Skip to content

Bump the bundler group across 1 directory with 4 updates - #72

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-1d989cbcc9
Open

Bump the bundler group across 1 directory with 4 updates#72
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-1d989cbcc9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 4 updates in the / directory: concurrent-ruby, faraday, addressable and rack.

Updates concurrent-ruby from 1.3.1 to 1.3.7

Release notes

Sourced from concurrent-ruby's releases.

v1.3.7

There are 3 security fixes in this release, so updating is recommended. These security vulnerabilities are not very likely to be hit in practice and have a corresponding Low severity score.

What's Changed

New Contributors

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7

v1.3.6

What's Changed

New Contributors

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.5...v1.3.6

... (truncated)

Changelog

Sourced from concurrent-ruby's changelog.

Release v1.3.7 (16 June 2026)

concurrent-ruby:

Release v1.3.6 (13 December 2025)

concurrent-ruby:

Release v1.3.5, edge v0.7.2 (15 January 2025)

concurrent-ruby:

  • (#1062) Remove dependency on logger.

concurrent-ruby-edge:

  • (#1062) Remove dependency on logger.

Release v1.3.4 (10 August 2024)

  • (#1060) Fix bug with return value of Concurrent.available_processor_count when cpu.cfs_quota_us is -1.
  • (#1058) Add Concurrent.cpu_shares that is cgroups aware.

Release v1.3.3 (9 June 2024)

  • (#1053) Improve the speed of Concurrent.physical_processor_count on Windows.

Release v1.3.2, edge v0.7.1 (7 June 2024)

concurrent-ruby:

  • (#1051) Remove dependency on win32ole.

concurrent-ruby-edge:

  • (#1052) Fix dependency on concurrent-ruby to allow the latest release.
Commits
  • 4c8fc28 Release 1.3.7
  • d91ca94 Fix AtomicReference#update livelock when stored value is Float::NAN on JRuby ...
  • 7e4d711 Fix ReentrantReadWriteLock read hold overflow into write-lock bit
  • 6e37e06 Fix AtomicReference#update livelock when stored value is Float::NAN
  • 2825cfa Cleanup spec
  • 3fd4932 Fix ReadWriteLock wrong-thread write release and stray read release
  • 1974b47 Add Ruby 4.0 in CI
  • df8706d Add SECURITY.md (#1104)
  • 7a1b789 Bump actions/upload-pages-artifact from 4 to 5
  • 9b2dbf7 Bump actions/deploy-pages from 4 to 5
  • Additional commits viewable in compare view

Updates faraday from 2.14.1 to 2.14.3

Release notes

Sourced from faraday's releases.

v2.14.3

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.14.2...v2.14.3

v2.14.2

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.14.1...v2.14.2

Commits

Updates addressable from 2.8.6 to 2.9.0

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

  • fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Addressable 2.8.10

  • fixes ReDoS vulnerability in Addressable::Template#match

Addressable 2.8.9

  • Reduce gem size by excluding test files (#569)
  • No need for bundler as development dependency (#571, 5fc1d93)
  • idna/pure: stop building the useless COMPOSITION_TABLE (removes the Addressable::IDNA::COMPOSITION_TABLE constant) (#564)

#569: sporkmonger/addressable#569 #571: sporkmonger/addressable#571 #564: sporkmonger/addressable#564

Addressable 2.8.8

  • Replace the unicode.data blob by a ruby constant (#561)
  • Allow public_suffix 7 (#558)

#561: sporkmonger/addressable#561 #558: sporkmonger/addressable#558

Addressable 2.8.7

  • Allow public_suffix 6 (#535)

#535: sporkmonger/addressable#535

Commits
  • 0c3e858 Revving version and changelog
  • 91915c1 Fixing additional vulnerable paths
  • a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
  • 463a819 Regenerate gemspec on newer rubygems
  • 0afcb0b Improve from O(n^2) to O(n)
  • c87f768 Fix a ReDoS vulnerability in URI template matching
  • 0d7e9b2 Fix links for 2.8.9 in CHANGELOG (#573)
  • e209120 Update version, gemspec, and CHANGELOG for 2.8.9 (#572)
  • 3875874 Reduce gem size by excluding test files (#569)
  • 3e57cc6 CI: back to windows-2022 for MRI job
  • Additional commits viewable in compare view

Updates rack from 3.1.20 to 3.1.21

Changelog

Sourced from rack's changelog.

[3.1.21] - 2026-04-01

Security

  • CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
  • CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
  • CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.
  • CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
  • CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
  • CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
  • CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
  • CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.
  • CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
  • CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
  • CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.
  • CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters.
Commits
  • ae84311 Bump patch version.
  • 87961c3 Fix typo in test.
  • fd1c23d Add logger to gemfile.
  • c59d924 Fix test expectation.
  • 176f468 Add Ruby v4.0 to the test matrix.
  • 2856934 Drop EOL Rubies from external tests.
  • 17ce783 Limit the number of quoted escapes during multipart parsing
  • 367a2a0 Add Content-Length size check in Rack::Multipart::Parser
  • a17cb99 Fix root prefix bug in Rack::Static
  • 59a0966 Only do a simple substitution on the x-accel-mapping paths
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Aug 20, 2026
@dependabot
Bump the bundler group across 1 directory with 4 updates
eb73ab4 
Bumps the bundler group with 4 updates in the / directory: [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby), [faraday](https://github.com/lostisland/faraday), [addressable](https://github.com/sporkmonger/addressable) and [rack](https://github.com/rack/rack).


Updates `concurrent-ruby` from 1.3.1 to 1.3.7
- [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases)
- [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md)
- [Commits](ruby-concurrency/concurrent-ruby@v1.3.1...v1.3.7)

Updates `faraday` from 2.14.1 to 2.14.3
- [Release notes](https://github.com/lostisland/faraday/releases)
- [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md)
- [Commits](lostisland/faraday@v2.14.1...v2.14.3)

Updates `addressable` from 2.8.6 to 2.9.0
- [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md)
- [Commits](sporkmonger/addressable@addressable-2.8.6...addressable-2.9.0)

Updates `rack` from 3.1.20 to 3.1.21
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v3.1.20...v3.1.21)

---
updated-dependencies:
- dependency-name: addressable
  dependency-version: 2.9.0
  dependency-type: indirect
- dependency-name: concurrent-ruby
  dependency-version: 1.3.7
  dependency-type: direct:production
- dependency-name: faraday
  dependency-version: 2.14.3
  dependency-type: direct:production
- dependency-name: rack
  dependency-version: 3.1.21
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/bundler-1d989cbcc9 branch from 82c0ac0 to eb73ab4 Compare September 8, 2026 20:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants