Bump the bundler group with 2 updates

[dependabot]

Bumps the bundler group with 2 updates: i18n and tzinfo.

Updates i18n from 0.6.9 to 0.8.0

Release notes

Sourced from i18n's releases.

v0.8.0

This release is the same as the v0.8.0.beta1 gem.

Notable changes

• You can now set I18n.cache_key_digest to determine how cache keys are calculated. If you were seeing issues where the same value stored in a cache produced a different key, then this fix will interest you. For more information, see #285.
• You can now override translate_format in I18n::Backend classes to customize how localize will perform. See svenfuchs/i18n#347 for more details.
• You can now interpolate the value of a key inside another key. See #300 for more information.
• The exists? method was added to the fallback backend, to match other backend implementations - #326
• Added N_ to GetText::Helpers - #121
• Added a :default option for I18n.localize - #251

Bug fixes

• Reverted a commit which made it so that the great documentation for I18n.translate wasn't made visible through a yard documentation generation. - bc926ebf98a9ae8f2db843ce16a33a5282d18d35
• I18n.MissingTranslation.new can now be called with two arguments. It will no longer raise a "TypeError: can't dup NilClass" exception - #295
• I18n's Hash#slice method no longer fails if the hash does not have the specified key - #289
• I18n::Backend::Metadata will now no longer attempt to set @translation_metadata on frozen objects - #305
• Added missing many rule to pl translation rules - #346
• Calling I18n.t(:foo, default: nil) Or I18n.t(:foo, default: false) will now return nil or false, rather than returning a missing translation exception - #144
• Setting I18n.load_path via I18n.load_path= will now reset the @@available_locales_set setting. - #348 & #173
• The subclasses of Hash when calling Hash#slice are maintained - #250
• Fixed I18n.interpolate behaviour when it was passed an ActiveSupport::SafeBuffer object - #216

0.8.0.beta1

Notable changes

• You can now set I18n.cache_key_digest to determine how cache keys are calculated. If you were seeing issues where the same value stored in a cache produced a different key, then this fix will interest you. For more information, see #285.
• You can now override translate_format in I18n::Backend classes to customize how localize will perform. See svenfuchs/i18n#347 for more details.
• You can now interpolate the value of a key inside another key. See #300 for more information.
• The exists? method was added to the fallback backend, to match other backend implementations - #326
• Added N_ to GetText::Helpers - #121
• Added a :default option for I18n.localize - #251

Bug fixes

• Reverted a commit which made it so that the great documentation for I18n.translate wasn't made visible through a yard documentation generation. - bc926ebf98a9ae8f2db843ce16a33a5282d18d35
• I18n.MissingTranslation.new can now be called with two arguments. It will no longer raise a "TypeError: can't dup NilClass" exception - #295
• I18n's Hash#slice method no longer fails if the hash does not have the specified key - #289
• I18n::Backend::Metadata will now no longer attempt to set @translation_metadata on frozen objects - #305
• Added missing many rule to pl translation rules - #346
• Calling I18n.t(:foo, default: nil) Or I18n.t(:foo, default: false) will now return nil or false, rather than returning a missing translation exception - #144
• Setting I18n.load_path via I18n.load_path= will now reset the @@available_locales_set setting. - #348 & #173
• The subclasses of Hash when calling Hash#slice are maintained - #250
• Fixed I18n.interpolate behaviour when it was passed an ActiveSupport::SafeBuffer object - #216

Commits

• 529fc5b Bump to 0.8.0
• d5fb5dd fix references to i18n in Gemfiles
• 5cd5c9f Add link to i18n guide to README
• 27d7ab7 Remove Gemfile.lock from source control
• 4f0331d Bump dependencies
• 210feb6 Update bundler
• 7b205f2 Add issue template
• 6f3a5bb Bump to 0.8.0.beta1
• 5e1af91 Merge pull request #252 from Chipairon/fix-tests-for-stored-procs
• e532e61 Merge pull request #216 from bogdan/interpolate-rails-safe-buffer
• Additional commits viewable in compare view

Updates tzinfo from 1.2.1 to 1.2.10

Release notes

Sourced from tzinfo's releases.

v1.2.10

• Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
• Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v1.2.10 on RubyGems.org

v1.2.9

• Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

v1.2.8

• Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
• Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

v1.2.7

• Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
• Fixed warnings when running on Ruby 2.8. #112.

TZInfo v1.2.7 on RubyGems.org

v1.2.6

• Timezone#strftime('%s', time) will now return the correct number of seconds since the epoch. #91.
• Removed the unused TZInfo::RubyDataSource::REQUIRE_PATH constant.
• Fixed "SecurityError: Insecure operation - require" exceptions when loading data with recent Ruby releases in safe mode.
• Fixed warnings when running on Ruby 2.7. #106 and #111.

TZInfo v1.2.6 on RubyGems.org

v1.2.5

• Support recursively (deep) freezing Country and Timezone instances. #80.
• Allow negative daylight savings time offsets to be derived when reading from zoneinfo files. The utc_offset and std_offset are now derived correctly for Europe/Dublin in the 2018a and 2018b releases of the Time Zone Database.

TZInfo v1.2.5 on RubyGems.org

v1.2.4

• Ignore the leapseconds file that is included in zoneinfo directories installed with version 2017c and later of the Time Zone Database.

TZInfo v1.2.4 on RubyGems.org

v1.2.3

• Reduce the number of String objects allocated when loading zoneinfo files. #54.
• Make Timezone#friendly_identifier compatible with frozen string literals.
• Improve the algorithm for deriving the utc_offset from zoneinfo files. This now correctly handles Pacific/Apia switching from one side of the International Date Line to the other whilst observing daylight savings time. #66.
• Fix an UnknownTimezone exception when calling transitions_up_to or offsets_up_to on a TimezoneProxy instance obtained from Timezone.get_proxy.
• Allow the Factory zone to be obtained from the Zoneinfo data source.
• Ignore the /usr/share/zoneinfo/timeconfig symlink included in Slackware distributions. #64.

... (truncated)

Changelog

Sourced from tzinfo's changelog.

Version 1.2.11 - 28-Jan-2023

• Eliminate Object#untaint deprecation warnings on JRuby 9.4.0.0. #145.

Version 1.2.10 - 19-Jul-2022

• Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
• Ignore the SECURITY file from Arch Linux's tzdata package. #134.

Version 1.2.9 - 16-Dec-2020

• Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

Version 1.2.8 - 8-Nov-2020

• Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
• Rubinius is no longer supported.

Version 1.2.7 - 2-Apr-2020

• Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
• Fixed warnings when running on Ruby 2.8. #112.

Version 1.2.6 - 24-Dec-2019

• Timezone#strftime('%s', time) will now return the correct number of seconds since the epoch. #91.
• Removed the unused TZInfo::RubyDataSource::REQUIRE_PATH constant.
• Fixed "SecurityError: Insecure operation - require" exceptions when loading data with recent Ruby releases in safe mode.
• Fixed warnings when running on Ruby 2.7. #106 and #111.

Version 1.2.5 - 4-Feb-2018

... (truncated)

Commits

• 0814dcd Fix the release date.
• fd05e2a Preparing v1.2.10.
• b98c32e Merge branch 'fix-directory-traversal-1.2' into 1.2
• ac3ee68 Remove unnecessary escaping of + within regex character classes.
• 9d49bf9 Fix relative path loading tests.
• 394c381 Remove private_constant for consistency and compatibility.
• 5e9f990 Exclude Arch Linux's SECURITY file from the time zone index.
• 17fc9e1 Workaround for 'Permission denied - NUL' errors with JRuby on Windows.
• 6bd7a51 Update copyright years.
• 9905ca9 Fix directory traversal in Timezone.get when using Ruby data source
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.