc
  • d9fb607 Use JSON.fast_generate on structure known to be safe
  • beb8ab5 Update release.yml
  • 03730a9 v1.80.3
  • Description has been truncated

    Note
    Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

…h-github, omniauth-oauth2, omniauth-google-oauth2, pry-byebug, sidekiq, byebug, sassc-embedded and rqrcode

Bumps [rack-protection](https://github.com/sinatra/sinatra), [sprockets](https://github.com/rails/sprockets), [rack](https://github.com/rack/rack), [omniauth](https://github.com/omniauth/omniauth), [omniauth-github](https://github.com/intridea/omniauth-github), [omniauth-oauth2](https://github.com/omniauth/omniauth-oauth2), [omniauth-google-oauth2](https://github.com/zquestz/omniauth-google-oauth2), [pry-byebug](https://github.com/deivid-rodriguez/pry-byebug), [sidekiq](https://github.com/sidekiq/sidekiq), [byebug](https://github.com/deivid-rodriguez/byebug), [sassc-embedded](https://github.com/sass-contrib/sassc-embedded-shim-ruby) and [rqrcode](https://github.com/whomwah/rqrcode). These dependencies needed to be updated together.

Updates `rack-protection` from 3.2.0 to 4.1.1
- [Changelog](https://github.com/sinatra/sinatra/blob/main/CHANGELOG.md)
- [Commits](sinatra/sinatra@v3.2.0...v4.1.1)

Updates `sprockets` from 3.7.5 to 4.2.2
- [Release notes](https://github.com/rails/sprockets/releases)
- [Changelog](https://github.com/rails/sprockets/blob/main/CHANGELOG.md)
- [Commits](rails/sprockets@v3.7.5...v4.2.2)

Updates `rack` from 2.2.10 to 3.1.15
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v2.2.10...v3.1.15)

Updates `omniauth` from 1.9.2 to 2.1.3
- [Release notes](https://github.com/omniauth/omniauth/releases)
- [Commits](omniauth/omniauth@v1.9.2...v2.1.3)

Updates `omniauth-github` from 1.4.0 to 2.0.1
- [Release notes](https://github.com/intridea/omniauth-github/releases)
- [Commits](omniauth/omniauth-github@v1.4.0...v2.0.1)

Updates `omniauth-oauth2` from 1.7.3 to 1.8.0
- [Release notes](https://github.com/omniauth/omniauth-oauth2/releases)
- [Changelog](https://github.com/omniauth/omniauth-oauth2/blob/master/CHANGELOG.md)
- [Commits](omniauth/omniauth-oauth2@v1.7.3...v1.8.0)

Updates `omniauth-google-oauth2` from 0.8.2 to 1.2.1
- [Release notes](https://github.com/zquestz/omniauth-google-oauth2/releases)
- [Changelog](https://github.com/zquestz/omniauth-google-oauth2/blob/master/CHANGELOG.md)
- [Commits](zquestz/omniauth-google-oauth2@v0.8.2...v1.2.1)

Updates `pry-byebug` from 3.10.1 to 3.11.0
- [Release notes](https://github.com/deivid-rodriguez/pry-byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/pry-byebug/blob/master/CHANGELOG.md)
- [Commits](deivid-rodriguez/pry-byebug@v3.10.1...v3.11.0)

Updates `sidekiq` from 6.5.12 to 7.3.9
- [Changelog](https://github.com/sidekiq/sidekiq/blob/main/Changes.md)
- [Commits](sidekiq/sidekiq@v6.5.12...v7.3.9)

Updates `byebug` from 11.1.3 to 12.0.0
- [Release notes](https://github.com/deivid-rodriguez/byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/byebug/blob/master/CHANGELOG.md)
- [Commits](deivid-rodriguez/byebug@v11.1.3...v12.0.0)

Updates `sassc-embedded` from 1.77.7 to 1.80.4
- [Commits](sass-contrib/sassc-embedded-shim-ruby@v1.77.7...v1.80.4)

Updates `rqrcode` from 2.2.0 to 3.1.0
- [Release notes](https://github.com/whomwah/rqrcode/releases)
- [Changelog](https://github.com/whomwah/rqrcode/blob/main/CHANGELOG.md)
- [Commits](whomwah/rqrcode@v2.2.0...v3.1.0)

---
updated-dependencies:
- dependency-name: rack-protection
  dependency-version: 4.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: sprockets
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: rack
  dependency-version: 3.1.15
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: omniauth
  dependency-version: 2.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: omniauth-github
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: omniauth-oauth2
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: omniauth-google-oauth2
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: pry-byebug
  dependency-version: 3.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: sidekiq
  dependency-version: 7.3.9
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: byebug
  dependency-version: 12.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
- dependency-name: sassc-embedded
  dependency-version: 1.80.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: rqrcode
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels May 28, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant