build(deps): bump the bundler group across 1 directory with 10 updates by dependabot[bot] · Pull Request #339 · umts/strap

dependabot · 2026-06-23T06:34:22Z

Bumps the bundler group with 7 updates in the / directory:

Package	From	To
haml_lint	`0.73.0`	`0.74.0`
rubocop	`1.87.0`	`1.88.0`
auth-sanitizer	`0.2.1`	`0.2.2`
concurrent-ruby	`1.3.6`	`1.3.7`
faraday	`2.14.2`	`2.14.3`
i18n	`1.14.8`	`1.15.2`
oauth2	`2.0.22`	`2.0.24`

Updates haml_lint from 0.73.0 to 0.74.0

Release notes

Sourced from haml_lint's releases.

0.74.0

What's Changed

Add tsort to rubocop1.0 gemfile to fix deprecation warning by @mattmenefee in sds/haml-lint#642

Include CLI flags in the auto-gen-config heading by @mattmenefee in sds/haml-lint#640

Add auto-correction to HAML-level linters by @wilfison in sds/haml-lint#649

Keep file/line in the github reporter's log output by @wilfison in sds/haml-lint#657

Stop testing on Ruby 3.2 by @sds in sds/haml-lint#662

Fix false Lint/UselessAssignment for HTML-style (parens) attributes by @wilfison in sds/haml-lint#659

Fix LineLength not being disabled inside filter blocks by @wilfison in sds/haml-lint#658

Add UnescapedHtml linter by @wilfison in sds/haml-lint#656

Fix RuboCop lints reported on the wrong line on repeated runs by @wilfison in sds/haml-lint#655

Fix Layout/EmptyLineAfterGuardClause false positive by @wilfison in sds/haml-lint#654

Fix UnnecessaryStringOutput false positives by @wilfison in sds/haml-lint#651

Attempt fix JRuby parallel linting by @sds in sds/haml-lint#663

New Contributors

@mattmenefee made their first contribution in sds/haml-lint#642

Full Changelog: sds/haml-lint@v0.73.0...v0.74.0

Changelog

Sourced from haml_lint's changelog.

0.74.0

Add auto-correction (-a/--auto-correct and -A/--auto-correct-all) to Haml-level linters.

Safe corrections (run under both -a and -A): ClassAttributeWithStaticValue, ClassesBeforeIds, EmptyObjectReference, FinalNewline, ImplicitDiv, LeadingCommentSpace, RubyComments, SpaceBeforeScript, SpaceInsideHashAttributes, TagName, TrailingEmptyLines, TrailingWhitespace, and UnnecessaryInterpolation.

Unsafe corrections (run only under -A): ConsecutiveComments, EmptyScript, and MultilineScript

Keep the file, line, and linter name in the github reporter's log output

Fix RuboCop reporting a false Lint/UselessAssignment

Fix LineLength not being disabled by haml-lint:disable comments inside filter blocks such as :javascript and :css

Add UnescapedHtml linter to flag use of !=/!~/! unescaped HTML output

Fix RuboCop lints being reported on the wrong line when the same file is linted more than once

Fix Layout/EmptyLineAfterGuardClause false positive for a blank line at the end of a :ruby filter

Fix UnnecessaryStringOutput false positives

Fix cached path handling in parallelized runs under JRuby

Commits

cf30d4f Fix automated release process (#666)
149bf63 Cut version 0.74.0 (#665)
773fc54 Add automated gem release flow (#664)
c905b5a Attempt fix JRuby parallel linting (#663)
4da7cfb Fix UnnecessaryStringOutput false positives (#651)
e562f9c Fix Layout/EmptyLineAfterGuardClause false positive inside a :ruby filter...
f42bc0d Fix RuboCop lints reported on wrong line on repeated runs (#655)
0a913fe Add UnescapedHtml linter (#656)
e41f734 Fix LineLength not being disabled inside filter blocks (#658)
e156f20 Fix false UselessAssignment for HTML-style (parens) attributes (#659)
Additional commits viewable in compare view

Updates rubocop from 1.87.0 to 1.88.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.88.0

New features

#15166: Add a new Recursive option to Style/MutableConstant. When enabled, the cop checks and freezes mutable literals nested inside arrays and hashes. The option is disabled by default to preserve existing behavior. ([@paracycle][])

Bug fixes

#15220: Fix a bad autocorrect for Lint/RedundantSplatExpansion when splatting an empty literal (e.g. when *[] or rescue *[]), which expanded to invalid or semantically different code. ([@bbatsov][])

#15221: Fix a bad autocorrect for Lint/RegexpAsCondition when the regexp literal is negated (e.g. if !/foo/), which inverted the condition. ([@bbatsov][])

#15242: Fix a bad autocorrect for Lint/SymbolConversion when the receiver is an interpolated string containing an embedded double quote (e.g. "foo#{bar}\"qux".to_sym), which produced a syntax error. ([@bbatsov][])

#15270: Fix a crash for Style/CombinableLoops when a for loop has an empty body, and stop autocorrecting consecutive for loops whose iteration variables differ (which produced code referencing an undefined variable). ([@bbatsov][])

#15272: Fix a crash for Style/ConstantVisibility when a visibility declaration has a numeric literal argument (e.g. private_constant 42). ([@bbatsov][])

#15215: Fix a false negative for Lint/OrderedMagicComments when an encoding magic comment is preceded by a magic comment other than frozen_string_literal (e.g. shareable_constant_value). ([@bbatsov][])

#15228: Fix a false negative for Lint/RedundantWithIndex when the block takes no arguments (e.g. ary.each_with_index { do_something }). ([@bbatsov][])

#15230: Fix a false negative for Lint/RequireRelativeSelfPath when requiring the current file by name with its extension (e.g. require_relative 'foo.rb') and the file path is absolute. ([@bbatsov][])

#15229: Fix a false negative for Lint/SafeNavigationChain when an ordinary method is chained after a parenthesized safe navigation call (e.g. (x&.foo).bar). ([@bbatsov][])

#15225: Fix a false negative for Lint/SafeNavigationWithEmpty when the receiver of &.empty? is a local variable, instance variable, constant, or other non-method-call expression. ([@bbatsov][])

#15231: Fix a false negative for Lint/SendWithMixinArgument when send/public_send/__send__ is called with no explicit receiver or with a self receiver (e.g. send(:include, Bar)). ([@bbatsov][])

#15248: Fix a false negative for Lint/ToEnumArguments when more positional arguments are passed than the method accepts (e.g. def m(x); to_enum(:m, x, extra); end), which raises ArgumentError when the enumerator is used. ([@bbatsov][])

#15249: Fix a false negative for Lint/UnescapedBracketInRegexp when an unescaped ] is preceded by an escaped backslash (e.g. /abc\\]123/). ([@bbatsov][])

#15267: Fix a false positive for Style/ArrayIntersectWithSingleElement with a splat argument (e.g. array.intersect?([*foo])), which is not a single element and was incorrectly rewritten to array.include?(*foo). ([@bbatsov][])

#15272: Fix a false positive for Style/ColonMethodCall with chained JRuby interop calls (e.g. Java::com::something_method). ([@bbatsov][])

#15271: Fix a false positive for Style/ConditionalAssignment with EnforcedStyle: assign_inside_condition when assigning an unless without an else branch (e.g. x = unless cond; 1; end), which was rewritten to move the assignment inside the unless and changed behavior when the condition was true. ([@bbatsov][])

#14401: Fix a false positive for Layout/BlockAlignment with EnforcedStyleAlignWith: start_of_line when a block is passed as a method argument. ([@augustocbx][])

#15216: Fix a false positive for Lint/RaiseException when raise Exception is used inside a module nested within an allowed implicit namespace (e.g. Gem). ([@bbatsov][])

#15219: Fix a false positive for Lint/RedundantDirGlobSort when sort is given a comparator block or a block-pass argument, which is not redundant with the default sorting. ([@bbatsov][])

#15224: Fix a false positive for Lint/ShadowingOuterLocalVariable when a block argument has the same name as a pattern variable from a different in branch of the same case. ([@bbatsov][])

#15239: Fix a false positive for Lint/SuppressedExceptionInNumberConversion when the numeric constructor already passes exception: false (e.g. Integer(arg, exception: false) rescue nil), which also produced an autocorrect with a duplicate exception: false keyword. ([@bbatsov][])

#15243: Fix a false positive for Lint/TopLevelReturnWithArgument when a return with an argument is inside a numbered-parameter block or an it block. ([@bbatsov][])

#15245: Fix a false positive for Lint/UselessRuby2Keywords when ruby2_keywords in a nested class or module refers to a method of the same name defined in an outer scope. ([@bbatsov][])

#15246: Fix a false positive for Lint/UselessSetterCall when a multiple assignment uses nested destructuring (e.g. (a, b), c = arg, other_arg), which misaligned variables with the right-hand side values. ([@bbatsov][])

#15125: Fix a false positive for Style/ZeroLengthPredicate when File::Stat.new(...).size.zero? is used. ([@augustocbx][])

#15196: Fix --start-server to wait until the server is running before returning, which fixes a flaky --restart-server spec and a race for commands run right after starting the server. ([@koic][])

#15272: Fix Style/Alias not detecting block scope for numbered-parameter and it blocks, which caused a false positive for alias_method and a false negative for alias inside such blocks. ([@bbatsov][])

#15281: Fix an incorrect autocorrect when Style/IfUnlessModifier and Style/Next correct the same conditional. ([@fynsta][])

#15260: Fix an error for Style/FileWrite when a literal or variable is passed to write in the block form. ([@koic][])

#15276: Fix an error for Style/RedundantFormat when the format string is a heredoc with format arguments. ([@fynsta][])

#15270: Fix an incorrect autocorrect for Style/AndOr when an operand is next, break, or yield with an argument (e.g. foo and next 1), which produced invalid Ruby like foo && next 1. ([@bbatsov][])

#15267: Fix an incorrect autocorrect for Style/ArrayFirstLast when arr[0]/arr[-1] is the target of a compound assignment (e.g. arr[0] += 1), which produced arr.first += 1 and raised NoMethodError. ([@bbatsov][])

#15267: Fix an incorrect autocorrect for Style/ArrayIntersect where a negated predicate on a safe-navigation chain (e.g. a&.intersection(b)&.none?) was rewritten to !a&.intersect?(b), flipping the result when the receiver is nil. ([@bbatsov][])

#15273: Fix an incorrect autocorrect for Style/BlockDelimiters that converted a single-line do...end block containing a block-level rescue or ensure to {...}, producing invalid Ruby. ([@bbatsov][])

#15268: Fix an incorrect autocorrect for Style/CaseEquality when the argument is an operator or unary expression (e.g. Array === a + b), which produced mis-parsed code like a + b.is_a?(Array). ([@bbatsov][])

#15268: Fix an incorrect autocorrect for Style/ClassEqualityComparison inside a namespace when the class name string is already fully qualified (e.g. bar.class.name == '::Bar'), which produced instance_of?(::::Bar) and was a syntax error. ([@bbatsov][])

#15268: Fix an incorrect autocorrect for Style/ClassEqualityComparison when comparing Class itself to a string literal (e.g. var.class == 'Date'), which produced var.instance_of?('Date') and raised TypeError; such comparisons are no longer autocorrected. ([@bbatsov][])

#15274: Fix an incorrect autocorrect for Style/ClassMethodsDefinitions that corrupted a preceding comment containing def <name> and left the method undefined as a class method. ([@bbatsov][])

#15270: Fix an incorrect autocorrect for Style/ComparableClamp when the clamped value is an operator expression (e.g. a + b), which produced mis-parsed code like a + b.clamp(low, high). ([@bbatsov][])

#15267: Fix an incorrect autocorrect for Style/ConcatArrayLiterals with an empty array literal argument (e.g. arr.concat([], [b])), which produced invalid Ruby like arr.push(, b). ([@bbatsov][])

#15274: Fix an incorrect autocorrect for Style/DigChain that duplicated a trailing comment and dropped indentation when the chain was inside a method or block. ([@bbatsov][])

#15288: Fix an incorrect autocorrect for Lint/UselessTimes when a 1.times block takes a single destructured (|(a, b)|) or splat (|*a|) argument, which produced a body referencing an undefined variable. ([@bbatsov][])

#15280: Fix an incorrect autocorrect for Style/ConditionalAssignment with EnforcedStyle: assign_inside_condition and a single-line case. ([@fynsta][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.88.0 (2026-06-16)

New features

#15166: Add a new Recursive option to Style/MutableConstant. When enabled, the cop checks and freezes mutable literals nested inside arrays and hashes. The option is disabled by default to preserve existing behavior. ([@paracycle][])

Bug fixes

#15220: Fix a bad autocorrect for Lint/RedundantSplatExpansion when splatting an empty literal (e.g. when *[] or rescue *[]), which expanded to invalid or semantically different code. ([@bbatsov][])

#15221: Fix a bad autocorrect for Lint/RegexpAsCondition when the regexp literal is negated (e.g. if !/foo/), which inverted the condition. ([@bbatsov][])

#15242: Fix a bad autocorrect for Lint/SymbolConversion when the receiver is an interpolated string containing an embedded double quote (e.g. "foo#{bar}\"qux".to_sym), which produced a syntax error. ([@bbatsov][])

#15270: Fix a crash for Style/CombinableLoops when a for loop has an empty body, and stop autocorrecting consecutive for loops whose iteration variables differ (which produced code referencing an undefined variable). ([@bbatsov][])

#15272: Fix a crash for Style/ConstantVisibility when a visibility declaration has a numeric literal argument (e.g. private_constant 42). ([@bbatsov][])

#15215: Fix a false negative for Lint/OrderedMagicComments when an encoding magic comment is preceded by a magic comment other than frozen_string_literal (e.g. shareable_constant_value). ([@bbatsov][])

#15228: Fix a false negative for Lint/RedundantWithIndex when the block takes no arguments (e.g. ary.each_with_index { do_something }). ([@bbatsov][])

#15230: Fix a false negative for Lint/RequireRelativeSelfPath when requiring the current file by name with its extension (e.g. require_relative 'foo.rb') and the file path is absolute. ([@bbatsov][])

#15229: Fix a false negative for Lint/SafeNavigationChain when an ordinary method is chained after a parenthesized safe navigation call (e.g. (x&.foo).bar). ([@bbatsov][])

#15225: Fix a false negative for Lint/SafeNavigationWithEmpty when the receiver of &.empty? is a local variable, instance variable, constant, or other non-method-call expression. ([@bbatsov][])

#15231: Fix a false negative for Lint/SendWithMixinArgument when send/public_send/__send__ is called with no explicit receiver or with a self receiver (e.g. send(:include, Bar)). ([@bbatsov][])

#15248: Fix a false negative for Lint/ToEnumArguments when more positional arguments are passed than the method accepts (e.g. def m(x); to_enum(:m, x, extra); end), which raises ArgumentError when the enumerator is used. ([@bbatsov][])

#15249: Fix a false negative for Lint/UnescapedBracketInRegexp when an unescaped ] is preceded by an escaped backslash (e.g. /abc\\]123/). ([@bbatsov][])

#15267: Fix a false positive for Style/ArrayIntersectWithSingleElement with a splat argument (e.g. array.intersect?([*foo])), which is not a single element and was incorrectly rewritten to array.include?(*foo). ([@bbatsov][])

#15272: Fix a false positive for Style/ColonMethodCall with chained JRuby interop calls (e.g. Java::com::something_method). ([@bbatsov][])

#15271: Fix a false positive for Style/ConditionalAssignment with EnforcedStyle: assign_inside_condition when assigning an unless without an else branch (e.g. x = unless cond; 1; end), which was rewritten to move the assignment inside the unless and changed behavior when the condition was true. ([@bbatsov][])

#14401: Fix a false positive for Layout/BlockAlignment with EnforcedStyleAlignWith: start_of_line when a block is passed as a method argument. ([@augustocbx][])

#15216: Fix a false positive for Lint/RaiseException when raise Exception is used inside a module nested within an allowed implicit namespace (e.g. Gem). ([@bbatsov][])

#15219: Fix a false positive for Lint/RedundantDirGlobSort when sort is given a comparator block or a block-pass argument, which is not redundant with the default sorting. ([@bbatsov][])

#15224: Fix a false positive for Lint/ShadowingOuterLocalVariable when a block argument has the same name as a pattern variable from a different in branch of the same case. ([@bbatsov][])

#15239: Fix a false positive for Lint/SuppressedExceptionInNumberConversion when the numeric constructor already passes exception: false (e.g. Integer(arg, exception: false) rescue nil), which also produced an autocorrect with a duplicate exception: false keyword. ([@bbatsov][])

#15243: Fix a false positive for Lint/TopLevelReturnWithArgument when a return with an argument is inside a numbered-parameter block or an it block. ([@bbatsov][])

#15245: Fix a false positive for Lint/UselessRuby2Keywords when ruby2_keywords in a nested class or module refers to a method of the same name defined in an outer scope. ([@bbatsov][])

#15246: Fix a false positive for Lint/UselessSetterCall when a multiple assignment uses nested destructuring (e.g. (a, b), c = arg, other_arg), which misaligned variables with the right-hand side values. ([@bbatsov][])

#15125: Fix a false positive for Style/ZeroLengthPredicate when File::Stat.new(...).size.zero? is used. ([@augustocbx][])

#15196: Fix --start-server to wait until the server is running before returning, which fixes a flaky --restart-server spec and a race for commands run right after starting the server. ([@koic][])

#15272: Fix Style/Alias not detecting block scope for numbered-parameter and it blocks, which caused a false positive for alias_method and a false negative for alias inside such blocks. ([@bbatsov][])

#15281: Fix an incorrect autocorrect when Style/IfUnlessModifier and Style/Next correct the same conditional. ([@fynsta][])

#15260: Fix an error for Style/FileWrite when a literal or variable is passed to write in the block form. ([@koic][])

#15276: Fix an error for Style/RedundantFormat when the format string is a heredoc with format arguments. ([@fynsta][])

#15270: Fix an incorrect autocorrect for Style/AndOr when an operand is next, break, or yield with an argument (e.g. foo and next 1), which produced invalid Ruby like foo && next 1. ([@bbatsov][])

#15267: Fix an incorrect autocorrect for Style/ArrayFirstLast when arr[0]/arr[-1] is the target of a compound assignment (e.g. arr[0] += 1), which produced arr.first += 1 and raised NoMethodError. ([@bbatsov][])

#15267: Fix an incorrect autocorrect for Style/ArrayIntersect where a negated predicate on a safe-navigation chain (e.g. a&.intersection(b)&.none?) was rewritten to !a&.intersect?(b), flipping the result when the receiver is nil. ([@bbatsov][])

#15273: Fix an incorrect autocorrect for Style/BlockDelimiters that converted a single-line do...end block containing a block-level rescue or ensure to {...}, producing invalid Ruby. ([@bbatsov][])

#15268: Fix an incorrect autocorrect for Style/CaseEquality when the argument is an operator or unary expression (e.g. Array === a + b), which produced mis-parsed code like a + b.is_a?(Array). ([@bbatsov][])

#15268: Fix an incorrect autocorrect for Style/ClassEqualityComparison inside a namespace when the class name string is already fully qualified (e.g. bar.class.name == '::Bar'), which produced instance_of?(::::Bar) and was a syntax error. ([@bbatsov][])

#15268: Fix an incorrect autocorrect for Style/ClassEqualityComparison when comparing Class itself to a string literal (e.g. var.class == 'Date'), which produced var.instance_of?('Date') and raised TypeError; such comparisons are no longer autocorrected. ([@bbatsov][])

#15274: Fix an incorrect autocorrect for Style/ClassMethodsDefinitions that corrupted a preceding comment containing def <name> and left the method undefined as a class method. ([@bbatsov][])

#15270: Fix an incorrect autocorrect for Style/ComparableClamp when the clamped value is an operator expression (e.g. a + b), which produced mis-parsed code like a + b.clamp(low, high). ([@bbatsov][])

#15267: Fix an incorrect autocorrect for Style/ConcatArrayLiterals with an empty array literal argument (e.g. arr.concat([], [b])), which produced invalid Ruby like arr.push(, b). ([@bbatsov][])

#15274: Fix an incorrect autocorrect for Style/DigChain that duplicated a trailing comment and dropped indentation when the chain was inside a method or block. ([@bbatsov][])

#15288: Fix an incorrect autocorrect for Lint/UselessTimes when a 1.times block takes a single destructured (|(a, b)|) or splat (|*a|) argument, which produced a body referencing an undefined variable. ([@bbatsov][])

... (truncated)

Commits

37bf5ad Cut 1.88
cd0c2e3 Update Changelog
b7af64a [Fix #12276] Record pending cops options in the auto-gen-config command
bbd7ff2 Add hk integration docs
117e40a Merge pull request #15293 from RedZapdos123/fix-literal-interp-hash-symbol
4d95141 [Fix #15291] Fix hash symbol interpolation
0347d27 Add Recursive option to Style/MutableConstant
f0d92b4 Fix incorrect autocorrects for Style/FileWrite with heredocs
32df346 Fix an incorrect autocorrect for Style/Semicolon with heredocs
4c221fb [Fix #15269] Fix a false positive where cop Include patterns matched parent...
Additional commits viewable in compare view

Updates auth-sanitizer from 0.2.1 to 0.2.2

Release notes

Sourced from auth-sanitizer's releases.

v0.2.2

0.2.2 - 2026-06-18

TAG: v0.2.2

COVERAGE: 100.00% -- 145/145 lines in 6 files

BRANCH COVERAGE: 100.00% -- 28/28 branches in 6 files

84.62% documented

Changed

Documented the released anonymous_loader gem as the preferred reusable helper for zero-auth-sanitizer-namespace loading.

Fixed

Documented the $LOAD_PATH fallback needed by isolated loader consumers when Bundler standalone setup provides auth_sanitizer/loader.rb without a matching Gem.loaded_specs or GEM_PATH entry.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

Changelog

Sourced from auth-sanitizer's changelog.

[0.2.2] - 2026-06-18

TAG: [v0.2.2][0.2.2t]

COVERAGE: 100.00% -- 145/145 lines in 6 files

BRANCH COVERAGE: 100.00% -- 28/28 branches in 6 files

84.62% documented

Changed

Documented the released anonymous_loader gem as the preferred reusable helper for zero-auth-sanitizer-namespace loading.

Fixed

Documented the $LOAD_PATH fallback needed by isolated loader consumers when Bundler standalone setup provides auth_sanitizer/loader.rb without a matching Gem.loaded_specs or GEM_PATH entry.

Commits

b43c584 🔖 Prepare release v0.2.2
ce05777 📝 Document anonymous_loader usage
29371b1 📝 Document standalone loader fallback
bc31e2e 💸 Thanks 🙏 to our new backers 🎒 and subscribers 📜
66d050b 🔒️ Checksums for v0.2.1
See full diff in compare view

Updates concurrent-ruby from 1.3.6 to 1.3.7

Release notes

Sourced from concurrent-ruby's releases.

v1.3.7

There are 3 security fixes in this release, so updating is recommended. These security vulnerabilities are not very likely to be hit in practice and have a corresponding Low severity score.

What's Changed

CVE-2026-54904 AtomicReference#update livelocks when the stored value is Float::NAN. Fix by @joshuay03 and @eregon

CVE-2026-54905 ReentrantReadWriteLock read-count overflow grants a write lock without exclusivity. Fix by @joshuay03

CVE-2026-54906 ReadWriteLock allows wrong-thread write release and stray read-release counter corruption. Fix by @joshuay03

concurrent-ruby-ext: fix build on Darwin 32-bit by @barracuda156 in ruby-concurrency/concurrent-ruby#1064

Add SECURITY.md by @eregon in ruby-concurrency/concurrent-ruby#1104

Add Ruby 4.0 in CI by @eregon in ruby-concurrency/concurrent-ruby#1106

New Contributors

@barracuda156 made their first contribution in ruby-concurrency/concurrent-ruby#1064

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7

Changelog

Sourced from concurrent-ruby's changelog.

Release v1.3.7 (16 June 2026)

concurrent-ruby:

See the release notes on GitHub.

Commits

4c8fc28 Release 1.3.7
d91ca94 Fix AtomicReference#update livelock when stored value is Float::NAN on JRuby ...
7e4d711 Fix ReentrantReadWriteLock read hold overflow into write-lock bit
6e37e06 Fix AtomicReference#update livelock when stored value is Float::NAN
2825cfa Cleanup spec
3fd4932 Fix ReadWriteLock wrong-thread write release and stray read release
1974b47 Add Ruby 4.0 in CI
df8706d Add SECURITY.md (#1104)
7a1b789 Bump actions/upload-pages-artifact from 4 to 5
9b2dbf7 Bump actions/deploy-pages from 4 to 5
Additional commits viewable in compare view

Updates faraday from 2.14.2 to 2.14.3

Release notes

Sourced from faraday's releases.

v2.14.3

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

Upgrade CI lint step from Ruby 3 to 4 by @larouxn in lostisland/faraday#1673

feat(test): add Stubs#clear to remove all stubs by @SAY-5 in lostisland/faraday#1675

New Contributors

@SAY-5 made their first contribution in lostisland/faraday#1675

Full Changelog: lostisland/faraday@v2.14.2...v2.14.3

Commits

f1ace87 Version bump to 2.14.3
36764bf Merge commit from fork
59334e0 feat(test): add Stubs#clear to remove all stubs (#1675)
469f25c Upgrade CI lint step from Ruby 3 to 4 (#1673)
See full diff in compare view

Updates i18n from 1.14.8 to 1.15.2

Release notes

Sourced from i18n's releases.

v1.15.2

What's Changed

Restore Ruby 3.1 support by @koic in ruby-i18n/i18n#739

Full Changelog: ruby-i18n/i18n@v1.15.1...v1.15.2

v1.15.1

What's Changed

Fix feature fiber storage by @YashaVinter in ruby-i18n/i18n#736

Ignore Ruby 3.2 + Rails main from the matrix by @radar in ruby-i18n/i18n#737

New Contributors

@YashaVinter made their first contribution in ruby-i18n/i18n#736

Full Changelog: ruby-i18n/i18n@v1.15.0...v1.15.1

v1.15.0

What's Changed

Make lazy loading of I18n translations thread safe ( part 2 ) by @chaadow in ruby-i18n/i18n#729

Add support to not replace non-ASCII chars not in map by @sobrinho in ruby-i18n/i18n#720

Add transliteration for O with ogonek by @radar in ruby-i18n/i18n#733

CI: exclude Ruby 3.2 from rails-main matrix by @radar in ruby-i18n/i18n#734

Fiber-aware I18n config storage by @lee266 in ruby-i18n/i18n#731

New Contributors

@chaadow made their first contribution in ruby-i18n/i18n#729

@sobrinho made their first contribution in ruby-i18n/i18n#720

Full Changelog: ruby-i18n/i18n@v1.14.8...v1.15.0

Commits

8beba78 Bump to 1.15.2
d6964f2 Merge pull request #739 from koic/restore_ruby_3_1_support
e4c806e Restore Ruby 3.1 support
02841cb Bump to 1.15.1
a56484d Merge pull request #737 from ruby-i18n/ignore-ruby32-rails-main
52deaba Ignore Ruby 3.2 + Rails main from the matrix
94891ca Merge pull request #736 from YashaVinter/fix-feature-fiber-storage
5a7913e Test against Ruby 3.2
cd337a8 fix ruby-i18n/i18n#735 NoMethodError: undefined met...
78fa20a Bump to 1.15.0
Additional commits viewable in compare view

Updates json from 2.19.8 to 2.19.9

Release notes

Sourced from json's releases.

v2.19.9

Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: ruby/json@v2.19.8...v2.19.9

Changelog

Sourced from json's changelog.

2026-06-11 (2.19.9)

Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Commits

2cff267 Release 2.19.9
fd6a65b generator.c: don't start with a stack buffer in IO case
See full diff in compare view

Updates oauth2 from 2.0.22 to 2.0.24

Release notes

Sourced from oauth2's releases.

v2.0.24

2.0.24 - 2026-06-18

TAG: v2.0.24

COVERAGE: 100.00% -- 558/558 lines in 15 files

BRANCH COVERAGE: 97.89% -- 186/190 branches in 15 files

88.35% documented

Changed

Raised the anonymous_loader runtime dependency floor to >= 0.1.1.

Raised the auth-sanitizer runtime dependency floor to >= 0.2.2 and switched isolated sanitizer loading to the released anonymous_loader gem, including local workspace wiring for the new runtime dependency.

Fixed

Fixed isolated auth-sanitizer loading when Bundler standalone setup makes auth_sanitizer/loader.rb available on $LOAD_PATH without adding auth-sanitizer to Gem.loaded_specs or GEM_PATH.

Official Discord 👉️ [![Live Chat on Discord][✉️discord-invite-img]][✉️discord-invite]

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

Bumps the bundler group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [haml_lint](https://github.com/sds/haml-lint) | `0.73.0` | `0.74.0` | | [rubocop](https://github.com/rubocop/rubocop) | `1.87.0` | `1.88.0` | | [auth-sanitizer](https://github.com/ruby-oauth/auth-sanitizer) | `0.2.1` | `0.2.2` | | [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) | `1.3.6` | `1.3.7` | | [faraday](https://github.com/lostisland/faraday) | `2.14.2` | `2.14.3` | | [i18n](https://github.com/ruby-i18n/i18n) | `1.14.8` | `1.15.2` | | [oauth2](https://github.com/ruby-oauth/oauth2) | `2.0.22` | `2.0.24` | Updates `haml_lint` from 0.73.0 to 0.74.0 - [Release notes](https://github.com/sds/haml-lint/releases) - [Changelog](https://github.com/sds/haml-lint/blob/main/CHANGELOG.md) - [Commits](sds/haml-lint@v0.73.0...v0.74.0) Updates `rubocop` from 1.87.0 to 1.88.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.87.0...v1.88.0) Updates `auth-sanitizer` from 0.2.1 to 0.2.2 - [Release notes](https://github.com/ruby-oauth/auth-sanitizer/releases) - [Changelog](https://github.com/ruby-oauth/auth-sanitizer/blob/main/CHANGELOG.md) - [Commits](ruby-oauth/auth-sanitizer@v0.2.1...v0.2.2) Updates `concurrent-ruby` from 1.3.6 to 1.3.7 - [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases) - [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md) - [Commits](ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7) Updates `faraday` from 2.14.2 to 2.14.3 - [Release notes](https://github.com/lostisland/faraday/releases) - [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md) - [Commits](lostisland/faraday@v2.14.2...v2.14.3) Updates `i18n` from 1.14.8 to 1.15.2 - [Release notes](https://github.com/ruby-i18n/i18n/releases) - [Changelog](https://github.com/ruby-i18n/i18n/blob/master/CHANGELOG.md) - [Commits](ruby-i18n/i18n@v1.14.8...v1.15.2) Updates `json` from 2.19.8 to 2.19.9 - [Release notes](https://github.com/ruby/json/releases) - [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md) - [Commits](ruby/json@v2.19.8...v2.19.9) Updates `oauth2` from 2.0.22 to 2.0.24 - [Release notes](https://github.com/ruby-oauth/oauth2/releases) - [Changelog](https://github.com/ruby-oauth/oauth2/blob/main/CHANGELOG.md) - [Commits](ruby-oauth/oauth2@v2.0.22...v2.0.24) Updates `snaky_hash` from 2.0.5 to 2.0.6 - [Release notes](https://github.com/ruby-oauth/snaky_hash/releases) - [Changelog](https://github.com/ruby-oauth/snaky_hash/blob/main/CHANGELOG.md) - [Commits](ruby-oauth/snaky_hash@v2.0.5...v2.0.6) Updates `version_gem` from 1.1.11 to 1.1.13 - [Release notes](https://github.com/ruby-oauth/version_gem/releases) - [Changelog](https://github.com/ruby-oauth/version_gem/blob/main/CHANGELOG.md) - [Commits](ruby-oauth/version_gem@v1.1.11...v1.1.13) --- updated-dependencies: - dependency-name: haml_lint dependency-version: 0.74.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler - dependency-name: rubocop dependency-version: 1.88.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler - dependency-name: auth-sanitizer dependency-version: 0.2.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler - dependency-name: concurrent-ruby dependency-version: 1.3.7 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler - dependency-name: faraday dependency-version: 2.14.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler - dependency-name: i18n dependency-version: 1.15.2 dependency-type: indirect update-type: version-update:semver-minor dependency-group: bundler - dependency-name: json dependency-version: 2.19.9 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler - dependency-name: oauth2 dependency-version: 2.0.24 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler - dependency-name: snaky_hash dependency-version: 2.0.6 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler - dependency-name: version_gem dependency-version: 1.1.13 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

This is just the result of rendering the content, which is itself escaped.

dependabot · 2026-06-24T06:33:53Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Jun 23, 2026

Permit "unescaped" yield

e5f8883

This is just the result of rendering the content, which is itself escaped.

werebus self-assigned this Jun 23, 2026

dependabot Bot closed this Jun 24, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the bundler group across 1 directory with 10 updates#339

build(deps): bump the bundler group across 1 directory with 10 updates#339
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/bundler/bundler-4100eef423

dependabot Bot commented on behalf of github Jun 23, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

0.74.0

What's Changed

New Contributors

0.74.0

RuboCop v1.88.0

New features

Bug fixes

1.88.0 (2026-06-16)

New features

Bug fixes

v0.2.2

0.2.2 - 2026-06-18

Changed

Fixed

[0.2.2] - 2026-06-18

Changed

Fixed

v1.3.7

What's Changed

New Contributors

Release v1.3.7 (16 June 2026)

v2.14.3

Security Note

What's Changed

New Contributors

v1.15.2

What's Changed

v1.15.1

What's Changed

New Contributors

v1.15.0

What's Changed

New Contributors

v2.19.9

2026-06-11 (2.19.9)

v2.0.24

2.0.24 - 2026-06-18

Changed

Fixed

Uh oh!

dependabot Bot commented on behalf of github Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Jun 23, 2026 •

edited

Loading