Skip to content

Bump the ruby group with 7 updates#158

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-854b92410f
Closed

Bump the ruby group with 7 updates#158
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-854b92410f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github May 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the ruby group with 7 updates:

Package From To
nokogiri 1.19.2 1.19.3
pagy 43.4.4 43.5.3
propshaft 1.3.1 1.3.2
puma 7.2.0 8.0.1
rake 13.3.1 13.4.2
view_component 4.6.0 4.8.0
faker 3.6.1 3.8.0

Updates nokogiri from 1.19.2 to 1.19.3

Release notes

Sourced from nokogiri's releases.

v1.19.3 / 2026-04-27

Fixed / Security

  • Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
  • [CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.
46b89e5d7b9e844c2ee360794240c6ea2a4e6fa0c5892a4ed487db621224b639  nokogiri-1.19.3-aarch64-linux-gnu.gem
8392dfdcd21be7a94dbbe9ccc138dea01b97b24cb2dc02a114ca98bfb1d9a0b7  nokogiri-1.19.3-aarch64-linux-musl.gem
3919d5ffc334ad778a4a9eb88fda7dcb8b1fb58c8a52ac640c6dcd2f038e774f  nokogiri-1.19.3-arm-linux-gnu.gem
9ce1cb6346bb9c67b1550eb537aa183ead91e4b6eadb2f36ade02d8dd2a79fb6  nokogiri-1.19.3-arm-linux-musl.gem
71b9bd424b1b7abc18b05052a1a3cfd3627abdca62be280854cc411791357e42  nokogiri-1.19.3-arm64-darwin.gem
40ea6ebf5cf2005dae1dee26dd557d3afb41fb6de6c9764aca8cf06fdb841db1  nokogiri-1.19.3-java.gem
8bb7132cad356c879a1286eaabcb5e68326cb2490317984280fbc62f456d506a  nokogiri-1.19.3-x64-mingw-ucrt.gem
77f3fba57d46c53ab31e62fc6c28f705109d1bf6264356c76f132b2be5728d4d  nokogiri-1.19.3-x86_64-darwin.gem
2f5078620fe12e83669b5b17311b32532a8153d02eee7ad06948b926d6080976  nokogiri-1.19.3-x86_64-linux-gnu.gem
248c906d2166eca5efb56d52fdee5f9a1f51d69a72e2b64fdac647b4ce39ea3f  nokogiri-1.19.3-x86_64-linux-musl.gem
78312cbac32a40c812780d9678221b79d51288eec00054c1a8d15f7ce05960e8  nokogiri-1.19.3.gem
Changelog

Sourced from nokogiri's changelog.

v1.19.3 / 2026-04-27

Fixed / Security

  • Address exponential regex backtracking in CSS selector tokenizer. See GHSA-c4rq-3m3g-8wgx for more information.
  • [CRuby] Address memory leak in XSLT::Stylesheet#transform. See GHSA-v2fc-qm4h-8hqv for more information.
Commits
  • c139a3d version bump to v1.19.3
  • 7501a63 fix: backtracking in CSS tokenizer rules (v1.19.x backport) (#3627)
  • 03e7968 test: skip CSS tokenizer benchmarks on JRuby
  • b984b7e fix: ReDoS in CSS tokenizer ident rule
  • 0092623 fix: ReDoS in CSS tokenizer STRING rule
  • ee17d33 fix: memory leak in XSLT transform (backport to v1.19.x) (#3624)
  • ce188a3 doc: update CHANGELOG
  • caeaac4 fix: memory leak in XSLT transform
  • 25220bf dep(test): test against libxml-ruby v6 (#3618)
  • 0caeb21 doc: add security warnings for untrusted XSLT stylesheets
  • See full diff in compare view

Updates pagy from 43.4.4 to 43.5.3

Release notes

Sourced from pagy's releases.

Version 43.5.3

Changes in 43.5.3

  • Autoload series, a_lambda and page_label
  • Add Hungarian localization file for Pagy (#896)

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

  • New :countish Paginator
    • Faster than OFFSET and supporting the full UI
  • New Keynav Pagination
    • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
  • New interactive dev-tools
    • New PagyWand to integrate the pagy CSS with your app themes.
    • New Pagy AI available right inside your own app.
  • Intelligent automation
  • Simpler API
    • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
    • Methods are autoloaded only if used, and consume no memory otherwise.
    • Methods have narrower scopes and can be overridden without deep knowledge.
  • New documentation
    • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.5.3

  • Autoload series, a_lambda and page_label
  • Add Hungarian localization file for Pagy (#896)

Version 43.5.2

  • Add type validation for page and limit keys type (close #895)
  • Simplify series_nav_js removing "pagy-rjs" CSS class (Fix #894)

Version 43.5.1

  • Remove ghost code from cli; improve tests

Version 43.5.0

  • Update javascripts according to es-linting
  • Update min ruby version to 3.3 (remove EOL 3.2)
  • Implement the NEW pagy/next entrypoint to run the NEXT version now
  • Refactor deprecations:
    • Deprecated :client_max_limit in favor of :max_limit; moved code into deprecation.rb
    • Move deprecated options out of class code, to keep the code clean
  • Remove RBS resources. Not worth the maintenance effort.
Commits

Updates propshaft from 1.3.1 to 1.3.2

Release notes

Sourced from propshaft's releases.

v1.3.2

What's Changed

New Contributors

Full Changelog: rails/propshaft@v1.3.1...v1.3.2

Commits
  • eb59571 Bump version for 1.3.2
  • 8335366 Add charset=utf-8 to Content-Type for CSS and HTML assets (#264)
  • 67def02 Merge pull request #265 from flavorjones/fix-ci-minitest
  • 2f9965a Support minitest 6 where possible, pin < 6 elsewhere
  • See full diff in compare view

Updates puma from 7.2.0 to 8.0.1

Release notes

Sourced from puma's releases.

v8.0.1

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

  • Breaking changes

    • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)
Changelog

Sourced from puma's changelog.

8.0.1 / 2026-04-27

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

  • Breaking changes

    • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)
Commits
  • cee7e61 Release v8.0.1 (#3932)
  • f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
  • 97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
  • 03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
  • 053efae Reword v8 upgrade guide ipv6 bullet (#3928)
  • b19f35a Fix incorrect hook names in gRPC docs (#3923)
  • eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
  • 08f63d4 Release v8.0.0 (#3914)
  • 7406cc1 Fix IPv4-mapped IPv6 addresses in REMOTE_ADDR and request logs (#3916)
  • e090243 Build(deps): Bump actions/checkout from 4 to 6 (#3915)
  • Additional commits viewable in compare view

Updates rake from 13.3.1 to 13.4.2

Commits
  • 503b8ec v13.4.2
  • 46038e7 Merge pull request #723 from ruby/fix/testopts-preserve-existing-value
  • 604a3d9 Isolate TESTOPTS env in TestRakeTestTask setup/teardown
  • 5886caa Preserve ENV["TESTOPTS"] when verbose is enabled
  • 92193ac v13.4.1
  • b74be0b Merge pull request #721 from ruby/fix/add-options-to-gemspec
  • 829f66d Add lib/rake/options.rb to gemspec
  • 2d55bc4 v13.4.0
  • 1415070 Exclude dependabot updates from release note
  • b3dc948 Merge pull request #713 from pvdb/simplify_standard_system_dir
  • Additional commits viewable in compare view

Updates view_component from 4.6.0 to 4.8.0

Release notes

Sourced from view_component's releases.

4.8.0

  • Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

    Joel Hawksley, GitHub Copilot

4.7.0

  • Fix stale content cache when slots are accessed before render_in.

    Jared Armstrong

  • Add rubocop-view_component to resources.

    Andy Waite

  • Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

    GitHub Copilot, Joel Hawksley, Cameron Dutro

Changelog

Sourced from view_component's changelog.

4.8.0

  • Add compile.view_component ActiveSupport::Notifications event for eager compilation at boot time.

    Joel Hawksley, GitHub Copilot

4.7.0

  • Fix stale content cache when slots are accessed before render_in.

    Jared Armstrong

  • Add rubocop-view_component to resources.

    Andy Waite

  • Fix bug where inheritance of components with formatless templates improperly raised a NoMethodError.

    GitHub Copilot, Joel Hawksley, Cameron Dutro

Commits
  • d7e8cb4 Merge pull request #2615 from ViewComponent/release-4-8-0
  • 091e30a fix flaky tesT
  • 9e0dae4 release 4.8.0
  • ef90407 Merge pull request #2613 from ViewComponent/instrument-compilation
  • d920918 clean up test
  • 3cc6d61 simplify test
  • d7947fc Add compile.view_component ActiveSupport::Notifications event for eager compi...
  • 5d84af8 Merge pull request #2612 from ViewComponent/dependabot/bundler/propshaft-1.3.2
  • 8f4ef89 Bump propshaft from 1.3.1 to 1.3.2
  • 9ae4d79 Merge pull request #2611 from ViewComponent/dependabot/bundler/yard-0.9.43
  • Additional commits viewable in compare view

Updates faker from 3.6.1 to 3.8.0

Release notes

Sourced from faker's releases.

v3.8.0

Changes

Enabling lazy load

This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.

Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:

1 - Set lazy load as a Faker Config

Faker::Config.lazy_loading = true

2 - Set lazy load as an environment variable

FAKER_LAZY_LOAD = 1

We hope you get to see the improvement by enabling it. Please file a bug report for any issues!

Thanks to @​jeremyevans for the mentoring, and to @​thdaraujo for pairing and code reviews.

Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0

v3.7.1

Thanks to all contributors!

Drops support for Ruby 3.1

What's changed

Update development dependencies

New Contributors

Full Changelog: faker-ruby/faker@v3.6.1...v3.7.1

Changelog

Sourced from faker's changelog.

v3.8.0 (2026-04-16)

Enabling lazy load

This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.

Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:

1 - Set lazy load as a Faker Config

Faker::Config.lazy_loading = true

2 - Set lazy load as an environment variable

FAKER_LAZY_LOAD = 1

We hope you get to see the improvement by enabling it. Please file a bug report for any issues!

Thanks to @​jeremyevans for the mentoring, and to @​thdaraujo for pairing and code reviews.

Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0

v3.7.1 (2026-04-14)

Thanks to all contributors!

Drops support for Ruby 3.1

What's changed

Update development dependencies

New Contributors

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the ruby group with 7 updates
21fb4ac 
Bumps the ruby group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.19.2` | `1.19.3` |
| [pagy](https://github.com/ddnexus/pagy) | `43.4.4` | `43.5.3` |
| [propshaft](https://github.com/rails/propshaft) | `1.3.1` | `1.3.2` |
| [puma](https://github.com/puma/puma) | `7.2.0` | `8.0.1` |
| [rake](https://github.com/ruby/rake) | `13.3.1` | `13.4.2` |
| [view_component](https://github.com/viewcomponent/view_component) | `4.6.0` | `4.8.0` |
| [faker](https://github.com/faker-ruby/faker) | `3.6.1` | `3.8.0` |


Updates `nokogiri` from 1.19.2 to 1.19.3
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.2...v1.19.3)

Updates `pagy` from 43.4.4 to 43.5.3
- [Release notes](https://github.com/ddnexus/pagy/releases)
- [Changelog](https://github.com/ddnexus/pagy/blob/master/docs/CHANGELOG.md)
- [Commits](ddnexus/pagy@43.4.4...43.5.3)

Updates `propshaft` from 1.3.1 to 1.3.2
- [Release notes](https://github.com/rails/propshaft/releases)
- [Commits](rails/propshaft@v1.3.1...v1.3.2)

Updates `puma` from 7.2.0 to 8.0.1
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v7.2.0...v8.0.1)

Updates `rake` from 13.3.1 to 13.4.2
- [Release notes](https://github.com/ruby/rake/releases)
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc)
- [Commits](ruby/rake@v13.3.1...v13.4.2)

Updates `view_component` from 4.6.0 to 4.8.0
- [Release notes](https://github.com/viewcomponent/view_component/releases)
- [Changelog](https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md)
- [Commits](ViewComponent/view_component@v4.6.0...v4.8.0)

Updates `faker` from 3.6.1 to 3.8.0
- [Release notes](https://github.com/faker-ruby/faker/releases)
- [Changelog](https://github.com/faker-ruby/faker/blob/main/CHANGELOG.md)
- [Commits](faker-ruby/faker@v3.6.1...v3.8.0)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.19.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby
- dependency-name: pagy
  dependency-version: 43.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby
- dependency-name: propshaft
  dependency-version: 1.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby
- dependency-name: puma
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ruby
- dependency-name: rake
  dependency-version: 13.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby
- dependency-name: view_component
  dependency-version: 4.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby
- dependency-name: faker
  dependency-version: 3.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels May 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github May 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this May 10, 2026
@dependabot
dependabot Bot deleted the dependabot/bundler/ruby-854b92410f branch May 10, 2026 09:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants