Skip to content

chore(deps): update all non-major bundler dependencies#1226

Open
renovate[bot] wants to merge 1 commit intostagingfrom
renovate/all-minor-patch-bundler
Open

chore(deps): update all non-major bundler dependencies#1226
renovate[bot] wants to merge 1 commit intostagingfrom
renovate/all-minor-patch-bundler

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Feb 2, 2026 •
edited
Loading

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
bootsnap '~> 1.21.1' → '~> 1.23.0' age confidence
brakeman (source, changelog) '~> 8.0.1' → '~> 8.0.4' age confidence
bullet (changelog) '~> 8.1' → '~> 8.1', '>= 8.1.1' age confidence
database_consistency '~> 2.1.1' → '~> 2.1.3' age confidence
devise-i18n (changelog) '~>1.15.0' → '~>1.16.0' age confidence
faker (changelog) '~> 3.6.0' → '~> 3.8.0' age confidence
grover '~> 1.2.6' → '~> 1.2.10' age confidence
mollie-api-ruby (changelog) '~> 4.18.0' → '~> 4.19.0' age confidence
net-imap (changelog) '~> 0.6.2' → '~> 0.6.4' age confidence
rails (source, changelog) '~> 7.2.3' → '~> 7.2.3', '>= 7.2.3.1' age confidence
rspec-rails (changelog) '~> 8.0.2' → '~> 8.0.4' age confidence
rubocop (source, changelog) '~> 1.84.0' → '~> 1.86.1' age confidence
sentry-rails (source, changelog) '~> 6.3' → '~> 6.5' age confidence
sentry-ruby (source, changelog) '~> 6.3' → '~> 6.5' age confidence
sentry-sidekiq (source, changelog) '~> 6.3' → '~> 6.5' age confidence
sidekiq (source, changelog) '~> 8.0.10' → '~> 8.1.3' age confidence
sidekiq-scheduler (source) '~> 6.0.1' → '~> 6.0.2' age confidence
spring (changelog) '~> 4.4.0' → '~> 4.4.2' age confidence
timecop '~> 0.9.10' → '~> 0.9.11' age confidence
web-console '~> 4.2.1' → '~> 4.3.0' age confidence

Release Notes

presidentbeef/brakeman (brakeman)

v8.0.4

Compare Source

  • Load 'date' library for --ensure-latest

v8.0.3

Compare Source

  • Fix polymorphic_name SQLi false positive (Fredrico Franco)
  • Fix logger behavior when loading config files
  • Handle application names with module prefixes
  • Add release age option for --ensure-latest

v8.0.2

Compare Source

  • Reline console control should use stderr
  • Fix logger cleanup based method (Imran Iqbal)
flyerhzm/bullet (bullet)

v8.1.1

Compare Source

  • Fix ActiveRecord 8.1 patch-level method signature compatibility; test against Rails 8.1.3.
  • Handle string associations in safelist for Action Text
  • Enhance N+1 query detection by including caller stack in association calls
  • Update external links in README.md
djezzzl/database_consistency (database_consistency)

v2.1.3

Compare Source

  • Fix MissingDependentDestroyChecker to support composite keys. Thanks Andy Allan for reporting this!

v2.1.2

Compare Source

  • Fix ForeignKeyTypeChecker to support composite keys. Thanks Quentin de Metz for reporting this!
  • Fix MissingUniqueIndexChecker to support composite keys. Thanks Andy Allan for reporting this!
devise-i18n/devise-i18n (devise-i18n)

v1.16.0

Compare Source

  • Added Ruby 4.0 to test matrix.
  • Added compatibility with Devise 5.0.
  • Updated views for Devise 5.0. Any views generated into your app prior to this release of devise-i18n should continue to work. Changes from Devise are:
  • Updated one English string for Devise 5.0: heartcombo/devise@41003bf. Translations of this string are unaffected.
  • Dropped compatibility for Devise < 5.0.
faker-ruby/faker (faker)

v3.8.0

Compare Source

Enabling lazy load

This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.

Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:

1 - Set lazy load as a Faker Config

Faker::Config.lazy_loading = true

2 - Set lazy load as an environment variable

FAKER_LAZY_LOAD = 1

We hope you get to see the improvement by enabling it. Please file a bug report for any issues!

Thanks to @​jeremyevans for the mentoring, and to @​thdaraujo for pairing and code reviews.

Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0

v3.7.1

Compare Source

Enabling lazy load

This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.

Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:

1 - Set lazy load as a Faker Config

Faker::Config.lazy_loading = true

2 - Set lazy load as an environment variable

FAKER_LAZY_LOAD = 1

We hope you get to see the improvement by enabling it. Please file a bug report for any issues!

Thanks to @​jeremyevans for the mentoring, and to @​thdaraujo for pairing and code reviews.

Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0

v3.6.1

Compare Source

It's almost Spring time in the Northern hemisphere 🌸

Security, performance improvements and bug fixes
Update development dependencies
New Contributors

Full Changelog: faker-ruby/faker@v3.6.0...v3.6.1

Studiosity/grover (grover)

v1.2.10

Compare Source

Fixed
  • #​305 Fix session isolation for remote browser WebSocket connections ([@​wooly][])

v1.2.9

Compare Source

Added

v1.2.8

Compare Source

Added

v1.2.7

Compare Source

Added
mollie/mollie-api-ruby (mollie-api-ruby)

v4.19.0

Compare Source

ruby/net-imap (net-imap)

v0.6.4

Compare Source

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

[!WARNING]
#​664 fixes a STARTTLS stripping vulnerability. Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

[!IMPORTANT]
Argument validation is significantly improved. Several command injection vulnerabilities have been fixed:
#​657 fixes a CRLF/command/argument injection vulnerability for Symbol arguments.
#​658 fixes a CRLF/command/argument injection vulnerability for the attr argument to #store/#uid_store.
#​659 fixes a CRLF/command/argument injection vulnerability for the storage_limit argument to #setquota.
#​660 fixes a CRLF/command injection vulnerability for RawData, which is used by:

  • #search and #uid_search send criteria as raw data, when it is a String
  • #fetch and #uid_fetch send attr as raw data, when it is a String.
    When attr is an Array, its String members are sent as raw data.

[!CAUTION]
RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

[!NOTE]
Two denial of service vectors have been addressed.
These are relevant when connecting to an untrusted hostile server (or without TLS).

#​642 fixes quadratic time complexity when reading large responses containing many string literals.
#​654 adds a configurable max_iterations count for SCRAM-* authentication.

The default ScramAuthenticator#max_iterations is 2**31 - 1 (max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.

Breaking Changes
  • ⚡ ResponseReader memoizes Config#max_response_size in #​642.
    Changes to #max_response_size now take effect once per response, not on every IO#read.
    NOTE: It is not expected that this will affect any current usage. See the PR for details.
Added
Fixed
Documentation
Other Changes
Miscellaneous

New Contributors

Full Changelog: ruby/net-imap@v0.6.3...v0.6.4

v0.6.3

Compare Source

What's Changed

Added
  • 🥅 Add parser state and #detailed_message to ResponseParseError by @​nevans in #​599
    • 🥅💄 Support (monochrome) highlights in parse error details by @​nevans in #​603
    • 🥅💄 Auto-highlight parse error detailed_message using TERM and FORCE_COLOR by @​nevans in #​607
    • 🥅💄 Add color highlights to parse error details (default honors NO_COLOR) by @​nevans in #​609
  • 🔧 Add Config#overrides? (opposite of #inherited?) by @​nevans in #​610
  • 🔧 Add recursive Config#inherits_defaults? by @​nevans in #​611
Fixed
Other Changes

Fixes for unreleased code:

Miscellaneous

Full Changelog: ruby/net-imap@v0.6.2...v0.6.3

rails/rails (rails)

v7.2.3.1: 7.2.3.1

Compare Source

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Filter user supplied metadata in DirectUploadController

    [CVE-2026-33173]

    Jean Boussier

  • Configurable maxmimum streaming chunk size

    Makes sure that byte ranges for blobs don't exceed 100mb by default.
    Content ranges that are too big can result in denial of service.

    [CVE-2026-33174]

    Gannon McGibbon

  • Limit range requests to a single range

    [CVE-2026-33658]

    Jean Boussier

  • Prevent path traversal in DiskService.

    DiskService#path_for now raises an InvalidKeyError when passed keys with dot segments (".",
    ".."), or if the resolved path is outside the storage root directory.

    #path_for also now consistently raises InvalidKeyError if the key is invalid in any way, for
    example containing null bytes or having an incompatible encoding. Previously, the exception
    raised may have been ArgumentError or Encoding::CompatibilityError.

    DiskController now explicitly rescues InvalidKeyError with appropriate HTTP status codes.

    [CVE-2026-33195]

    Mike Dalessio

  • Prevent glob injection in DiskService#delete_prefixed.

    Escape glob metacharacters in the resolved path before passing to Dir.glob.

    Note that this change breaks any existing code that is relying on delete_prefixed to expand
    glob metacharacters. This change presumes that is unintended behavior (as other storage services
    do not respect these metacharacters).

    [CVE-2026-33202]

    Mike Dalessio

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

Guides

  • No changes.
rspec/rspec-rails (rspec-rails)

v8.0.4

Compare Source

Full Changelog

Released to relax version constraint for rspec to allow 4.0.0.beta1.

v8.0.3

Compare Source

Full Changelog

Bug Fixes:

  • Fix insertion order of controller prefix in the view lookup_context. (Stephen Nelson, #​2749)
  • Ensure rails stats looks for specs using application root rather than working directory.
    (Marvin Tangpos, #​2879)
rubocop/rubocop (rubocop)

v1.86.1

Compare Source

Bug fixes
  • #​11051: Fix Style/AccessModifierDeclarations inline autocorrect dropping comments between the access modifier and the following method definition. ([@​dduugg][])
  • #​14665: Cache plugin integration in CopHelper to avoid repeated loading. ([@​55728][])
  • #​15091: Fix Lint/DuplicateMethods false positives for anonymous classes in constant assignments and method return values. ([@​eugeneius][])
  • #​15055: Fix Lint/DuplicateMethods false positives with anonymous classes inside blocks (e.g. RSpec let, describe). ([@​ShkumbinDelija][])
  • #​15035: Exclude included_modules from Style/ModuleMemberExistenceCheck. ([@​koic][])
  • #​15087: Fix false positive for Style/RedundantLineContinuation when using interpolated string literals. ([@​koic][])
  • #​14361: Fix false positive in file_to_include? when a relative Include pattern matches a parent directory name in the absolute file path. ([@​jonas054][])
  • #​15090: Fix false positives for Layout/EmptyLineAfterGuardClause when consecutive guard clauses use and return. ([@​eugeneius][])
  • #​15070: Fix false positive for Lint/RedundantSafeNavigation when chained safe navigation is used in a conditional expression with InferNonNilReceiver enabled. ([@​koic][])
  • #​15074: Fix false positives in Style/RedundantParentheses when using parentheses around an endless range in assignment. ([@​koic][])
  • #​15048: Fix issue where the url_for is missing for Cops without instance methods. ([@​Fryguy][])
  • #​15051: Fix Style/RedundantParentheses handling of beginless ranges. ([@​oggy][])
  • #​14980: Fix Lint/Syntax zero-length diagnostic range for syntax errors at EOF. ([@​55728][])
  • #​15084: Handle heredocs with methods calls correctly when fixing guard clauses. ([@​G-Rath][])
  • #​11398: Fix incorrect Include path adjustment when local config overrides an inherited Include. ([@​jonas054][])
  • #​15092: Fix Layout/EndAlignment cop error on an empty begin. ([@​viralpraxis][])
  • #​15059: Fix an error in Layout/LineLength when SplitStrings option is enabled and __FILE__ is used. ([@​jeromedalbert][])
  • #​5876: Fix Lint/UnusedMethodArgument false positive when block argument is used via yield. ([@​dduugg][])
  • #​15093: Return tool execution errors instead of protocol errors in MCP server. ([@​koic][])
Changes

v1.86.0

Compare Source

New features
Bug fixes
  • #​15015: Fix Style/ConcatArrayLiterals autocorrect deleting code for percent literals with interpolation. ([@​bbatsov][])
  • #​14897: Detect constant reassignment after class/module definition in Lint/ConstantReassignment. ([@​ydakuka][])
  • #​11829: Fix false negatives for Lint/DuplicateMethods when duplicate methods are defined in anonymous classes and modules not assigned to a constant. ([@​Darhazer][])
  • #​14988: Fix false negative in Style/RedundantParentheses when redundant parentheses around range literals in block body. ([@​koic][])
  • #​14916: Fix false positive for Layout/MultilineMethodCallIndentation when method chain is inside a hash pair value passed to a multiline chained method call. ([@​ydakuka][])
  • #​15010: Fix a false positive for Lint/DuplicateMethods when modules blocks are passed as method arguments. ([@​5hun-s][])
  • #​15028: Fix a false positive for Lint/DuplicateMethods when the same method is defined in different anonymous module blocks passed to a no-receiver call (e.g. stub_const). ([@​Darhazer][])
  • #​15021: Fix false positives in Layout/EmptyLineAfterGuardClause when using a guard clause followed by a multi-line guard clause with raise, fail, return, break, or next. ([@​koic][])
  • #​15001: Fix false positives in Layout/RedundantLineBreak when setting InspectBlocks: true and using rescue or ensure in the block. ([@​koic][])
  • #​14997: Fix false positives in Style/FileOpen when assigning File.open to an instance variable, class variable, global variable, or constant. ([@​koic][])
  • #​15019: Fix false positives in Lint/DuplicateMethods when the same method is defined in anonymous module blocks passed to different receivers. ([@​koic][])
  • #​14987: Complete ERB and Haml autocorrection in a single run. ([@​alpaca-tc][])
  • #​15039: Fix incorrect autocorrect in Style/IfWithSemicolon when return with value is in the else branch. ([@​koic][])
  • #​14930: Fix incorrect autocorrection for Style/IfUnlessModifier when multiple if/unless modifier forms are on the same line inside a collection. ([@​ydakuka][])
  • #​14985: Fix incorrect autocorrection in Lint/SafeNavigationChain when chaining a method call after safe navigation in the if branch of a ternary. ([@​koic][])
  • #​15009: Fix infinite loop in Layout/EndAlignment when end is followed by || or &&. ([@​koic][])
  • #​14981: Fix spurious warning "does not support Safe/SafeAutoCorrect parameter" when those parameters are set for cops that don't have them in their default configuration. ([@​dduugg][])
  • #​15043: Fix an error for Lint/UselessDefaultValueArgument when fetch without a receiver is inside a fetch block. ([@​koic][])
  • #​15034: Fix incorrect autocorrection in Style/IfWithSemicolon when using single-line unless / ; / end. ([@​koic][])
  • #​15015: Fix Style/NonNilCheck autocorrect for receivers containing spaces. ([@​bbatsov][])
  • #​15015: Fix Style/RaiseArgs to allow anonymous keyword forwarding (raise Ex.new(**)). ([@​bbatsov][])
  • #​14890: Fix a false positive for Lint/RedundantCopDisableDirective when a rubocop:disable comment is used to suppress Lint/EmptyWhen, Lint/EmptyConditionalBody, Lint/EmptyInPattern, or Style/SymbolProc. ([@​eugeneius][])
  • #​15015: Fix false negative in Style/RedundantPercentQ for %q strings with interpolation-like syntax. ([@​bbatsov][])
  • #​14984: Fix Style/AndOr adding unnecessary parentheses around return without arguments. ([@​eugeneius][])
  • #​14945: Support files with multiple modifiers in Lint/UselessConstantScoping. ([@​h-lame][])
  • #​15015: Fix Style/TrailingMethodEndStatement to detect singleton methods (def self.foo). ([@​bbatsov][])
  • #​10822: Don't store results in cache if there are warnings. ([@​jonas054][])
Changes
  • #​14718: Allow setting MaxFilesInCache to false to entirely disable cache pruning. ([@​byroot][])
  • #​14989: Make Lint/RedundantSafeNavigation aware of safe navigation in conditional true branch. ([@​koic][])
  • #​15041: Remove mcp gem from runtime dependencies. ([@​koic][])

v1.85.1

Compare Source

Bug fixes
  • #​14958: Fix false positives in Style/FileOpen when File.open is passed as an argument or returned from a method. ([@​sferik][])
  • #​14973: Fix Style/ReduceToHash false positive when accumulator is read in key/value. ([@​sferik][])
  • #​14964: Fix false positives in Style/RedundantParentheses when parenthesizing a range in a block body. ([@​koic][])
Changes

v1.85.0

Compare Source

New features
Bug fixes
  • #​14829: Allow classes without a superclass in Style/EmptyClassDefinition. ([@​koic][])
  • #​14873: Fix an error in Style/NegatedWhile when the last expression of an until condition is negated. ([@​koic][])
  • #​14827: Improve Style/EmptyClassDefinition message wording. ([@​bbatsov][])
  • #​14800: Fix false obsolete configuration error for extracted cops when loaded as plugins. ([@​bbatsov][])
  • #​14928: Fix a false positive for Lint/Void when nil is used in case branch. ([@​5hun-s][])
  • #​14857: Fix false positives in Style/IfUnlessModifier when modifier forms are used inside string interpolations. ([@​koic][])
  • #​8773: Fix false positives in Style/HashTransformKeys and Style/HashTransformValues. ([@​sferik][])
  • #​6963: Fix false positives in Lint/Void for each blocks where the return value may be meaningful (e.g., Enumerator#each). ([@​sferik][])
  • #​14931: Ignore directive comments inside comments. ([@​koic][])
  • #​14834: Fix Layout/IndentationWidth false positive for chained method blocks when EnforcedStyleAlignWith is start_of_line. (\

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Feb 2, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Feb 2, 2026

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

  • 🔍 Trigger a full review

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov
Copy link
Copy Markdown

codecov Bot commented Feb 2, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.59%. Comparing base (9e7b1d0) to head (4782a50).

Additional details and impacted files 
@@           Coverage Diff            @@
##           staging    #1226   +/-   ##
========================================
  Coverage    77.59%   77.59%           
========================================
  Files           54       54           
  Lines         1406     1406           
========================================
  Hits          1091     1091           
  Misses         315      315

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@renovate renovate Bot changed the title chore(deps): update dependency sidekiq to '~> 8.1.0' chore(deps): update all non-major bundler dependencies Feb 2, 2026
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 6 times, most recently from 798ae9a to 87d76d0 Compare February 7, 2026 04:51
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 9 times, most recently from 354ff24 to 5635ee4 Compare February 17, 2026 23:58
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 3 times, most recently from 4782a50 to 5ce8e84 Compare February 23, 2026 21:27
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Feb 23, 2026

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock
Writing lockfile to /tmp/renovate/repos/github/csvalpha/sofia/Gemfile.lock
Fetching gem metadata from https://rubygems.org/........
Resolving dependencies...

Could not find compatible versions

Because web-console >= 4.3.0 depends on railties >= 8.0.0
  and rails-i18n >= 7.0.1, < 8.0.0 depends on railties >= 6.0.0, < 8,
  web-console >= 4.3.0 is incompatible with rails-i18n >= 7.0.1, < 8.0.0.
So, because Gemfile depends on rails-i18n ~> 7.0.10
  and Gemfile depends on web-console ~> 4.3.0,
  version solving has failed.

@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 4 times, most recently from a2ffd1b to 17a6987 Compare March 2, 2026 14:54
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 3 times, most recently from 220dace to b2a9253 Compare March 9, 2026 09:47
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 4 times, most recently from 2c80ec3 to 6738ebb Compare March 17, 2026 21:12
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 5 times, most recently from 17a1876 to 699f3df Compare March 25, 2026 01:03
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 4 times, most recently from e039391 to b6e6914 Compare April 2, 2026 19:11
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 3 times, most recently from 001ee7b to a5ed3b2 Compare April 15, 2026 01:07
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch 4 times, most recently from ca69050 to 7df3d05 Compare April 23, 2026 06:05
@renovate renovate Bot force-pushed the renovate/all-minor-patch-bundler branch from 7df3d05 to b1c27d0 Compare April 23, 2026 21:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants