Skip to content

build(deps): bump the bundler group across 1 directory with 5 updates#1378

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/ruby-on-rails/bundler-58ff69bc2e
Open

build(deps): bump the bundler group across 1 directory with 5 updates#1378
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/ruby-on-rails/bundler-58ff69bc2e

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 23, 2026

Bumps the bundler group with 2 updates in the /ruby-on-rails directory: nokogiri and actionview.

Updates nokogiri from 1.19.0 to 1.19.1

Release notes

Sourced from nokogiri's releases.

v1.19.1 / 2026-02-16

Security

cfdb0eafd9a554a88f12ebcc688d2b9005f9fce42b00b970e3dc199587b27f32  nokogiri-1.19.1-aarch64-linux-gnu.gem
1e2150ab43c3b373aba76cd1190af7b9e92103564063e48c474f7600923620b5  nokogiri-1.19.1-aarch64-linux-musl.gem
0a39ed59abe3bf279fab9dd4c6db6fe8af01af0608f6e1f08b8ffa4e5d407fa3  nokogiri-1.19.1-arm-linux-gnu.gem
3a18e559ee499b064aac6562d98daab3d39ba6cbb4074a1542781b2f556db47d  nokogiri-1.19.1-arm-linux-musl.gem
dfe2d337e6700eac47290407c289d56bcf85805d128c1b5a6434ddb79731cb9e  nokogiri-1.19.1-arm64-darwin.gem
1e0bda88b1c6409f0edb9e0c25f1bf9ff4fa94c3958f492a10fcf50dda594365  nokogiri-1.19.1-java.gem
110d92ae57694ae7866670d298a5d04cd150fae5a6a7849957d66f171e6aec9b  nokogiri-1.19.1-x64-mingw-ucrt.gem
7093896778cc03efb74b85f915a775862730e887f2e58d6921e3fa3d981e68bf  nokogiri-1.19.1-x86_64-darwin.gem
1a4902842a186b4f901078e692d12257678e6133858d0566152fe29cdb98456a  nokogiri-1.19.1-x86_64-linux-gnu.gem
4267f38ad4fc7e52a2e7ee28ed494e8f9d8eb4f4b3320901d55981c7b995fc23  nokogiri-1.19.1-x86_64-linux-musl.gem
598b327f36df0b172abd57b68b18979a6e14219353bca87180c31a51a00d5ad3  nokogiri-1.19.1.gem
Changelog

Sourced from nokogiri's changelog.

v1.19.1 / 2026-02-16

Security

Commits

Updates actionview from 7.2.2.1 to 7.2.3.1

Release notes

Sourced from actionview's releases.

7.2.3.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • ba76fca Preparing for 7.2.3.1 release
  • 8a379f4 Update changelog
  • 0b6f800 Skip blank attribute names in Action View tag helpers
  • bb2bdef Preparing for 7.2.3 release
  • b5a9a37 Merge pull request #55809 from zzak/8-0-rubocop
  • b14489e Sync CHANGELOG
  • f96593c Merge pull request #55725 from byroot/js-include-type-module-sym
  • 788fde0 Merge branch '7-2-sec' into 7-2-stable
  • 9204eb5 Preparing for 7.2.2.2 release
  • 2db40ab Merge pull request #55476 from jonathanhefner/excerpt-with-non-whitespace-sep...
  • Additional commits viewable in compare view

Updates activerecord from 7.2.2.1 to 7.2.3.1

Release notes

Sourced from activerecord's releases.

7.2.3.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • ba76fca Preparing for 7.2.3.1 release
  • bb2bdef Preparing for 7.2.3 release
  • 40e5415 Sync CHANGELOG
  • 35ad36a Merge pull request #55969 from rails/fix-explain-tests-mysql-9.5
  • 766a8e1 Merge pull request #55925 from flavorjones/flavorjones/shard-swap-prohibition...
  • 31217f6 Merge pull request #55907 from ruyrocha/fix/sqlite3-data-loss
  • 95f14a4 Merge pull request #55332 from zzak/re-54882
  • 8ee0169 Merge pull request #55778 from ianterrell/ianterrell/fix-autosave-changed-via...
  • b14489e Sync CHANGELOG
  • e00df05 Merge pull request #55722 from kozy4324/fix-lease-sticky-flag-timing
  • Additional commits viewable in compare view

Updates activestorage from 7.2.2.1 to 7.2.3.1

Release notes

Sourced from activestorage's releases.

7.2.3.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • ba76fca Preparing for 7.2.3.1 release
  • 8a379f4 Update changelog
  • fa19073 Prevent glob injection in ActiveStorage DiskService#delete_prefixed
  • 4933c1e Prevent path traversal in ActiveStorage DiskService
  • 707c0f1 Active Storage: Filter user supplied metadata in DirectUploadController
  • b8a1665 ActiveStorage::Streaming limit range requests to a single range
  • 8159a9c Configurable maxmimum streaming chunk size
  • bb2bdef Preparing for 7.2.3 release
  • 33f9043 Disable GCS tests in CI
  • b14489e Sync CHANGELOG
  • Additional commits viewable in compare view

Updates activesupport from 7.2.2.1 to 7.2.3.1

Release notes

Sourced from activesupport's releases.

7.2.3.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • ba76fca Preparing for 7.2.3.1 release
  • 8a379f4 Update changelog
  • b54a4b3 Improve performance of NumberToDelimitedConverter
  • c1ad0e8 Fix SafeBuffer#% to preserve unsafe status
  • ebd6be1 NumberConverter: reject scientific notation
  • 4a155f1 Lock some dependencies
  • bb2bdef Preparing for 7.2.3 release
  • fe41a9f Merge pull request #55840 from zzak/asup-xml-mini-bigdecimal-float-precision
  • 12040a3 Merge pull request #55808 from olivier-thatch/fix-enum-sole
  • 58630e1 Merge pull request #55794 from rails/fix-55513
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 2 updates in the /ruby-on-rails directory: [nokogiri](https://github.com/sparklemotion/nokogiri) and [actionview](https://github.com/rails/rails).


Updates `nokogiri` from 1.19.0 to 1.19.1
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.0...v1.19.1)

Updates `actionview` from 7.2.2.1 to 7.2.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/actionview/CHANGELOG.md)
- [Commits](rails/rails@v7.2.2.1...v7.2.3.1)

Updates `activerecord` from 7.2.2.1 to 7.2.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activerecord/CHANGELOG.md)
- [Commits](rails/rails@v7.2.2.1...v7.2.3.1)

Updates `activestorage` from 7.2.2.1 to 7.2.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activestorage/CHANGELOG.md)
- [Commits](rails/rails@v7.2.2.1...v7.2.3.1)

Updates `activesupport` from 7.2.2.1 to 7.2.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v7.2.2.1...v7.2.3.1)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.19.1
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: actionview
  dependency-version: 7.2.3.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: activerecord
  dependency-version: 7.2.3.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: activestorage
  dependency-version: 7.2.3.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: activesupport
  dependency-version: 7.2.3.1
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Mar 23, 2026
@vercel
Copy link
Contributor

vercel bot commented Mar 23, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
empower Ignored Ignored Preview Mar 23, 2026 10:29pm

Request Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants