Skip to content

Bump the "all" group with 2 updates across multiple ecosystems#907

Merged
MikeMcQuaid merged 3 commits into
mainfrom
dependabot/all-153d28bb0a
Oct 13, 2025
Merged

Bump the "all" group with 2 updates across multiple ecosystems#907
MikeMcQuaid merged 3 commits into
mainfrom
dependabot/all-153d28bb0a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 13, 2025

Copy link
Copy Markdown
Contributor

Bumps the all group with 4 updates: json, prism, rack and uri.

Updates json from 2.15.0 to 2.15.1

Release notes

Sourced from json's releases.

v2.15.1

What's Changed

  • Fix incorrect escaping in the JRuby extension when encoding shared strings.

Full Changelog: ruby/json@v2.15.0...v2.15.1

Changelog

Sourced from json's changelog.

2025-10-07 (2.15.1)

  • Fix incorrect escaping in the JRuby extension when encoding shared strings.
Commits

Updates prism from 1.5.1 to 1.5.2

Release notes

Sourced from prism's releases.

v1.5.2

Changed

  • Fix character literal forced encoding when a unicode escape sequence is used.
  • Reject 1 if foo = bar baz.
  • Clear static literal flag on interpolated strings.
  • Reject optional argument/endless method definition ambiguity.
Changelog

Sourced from prism's changelog.

[1.5.2] - 2025-10-09

Changed

  • Fix character literal forced encoding when a unicode escape sequence is used.
  • Reject 1 if foo = bar baz.
  • Clear static literal flag on interpolated strings.
  • Reject optional argument/endless method definition ambiguity.
Commits
  • 5446f7b Merge pull request #3675 from ruby/bump-version
  • 7574837 Bump to v
  • 022d6d0 Merge pull request #3674 from Earlopain/endless-method-no-parens
  • e1910d4 For these special cases, there exists no optional argument type. Since a endl...
  • c89ca2a sync-ruby.yml: Fix the target push branch
  • c0f3ea7 Add a workflow to sync commits to ruby/ruby (#3673)
  • 3070615 Merge pull request #3672 from ruby/dependabot/bundler/gemfiles/typecheck/ruby...
  • 5e2a3af Merge pull request #3671 from ruby/dependabot/maven/java-wasm/java-deps-7d48a...
  • f6befc3 Bump sorbet
  • bde0629 Bump the java-deps group in /java-wasm with 4 updates
  • Additional commits viewable in compare view

Updates rack from 3.2.1 to 3.2.3

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

Security

  • CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.
  • CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

SPEC Changes

Added

  • Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @​codergeek121)
  • Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @​skipkayhil)
  • Add support for streaming bodies when using Rack::Events. (#2375, @​unflxw)

Changed

[3.2.2] - 2025-10-07

Security

  • CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)
  • CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
  • CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)
Commits
  • 32bf888 Bump patch version.
  • e179614 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
  • 57277b7 Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
  • 403b74b Normalize adivsories links.
  • fb395bb Fix handling of Errno::EPIPE in multipart tests.
  • bce149b Bump patch version.
  • 3beacfc Limit amount of retained data when parsing multipart requests
  • 589127f Fix denial of service vulnerbilties in multipart parsing
  • See full diff in compare view

Updates uri from 1.0.3 to 1.0.4

Release notes

Sourced from uri's releases.

v1.0.4

Security fixes

Full Changelog: ruby/uri@v1.0.3...v1.0.4

Commits

Bumps the all group with 2 updates: ruby/setup-ruby and pnpm/action-setup.

Updates ruby/setup-ruby from 1.263.0 to 1.265.0

Release notes

Sourced from ruby/setup-ruby's releases.

v1.265.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.264.0...v1.265.0

v1.264.0

What's Changed

Full Changelog: ruby/setup-ruby@v1.263.0...v1.264.0

Commits

Updates pnpm/action-setup from 4.1.0 to 4.2.0

Release notes

Sourced from pnpm/action-setup's releases.

v4.2.0

When there's a .npmrc file at the root of the repository, pnpm will be fetched from the registry that is specified in that .npmrc file #179

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the all group with 4 updates
50b679f 
Bumps the all group with 4 updates: [json](https://github.com/ruby/json), [prism](https://github.com/ruby/prism), [rack](https://github.com/rack/rack) and [uri](https://github.com/ruby/uri).


Updates `json` from 2.15.0 to 2.15.1
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v2.15.0...v2.15.1)

Updates `prism` from 1.5.1 to 1.5.2
- [Release notes](https://github.com/ruby/prism/releases)
- [Changelog](https://github.com/ruby/prism/blob/main/CHANGELOG.md)
- [Commits](ruby/prism@v1.5.1...v1.5.2)

Updates `rack` from 3.2.1 to 3.2.3
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v3.2.1...v3.2.3)

Updates `uri` from 1.0.3 to 1.0.4
- [Release notes](https://github.com/ruby/uri/releases)
- [Commits](ruby/uri@v1.0.3...v1.0.4)
build(deps): bump the all group with 2 updates

Bumps the all group with 2 updates: [ruby/setup-ruby](https://github.com/ruby/setup-ruby) and [pnpm/action-setup](https://github.com/pnpm/action-setup).


Updates `ruby/setup-ruby` from 1.263.0 to 1.265.0
- [Release notes](https://github.com/ruby/setup-ruby/releases)
- [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb)
- [Commits](ruby/setup-ruby@0481980...ab177d4)

Updates `pnpm/action-setup` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@a7487c7...41ff726)

---
updated-dependencies:
- dependency-name: json
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: prism
  dependency-version: 1.5.2
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: rack
  dependency-version: 3.2.3
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: uri
  dependency-version: 1.0.4
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: all
- dependency-name: ruby/setup-ruby
  dependency-version: 1.265.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
- dependency-name: pnpm/action-setup
  dependency-version: 4.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code ruby Pull requests that update Ruby code labels Oct 13, 2025
@MikeMcQuaid MikeMcQuaid enabled auto-merge October 13, 2025 13:20
@MikeMcQuaid MikeMcQuaid merged commit 21b3ade into main Oct 13, 2025
47 checks passed
@MikeMcQuaid MikeMcQuaid deleted the dependabot/all-153d28bb0a branch October 13, 2025 13:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code ruby Pull requests that update Ruby code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MikeMcQuaid