Bump the bundler group across 1 directory with 4 updates #193

dependabot · 2024-05-16T21:12:56Z

Bumps the bundler group with 3 updates in the / directory: puma, rack and rexml.

Updates puma from 6.3.1 to 6.4.2

Release notes

6.4.1

Bugfixes

DSL#warn_if_in_single_mode - fixup when workers set via CLI (#3256)

Fix idle-timeout not working in cluster mode (#3235, #3228, #3282, #3283)

Fix worker 0 timing out during phased restart (#3225, #2786)

context_builder.rb - require openssl if verify_mode != 'none' (#3179)

Make puma cluster process suitable as PID 1 (#3255)

Improve Puma::NullIO consistency with real IO (#3276)

extconf.rb - fixup to detect openssl info in Ruby build (#3271, #3266)

MiniSSL.java - set serialVersionUID, fix RaiseException deprecation (#3270)

dsl.rb - fix warn_if_in_single_mode when WEB_CONCURRENCY is set (#3265, #3264)

Maintenance

LOTS of test refactoring to make tests more stable and easier to write - thanks to @MSP-Greg!

Fix bug in tests re: TestPuma::HOST4 (#3254)

Dockerfile for minimal repros: use Ruby 3.2, expect bundler installed (#3245)

fix define_method calls, use Symbol parameter instead of String (#3293)

Docs

README.md - add the puma-acme plugin (#3301)

Remove --keep-file-descriptors flag from systemd docs (#3248)

Note symlink mechanism in restart documentation for hot restart (#3298)

6.4.0 - The Eagle of Durango

America is #1 in professional cycling, baby!

Features

on_thread_exit hook (#2920)

on_thread_start_hook (#3195)

Shutdown on idle (#3209, #2580)

New error message when control server port taken (#3204)

Refactor

Remove Forwardable dependency (#3191, #3190)

Update URLMap Regexp usage for Ruby v3.3 (#3165)

Bugfixes

Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. (#3174)

Fix using control server with IPv6 host (#3181)

control_cli.rb - add require_relative 'log_writer' (#3187)

Fix cases where fallback Rack response wasn't sent to the client (#3094)

Changelog

Sourced from puma's changelog.

6.4.2 / 2024-01-08

Security

Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

6.4.1 / 2024-01-03

Bugfixes

DSL#warn_if_in_single_mode - fixup when workers set via CLI (#3256)

Fix idle-timeout not working in cluster mode (#3235, #3228, #3282, #3283)

Fix worker 0 timing out during phased restart (#3225, #2786)

context_builder.rb - require openssl if verify_mode != 'none' (#3179)

Make puma cluster process suitable as PID 1 (#3255)

Improve Puma::NullIO consistency with real IO (#3276)

extconf.rb - fixup to detect openssl info in Ruby build (#3271, #3266)

MiniSSL.java - set serialVersionUID, fix RaiseException deprecation (#3270)

dsl.rb - fix warn_if_in_single_mode when WEB_CONCURRENCY is set (#3265, #3264)

Maintenance

LOTS of test refactoring to make tests more stable and easier to write - thanks to @MSP-Greg!

Fix bug in tests re: TestPuma::HOST4 (#3254)

Dockerfile for minimal repros: use Ruby 3.2, expect bundler installed (#3245)

fix define_method calls, use Symbol parameter instead of String (#3293)

Docs

README.md - add the puma-acme plugin (#3301)

Remove --keep-file-descriptors flag from systemd docs (#3248)

Note symlink mechanism in restart documentation for hot restart (#3298)

6.4.0 / 2023-09-21

Features

on_thread_exit hook (#2920)

on_thread_start_hook (#3195)

Shutdown on idle (#3209, #2580)

New error message when control server port taken (#3204)

Refactor

Remove Forwardable dependency (#3191, #3190)

Update URLMap Regexp usage for Ruby v3.3 (#3165)

Bugfixes

Bring the cert_pem: parameter into parity with the cert: parameter to ssl_bind. (#3174)

Fix using control server with IPv6 host (#3181)

control_cli.rb - add require_relative 'log_writer' (#3187)

Fix cases where fallback Rack response wasn't sent to the client (#3094)

Commits

5fc43d7 5.6.8 and 6.4.2
dfbba22 6.4.2
60d5ee3 Merge pull request from GHSA-c2f4-cvqm-65w2
a287025 6.4.1 version tick!
32a629d 6.4.1
7e17826 [Fix #3282] idle-timeout not waiting on all workers in cluster mode (#3283)
437142e README.md - add the puma-acme plugin (#3301)
e9125fa [CI] Change all workflow file extensions to '.yml' (#3300)
d49dec9 [CI] Add Ruby 3.3, use 'rubygems: latest' in tests.yaml MRI (#3299)
2d27225 Note symlink mechanism in restart documentation for hot restart (#3298)
Additional commits viewable in compare view

Updates rails from 7.0.8 to 0.9.5

Commits

11611c1 Raise LoadErrors separately
be80d46 Moved subclass reloading responsibilities to Dependencies
20b14e0 Comply to the new dependency reload system
ee662e9 New approach to reloading that uses remove_const on ARs and AOs as well as ACs
c37e8d3 Added methods for removing subclasses -- couldnt make it work with the regula...
1369623 Fixed the ordering of attributes in the xml-decleration of Builder #540 [woeye]
efa81da Added the option of supplying an array of ids and attributes to Base#update, ...
256b594 Fixed documentation #538
2f11b7c Added @request.raw_post as a convenience access to @request.env['RAW_POST_DAT...
fd67e3b The create and build methods are only available for has_one/belongs_to if an ...
Additional commits viewable in compare view

Updates rack from 2.2.8 to 2.2.9

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

Commits

b1deebd Bump patch version.
f7d40f9 Merge branch '2-2-sec' into 2-2-stable
e830011 bump version
d9c163a Avoid 2nd degree polynomial regexp in MediaType
6245768 Return an empty array when ranges are too large
e4c1177 Fixing ReDoS in header parsing
fdb12cb backport #2104 (#2121)
99057e6 Update CHANGELOG for 2.2.8 (#2107)
3314622 Adds missing 2.2.8 to CHANGELOG.md (#2106)
See full diff in compare view

Updates rexml from 3.2.6 to 3.2.8

Release notes

Sourced from rexml's releases.

REXML 3.2.8 - 2024-05-16

Fixes

Suppressed a warning

REXML 3.2.7 - 2024-05-16

Improvements

Improve parse performance by using StringScanner.

GH-106

GH-107

GH-108

GH-109

GH-112

GH-113

GH-114

GH-115

GH-116

GH-117

GH-118

GH-119

GH-121

Patch by NAITOH Jun.

Improved parse performance when an attribute has many <s.

GH-124

Fixes

XPath: Fixed a bug of normalize_space(array).

GH-110

GH-111

Patch by flatisland.

XPath: Fixed a bug that wrong position is used with nested path.

GH-110

GH-122

Reported by jcavalieri.

Patch by NAITOH Jun.

Fixed a bug that an exception message can't be generated for invalid encoding XML.

... (truncated)

Changelog

Sourced from rexml's changelog.

3.2.8 - 2024-05-16 {#version-3-2-8}

Fixes

Suppressed a warning

3.2.7 - 2024-05-16 {#version-3-2-7}

Improvements

Improve parse performance by using StringScanner.

GH-106

GH-107

GH-108

GH-109

GH-112

GH-113

GH-114

GH-115

GH-116

GH-117

GH-118

GH-119

GH-121

Patch by NAITOH Jun.

Improved parse performance when an attribute has many <s.

GH-124

Fixes

XPath: Fixed a bug of normalize_space(array).

GH-110

GH-111

Patch by flatisland.

XPath: Fixed a bug that wrong position is used with nested path.

GH-110

GH-122

Reported by jcavalieri.

Patch by NAITOH Jun.

Fixed a bug that an exception message can't be generated for

... (truncated)

Commits

1cf37ba Add 3.2.8 entry
b67081c Remove an unused variable (#128)
94e180e Suppress a warning
d574ba5 ci: install only gems required for running tests (#129)
4670f8f Add missing Thanks section
9ba35f9 Bump version
085def0 Add 3.2.7 entry
4325835 Read quoted attributes in chunks (#126)
e77365e Exclude older than 2.6 on macos-14
bf2c8ed Move development dependencies to Gemfile (#124)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 3 updates in the / directory: [puma](https://github.com/puma/puma), [rack](https://github.com/rack/rack) and [rexml](https://github.com/ruby/rexml). Updates `puma` from 6.3.1 to 6.4.2 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/master/History.md) - [Commits](puma/puma@v6.3.1...v6.4.2) Updates `rails` from 7.0.8 to 0.9.5 - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v7.0.8...v0.9.5) Updates `rack` from 2.2.8 to 2.2.9 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.8...v2.2.9) Updates `rexml` from 3.2.6 to 3.2.8 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.2.6...v3.2.8) --- updated-dependencies: - dependency-name: puma dependency-type: direct:production dependency-group: bundler - dependency-name: rails dependency-type: direct:development dependency-group: bundler - dependency-name: rack dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-type: indirect dependency-group: bundler ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label May 16, 2024

dependabot bot mentioned this pull request May 16, 2024

Bump the bundler group across 1 directory with 3 updates #192

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the bundler group across 1 directory with 4 updates #193

Bump the bundler group across 1 directory with 4 updates #193

dependabot bot commented on behalf of github May 16, 2024

Bump the bundler group across 1 directory with 4 updates #193

Are you sure you want to change the base?

Bump the bundler group across 1 directory with 4 updates #193

Conversation

dependabot bot commented on behalf of github May 16, 2024

6.4.1

6.4.0 - The Eagle of Durango

6.4.2 / 2024-01-08

6.4.1 / 2024-01-03

6.4.0 / 2023-09-21

v2.2.8.1

What's Changed

REXML 3.2.8 - 2024-05-16

Fixes

REXML 3.2.7 - 2024-05-16

Improvements

Fixes

3.2.8 - 2024-05-16 {#version-3-2-8}

Fixes

3.2.7 - 2024-05-16 {#version-3-2-7}

Improvements

Fixes