Bump the bundler group across 1 directory with 9 updates

[dependabot]

Bumps the bundler group with 6 updates in the / directory:

Package	From	To
view_component	4.10.0	4.12.0
pagy	43.3.1	43.5.6
activestorage	8.1.2.1	8.1.3.1
mcp	0.9.2	0.23.0
msgpack	1.8.0	1.8.2
websocket-driver	0.8.0	0.8.2

Updates view_component from 4.10.0 to 4.12.0

Release notes

Sourced from view_component's releases.

4.12.0

• Fix stale render context on reused component instances. A ViewComponent::Base instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via ||=. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. #render_in now resets these ivars on every call so each render derives its context from the current view.

  Joel Hawksley

• Fix HTML-safety bypass in around_render. ViewComponent::Base#around_render could return HTML-unsafe strings that bypassed the escaping applied to normal #call return values, creating an XSS risk. The vulnerability was amplified in ViewComponent::Collection#render_in, which joined per-item results and unconditionally marked the output html_safe. HTML-unsafe strings returned from around_render are now escaped (with a warning) and Collection#render_in now uses safe_join so unsafe per-item output is escaped instead of laundered into a SafeBuffer. Joel Hawksley

4.11.0

• Update render_in signature to accept **_ for compatibility with Rails #50623.

  Joel Hawksley

• Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

  Artin Boghosian

Changelog

Sourced from view_component's changelog.

4.12.0

• Fix stale render context on reused component instances. A ViewComponent::Base instance memoized its controller, helpers, request, view context, lookup context, view flow, and requested format details on first render via ||=. Rendering the same instance a second time (intentionally or via aliasing) reused that stale context, which could leak data across requests, sessions, or users. #render_in now resets these ivars on every call so each render derives its context from the current view.

  Joel Hawksley

• Fix HTML-safety bypass in around_render. ViewComponent::Base#around_render could return HTML-unsafe strings that bypassed the escaping applied to normal #call return values, creating an XSS risk. The vulnerability was amplified in ViewComponent::Collection#render_in, which joined per-item results and unconditionally marked the output html_safe. HTML-unsafe strings returned from around_render are now escaped (with a warning) and Collection#render_in now uses safe_join so unsafe per-item output is escaped instead of laundered into a SafeBuffer.

  Joel Hawksley

4.11.0

• Update render_in signature to accept **_ for compatibility with Rails #50623.

  Joel Hawksley

• Fix translation scope resolution in nested lambda-backed slots. Relative t(".key") calls inside lambda-backed slots were resolving against an intermediate component's scope instead of the original partial's scope where the block was defined.

  Artin Boghosian

Commits

• 4cbdbaa Merge pull request #2649 from ViewComponent/release-4-12-0
• a8888e1 Fix lint and bump allocation ranges
• 02d8896 lockfiles
• 50a2baf release 4.12.0
• 6796b2e Merge commit from fork
• 015f42c clean up changelog
• 5963e48 simplify
• 53106be update changelog
• 7b05073 fix Reused component instances retain stale render context
• 48e5fd2 fix for around_render safety gap
• Additional commits viewable in compare view

Updates pagy from 43.3.1 to 43.5.6

Release notes

Sourced from pagy's releases.

Version 43.5.6

Changes in 43.5.6

• Validate I18n locale input, coerce dev_tools wand_scale, add input-safety docs (#908)
  • Coerce dev_tools wand_scale to a float
  • Validate the I18n locale against a BCP 47 pattern
  • Update docs and comments about safety

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

• New :countish Paginator
  • Faster than OFFSET and supporting the full UI
• New Keynav Pagination
  • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
• New interactive dev-tools
  • New PagyWand to integrate the pagy CSS with your app themes.
  • New Pagy AI available right inside your own app.
• Intelligent automation
  • Configuration requirements reduced by 99%.
  • Simplified JavaScript setup.
  • Automatic I18n loading.
• Simpler API
  • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
  • Methods are autoloaded only if used, and consume no memory otherwise.
  • Methods have narrower scopes and can be overridden without deep knowledge.
• New documentation
  • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.5.6

• Validate I18n locale input, coerce dev_tools wand_scale, add input-safety docs (#908)
  • Coerce dev_tools wand_scale to a float
  • Validate the I18n locale against a BCP 47 pattern
  • Update docs and comments about safety

Version 43.5.5

• Rescue malformed page request param in Pagy::Keyset and KeynavJsPaginator (#907)
  • Rescue malformed page request param in Pagy::Keyset and KeynavJsPaginator
  • Simplify decoding logic

Version 43.5.4

• Fix SERIES_SLOTS loading error (close #902)

Version 43.5.3

• Autoload series, a_lambda and page_label
• Add Hungarian localization file for Pagy (#896)

Version 43.5.2

• Add type validation for page and limit keys type (close #895)
• Simplify series_nav_js removing "pagy-rjs" CSS class (Fix #894)

Version 43.5.1

• Remove ghost code from cli; improve tests

Version 43.5.0

• Update javascripts according to es-linting
• Update min ruby version to 3.3 (remove EOL 3.2)
• Implement the NEW pagy/next entrypoint to run the NEXT version now
• Refactor deprecations:
  • Deprecated :client_max_limit in favor of :max_limit; moved code into deprecation.rb
  • Move deprecated options out of class code, to keep the code clean
• Remove RBS resources. Not worth the maintenance effort.

Version 43.4.4

• Make typecasting in Keyset based classes safer and more efficient

Version 43.4.3

• Deprecate the :max_pages option (close #890)

Version 43.4.2

... (truncated)

Commits

• ef90524 Merge branch 'dev'
• d6e546f Version 43.5.6
• efcf096 💎 Validate I18n locale input, coerce dev_tools wand_scale, add input-safety d...
• cbc77eb Update gems and packages
• 2641e8c Improve docs
• eb4a810 Merge branch 'dev'
• 8ee37a0 Version 43.5.5
• ac62e00 Improve comment/docs
• 81215c4 Update gem and packages
• 9161301 💎 Rescue malformed page request param in Pagy::Keyset and KeynavJsPaginator (...
• Additional commits viewable in compare view

Updates activestorage from 8.1.2.1 to 8.1.3.1

Release notes

Sourced from activestorage's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.3.1 (July 29, 2026)

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

  This is a breaking change for applications that process image types with an unfuzzed loader or saver. Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error, and analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer record width and height. Requesting an unfuzzed output format, typically FITS, JXL, or anything delegated to ImageMagick, will also raise Vips::Error. Attaching, storing, and downloading are unchanged.

  An application seeing Vips::Error raised during image transformation may wish to remove the affected content types from config.active_storage.variable_content_types in an initializer. Active Storage will then treat those attachments as not variable and will not generate variants for them. This most often matters to an application that transforms images during a request rather than in a background job, where the failure surfaces as an error response instead of a failed job.

  Rails.application.config.active_storage.variable_content_types -=
    %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]

  Applications using the :mini_magick variant processor will see no change in how their attachments are processed, but the loaders and savers will be disabled process-wide whenever ruby-vips is installed, and the version requirements below will still apply. Such an application may remove ruby-vips from its Gemfile to avoid both.

  The minimum supported version of libvips is now 8.13, and the minimum supported version of ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise a RuntimeError while booting rather than run in an unsecurable environment.

  [GHSA-xr9x-r78c-5hrm] [CVE-2026-66066]

  Mike Dalessio

Rails 8.1.3 (March 24, 2026)

• Fix ActiveStorage::Blob content type predicate methods to handle nil.

  Daichi KUDO

Commits

• 3989ebf Preparing for 8.1.3.1 release
• 349e7a5 Disable libvips's unfuzzed image loaders and savers
• fa8f081 Preparing for 8.1.3 release
• 63cef3d Merge branch '8-1-sec' into 8-1-stable
• 064cea7 Merge pull request #56783 from kudoas/fix-activestorage-blob-content-type-nil
• See full diff in compare view

Updates json from 2.20.0 to 2.21.2

Release notes

Sourced from json's releases.

v2.21.2

What's Changed

• Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc].

Full Changelog: ruby/json@v2.21.1...v2.21.2

v2.21.0

What's Changed

• JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
• Added #empty? and #partial_value? methods on JSON::ResumableParser.
• Numerous correctness and performance fixes for JSON::ResumableParser.
• Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
• Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

Full Changelog: ruby/json@v2.20.0...v2.21.0

Changelog

Sourced from json's changelog.

2026-07-31 (2.21.2)

• Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc][CVE-2026-71847].

2026-07-13 (2.21.1)

• Fix a compilation issue on Window and Microsoft Visual C++.

2026-07-12 (2.21.0)

• JSON.generate now accept a sort_keys option, which takes either a boolean or a block.
• Added #empty? and #partial_value? methods on JSON::ResumableParser.
• Numerous correctness and performance fixes for JSON::ResumableParser.
• Avoid triggering Ruby's float out of range warning when parsing out of range numbers.
• Declare C types with Ruby 4.1 RUBY_TYPED_THREAD_SAFE_FREE.

Commits

• 5a32e43 Release 2.21.2
• 2c332bf Also don't compute ResumableParser cursor position for warning
• 5499aa5 Improve max_nesting documentation
• 499d9bc Fix the parser benchmark bytes report
• f5fc245 Pass '-mno-outline' to the compiler (if supported) to prevent function outlin...
• fd61def Release 2.21.1
• db70b14 Rely on Ruby's HAVE_BUILTIN___BUILTIN_CLZLL
• 9be0e8e Release 2.21.0
• d1299d4 Avoid re-decoding an incomplete number on every ResumableParser chunk
• cc010c4 Fix ResumableParser losing tokens before a feed-boundary suspension
• Additional commits viewable in compare view

Updates loofah from 2.25.1 to 2.25.2

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

Commits

• 2706d7e version bump to v2.25.2
• 1afde0c Merge pull request #308 from flavorjones/security-2252
• f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
• 5e91af8 Update allowed_uri? to handle named whitespace character references
• 20867b9 Properly restrict SVG href attributes
• 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
• b07713d test: do not run in verbose mode
• babe7a8 doc: update CHANGELOG
• a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
• b52f4b0 version bump to 2.25.2.beta1
• Additional commits viewable in compare view

Updates mcp from 0.9.2 to 0.23.0

Release notes

Sourced from mcp's releases.

v0.23.0

Added

• Add a session-ownership hook to StreamableHTTPTransport

Changed

• Require calling MCP::Client#connect before sending requests on stdio transport (#427)

Deprecated

• Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)

Fixed

• Fix an incorrect result: null response to an id-bearing notification message (#435)
• Validate Host and Origin headers to prevent DNS rebinding per MCP 2025-11-25
• Bound stateful session retention to prevent an initialize-flood DoS
• Bound stdio frame reads with max_line_bytes
• Bound request body and frame reads to prevent memory-exhaustion DoS

v0.22.0

Added

• Add audience role validation for MCP::Annotations per MCP specification (#422)
• Send SEP-2243 Mcp-Method and Mcp-Name headers per MCP specification (#423)
• Support client-side notifications/cancelled per MCP specification (#425)

Changed

• Conform Tool Schemas to JSON Schema 2020-12 per SEP-2106 (#417)

Fixed

• Fix a SyntaxError on Ruby 2.7.0 caused by arguments forwarding syntax (#419)

v0.21.0

Added

• Support capability extensions per SEP-2133 (#405)
• Add range validation for MCP::Annotations#priority per MCP specification (#410)
• Isolate stateless requests in ephemeral sessions per SEP-2567 (#415)

Changed

• Set OIDC application_type on Dynamic Client Registration per SEP-837 (#408)
• Fall back to legacy 2025-03-26 OAuth discovery for servers without PRM (#414)

v0.20.0

Added

... (truncated)

Changelog

Sourced from mcp's changelog.

[0.23.0] - 2026-07-07

Added

• Add a session-ownership hook to StreamableHTTPTransport

Changed

• Require calling MCP::Client#connect before sending requests on stdio transport (#427)

Deprecated

• Annotate Roots, Sampling, and Logging APIs as deprecated per SEP-2577 (#429)

Fixed

• Fix an incorrect result: null response to an id-bearing notification message (#435)
• Validate Host and Origin headers to prevent DNS rebinding per MCP 2025-11-25
• Bound stateful session retention to prevent an initialize-flood DoS
• Bound stdio frame reads with max_line_bytes
• Bound request body and frame reads to prevent memory-exhaustion DoS

[0.22.0] - 2026-06-27

Added

• Add audience role validation for MCP::Annotations per MCP specification (#422)
• Send SEP-2243 Mcp-Method and Mcp-Name headers per MCP specification (#423)
• Support client-side notifications/cancelled per MCP specification (#425)

Changed

• Conform Tool Schemas to JSON Schema 2020-12 per SEP-2106 (#417)

Fixed

• Fix a SyntaxError on Ruby 2.7.0 caused by arguments forwarding syntax (#419)

[0.21.0] - 2026-06-20

Added

• Support capability extensions per SEP-2133 (#405)
• Add range validation for MCP::Annotations#priority per MCP specification (#410)
• Isolate stateless requests in ephemeral sessions per SEP-2567 (#415)

Changed

• Set OIDC application_type on Dynamic Client Registration per SEP-837 (#408)
• Fall back to legacy 2025-03-26 OAuth discovery for servers without PRM (#414)

... (truncated)

Commits

• 95feef2 Merge pull request #442 from koic/release_0_23_0
• 494f43d Release 0.23.0
• 6cb78ea Merge commit from fork
• 772e0cb Bound Request Body and Frame Reads to Prevent Memory-Exhaustion DoS
• 0ede5fc Merge commit from fork
• 3546660 Add a Session-Ownership Hook to StreamableHTTPTransport
• 4b400be Merge commit from fork
• dfdd4ef Merge upstream modelcontextprotocol/ruby-sdk main
• cfccb7c Merge commit from fork
• c893075 Merge commit from fork
• Additional commits viewable in compare view

Updates msgpack from 1.8.0 to 1.8.2

Changelog

Sourced from msgpack's changelog.

2026-06-09 1.8.2

• Fix Buffer#clear to properly reset memory chunks before adding them back to the pool. This could have caused data to leak across buffers when using the MessagePack::Buffer API directly. [CVE-2026-54522].

2026-05-28 1.8.1

• Workaround rare compilation issue when rb_hash_new_capa isn't properly detected.
• Never pre-allocate strings larger than the buffered size.

Commits

• 09c914d Release 1.8.2
• 9cfd2ab Stop testing ruby 2.5 on macOS
• 50245ac Merge commit from fork
• 5627d71 _msgpack_buffer_shift_chunk: reset rmem pointers when fully empty
• cce2485 Release 1.8.1
• 677e6b8 Merge pull request #389 from msgpack/str-limit
• f0b6281 Update CI matrix
• abe9066 Update CI matrix
• 8ba8702 Don't pre-allocate strings larger than the buffered size
• 199e88f Merge pull request #386 from msgpack/fix-valgrind-ci
• Additional commits viewable in compare view

Updates rails-html-sanitizer from 1.7.0 to 1.7.1

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio @​flavorjones

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio

Commits

• 4f37e3d version bump to v1.7.1
• b4673b9 Merge pull request #223 from rails/svg-href-local-ref
• 74dcb80 Properly restrict SVG href attributes
• 11ee440 Adjust data: URI mediatype tests for loofah 2.25.2 (#222)
• bc9622c Harden GitHub Actions workflows (#220)
• 3459ffd dep(dev): update nokogiri (#219)
• 8aa4bb2 build(deps-dev): bump concurrent-ruby from 1.3.6 to 1.3.7 (#218)
• 4ddc0c7 dep(dev): update development dependencies (#217)
• f87abb4 Merge pull request #215 from yuri-zubov/reduce-gem-size
• 527b317 Reduce gem size by excluding test files
• See full diff in compare view

Updates websocket-driver from 0.8.0 to 0.8.2

Changelog

Sourced from websocket-driver's changelog.

0.8.2 / 2026-06-23

• Gracefully handle malformed Host headers in the Server driver

0.8.1 / 2026-06-04

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing
• Limit the total HTTP request line and headers size to 32K

Commits

• 49e230b Bump version to 0.8.2
• 7d6fd87 Gracefully handle malformed Host headers in the Server driver
• 5cab908 Bump version to 0.8.1
• 17b569f Limit the total HTTP request line and headers size to 32K
• fa86417 Fail the connection if a message is larger than the configured max length aft...
• d0141f0 Close a draft-75/76 connection if a length header grows to exceed the configu...
• 1e4475e Test on Ruby 4.0
• See full diff in compare view