Bump the bundler group across 1 directory with 7 updates by dependabot[bot] · Pull Request #2 · Pathsis/pathsis.github.io

dependabot · 2026-09-01T06:46:17Z

Bumps the bundler group with 6 updates in the / directory:

Package	From	To
webrick	`1.7.0`	`1.8.2`
activesupport	`7.0.3.1`	`7.2.3.1`
addressable	`2.8.1`	`2.9.0`
nokogiri	`1.13.8`	`1.19.4`
rack	`2.2.4`	`2.2.23`
rexml	`3.2.5`	`3.4.2`

Updates webrick from 1.7.0 to 1.8.2

Release notes

Sourced from webrick's releases.

v1.8.2

What's Changed

Drop commented-out line by @olleolleolle in ruby/webrick#108

Add Ruby 3.1 & 3.2 to CI matrix by @tricknotes in ruby/webrick#109

Fix/redos by @ooooooo-q in ruby/webrick#114

Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by @jeremyevans in ruby/webrick#120

Bump actions/checkout from 3 to 4 by @dependabot in ruby/webrick#121

Improve CI by @hsbt in ruby/webrick#123

Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by @KJTsanaktsidis in ruby/webrick#128

Fix bug chunk extension detection by @jeremyevans in ruby/webrick#125

Fix CI. by @ioquatix in ruby/webrick#131

Merge multiple cookie headers, preserving semantic correctness. by @ioquatix in ruby/webrick#130

Test on macos-latest by @byroot in ruby/webrick#132

Require CRLF line endings in request line and headers by @jeremyevans in ruby/webrick#138

Prefer squigly heredocs. by @ioquatix in ruby/webrick#143

Only strip space and horizontal tab in headers by @jeremyevans in ruby/webrick#141

Treat missing CRLF separator after headers as an EOFError by @jeremyevans in ruby/webrick#142

Return 400 response for chunked requests with unexpected data after chunk by @jeremyevans in ruby/webrick#136

Fix reference to URI::REGEXP::PATTERN::HOST by @casperisfine in ruby/webrick#144

Prevent request smuggling by @jeremyevans in ruby/webrick#146

New Contributors

@tricknotes made their first contribution in ruby/webrick#109

@ooooooo-q made their first contribution in ruby/webrick#114

@KJTsanaktsidis made their first contribution in ruby/webrick#128

@byroot made their first contribution in ruby/webrick#132

@casperisfine made their first contribution in ruby/webrick#144

Full Changelog: ruby/webrick@v1.8.1...v1.8.2

v1.8.1

What's Changed

Body should be non-frozen by default. by @ioquatix in ruby/webrick#103

Join test thread. by @ioquatix in ruby/webrick#104

Fix several regexp warnings. by @ioquatix in ruby/webrick#105

Full Changelog: ruby/webrick@v1.8.0...v1.8.1

v1.8.0

What's Changed

Use frozen strings by @kirs in ruby/webrick#65

Use test-unit by @hsbt in ruby/webrick#66

More rubies on CI, deprecating ruby 2.3 due to test failure by @mathieujobin in ruby/webrick#68

Adds common mime types by @gotoken in ruby/webrick#75

add mime type for .webmanifest extension by @olleolleolle in ruby/webrick#76

CI: use bundler-cache: true by @olleolleolle in ruby/webrick#79

Typo by @printfinn in ruby/webrick#78

s/RubyVM::JIT/RubyVM::MJIT/g by @k0kubun in ruby/webrick#82

Fix invalid use of IP addresses in SNI by @jeremyevans in ruby/webrick#83

... (truncated)

Commits

0fb9de6 Bump up v1.8.2
b9a4c81 Removed trailing spaces
f5faca9 Prevent request smuggling
0c600e1 Fix reference to URI::REGEXP::PATTERN::HOST
15a9391 Return 400 response for chunked requests with unexpected data after chunk
2b38d56 Treat missing CRLF separator after headers as an EOFError
e4efb4a Remove unnecessary gsub calls in test_httprequest.rb
426e214 Only strip space and horizontal tab in headers
e72cb69 Prefer squigly heredocs. (#143)
ee60354 Require CRLF line endings in request line and headers
Additional commits viewable in compare view

Updates activesupport from 7.0.3.1 to 7.2.3.1

Release notes

Sourced from activesupport's releases.

7.2.3.1

Active Support

Reject scientific notation in NumberConverter

[CVE-2026-33176]

Jean Boussier

Fix SafeBuffer#% to preserve unsafe status

[CVE-2026-33170]

Jean Boussier

Improve performance of NumberToDelimitedConverter

[CVE-2026-33169]

Jean Boussier

Active Model

No changes.

Active Record

No changes.

Action View

Skip blank attribute names in tag helpers to avoid generating invalid HTML.

[CVE-2026-33168]

Mike Dalessio

Action Pack

No changes.

Active Job

No changes.

... (truncated)

Commits

ba76fca Preparing for 7.2.3.1 release
8a379f4 Update changelog
b54a4b3 Improve performance of NumberToDelimitedConverter
c1ad0e8 Fix SafeBuffer#% to preserve unsafe status
ebd6be1 NumberConverter: reject scientific notation
4a155f1 Lock some dependencies
bb2bdef Preparing for 7.2.3 release
fe41a9f Merge pull request #55840 from zzak/asup-xml-mini-bigdecimal-float-precision
12040a3 Merge pull request #55808 from olivier-thatch/fix-enum-sole
58630e1 Merge pull request #55794 from rails/fix-55513
Additional commits viewable in compare view

Updates addressable from 2.8.1 to 2.9.0

Changelog

Sourced from addressable's changelog.

Addressable 2.9.0

fixes ReDoS vulnerability in Addressable::Template#match (fixes incomplete remediation in 2.8.10)

Commits

0c3e858 Revving version and changelog
91915c1 Fixing additional vulnerable paths
a091e39 Add many more adversarial test cases to ensure we don't have any ReDoS regres...
463a819 Regenerate gemspec on newer rubygems
0afcb0b Improve from O(n^2) to O(n)
c87f768 Fix a ReDoS vulnerability in URI template matching
0d7e9b2 Fix links for 2.8.9 in CHANGELOG (#573)
e209120 Update version, gemspec, and CHANGELOG for 2.8.9 (#572)
3875874 Reduce gem size by excluding test files (#569)
3e57cc6 CI: back to windows-2022 for MRI job
Additional commits viewable in compare view

Updates concurrent-ruby from 1.1.10 to 1.3.8

Release notes

Sourced from concurrent-ruby's releases.

v1.3.8

What's Changed

Programatically set the backtrace_location on exception by @Edouard-chin in ruby-concurrency/concurrent-ruby#1107

Allow to use Concurrent::Map#compute_if_absent in a Ractor by @Edouard-chin in ruby-concurrency/concurrent-ruby#1109

New Contributors

@Edouard-chin made their first contribution in ruby-concurrency/concurrent-ruby#1107

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.7...v1.3.8

v1.3.7

There are 3 security fixes in this release, so updating is recommended. These security vulnerabilities are not very likely to be hit in practice and have a corresponding Low severity score.

What's Changed

CVE-2026-54904 AtomicReference#update livelocks when the stored value is Float::NAN. Fix by @joshuay03 and @eregon

CVE-2026-54905 ReentrantReadWriteLock read-count overflow grants a write lock without exclusivity. Fix by @joshuay03

CVE-2026-54906 ReadWriteLock allows wrong-thread write release and stray read-release counter corruption. Fix by @joshuay03

concurrent-ruby-ext: fix build on Darwin 32-bit by @barracuda156 in ruby-concurrency/concurrent-ruby#1064

Add SECURITY.md by @eregon in ruby-concurrency/concurrent-ruby#1104

Add Ruby 4.0 in CI by @eregon in ruby-concurrency/concurrent-ruby#1106

New Contributors

@barracuda156 made their first contribution in ruby-concurrency/concurrent-ruby#1064

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7

v1.3.6

What's Changed

Run tests without the C extension in CI by @eregon in ruby-concurrency/concurrent-ruby#1081

Fix typo in Promise docs by @danieldiekmeier in ruby-concurrency/concurrent-ruby#1083

Correct word in readme by @wwahammy in ruby-concurrency/concurrent-ruby#1084

Fix mistakes in MVar documentation by @trinistr in ruby-concurrency/concurrent-ruby#1087

Fix multi require concurrent/executor/cached_thread_pool by @OuYangJinTing in ruby-concurrency/concurrent-ruby#1085

Use typed data APIs by @nobu in ruby-concurrency/concurrent-ruby#1096

Add Joshua Young to the list of maintainers by @eregon in ruby-concurrency/concurrent-ruby#1097

Asynchronous pruning for RubyThreadPoolExecutor by @joshuay03 in ruby-concurrency/concurrent-ruby#1082

Mark RubySingleThreadExecutor as a SerialExecutorService by @meineerde in ruby-concurrency/concurrent-ruby#1070

Allow TimerTask to be safely restarted after shutdown and avoid duplicate tasks by @bensheldon in ruby-concurrency/concurrent-ruby#1001

... (truncated)

Changelog

Sourced from concurrent-ruby's changelog.

Release v1.3.8 (19 July 2026)

concurrent-ruby:

See the release notes on GitHub.

Release v1.3.7 (16 June 2026)

concurrent-ruby:

See the release notes on GitHub.

Release v1.3.6 (13 December 2025)

concurrent-ruby:

See the release notes on GitHub.

Release v1.3.5, edge v0.7.2 (15 January 2025)

concurrent-ruby:

(#1062) Remove dependency on logger.

concurrent-ruby-edge:

(#1062) Remove dependency on logger.

Release v1.3.4 (10 August 2024)

(#1060) Fix bug with return value of Concurrent.available_processor_count when cpu.cfs_quota_us is -1.

(#1058) Add Concurrent.cpu_shares that is cgroups aware.

Release v1.3.3 (9 June 2024)

(#1053) Improve the speed of Concurrent.physical_processor_count on Windows.

Release v1.3.2, edge v0.7.1 (7 June 2024)

concurrent-ruby:

(#1051) Remove dependency on win32ole.

concurrent-ruby-edge:

(#1052) Fix dependency on concurrent-ruby to allow the latest release.

Release v1.3.1 (29 May 2024)

Release 1.3.0 was broken when pushed to RubyGems. 1.3.1 is a packaging fix.

... (truncated)

Commits

0b88d5f Release 1.3.8
0f83a98 Allow to use Concurrent::Map#compute_if_absent in a Ractor (#1109)
cc5a32f Programatically set the backtrace_location on exception:
4c8fc28 Release 1.3.7
d91ca94 Fix AtomicReference#update livelock when stored value is Float::NAN on JRuby ...
7e4d711 Fix ReentrantReadWriteLock read hold overflow into write-lock bit
6e37e06 Fix AtomicReference#update livelock when stored value is Float::NAN
2825cfa Cleanup spec
3fd4932 Fix ReadWriteLock wrong-thread write release and stray read release
1974b47 Add Ruby 4.0 in CI
Additional commits viewable in compare view

Updates nokogiri from 1.13.8 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

[CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.

[CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.

[CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.

[CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.

[CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.

[CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.

[CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.

[CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.

[JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.
1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem
v1.19.3 / 2026-04-27

Fixed / Security

Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.

[CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.
46b89e5d7b9e844c2ee360794240c6ea2a4e6fa0c5892a4ed487db621224b639  nokogiri-1.19.3-aarch64-linux-gnu.gem
8392dfdcd21be7a94dbbe9ccc138dea01b97b24cb2dc02a114ca98bfb1d9a0b7  nokogiri-1.19.3-aarch64-linux-musl.gem
3919d5ffc334ad778a4a9eb88fda7dcb8b1fb58c8a52ac640c6dcd2f038e774f  nokogiri-1.19.3-arm-linux-gnu.gem
9ce1cb6346bb9c67b1550eb537aa183ead91e4b6eadb2f36ade02d8dd2a79fb6  nokogiri-1.19.3-arm-linux-musl.gem
71b9bd424b1b7abc18b05052a1a3cfd3627abdca62be280854cc411791357e42  nokogiri-1.19.3-arm64-darwin.gem
40ea6ebf5cf2005dae1dee26dd557d3afb41fb6de6c9764aca8cf06fdb841db1  nokogiri-1.19.3-java.gem
8bb7132cad356c879a1286eaabcb5e68326cb2490317984280fbc62f456d506a  nokogiri-1.19.3-x64-mingw-ucrt.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

[CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.

[CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.

[CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.

[CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.

[CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.

[CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.

[CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.

[CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.

[JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

v1.19.3 / 2026-04-27

Fixed / Security

Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.

[CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.

v1.19.2 / 2026-03-19

Dependencies

[JRuby] Saxon-HE is updated to 12.7, from 9.6.0-4. Saxon-HE is a transitive dependency of nu.validator:jing, and this update addresses CVEs in Saxon-HE's own transitive dependencies JDOM and dom4j. We don't think this warrants a security release, however we're cutting a patch release to help users whose security scanners are flagging this. #3611 @flavorjones

v1.19.1 / 2026-02-16

Security

[CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

Introduce native gem support for Ruby 4.0. #3590

End support for Ruby 3.1, for which upstream support ended 2025-03-26.

End support for JRuby 9.4 (which targets Ruby 3.1 compatibility).

v1.18.10 / 2025-09-15

... (truncated)

Commits

8cfb9da version bump to v1.19.4
a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
f658a54 fix: JRuby NONET bypass in XML::Schema
39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
Additional commits viewable in compare view

Updates rack from 2.2.4 to 2.2.23

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

v2.2.8

What's Changed

Limit file extension length of multipart tempfiles (2.2 backport) by @dentarg in rack/rack#2075

CHANGELOG: Add missing 2.2.7 by @tisba in rack/rack#2081

Update cookie.rb by @dchandekstark in rack/rack#2092

Prefer ubuntu-latest for testing. by @ioquatix in rack/rack#2095

Fix inefficient assert pattern in Rack::Lint [2-2-stable] by @skipkayhil in rack/rack#2101

Regenerate SPEC [2-2-stable] by @skipkayhil in rack/rack#2102

New Contributors

@tisba made their first contribution in rack/rack#2081

@dchandekstark made their first contribution in rack/rack#2092

Full Changelog: rack/rack@v2.2.7...v2.2.8

v2.2.7

What's Changed

Correct the year number in the changelog by @kimulab in rack/rack#2015

Support underscore in host names for Rack 2.2 (Fixes #2070) by @jeremyevans in rack/rack#2071

New Contributors

@kimulab made their first contribution in rack/rack#2015

Full Changelog: rack/rack@v2.2.6.4...v2.2.7

v2.2.6.4

No release notes provided.

Changelog

Sourced from rack's changelog.

[2.2.23] - 2026-04-01

Security

CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.

CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.

CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.

CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.

CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.

CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.

CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.

CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.

CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

[2.2.22] - 2026-02-16

Security

CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.

CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

[2.2.21] - 2025-11-03

Fixed

Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @alpaca-tc, @willnet, @krororo)

[2.2.20] - 2025-10-10

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[2.2.19] - 2025-10-07

Security

CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

[2.2.18] - 2025-09-25

Security

CVE-2025-59830 Unbounded parameter parsing in Rack::QueryParser can lead to memory exhaustion via semicolon-separated parameters.

[2.2.17] - 2025-06-03

... (truncated)

Commits

f2af0c8 Bump patch version.
345b744 Fix tests for old Rubies.
e2d8e30 Add version guard around non-default gems.
add1a80 Fix handling of Errno::EPIPE in multipart tests.
54261ec Fix typo in test.
a36f48b Add ostruct to Gemfile.
8883f0d Fix test expectation.
2287a3b Add logger to gemfile.
e6540e5 Add Ruby v4.0 to the test matrix.
c42e357 Add Content-Length size check in Rack::Multipart::Parser
Additional commits viewable in compare view

Updates rexml from 3.2.5 to 3.4.2

Release notes

Sourced from rexml's releases.

REXML 3.4.2 - 2025-08-26

Improvement

Improved performance.

GH-244

GH-245

GH-246

GH-249

GH-256

Patch by NAITOH Jun

Raise appropriate exception when failing to match start tag in DOCTYPE

GH-247

Patch by NAITOH Jun

Deprecate accepting array as an element in XPath.match, first and each

GH-252

Patch by tomoya ishida

Don't call needless encoding_updated

GH-259

Patch by Sutou Kouhei

Reuse XPath::match

GH-263

Patch by pboling

Cache redundant calls for doctype

GH-264

Patch by pboling

Use Safe Navigation (&.) from Ruby 2.3

GH-265

Patch by pboling

Remove redundant return statements

GH-266

Patch by pboling

Added XML declaration check & Source#skip_spaces method

GH-282

Patch by NAITOH Jun

Reported by Sofi Aberegg

Fixes

Fix docs typo

GH-248

Patch by James Coleman

... (truncated)

Changelog

Sourced from rexml's changelog.

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

Improved performance.

GH-244

GH-245

GH-246

GH-249

GH-256

Patch by NAITOH Jun

Raise appropriate exception when failing to match start tag in DOCTYPE

GH-247

Patch by NAITOH Jun

Deprecate accepting array as an element in XPath.match, first and each

GH-252

Patch by tomoya ishida

Don't call needless encoding_updated

GH-259

Patch by Sutou Kouhei

Reuse XPath::match

GH-263

Patch by pboling

Cache redundant calls for doctype

GH-264

Patch by pboling

Use Safe Navigation (&.) from Ruby 2.3

GH-265

Patch by pboling

Remove redundant return statements

GH-266

Patch by pboling

Added XML declaration check & Source#skip_spaces method

GH-282

Patch by NAITOH Jun

Reported by Sofi Aberegg

Fixes

Fix docs typo

GH-248

Patch by James Coleman

... (truncated)

Commits

f36916f Add 3.4.2 entry (#284)
5859bde Added XML declaration check & Source#skip_spaces method (#282)
1d876e3 Bump actions/checkout from 4 to 5 (#283)
c87bda8 Remove ostruct from dev deps (#281)
c60ae02 Remove bundler from dev deps (#277)
9b084d7 Fix & Deprecate REXML::Text#text_indent (#275)
04a589a Fix a bug that XPath can't be used for no document element (#268)
66232ea Remove redundant return statements (#266)
63f3e97 Use Safe Navigation (&.) from Ruby 2.3 (#265)
d427fc5 Avoid redundant calls for doctype (#264)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [webrick](https://github.com/ruby/webrick) | `1.7.0` | `1.8.2` | | [activesupport](https://github.com/rails/rails) | `7.0.3.1` | `7.2.3.1` | | [addressable](https://github.com/sporkmonger/addressable) | `2.8.1` | `2.9.0` | | [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.13.8` | `1.19.4` | | [rack](https://github.com/rack/rack) | `2.2.4` | `2.2.23` | | [rexml](https://github.com/ruby/rexml) | `3.2.5` | `3.4.2` | Updates `webrick` from 1.7.0 to 1.8.2 - [Release notes](https://github.com/ruby/webrick/releases) - [Commits](ruby/webrick@v1.7.0...v1.8.2) Updates `activesupport` from 7.0.3.1 to 7.2.3.1 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activesupport/CHANGELOG.md) - [Commits](rails/rails@v7.0.3.1...v7.2.3.1) Updates `addressable` from 2.8.1 to 2.9.0 - [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md) - [Commits](sporkmonger/addressable@addressable-2.8.1...addressable-2.9.0) Updates `concurrent-ruby` from 1.1.10 to 1.3.8 - [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases) - [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md) - [Commits](ruby-concurrency/concurrent-ruby@v1.1.10...v1.3.8) Updates `nokogiri` from 1.13.8 to 1.19.4 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.13.8...v1.19.4) Updates `rack` from 2.2.4 to 2.2.23 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@2.2.4...v2.2.23) Updates `rexml` from 3.2.5 to 3.4.2 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.2.5...v3.4.2) --- updated-dependencies: - dependency-name: webrick dependency-version: 1.8.2 dependency-type: direct:production dependency-group: bundler - dependency-name: activesupport dependency-version: 7.2.3.1 dependency-type: indirect dependency-group: bundler - dependency-name: addressable dependency-version: 2.9.0 dependency-type: indirect dependency-group: bundler - dependency-name: concurrent-ruby dependency-version: 1.3.8 dependency-type: indirect dependency-group: bundler - dependency-name: nokogiri dependency-version: 1.19.4 dependency-type: indirect dependency-group: bundler - dependency-name: rack dependency-version: 2.2.23 dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-version: 3.4.2 dependency-type: indirect dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Sep 1, 2026

dependabot Bot mentioned this pull request Sep 1, 2026

Bump concurrent-ruby from 1.1.10 to 1.3.7 in the bundler group across 1 directory #1

Closed

Navigation Menu

Bump the bundler group across 1 directory with 7 updates - #2

Bump the bundler group across 1 directory with 7 updates#2
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/bundler-ac7674f14a

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

v1.8.2

What's Changed

New Contributors

v1.8.1

What's Changed

v1.8.0

What's Changed

7.2.3.1

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Addressable 2.9.0

v1.3.8

What's Changed

New Contributors

v1.3.7

What's Changed

New Contributors

v1.3.6

What's Changed

Release v1.3.8 (19 July 2026)

Release v1.3.7 (16 June 2026)

Release v1.3.6 (13 December 2025)

Release v1.3.5, edge v0.7.2 (15 January 2025)

Release v1.3.4 (10 August 2024)

Release v1.3.3 (9 June 2024)

Release v1.3.2, edge v0.7.1 (7 June 2024)

Release v1.3.1 (29 May 2024)

v1.19.4 / 2026-06-18

Security

v1.19.3 / 2026-04-27

Fixed / Security

v1.19.4 / 2026-06-18

Security

v1.19.3 / 2026-04-27

Fixed / Security

v1.19.2 / 2026-03-19

Dependencies

v1.19.1 / 2026-02-16

Security

v1.19.0 / 2025-12-28

Ruby

v1.18.10 / 2025-09-15

v2.2.8.1

What's Changed

v2.2.8

What's Changed

New Contributors

v2.2.7

What's Changed

New Contributors

v2.2.6.4

[2.2.23] - 2026-04-01

Security

[2.2.22] - 2026-02-16

Security

[2.2.21] - 2025-11-03

Fixed

[2.2.20] - 2025-10-10

Security

[2.2.19] - 2025-10-07

Security

[2.2.18] - 2025-09-25

Security

[2.2.17] - 2025-06-03

REXML 3.4.2 - 2025-08-26

Improvement

Fixes

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

Fixes

Uh oh!

Reviewers

Assignees

Labels