Skip to content

Bump activesupport from 8.0.2 to 8.0.4.1#3270

Merged
ajpallares merged 1 commit into
mainfrom
dependabot/bundler/activesupport-8.0.4.1
Mar 24, 2026
Merged

Bump activesupport from 8.0.2 to 8.0.4.1#3270
ajpallares merged 1 commit into
mainfrom
dependabot/bundler/activesupport-8.0.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 23, 2026

Copy link
Copy Markdown
Contributor

Bumps activesupport from 8.0.2 to 8.0.4.1.

Release notes

Sourced from activesupport's releases.

8.0.4.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • No changes.

Active Job

  • No changes.

... (truncated)

Commits
  • a79efed Preparing for 8.0.4.1 release
  • ac7979b Update changelog
  • 29154f1 Improve performance of NumberToDelimitedConverter
  • 6e8a811 Fix SafeBuffer#% to preserve unsafe status
  • ee2c59e NumberConverter: reject scientific notation
  • 5b6ad9d Lock some dependencies
  • 624fe3c Preparing for 8.0.4 release
  • 0ddf2c9 Delete test that now fails with new version of benchmark gem
  • 3c7a8a8 Merge pull request #55864 from RicardoTrindade/patch-2
  • 00e1dfa Merge pull request #55840 from zzak/asup-xml-mini-bigdecimal-float-precision
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note

Low Risk
Low risk since this only updates Gemfile.lock, but it may slightly affect tooling behavior by upgrading activesupport and a few transitive gems (minitest, uri, connection_pool, etc.).

Overview
Bumps activesupport from 8.0.2 to 8.0.4.1 via Gemfile.lock, pulling in updated constraints (notably minitest < 6).

Also refreshes several transitive gem versions in the lockfile, including concurrent-ruby, connection_pool, i18n, minitest, and uri.

Written by Cursor Bugbot for commit 86e874b. This will update automatically on new commits. Configure here.

Bumps [activesupport](https://github.com/rails/rails) from 8.0.2 to 8.0.4.1.
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v8.0.2...v8.0.4.1)

---
updated-dependencies:
- dependency-name: activesupport
  dependency-version: 8.0.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Mar 23, 2026
@dependabot dependabot Bot requested a review from a team as a code owner March 23, 2026 21:13
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Mar 23, 2026
@codecov

codecov Bot commented Mar 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.38%. Comparing base (1347bf4) to head (86e874b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3270   +/-   ##
=======================================
  Coverage   79.38%   79.38%           
=======================================
  Files         357      357           
  Lines       14347    14347           
  Branches     1959     1959           
=======================================
  Hits        11389    11389           
  Misses       2154     2154           
  Partials      804      804           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ajpallares ajpallares added this pull request to the merge queue Mar 24, 2026
Merged via the queue into main with commit c6f7c10 Mar 24, 2026
35 checks passed
@ajpallares ajpallares deleted the dependabot/bundler/activesupport-8.0.4.1 branch March 24, 2026 07:20
github-merge-queue Bot pushed a commit that referenced this pull request Mar 26, 2026
**This is an automatic release.**

## RevenueCat SDK
### 🐞 Bugfixes
* [EXTERNAL] fix: ensure activity is attached before showing in-app
messages (#3274) contributed by @matteinn (#3275) via Toni Rico
(@tonidero)
* Ensure MediaPlayer has dedicated thread owner that is not the main
thread (#3148) via Jacob Rakidzich (@JZDesign)
* Fix heartbeat monitor and Slack notifications for nightly integration
tests (#3259) via Rick (@rickvdl)

## RevenueCatUI SDK
### Paywallv2
#### ✨ New Features
* Feat: Restore gating in paywalls UI (#3171) via Jacob Rakidzich
(@JZDesign)

### 🔄 Other Changes
* security: pin GitHub Actions to SHA hashes (#3272) via Alfonso
Embid-Desmet (@alfondotnet)
* Bump activesupport from 8.0.2 to 8.0.4.1 (#3270) via dependabot[bot]
(@dependabot[bot])
* Merge release PR after deploy (#3269) via Antonio Pallares
(@ajpallares)
* Require PR approval before release tagging (#3268) via Antonio
Pallares (@ajpallares)
* Bump json from 2.18.1 to 2.19.2 (#3261) via dependabot[bot]
(@dependabot[bot])
* feat(ads): update admob sample app (#3264) via Peter Porfy
(@peterporfy)
* feat(ads): add vanilla-ad-tracker-sample (#3263) via Peter Porfy
(@peterporfy)
* [Purchase Tester]: Persist appUserId on login screen across app
launches (#3266) via Will Taylor (@fire-at-will)

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> Mostly release automation and versioning changes, but it modifies
CI/orb references and deploy/merge automation, which could affect the
release pipeline if misconfigured.
> 
> **Overview**
> Cuts the `9.28.0` release by removing `-SNAPSHOT` across version
sources (`.version`, `gradle.properties`, `Config.frameworkVersion`) and
updating sample/test-app dependency pins to `9.28.0`.
> 
> Updates release documentation: publishes Dokka docs to the `9.28.0` S3
path, updates `docs/index.html` redirect to `9.28.0`, and rolls
`CHANGELOG.latest.md` into a new `9.28.0` section in `CHANGELOG.md`.
> 
> Tweaks release tooling/CI: pins `fastlane-plugin-revenuecat_internal`
to a specific git ref (and bumps a few Ruby deps), switches the CircleCI
`revenuecat/sdks-common-config` orb to a dev commit, and adds a
temporary `test_merge_queue` workflow to exercise
`revenuecat/merge-release-pr` with `use_merge_queue: true`.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
5050888. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant