Bump the bundler group across 4 directories with 10 updates by dependabot[bot] · Pull Request #3 · waveaccounting/activeadmin

dependabot · 2026-02-19T23:32:43Z

Bumps the bundler group with 4 updates in the /docs directory: webrick, nokogiri, rexml and faraday.
Bumps the bundler group with 5 updates in the /gemfiles/rails_61 directory:

Package	From	To
webrick	`1.8.1`	`1.8.2`
net-imap	`0.4.14`	`0.4.20`
nokogiri	`1.16.7`	`1.19.1`
rack	`2.2.9`	`2.2.22`
rexml	`3.3.6`	`3.4.2`

Bumps the bundler group with 5 updates in the /gemfiles/rails_70 directory:

Package	From	To
webrick	`1.8.1`	`1.8.2`
net-imap	`0.4.14`	`0.4.20`
nokogiri	`1.16.7`	`1.19.1`
rack	`2.2.9`	`2.2.22`
rexml	`3.3.6`	`3.4.2`

Bumps the bundler group with 7 updates in the /gemfiles/rails_71 directory:

Package	From	To
webrick	`1.8.1`	`1.8.2`
activerecord	`7.1.4`	`7.1.5.2`
net-imap	`0.4.14`	`0.4.20`
nokogiri	`1.16.7`	`1.19.1`
rack	`3.1.7`	`3.1.20`
rack-session	`2.0.0`	`2.1.1`
rexml	`3.3.6`	`3.4.2`

Updates webrick from 1.8.1 to 1.8.2

Release notes

Sourced from webrick's releases.

v1.8.2

What's Changed

Drop commented-out line by @olleolleolle in ruby/webrick#108

Add Ruby 3.1 & 3.2 to CI matrix by @tricknotes in ruby/webrick#109

Fix/redos by @ooooooo-q in ruby/webrick#114

Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by @jeremyevans in ruby/webrick#120

Bump actions/checkout from 3 to 4 by @dependabot in ruby/webrick#121

Improve CI by @hsbt in ruby/webrick#123

Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by @KJTsanaktsidis in ruby/webrick#128

Fix bug chunk extension detection by @jeremyevans in ruby/webrick#125

Fix CI. by @ioquatix in ruby/webrick#131

Merge multiple cookie headers, preserving semantic correctness. by @ioquatix in ruby/webrick#130

Test on macos-latest by @byroot in ruby/webrick#132

Require CRLF line endings in request line and headers by @jeremyevans in ruby/webrick#138

Prefer squigly heredocs. by @ioquatix in ruby/webrick#143

Only strip space and horizontal tab in headers by @jeremyevans in ruby/webrick#141

Treat missing CRLF separator after headers as an EOFError by @jeremyevans in ruby/webrick#142

Return 400 response for chunked requests with unexpected data after chunk by @jeremyevans in ruby/webrick#136

Fix reference to URI::REGEXP::PATTERN::HOST by @casperisfine in ruby/webrick#144

Prevent request smuggling by @jeremyevans in ruby/webrick#146

New Contributors

@tricknotes made their first contribution in ruby/webrick#109

@ooooooo-q made their first contribution in ruby/webrick#114

@KJTsanaktsidis made their first contribution in ruby/webrick#128

@byroot made their first contribution in ruby/webrick#132

@casperisfine made their first contribution in ruby/webrick#144

Full Changelog: ruby/webrick@v1.8.1...v1.8.2

Commits

0fb9de6 Bump up v1.8.2
b9a4c81 Removed trailing spaces
f5faca9 Prevent request smuggling
0c600e1 Fix reference to URI::REGEXP::PATTERN::HOST
15a9391 Return 400 response for chunked requests with unexpected data after chunk
2b38d56 Treat missing CRLF separator after headers as an EOFError
e4efb4a Remove unnecessary gsub calls in test_httprequest.rb
426e214 Only strip space and horizontal tab in headers
e72cb69 Prefer squigly heredocs. (#143)
ee60354 Require CRLF line endings in request line and headers
Additional commits viewable in compare view

Updates nokogiri from 1.16.7 to 1.19.1

Release notes

Sourced from nokogiri's releases.

v1.19.1 / 2026-02-16

Security

[CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

cfdb0eafd9a554a88f12ebcc688d2b9005f9fce42b00b970e3dc199587b27f32  nokogiri-1.19.1-aarch64-linux-gnu.gem
1e2150ab43c3b373aba76cd1190af7b9e92103564063e48c474f7600923620b5  nokogiri-1.19.1-aarch64-linux-musl.gem
0a39ed59abe3bf279fab9dd4c6db6fe8af01af0608f6e1f08b8ffa4e5d407fa3  nokogiri-1.19.1-arm-linux-gnu.gem
3a18e559ee499b064aac6562d98daab3d39ba6cbb4074a1542781b2f556db47d  nokogiri-1.19.1-arm-linux-musl.gem
dfe2d337e6700eac47290407c289d56bcf85805d128c1b5a6434ddb79731cb9e  nokogiri-1.19.1-arm64-darwin.gem
1e0bda88b1c6409f0edb9e0c25f1bf9ff4fa94c3958f492a10fcf50dda594365  nokogiri-1.19.1-java.gem
110d92ae57694ae7866670d298a5d04cd150fae5a6a7849957d66f171e6aec9b  nokogiri-1.19.1-x64-mingw-ucrt.gem
7093896778cc03efb74b85f915a775862730e887f2e58d6921e3fa3d981e68bf  nokogiri-1.19.1-x86_64-darwin.gem
1a4902842a186b4f901078e692d12257678e6133858d0566152fe29cdb98456a  nokogiri-1.19.1-x86_64-linux-gnu.gem
4267f38ad4fc7e52a2e7ee28ed494e8f9d8eb4f4b3320901d55981c7b995fc23  nokogiri-1.19.1-x86_64-linux-musl.gem
598b327f36df0b172abd57b68b18979a6e14219353bca87180c31a51a00d5ad3  nokogiri-1.19.1.gem

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

Introduce native gem support for Ruby 4.0. #3590
End support for Ruby 3.1, for which upstream support ended 2025-03-26.
End support for JRuby 9.4 (which targets Ruby 3.1 compatibility).

11a97ecc3c0e7e5edcf395720b10860ef493b768f6aa80c539573530bc933767  nokogiri-1.19.0-aarch64-linux-gnu.gem
eb70507f5e01bc23dad9b8dbec2b36ad0e61d227b42d292835020ff754fb7ba9  nokogiri-1.19.0-aarch64-linux-musl.gem
572a259026b2c8b7c161fdb6469fa2d0edd2b61cd599db4bbda93289abefbfe5  nokogiri-1.19.0-arm-linux-gnu.gem
23ed90922f1a38aed555d3de4d058e90850c731c5b756d191b3dc8055948e73c  nokogiri-1.19.0-arm-linux-musl.gem
0811dfd936d5f6dd3f6d32ef790568bf29b2b7bead9ba68866847b33c9cf5810  nokogiri-1.19.0-arm64-darwin.gem
5f3a70e252be641d8a4099f7fb4cc25c81c632cb594eec9b4b8f2ca8be4374f3  nokogiri-1.19.0-java.gem
05d7ed2d95731edc9bef2811522dc396df3e476ef0d9c76793a9fca81cab056b  nokogiri-1.19.0-x64-mingw-ucrt.gem
1dad56220b603a8edb9750cd95798bffa2b8dd9dd9aa47f664009ee5b43e3067  nokogiri-1.19.0-x86_64-darwin.gem
f482b95c713d60031d48c44ce14562f8d2ce31e3a9e8dd0ccb131e9e5a68b58c  nokogiri-1.19.0-x86_64-linux-gnu.gem
1c4ca6b381622420073ce6043443af1d321e8ed93cc18b08e2666e5bd02ffae4  nokogiri-1.19.0-x86_64-linux-musl.gem
e304d21865f62518e04f2bf59f93bd3a97ca7b07e7f03952946d8e1c05f45695  nokogiri-1.19.0.gem

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.1 / 2026-02-16

Security

[CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

Introduce native gem support for Ruby 4.0. #3590

End support for Ruby 3.1, for which upstream support ended 2025-03-26.

End support for JRuby 9.4 (which targets Ruby 3.1 compatibility).

v1.18.10 / 2025-09-15

Dependencies

[CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.

[CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18

v1.18.9 / 2025-07-20

Security

[CRuby] Applied upstream libxml2 patches to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796. See GHSA-353f-x4gh-cqq8 for more information.

v1.18.8 / 2025-04-21

Security

[CRuby] Vendored libxml2 is updated to v2.13.8 to address CVE-2025-32414 and CVE-2025-32415. See GHSA-5w6v-399v-w3cc for more information.

v1.18.7 / 2025-03-31

Dependencies

[CRuby] Vendored libxml2 is updated to v2.13.7, which is a bugfix release.

v1.18.6 / 2025-03-24

Fixed

... (truncated)

Commits

d913045 version bump to v1.19.1
b81cb98 doc: update CHANGELOG for upcoming v1.19.1
8e66809 C14n raise on failure (#3600)
5b77f3d Raise RuntimeError when canonicalization fails
edc5595 Thank sponsors in the README
d4dc245 dep: update rdoc to v7
d77bfb6 version bump to v1.19.0
1eb5c2c dev: convert scripts/test-gem-set to use mise
88a120f dep: Add native Ruby 4 support, drop Ruby 3.1 support (v1.19.x) (#3592)
f8c8f74 Skip the parser compression test for Windows system libs
Additional commits viewable in compare view

Updates rexml from 3.3.6 to 3.4.2

Release notes

Sourced from rexml's releases.

REXML 3.4.2 - 2025-08-26

Improvement

Improved performance.

GH-244

GH-245

GH-246

GH-249

GH-256

Patch by NAITOH Jun

Raise appropriate exception when failing to match start tag in DOCTYPE

GH-247

Patch by NAITOH Jun

Deprecate accepting array as an element in XPath.match, first and each

GH-252

Patch by tomoya ishida

Don't call needless encoding_updated

GH-259

Patch by Sutou Kouhei

Reuse XPath::match

GH-263

Patch by pboling

Cache redundant calls for doctype

GH-264

Patch by pboling

Use Safe Navigation (&.) from Ruby 2.3

GH-265

Patch by pboling

Remove redundant return statements

GH-266

Patch by pboling

Added XML declaration check & Source#skip_spaces method

GH-282

Patch by NAITOH Jun

Reported by Sofi Aberegg

Fixes

Fix docs typo

GH-248

Patch by James Coleman

... (truncated)

Changelog

Sourced from rexml's changelog.

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

Improved performance.

GH-244

GH-245

GH-246

GH-249

GH-256

Patch by NAITOH Jun

Raise appropriate exception when failing to match start tag in DOCTYPE

GH-247

Patch by NAITOH Jun

Deprecate accepting array as an element in XPath.match, first and each

GH-252

Patch by tomoya ishida

Don't call needless encoding_updated

GH-259

Patch by Sutou Kouhei

Reuse XPath::match

GH-263

Patch by pboling

Cache redundant calls for doctype

GH-264

Patch by pboling

Use Safe Navigation (&.) from Ruby 2.3

GH-265

Patch by pboling

Remove redundant return statements

GH-266

Patch by pboling

Added XML declaration check & Source#skip_spaces method

GH-282

Patch by NAITOH Jun

Reported by Sofi Aberegg

Fixes

Fix docs typo

GH-248

Patch by James Coleman

... (truncated)

Commits

f36916f Add 3.4.2 entry (#284)
5859bde Added XML declaration check & Source#skip_spaces method (#282)
1d876e3 Bump actions/checkout from 4 to 5 (#283)
c87bda8 Remove ostruct from dev deps (#281)
c60ae02 Remove bundler from dev deps (#277)
9b084d7 Fix & Deprecate REXML::Text#text_indent (#275)
04a589a Fix a bug that XPath can't be used for no document element (#268)
66232ea Remove redundant return statements (#266)
63f3e97 Use Safe Navigation (&.) from Ruby 2.3 (#265)
d427fc5 Avoid redundant calls for doctype (#264)
Additional commits viewable in compare view

Updates faraday from 2.10.1 to 2.14.1

Release notes

Sourced from faraday's releases.

v2.14.1

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot by @Copilot in lostisland/faraday#1642

Add RFC document for Options architecture refactoring plan by @Copilot in lostisland/faraday#1644

Bump actions/checkout from 5 to 6 by @dependabot[bot] in lostisland/faraday#1655

Explicit top-level namespace reference by @c960657 in lostisland/faraday#1657

New Contributors

@Copilot made their first contribution in lostisland/faraday#1642

Full Changelog: lostisland/faraday@v2.14.0...v2.14.1

v2.14.0

What's Changed

New features ✨

Use newer UnprocessableContent naming for 422 by @tylerhunt in lostisland/faraday#1638

Fixes 🐞

Convert strings to UTF-8 by @c960657 in lostisland/faraday#1624

Fix Response#to_hash when response not finished yet by @yykamei in lostisland/faraday#1639

Misc/Docs 📄

Lint: use filter_map by @olleolleolle in lostisland/faraday#1637

Bump actions/checkout from v4 to v5 by @dependabot[bot] in lostisland/faraday#1636

Fixes documentation by @dharamgollapudi in lostisland/faraday#1635

New Contributors

@c960657 made their first contribution in lostisland/faraday#1624

@dharamgollapudi made their first contribution in lostisland/faraday#1635

@tylerhunt made their first contribution in lostisland/faraday#1638

Full Changelog: lostisland/faraday@v2.13.4...v2.14.0

v2.13.4

What's Changed

Improve error handling logic and add missing test coverage by @iMacTia in lostisland/faraday#1633

Full Changelog: lostisland/faraday@v2.13.3...v2.13.4

v2.13.3

What's Changed

Fix type assumption in Faraday::Error by @iMacTia in lostisland/faraday#1630

... (truncated)

Commits

16cbd38 Version bump to 2.14.1
a6d3a3a Merge commit from fork
b23f710 Explicit top-level namespace reference (#1657)
49ba4ac Bump actions/checkout from 5 to 6 (#1655)
51a49bc Ensure Claude reads the guidelines and allow to plan in a gitignored .ai/PLAN...
894f65c Add RFC document for Options architecture refactoring plan (#1644)
397e3de Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot ...
d98c65c Update Faraday-specific AI agent guidelines
56c18ec Add AI agent guidelines specific to Faraday repository
3201a42 Version bump to 2.14.0
Additional commits viewable in compare view

Updates uri from 0.13.0 to 1.1.1

Release notes

Sourced from uri's releases.

v1.1.1

What's Changed

Re-allow consecutive, leading and trailing dots in EMAIL_REGEXP by @osyoyu in ruby/uri#189

New Contributors

@osyoyu made their first contribution in ruby/uri#189

Full Changelog: ruby/uri@v1.1.0...v1.1.1

v1.1.0

What's Changed

Update to use the latest version of setup-ruby and bump up to Ruby 3.4 by @hsbt in ruby/uri#158

Fix the mention to removed URI.escape/URI::Escape by @y-yagi in ruby/uri#146

Use a fully qualified name in warning messages by @y-yagi in ruby/uri#150

Support Ractor#value by @hsbt in ruby/uri#163

Removed unnecessary workaround by @hsbt in ruby/uri#164

Escape reserved characters in scheme name by @nobu in ruby/uri#148

[DOC] State that uri library is needed to call Kernel#URI by @nobu in ruby/uri#167

Prefer dedicated assertion methods by @nobu in ruby/uri#169

Fix the message for unexpected argument by @nobu in ruby/uri#171

Make URI::regexp schemes case sensitive (#38) by @nobu in ruby/uri#170

The local part should not contain leading or trailing dots in the EMAIL_REGEXP by @nlevchuk in ruby/uri#124

More checks in EMAIL_REGEXP by @nobu in ruby/uri#172

Do not allow empty host names, as they are not allowed by RFC 3986 by @jeremyevans in ruby/uri#116

Improve performance of URI::MailTo::EMAIL_REGEXP by @nobu in ruby/uri#173

Performance test stability by @nobu in ruby/uri#174

Update documents that used URI::Parser by @nobu in ruby/uri#175

Add a workflow to sync commits to ruby/ruby by @k0kubun in ruby/uri#183

Add irb to the Gemfile to fix the warning by @y-yagi in ruby/uri#182

Replace reference to the obsolete URI.escape with URI::RFC2396_PARSER.escape by @vivshaw in ruby/uri#166

Switch a parsing behavior completely when switching a parser by @y-yagi in ruby/uri#161

improve error message by @soda92 in ruby/uri#130

Use generic version number to VERSION by @hsbt in ruby/uri#187

New Contributors

@y-yagi made their first contribution in ruby/uri#146

@nlevchuk made their first contribution in ruby/uri#124

@vivshaw made their first contribution in ruby/uri#166

@soda92 made their first contribution in ruby/uri#130

Full Changelog: ruby/uri@v1.0.4...v1.1.0

v1.0.4

Security fixes

CVE-2025-61594

... (truncated)

Commits

f1b05c8 v1.1.1
8557e8d Merge pull request #189 from osyoyu/restore-whatwg-email-regexp
c551d70 Re-allow consecutive, leading and trailing dots in EMAIL_REGEXP
c41903b v1.1.0
b433f34 Merge pull request #187 from ruby/switch-version-code
1fc4f04 Use generic version number to VERSION and generate VERSION_CODE from that
e830680 Exclude dependabot updates from release note
70d245f Merge pull request #130 from soda92/improve-error-message
d629c8c Merge pull request #161 from y-yagi/fix_changing_parser
fec6733 Merge pull request #166 from vivshaw/vivshaw/correct-obsolete-parse
Additional commits viewable in compare view

Updates webrick from 1.8.1 to 1.8.2

Release notes

Sourced from webrick's releases.

v1.8.2

What's Changed

Drop commented-out line by @olleolleolle in ruby/webrick#108

Add Ruby 3.1 & 3.2 to CI matrix by @tricknotes in ruby/webrick#109

Fix/redos by @ooooooo-q in ruby/webrick#114

Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by @jeremyevans in ruby/webrick#120

Bump actions/checkout from 3 to 4 by @dependabot in ruby/webrick#121

Improve CI by @hsbt in ruby/webrick#123

Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by @KJTsanaktsidis in ruby/webrick#128

Fix bug chunk extension detection by @jeremyevans in ruby/webrick#125

Fix CI. by @ioquatix in ruby/webrick#131

Merge multiple cookie headers, preserving semantic correctness. by @ioquatix in ruby/webrick#130

Test on macos-latest by @byroot in ruby/webrick#132

Require CRLF line endings in request line and headers by @jeremyevans in ruby/webrick#138

Prefer squigly heredocs. by @ioquatix in ruby/webrick#143

Only strip space and horizontal tab in headers by @jeremyevans in ruby/webrick#141

Treat missing CRLF separator after headers as an EOFError by @jeremyevans in ruby/webrick#142

Return 400 response for chunked requests with unexpected data after chunk by @jeremyevans in ruby/webrick#136

Fix reference to URI::REGEXP::PATTERN::HOST by @casperisfine in ruby/webrick#144

Prevent request smuggling by @jeremyevans in ruby/webrick#146

New Contributors

@tricknotes made their first contribution in ruby/webrick#109

@ooooooo-q made their first contribution in ruby/webrick#114

@KJTsanaktsidis made their first contribution in ruby/webrick#128

@byroot made their first contribution in ruby/webrick#132

@casperisfine made their first contribution in ruby/webrick#144

Full Changelog: ruby/webrick@v1.8.1...v1.8.2

Commits

0fb9de6 Bump up v1.8.2
b9a4c81 Removed trailing spaces
f5faca9 Prevent request smuggling
0c600e1 Fix reference to URI::REGEXP::PATTERN::HOST
15a9391 Return 400 response for chunked requests with unexpected data after chunk
2b38d56 Treat missing CRLF separator after headers as an EOFError
e4efb4a Remove unnecessary gsub calls in test_httprequest.rb
426e214 Only strip space and horizontal tab in headers
e72cb69 Prefer squigly heredocs. (#143)
ee60354 Require CRLF line endings in request line and headers
Additional commits viewable in compare view

Updates net-imap from 0.4.14 to 0.4.20

Release notes

Sourced from net-imap's releases.

v0.4.20

What's Changed

🔒 Security

This release backports two features to prevent unbounded memory use: the response_handlers keyword argument to Net::IMAP.new so response handlers can be added before the server can send any responses (ruby/net-imap#427), and the max_response_size config attribute (ruby/net-imap#445, GHSA-j3g3-5qv5-52mj, CVE-2025-43857, reported by @Masamuneee).

[!NOTE] The default max_response_size is nil (unlimited), to avoid backward compatibility issues with secure connections to trusted servers that are well-behaved. It can be configured more conservatively to guard against untrusted servers (for example, connecting to user-provided hostnames). It is the responsibility of net-imap users to configure their client appropriately for the server they are connecting to.

Known Issues

Fixed in v0.4.22: Ruby 3.0.0 through 3.0.2 on Mac OS crash when net/imap is required (ruby/net-imap#471).

[!IMPORTANT] This is fixed by Ruby 3.0.3, which was released 2021-11-24. Ruby 3.0.7 was released on 2024-04-23. Ruby 3.0 has reached its EOL.

If you are affected by ruby/net-imap#471, upgrading Ruby is much more important than upgrading net-imap!

Added

✨ Add response_handlers kwarg to Net::IMAP.new by @nevans in ruby/net-imap#427

Backports #419

✨ Limit max_response_size by @nevans in ruby/net-imap#445

Backports #444

Documentation

📚 Backport documentation to v0.4 by @nevans in ruby/net-imap#426

Backports #418, #420, documentation only from #416, and #424

Other Changes

♻️ Update versioned default configs by @nevans in ruby/net-imap#413

Backports #412

♻️ Refactor get_response by @nevans in ruby/net-imap#431

Backports #422

♻️ Rational config versions by @nevans in ruby/net-imap#430

Backports #429

♻️ Extract ResponseReader from get_response by @nevans in ruby/net-imap#434

Backports #433

♻️ Refactoring by @nevans in ruby/net-imap#436

Backports #417 and #435

Miscellaneous

✅ Various test improvements to v0.4 by @nevans in ruby/net-imap#425

Backports #414, #415, #421, and assert_pattern from minitest (originally in #333)

Full Changelog: ruby/net-imap@v0.4.19...v0.4.20

v0.4.19

What's Changed

... (truncated)

Commits

5b8f9ae 🔖 Bump version to 0.4.20
8222a36 🔀 Merge pull request #445 from ruby/backport/v0.4-max_response_size
641c4c4 ✅ Fix backport compatibility with ruby 2.7
19bea63 ✨ Make max_response_size configurable
ddcaabd ✨ Limit max response size to 512MiB (hard-coded)
2ca4dbc 🔀 Merge pull request #436 from ruby/backport/v0.4-refactor-config-and-respons...
9279f8a ✅ Fix backport compatibility with ruby 2.7
0e27fc1 ♻️ Save ResponseReader ivars: @buff & @literal_size
17064cd ✅ Fix backport compatibility with ruby 2.7
e4bb734 ✨ Fix Config::AttrTypeCoercion for Ractor sharing
Additional commits viewable in compare view

Updates nokogiri from 1.16.7 to 1.19.1

Release notes

Sourced from nokogiri's releases.

v1.19.1 / 2026-02-16

Security

[CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

cfdb0eafd9a554a88f12ebcc688d2b9005f9fce42b00b970e3dc199587b27f32  nokogiri-1.19.1-aarch64-linux-gnu.gem
1e2150ab43c3b373aba76cd1190af7b9e92103564063e48c474f7600923620b5  nokogiri-1.19.1-aarch64-linux-musl.gem
0a39ed59abe3bf279fab9dd4c6db6fe8af01af0608f6e1f08b8ffa4e5d407fa3  nokogiri-1.19.1-arm-linux-gnu.gem
3a18e559ee499b064aac6562d98daab3d39ba6cbb4074a1542781b2f556db47d  nokogiri-1.19.1-arm-linux-musl.gem
dfe2d337e6700eac47290407c289d56bcf85805d128c1b5a6434ddb79731cb9e  nokogiri-1.19.1-arm64-darwin.gem
1e0bda88b1c6409f0edb9e0c25f1bf9ff4fa94c3958f492a10fcf50dda594365  nokogiri-1.19.1-java.gem
110d92ae57694ae7866670d298a5d04cd150fae5a6a7849957d66f171e6aec9b  nokogiri-1.19.1-x64-mingw-ucrt.gem
7093896778cc03efb74b85f915a775862730e887f2e58d6921e3fa3d981e68bf  nokogiri-1.19.1-x86_64-darwin.gem
1a4902842a186b4f901078e692d12257678e6133858d0566152fe29cdb98456a  nokogiri-1.19.1-x86_64-linux-gnu.gem
4267f38ad4fc7e52a2e7ee28ed494e8f9d8eb4f4b3320901d55981c7b995fc23  nokogiri-1.19.1-x86_64-linux-musl.gem
598b327f36df0b172abd57b68b18979a6e14219353bca87180c31a51a00d5ad3  nokogiri-1.19.1.gem

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

Introduce native gem support for Ruby 4.0. #3590
End support for Ruby 3.1, for which upstream support ended 2025-03-26.
End support for JRuby 9.4 (which targets Ruby 3.1 compatibility).

11a97ecc3c0e7e5edcf395720b10860ef493b768f6aa80c539573530bc933767  nokogiri-1.19.0-aarch64-linux-gnu.gem
eb70507f5e01bc23dad9b8dbec2b36ad0e61d227b42d292835020ff754fb7ba9  nokogiri-1.19.0-aarch64-linux-musl.gem
572a259026b2c8b7c161fdb6469fa2d0edd2b61cd599db4bbda93289abefbfe5  nokogiri-1.19.0-arm-linux-gnu.gem
23ed90922f1a38aed555d3de4d058e90850c731c5b756d191b3dc8055948e73c  nokogiri-1.19.0-arm-linux-musl.gem
0811dfd936d5f6dd3f6d32ef790568bf29b2b7bead9ba68866847b33c9cf5810  nokogiri-1.19.0-arm64-darwin.gem
5f3a70e252be641d8a4099f7fb4cc25c81c632cb594eec9b4b8f2ca8be4374f3  nokogiri-1.19.0-java.gem
05d7ed2d95731edc9bef2811522dc396df3e476ef0d9c76793a9fca81cab056b  nokogiri-1.19.0-x64-mingw-ucrt.gem
1dad56220b603a8edb9750cd95798bffa2b8dd9dd9aa47f664009ee5b43e3067  nokogiri-1.19.0-x86_64-darwin.gem
f482b95c713d60031d48c44ce14562f8d2ce31e3a9e8dd0ccb131e9e5a68b58c  nokogiri-1.19.0-x86_64-linux-gnu.gem
1c4ca6b381622420073ce6043443af1d321e8ed93cc18b08e2666e5bd02ffae4  nokogiri-1.19.0-x86_64-linux-musl.gem
e304d21865f62518e04f2bf59f93bd3a97ca7b07e7f03952946d8e1c05f45695  nokogiri-1.19.0.gem

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.1 / 2026-02-16

Security

[CRuby] Address unchecked return value from xmlC14NExecute which was a contributing cause to ruby-saml GHSA-x4h9-gwv3-r4m4. See GHSA-wx95-c6cv-8532 for more information.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

Introduce native gem support for Ruby 4.0. #3590

End support for Ruby 3.1, for which upstream support ended 2025-03-26.

End support for JRuby 9.4 (which targets Ruby 3.1 compatibility).

v1.18.10 / 2025-09-15

Dependencies

[CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.

[CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18

v1.18.9 / 2025-07-20

Security

[CRuby] Applied upstream libxml2 patches to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796. See GHSA-353f-x4gh-cqq8 for more information.

v1.18.8 / 2025-04-21

Security

[CRuby] Vendored libxml2 is updated to v2.13.8 to address CVE-2025-32414 and CVE-2025-32415. See GHSA-5w6v-399v-w3cc for more information.

v1.18.7 / 2025-03-31

Dependencies

[CRuby] Vendored libxml2 is updated to v2.13.7, which is a bugfix release.

v1.18.6 / 2025-03-24

Fixed

... (truncated)

Commits

d913045 version bump to v1.19.1
b81cb98 doc: update CHANGELOG for upcoming v1.19.1
8e66809 C14n raise on failure (#3600)
5b77f3d Raise RuntimeError when canonicalization fails
edc5595 Thank sponsors in the README
d4dc245 dep: update rdoc to v7
d77bfb6 version bump to v1.19.0
1eb5c2c dev: convert scripts/test-gem-set to use mise
88a120f dep: Add native Ruby 4 support, drop Ruby 3.1 support (v1.19.x) (#3592)
f8c8f74 Skip the parser compression test for Windows system libs
Additional commits viewable in compare view

Updates rack from 2.2.9 to 2.2.22

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.

CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

SPEC Changes

Define rack.response_finished callback arguments more strictly. (#2365, @skipkayhil)

Added

Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @codergeek121)

Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @skipkayhil)

Add support for streaming bodies when using Rack::Events. (#2375, Description has been truncated

Bumps the bundler group with 4 updates in the /docs directory: [webrick](https://github.com/ruby/webrick), [nokogiri](https://github.com/sparklemotion/nokogiri), [rexml](https://github.com/ruby/rexml) and [faraday](https://github.com/lostisland/faraday). Bumps the bundler group with 5 updates in the /gemfiles/rails_61 directory: | Package | From | To | | --- | --- | --- | | [webrick](https://github.com/ruby/webrick) | `1.8.1` | `1.8.2` | | [net-imap](https://github.com/ruby/net-imap) | `0.4.14` | `0.4.20` | | [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.16.7` | `1.19.1` | | [rack](https://github.com/rack/rack) | `2.2.9` | `2.2.22` | | [rexml](https://github.com/ruby/rexml) | `3.3.6` | `3.4.2` | Bumps the bundler group with 5 updates in the /gemfiles/rails_70 directory: | Package | From | To | | --- | --- | --- | | [webrick](https://github.com/ruby/webrick) | `1.8.1` | `1.8.2` | | [net-imap](https://github.com/ruby/net-imap) | `0.4.14` | `0.4.20` | | [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.16.7` | `1.19.1` | | [rack](https://github.com/rack/rack) | `2.2.9` | `2.2.22` | | [rexml](https://github.com/ruby/rexml) | `3.3.6` | `3.4.2` | Bumps the bundler group with 7 updates in the /gemfiles/rails_71 directory: | Package | From | To | | --- | --- | --- | | [webrick](https://github.com/ruby/webrick) | `1.8.1` | `1.8.2` | | [activerecord](https://github.com/rails/rails) | `7.1.4` | `7.1.5.2` | | [net-imap](https://github.com/ruby/net-imap) | `0.4.14` | `0.4.20` | | [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.16.7` | `1.19.1` | | [rack](https://github.com/rack/rack) | `3.1.7` | `3.1.20` | | [rack-session](https://github.com/rack/rack-session) | `2.0.0` | `2.1.1` | | [rexml](https://github.com/ruby/rexml) | `3.3.6` | `3.4.2` | Updates `webrick` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/ruby/webrick/releases) - [Commits](ruby/webrick@v1.8.1...v1.8.2) Updates `nokogiri` from 1.16.7 to 1.19.1 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.16.7...v1.19.1) Updates `rexml` from 3.3.6 to 3.4.2 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.3.6...v3.4.2) Updates `faraday` from 2.10.1 to 2.14.1 - [Release notes](https://github.com/lostisland/faraday/releases) - [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md) - [Commits](lostisland/faraday@v2.10.1...v2.14.1) Updates `uri` from 0.13.0 to 1.1.1 - [Release notes](https://github.com/ruby/uri/releases) - [Commits](ruby/uri@v0.13.0...v1.1.1) Updates `webrick` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/ruby/webrick/releases) - [Commits](ruby/webrick@v1.8.1...v1.8.2) Updates `net-imap` from 0.4.14 to 0.4.20 - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](ruby/net-imap@v0.4.14...v0.4.20) Updates `nokogiri` from 1.16.7 to 1.19.1 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.16.7...v1.19.1) Updates `rack` from 2.2.9 to 2.2.22 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.9...v2.2.22) Updates `rexml` from 3.3.6 to 3.4.2 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.3.6...v3.4.2) Updates `webrick` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/ruby/webrick/releases) - [Commits](ruby/webrick@v1.8.1...v1.8.2) Updates `net-imap` from 0.4.14 to 0.4.20 - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](ruby/net-imap@v0.4.14...v0.4.20) Updates `nokogiri` from 1.16.7 to 1.19.1 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.16.7...v1.19.1) Updates `rack` from 2.2.9 to 2.2.22 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.9...v2.2.22) Updates `rexml` from 3.3.6 to 3.4.2 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.3.6...v3.4.2) Updates `webrick` from 1.8.1 to 1.8.2 - [Release notes](https://github.com/ruby/webrick/releases) - [Commits](ruby/webrick@v1.8.1...v1.8.2) Updates `activerecord` from 7.1.4 to 7.1.5.2 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v8.1.2/activerecord/CHANGELOG.md) - [Commits](rails/rails@v7.1.4...v7.1.5.2) Updates `activestorage` from 7.1.4 to 7.1.5.2 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v8.1.2/activestorage/CHANGELOG.md) - [Commits](rails/rails@v7.1.4...v7.1.5.2) Updates `net-imap` from 0.4.14 to 0.4.20 - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](ruby/net-imap@v0.4.14...v0.4.20) Updates `nokogiri` from 1.16.7 to 1.19.1 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.16.7...v1.19.1) Updates `rack` from 3.1.7 to 3.1.20 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.9...v2.2.22) Updates `rack-session` from 2.0.0 to 2.1.1 - [Release notes](https://github.com/rack/rack-session/releases) - [Changelog](https://github.com/rack/rack-session/blob/main/releases.md) - [Commits](rack/rack-session@v2.0.0...v2.1.1) Updates `rexml` from 3.3.6 to 3.4.2 - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.3.6...v3.4.2) --- updated-dependencies: - dependency-name: webrick dependency-version: 1.8.2 dependency-type: indirect dependency-group: bundler - dependency-name: nokogiri dependency-version: 1.19.1 dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-version: 3.4.2 dependency-type: indirect dependency-group: bundler - dependency-name: faraday dependency-version: 2.14.1 dependency-type: indirect dependency-group: bundler - dependency-name: uri dependency-version: 1.1.1 dependency-type: indirect dependency-group: bundler - dependency-name: webrick dependency-version: 1.8.2 dependency-type: direct:development dependency-group: bundler - dependency-name: net-imap dependency-version: 0.4.20 dependency-type: indirect dependency-group: bundler - dependency-name: nokogiri dependency-version: 1.19.1 dependency-type: indirect dependency-group: bundler - dependency-name: rack dependency-version: 2.2.22 dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-version: 3.4.2 dependency-type: indirect dependency-group: bundler - dependency-name: webrick dependency-version: 1.8.2 dependency-type: direct:development dependency-group: bundler - dependency-name: net-imap dependency-version: 0.4.20 dependency-type: indirect dependency-group: bundler - dependency-name: nokogiri dependency-version: 1.19.1 dependency-type: indirect dependency-group: bundler - dependency-name: rack dependency-version: 2.2.22 dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-version: 3.4.2 dependency-type: indirect dependency-group: bundler - dependency-name: webrick dependency-version: 1.8.2 dependency-type: direct:development dependency-group: bundler - dependency-name: activerecord dependency-version: 7.1.5.2 dependency-type: indirect dependency-group: bundler - dependency-name: activestorage dependency-version: 7.1.5.2 dependency-type: indirect dependency-group: bundler - dependency-name: net-imap dependency-version: 0.4.20 dependency-type: indirect dependency-group: bundler - dependency-name: nokogiri dependency-version: 1.19.1 dependency-type: indirect dependency-group: bundler - dependency-name: rack dependency-version: 3.1.20 dependency-type: indirect dependency-group: bundler - dependency-name: rack-session dependency-version: 2.1.1 dependency-type: indirect dependency-group: bundler - dependency-name: rexml dependency-version: 3.4.2 dependency-type: indirect dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-17T18:25:20Z

Superseded by #4.

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Feb 19, 2026

dependabot Bot closed this Mar 17, 2026

dependabot Bot deleted the dependabot/bundler/docs/bundler-7d673e032a branch March 17, 2026 18:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the bundler group across 4 directories with 10 updates#3

Bump the bundler group across 4 directories with 10 updates#3
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/docs/bundler-7d673e032a

dependabot Bot commented on behalf of github Feb 19, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 19, 2026

v1.8.2

What's Changed

New Contributors

v1.19.1 / 2026-02-16

Security

v1.19.0 / 2025-12-28

Ruby

v1.19.1 / 2026-02-16

Security

v1.19.0 / 2025-12-28

Ruby

v1.18.10 / 2025-09-15

Dependencies

v1.18.9 / 2025-07-20

Security

v1.18.8 / 2025-04-21

Security

v1.18.7 / 2025-03-31

Dependencies

v1.18.6 / 2025-03-24

Fixed

REXML 3.4.2 - 2025-08-26

Improvement

Fixes

3.4.2 - 2025-08-26 {#version-3-4-2}

Improvement

Fixes

v2.14.1

Security Note

What's Changed

New Contributors

v2.14.0

What's Changed

New features ✨

Fixes 🐞

Misc/Docs 📄

New Contributors

v2.13.4

What's Changed

v2.13.3

What's Changed

v1.1.1

What's Changed

New Contributors

v1.1.0

What's Changed

New Contributors

v1.0.4

Security fixes

v1.8.2

What's Changed

New Contributors

v0.4.20

What's Changed

🔒 Security

Known Issues

Added

Documentation

Other Changes

Miscellaneous

v0.4.19

What's Changed

v1.19.1 / 2026-02-16

Security

v1.19.0 / 2025-12-28

Ruby

v1.19.1 / 2026-02-16

Security

v1.19.0 / 2025-12-28

Ruby

v1.18.10 / 2025-09-15

Dependencies

v1.18.9 / 2025-07-20

Security

v1.18.8 / 2025-04-21

Security

v1.18.7 / 2025-03-31