Skip to content

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Aug 14, 2025


🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!


Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (7.2.2.1 → 7.2.2.2) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actioncable (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailbox (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

↗️ actionmailer (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionpack (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actiontext (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionview (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activejob (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activemodel (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activerecord (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Security Advisories 🚨

🚨 Active Record logging vulnerable to ANSI escape injection

This vulnerability has been assigned the CVE identifier CVE-2025-55193

Impact

The ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

Releases

The fixed releases are available at the normal locations.

Credits

Thanks to lio346 for reporting this vulnerability

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activestorage (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activesupport (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ erb (indirect, 5.0.1 → 5.0.2) · Repo · Changelog

Release Notes

5.0.2 (from changelog)

  • Declare escape functions as Ractor-safe #63

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ io-console (indirect, 0.8.0 → 0.8.1) · Repo

Release Notes

0.8.1

What's Changed

  • Bump step-security/harden-runner from 2.10.2 to 2.10.3 by @dependabot[bot] in #84
  • Bump step-security/harden-runner from 2.10.3 to 2.10.4 by @dependabot[bot] in #85
  • Bump step-security/harden-runner from 2.10.4 to 2.11.0 by @dependabot[bot] in #86
  • Bump step-security/harden-runner from 2.11.0 to 2.11.1 by @dependabot[bot] in #87
  • Bump step-security/harden-runner from 2.11.1 to 2.12.0 by @dependabot[bot] in #89
  • Alias value or join to take in old Ruby by @hsbt in #91
  • Bump step-security/harden-runner from 2.12.0 to 2.12.1 by @dependabot[bot] in #92
  • Ignore ^C at interrupt test by @nobu in #93
  • Bump step-security/harden-runner from 2.12.1 to 2.12.2 by @dependabot[bot] in #94
  • Bump rubygems/release-gem from 1.1.0 to 1.1.1 by @dependabot[bot] in #83
  • Use host_os in RbConfig instead of RUBY_PLATFORM for JRuby by @nobu in #95
  • Fix removing unexpected control chars by @nobu in #96
  • Run have_func with the header providing the declarations by @nobu in #97

Full Changelog: v0.8.0...v0.8.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ net-imap (indirect, 0.5.8 → 0.5.9) · Repo

Release Notes

0.5.9

What's Changed

Added

  • ✨ Add Net::IMAP::SequenceSet() coercion method by @nevans in #490

Fixed

  • 🐛 Fix SequenceSet#include? handling of invalid inputs by @nevans in #479

Documentation

  • 📚🐛 Fix SequenceSet documentation errors by @nevans in #480
  • 📚🐛 Fix doc & error msg for SequenceSet coersion by @nevans in #483
  • 📚 RDoc updates for SequenceSet by @nevans in #489

Other Changes

  • ♻️ Short-circuit frozen SequenceSet modifications by @nevans in #473
  • 🐛 Always remove idle response handler after done by @nevans in #481
  • ♻️ Move SequenceSet autoload by @nevans in #491
  • ♻️ Avoid unnecessary allocation in SequenceSet[] by @nevans in #492
  • 🧵 Close socket in #disconnect before waiting for lock & thread join by @nevans in #493
  • 🧵 Improve synchronization of connection_state transitions by @nevans in #494

Miscellaneous

  • ♻️ Generate same stringprep tables with ruby 3.4 by @nevans in #469
  • ✅ CI: Mark ruby head on windows as "experimental" by @nevans in #472
  • ✅ Update Regexp.linear_time? tests for non-CRuby by @nevans in #477
  • ✅ Add timeouts to CI workflow by @nevans in #478
  • ✅ Update ResponseReader, UIDFetchData, DeprecatedClientOptions tests by @nevans in #476
  • ⏪ Revert #472 (✅ CI: Mark ruby head on windows as "experimental") by @nevans in #482
  • ➕ Add benchmark to Gemfile to silence warnings by @nevans in #486
  • ⬆️ Bump step-security/harden-runner from 2.12.0 to 2.12.1 by @dependabot in #488

Full Changelog: v0.5.8...v0.5.9

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.18.8 → 1.18.9) · Repo · Changelog

Security Advisories 🚨

🚨 Nokogiri patches vendored libxml2 to resolve multiple CVEs

Summary

Nokogiri v1.18.9 patches the vendored libxml2 to address CVE-2025-6021, CVE-2025-6170, CVE-2025-49794, CVE-2025-49795, and CVE-2025-49796.

Impact and severity

CVE-2025-6021

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

NVD claims a severity of 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/17d950ae

CVE-2025-6170

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.

NVD claims a severity of 2.5 Low (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L)

Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/5e9ec5c1

CVE-2025-49794

A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors.

NVD claims a severity of 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5

CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.

NVD claims a severity of 7.5 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/62048278

CVE-2025-49796

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

NVD claims a severity of 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Fixed by applying https://gitlab.gnome.org/GNOME/libxml2/-/commit/81cef8c5

Affected Versions

  • Nokogiri < 1.18.9 when using CRuby (MRI) with vendored libxml2

Patched Versions

  • Nokogiri >= 1.18.9

Mitigation

Upgrade to Nokogiri v1.18.9 or later.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against patched external libxml2 libraries which will also address these same issues.

References

Release Notes

1.18.9

v1.18.9 / 2025-07-20

Security

sha256 checksums

5bcfdf7aa8d1056a7ad5e52e1adffc64ef53d12d0724fbc6f458a3af1a4b9e32  nokogiri-1.18.9-aarch64-linux-gnu.gem
55e9e6ca46c4ad1715e313f407d8481d15be1e3b65d9f8e52ba1c124d01676a7  nokogiri-1.18.9-aarch64-linux-musl.gem
eea3f1f06463ff6309d3ff5b88033c4948d0da1ab3cc0a3a24f63c4d4a763979  nokogiri-1.18.9-arm64-darwin.gem
fe611ae65880e445a9c0f650d52327db239f3488626df4173c05beafd161d46e  nokogiri-1.18.9-arm-linux-gnu.gem
935605e14c0ba17da18d203922440bf6c0676c602659278d855d4622d756a324  nokogiri-1.18.9-arm-linux-musl.gem
ac5a7d93fd0e3cef388800b037407890882413feccca79eb0272a2715a82fa33  nokogiri-1.18.9.gem
1fe5b7aa4a054eda689a969bb4e03999960a6ea806582d327207d687168bceb5  nokogiri-1.18.9-java.gem
6b4fc1523aa0370c78653e38c94cb50e7f3ab786425de66ba7ad24222c1164a3  nokogiri-1.18.9-x64-mingw-ucrt.gem
e0d2deb03d3d7af8016e8c9df5ff4a7d692159cefb135cbb6a4109f265652348  nokogiri-1.18.9-x86_64-darwin.gem
b52f5defedc53d14f71eeaaf990da66b077e1918a2e13088b6a96d0230f44360  nokogiri-1.18.9-x86_64-linux-gnu.gem
e69359d6240c17e64cc9f43970d54f13bfc7b8cc516b819228f687e953425e69  nokogiri-1.18.9-x86_64-linux-musl.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ railties (indirect, 7.2.2.1 → 7.2.2.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rdoc (indirect, 6.14.0 → 6.14.2) · Repo · Changelog

Release Notes

6.14.2

What's Changed

🐛 Bug Fixes

  • Support markdown syntax in table cells by @st0012 in #1386

🛠 Other Changes

  • Fixup to usage of cgi/escape for Windows CI by @hsbt in #1378
  • Added gemspec file to gem package by @hsbt in #1379
  • Use GITHUB_TOKEN instead of admin credential by @hsbt in #1380
  • Bump step-security/harden-runner from 2.12.0 to 2.12.1 by @dependabot in #1377
  • test/lib/helper.rb is only for ruby/rdoc repository by @hsbt in #1372
  • Refactor PR preview workflow for improved approval process by @st0012 in #1370
  • Use repository_dispatch for previewing instead by @st0012 in #1384
  • Bump step-security/harden-runner from 2.12.1 to 2.12.2 by @dependabot in #1385
  • Fix template files location by @nobu in #1383
  • Bump version to 6.14.2 by @st0012 in #1387

Full Changelog: v6.14.0...v6.14.2

6.14.1

What's Changed

🛠 Other Changes

  • Fixup to usage of cgi/escape for Windows CI by @hsbt in #1378
  • Added gemspec file to gem package by @hsbt in #1379

Full Changelog: v6.14.0...v6.14.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ reline (indirect, 0.6.1 → 0.6.2) · Repo

Release Notes

0.6.2

What's Changed

✨ Enhancements

🐛 Bug Fixes

  • Rescue more errors in get/set_screen_size by @tompng in #824
  • Fix cursor positioning for invalid halfwidth dakuten/handakuten combinations by @moznion in #832
  • Fix quoted insert with invalid byte input by @tompng in #836
  • Don't print useless prompt before escape sequence by @tompng in #839

🛠 Other Changes

  • Enabled trusted publisher for rubygems.org by @hsbt in #828
  • Bump step-security/harden-runner from 2.12.0 to 2.12.1 by @dependabot[bot] in #830
  • Add validation for Encoding.default_external by @ksaito422 in #829
  • Bump step-security/harden-runner from 2.12.1 to 2.12.2 by @dependabot[bot] in #831
  • Add a test for non-ascii char input escaped with C-v by @tompng in #835
  • Update grapheme cluster width calculation by @tompng in #837
  • Support grapheme cluster that has width >= 3 by @tompng in #834
  • Bump version to 0.6.2 by @ima1zumi in #843

New Contributors

Full Changelog: v0.6.1...v0.6.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ thor (indirect, 1.3.2 → 1.4.0) · Repo · Changelog

Release Notes

1.4.0

What's Changed

New Contributors

Full Changelog: v1.3.2...v1.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.


Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Aug 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants