Skip to content

Bump the bundler group across 1 directory with 5 updates#47

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-c35b3d207a
Open

Bump the bundler group across 1 directory with 5 updates#47
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-c35b3d207a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 3 updates in the / directory: sinatra, rexml and websocket-driver.

Updates sinatra from 4.0.0 to 4.2.0

Changelog

Sourced from sinatra's changelog.

4.2.0 / 2025-10-08

  • New: Add :static_headers setting for custom headers in static file responses (#2089)
  • Fix: Fix regex in etag_matches? to prevent ReDoS (#2121)
  • Fix: PATH_INFO can never be empty (#2114)
  • Fix: Fix malformed Content-Type headers (#2081)
  • Fix: Avoid crash for integer values in content_type parameters (#2078)

4.1.1 / 2024-11-20

  • Fix: Restore WEBrick support (#2067)

4.1.0 / 2024-11-18

  • New: Add host_authorization setting (#2053)
    • Defaults to .localhost, .test and any IP address in development mode.
    • Security: addresses CVE-2024-21510.
  • Fix: Return an instance of Sinatra::IndifferentHash when calling #except (#2044)
  • Fix: Address warning from URI for Ruby 3.4 (#2060)
  • Fix: rackup no longer depends on WEBrick, recommend Puma instead (4a558503)
  • Fix: Zeitwerk 2.7.0+ compatibility (#2050)
  • Fix: Address warning about Hash construction for Ruby 3.4 (#2028)
  • Fix: Declare missing dependencies for Ruby 3.5 (#2032)
  • Fix: Compatibility with --enable-frozen-string-literal (#2033)
  • Fix: Rack 3.1 compatibility (#2035)
    • Don't depend on Rack::Logger
    • Don't delete content-length header when Rack::Files is used

4.0.1 / 2025-05-24

  • Rack 3.1 compatibility (#2035)

  • Fix malformed Content-Type headers (#2081)

  • Avoid crash for integer values in content_type parameters (#2078)

  • Fix compatibility with --enable-frozen-string-literal (#2033)

  • Declare missing dependencies for Ruby 3.5 (#2032)

  • Fix warning about Hash construction. (#2028)

  • Support Zeitwerk 2.7.0+ (#2050)

  • Address URI depreciation (#2060)

#2035: sinatra/sinatra#2035 #2081: sinatra/sinatra#2081 #2078: sinatra/sinatra#2078 #2033: sinatra/sinatra#2033

... (truncated)

Commits

Updates rack from 3.1.7 to 3.2.6

Release notes

Sourced from rack's releases.

v3.2.6

Full Changelog: rack/rack@v3.2.5...v3.2.6

v3.2.4

No release notes provided.

Changelog

Sourced from rack's changelog.

[3.2.6] - 2026-04-01

Security

  • CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
  • CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
  • CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.
  • CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
  • CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
  • CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
  • CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
  • CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.
  • CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.
  • CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.
  • CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.
  • CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters.
  • CVE-2026-26962 Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.

[3.2.5] - 2026-02-16

Security

  • CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.
  • CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

Fixed

[3.2.4] - 2025-11-03

Fixed

  • Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)

[3.2.3] - 2025-10-10

Security

  • CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
  • CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.2.2] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

... (truncated)

Commits
  • e1f22fd Bump patch version.
  • 31989fd Fix typo in test.
  • d268165 Fix test expectation.
  • 8f425de Add Ruby v4.0 to the test matrix.
  • bf83042 Drop EOL Rubies from external tests.
  • d50c4d3 Implement OBS unfolding for multipart requests per RFC 5322 2.2.3
  • bfb6914 Limit the number of quoted escapes during multipart parsing
  • b3e5945 Add Content-Length size check in Rack::Multipart::Parser
  • 7a8f326 Fix root prefix bug in Rack::Static
  • a57bc14 Only do a simple substitution on the x-accel-mapping paths
  • Additional commits viewable in compare view

Updates rack-session from 2.0.0 to 2.1.2

Release notes

Sourced from rack-session's releases.

v2.1.2

  • CVE-2026-39324 Don't fall back to unencrypted coder if encryptors are present.

v2.1.1

Full Changelog: rack/rack-session@v2.1.0...v2.1.1

v2.1.0

Full Changelog: rack/rack-session@v2.0.0...v2.1.0

Changelog

Sourced from rack-session's changelog.

v2.1.2

  • CVE-2026-39324 Don't fall back to unencrypted coder if encryptors are present.

v2.1.1

  • Prevent Rack::Session::Pool from recreating deleted sessions CVE-2025-46336.

v2.1.0

  • Improved compatibility with Ruby 3.3+ and Rack 3+.
  • Add support for cookie option partitioned.
  • Introduce assume_ssl option to allow secure session cookies through insecure proxy.
Commits
  • 504367b Bump patch version.
  • f43638c Don't fall back to unencrypted coder if encryptors are present.
  • dadcfe6 Bump actions/checkout from 4 to 5 (#54)
  • 4eb9ea8 Add top level session spec to validate existing formats.
  • 8f94577 Add rails to external tests.
  • 38ea47d Allow the v2 encryptor to serialize messages with Marshal (#44)
  • 43f2e3a Fix compatibility with older Rubies.
  • 6a060b8 Support UTF-8 data when using the JSON serializer (#39)
  • 8ce0146 Fix auth_tag retrieval on JRuby (#32)
  • 7727185 Add AEAD encryption (#23)
  • Additional commits viewable in compare view

Updates rexml from 3.3.7 to 3.4.2

Release notes

Sourced from rexml's releases.

REXML 3.4.2 - 2025-08-26

Improvement

  • Improved performance.

  • Raise appropriate exception when failing to match start tag in DOCTYPE

  • Deprecate accepting array as an element in XPath.match, first and each

    • GH-252
    • Patch by tomoya ishida

  • Don't call needless encoding_updated

    • GH-259
    • Patch by Sutou Kouhei

  • Reuse XPath::match

  • Cache redundant calls for doctype

  • Use Safe Navigation (&.) from Ruby 2.3

  • Remove redundant return statements

  • Added XML declaration check & Source#skip_spaces method

    • GH-282
    • Patch by NAITOH Jun
    • Reported by Sofi Aberegg

Fixes

  • Fix docs typo
    • GH-248
    • Patch by James Coleman

... (truncated)

Changelog

Sourced from rexml's changelog.

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

  • Improved performance.

  • Raise appropriate exception when failing to match start tag in DOCTYPE

  • Deprecate accepting array as an element in XPath.match, first and each

    • GH-252
    • Patch by tomoya ishida

  • Don't call needless encoding_updated

    • GH-259
    • Patch by Sutou Kouhei

  • Reuse XPath::match

  • Cache redundant calls for doctype

  • Use Safe Navigation (&.) from Ruby 2.3

  • Remove redundant return statements

  • Added XML declaration check & Source#skip_spaces method

    • GH-282
    • Patch by NAITOH Jun
    • Reported by Sofi Aberegg

Fixes

  • Fix docs typo
    • GH-248
    • Patch by James Coleman

... (truncated)

Commits

Updates websocket-driver from 0.7.6 to 0.8.1

Changelog

Sourced from websocket-driver's changelog.

0.8.1 / 2026-06-04

  • Close a draft-75/76 connection if a length header grows to exceed the configured max length
  • Fail the connection if a message is larger than the configured max length after extension processing
  • Limit the total HTTP request line and headers size to 32K

0.8.0 / 2025-05-25

  • Emit binary message as a string with Encoding::BINARY instead of an array
  • Add the option :binary_data_format to force the previous behaviour

0.7.7 / 2025-01-04

  • Add base64 gem to the dependencies to support Ruby 3.4
Commits
  • 5cab908 Bump version to 0.8.1
  • 17b569f Limit the total HTTP request line and headers size to 32K
  • fa86417 Fail the connection if a message is larger than the configured max length aft...
  • d0141f0 Close a draft-75/76 connection if a length header grows to exceed the configu...
  • 1e4475e Test on Ruby 4.0
  • 2824edc Update release date for 0.8.0
  • befd449 Prefer text frames over binary; if the input is in some non-UTF-8 text encodi...
  • e3155f7 Bump version to 0.8.0
  • 22e0704 Default to text frames if the input buffer is specifically UTF8-encoded
  • 64ceaa4 Remove Ruby versions unsupported by GitHub
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the bundler group across 1 directory with 5 updates
d8ab7c7 
Bumps the bundler group with 3 updates in the / directory: [sinatra](https://github.com/sinatra/sinatra), [rexml](https://github.com/ruby/rexml) and [websocket-driver](https://github.com/faye/websocket-driver-ruby).


Updates `sinatra` from 4.0.0 to 4.2.0
- [Changelog](https://github.com/sinatra/sinatra/blob/main/CHANGELOG.md)
- [Commits](sinatra/sinatra@v4.0.0...v4.2.0)

Updates `rack` from 3.1.7 to 3.2.6
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v3.1.7...v3.2.6)

Updates `rack-session` from 2.0.0 to 2.1.2
- [Release notes](https://github.com/rack/rack-session/releases)
- [Changelog](https://github.com/rack/rack-session/blob/main/releases.md)
- [Commits](rack/rack-session@v2.0.0...v2.1.2)

Updates `rexml` from 3.3.7 to 3.4.2
- [Release notes](https://github.com/ruby/rexml/releases)
- [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md)
- [Commits](ruby/rexml@v3.3.7...v3.4.2)

Updates `websocket-driver` from 0.7.6 to 0.8.1
- [Changelog](https://github.com/faye/websocket-driver-ruby/blob/main/CHANGELOG.md)
- [Commits](faye/websocket-driver-ruby@0.7.6...0.8.1)

---
updated-dependencies:
- dependency-name: sinatra
  dependency-version: 4.2.0
  dependency-type: direct:development
  dependency-group: bundler
- dependency-name: rack
  dependency-version: 3.2.6
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: rack-session
  dependency-version: 2.1.2
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: rexml
  dependency-version: 3.4.2
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: websocket-driver
  dependency-version: 0.8.1
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Jul 16, 2026
This was referenced Jul 16, 2026
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants