🚨 [security] Update async-container 0.18.3 → 0.37.0 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ async-container (indirect, 0.18.3 → 0.37.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ bundler-audit (0.9.2 → 0.9.3) · Repo · Changelog

Release Notes

0.9.3

• Officially support Ruby 3.4, 3.5, and 4.0.
• Added support for Bundler 4.x.
• Fixed typos in API documentation.

CLI

• Ensure that the bundler-audit check command honors the BUNDLER_AUDIT_DB environment variable.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

• Updated the ChangeLog for 0.9.3.
• Version bump to 0.9.3.
• Added Ruby 4.0 to the CI matrix.
• Added Ruby 3.5 to the CI matrix.
• Require rubygems-tasks ~> 0.3 for Ruby 3.5 and 4.0.
• Allow using bundler 4.x
• Remove syntax highlighting from example output.
• Be consistent and only use markdown code fences.
• Fixed typo in `@return` tag.
• Update RubyGems in GitHub Actions CI (#406)
• Added Ruby 3.4 to the GitHub CI matrix.
• Disable new rubocops.
• Default `check --database` to `Database::DEFAULT_PATH`.
• Switched to using `Database::DEFAULT_PATH` instead of `Database.path`.
• Disable the `Gemspec/RequireMFA` rule since it's not aware of `gemspec.yml`.
• Added gem metadata and corrected links in gemspec.yml

↗️ async (indirect, 2.23.0 → 2.40.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ console (indirect, 1.29.3 → 1.36.0) · Repo · Changelog

Release Notes

1.36.0

• Add a size_limit to Console::Format::Safe (default 16KiB) which rebuilds oversized records field-by-field, keeping as many top-level fields as fit within the limit.
• Degraded fields are recorded in a truncated object that maps each field name to why it was truncated: true (dropped for size) or the error (the value could not be serialized directly and a safe representation was kept in its place).
• Rename Console::Format::Safe's limit: to depth_limit: (with a deprecated limit: alias) to clarify its purpose alongside the new size_limit:.

1.35.0

• Fix handling of Errno::ENODEV errors when calculating the width of a terminal that was been re-opened to File::NULL.

1.34.1 (from changelog)

• Add process_id to serialized output records for clarity (pid is still included for backwards compatibility).
  • Add object_id to serialized output records only when the subject is not a string or class/module.

1.34.0 (from changelog)

• Allow Console::Compatible::Logger#add to accept **options.

1.32.0 (from changelog)

• Add fiber_id to serialized output records to help identify which fiber logged the message.
• Ractor support appears broken in older Ruby versions, so we now require Ruby 3.4 or later for Ractor compatibility, if you need Ractor support.

1.31.0 (from changelog)

Ractor compatibility.

The console library now works correctly with Ruby's Ractor concurrency model. Previously, attempting to use console logging within Ractors would fail with errors about non-shareable objects. This has been fixed by ensuring the default configuration is properly frozen.

# This now works without errors:
ractor = Ractor.new do
require 'console'
Console.info('Hello from Ractor!')
'Ractor completed successfully'
end

result = ractor.take
puts result # => 'Ractor completed successfully'

The fix is minimal and maintains full backward compatibility while enabling safe parallel logging across multiple Ractors.

Symbol log level compatibility.

Previously, returning symbols from custom log_level methods in configuration files would cause runtime errors like "comparison of Integer with :debug failed". This has been fixed to properly convert symbols to their corresponding integer values.

# config/console.rb - This now works correctly:
def log_level(env = ENV)
	:debug  # Automatically converted to Console::Logger::LEVELS[:debug]
end

While this fix maintains backward compatibility, the recommended approach is still to use integer values directly:

# config/console.rb - Recommended approach:
def log_level(env = ENV)
	Console::Logger::LEVELS[:debug]  # Returns 0
end

Improved output format selection for cron jobs and email contexts.

When MAILTO environment variable is set (typically in cron jobs), the console library now prefers human-readable terminal output instead of JSON serialized output, even when the output stream is not a TTY. This ensures that cron job output sent via email is formatted in a readable way for administrators.

# Previously in cron jobs (non-TTY), this would output JSON:

# {"time":"2025-06-07T10:30:00Z","severity":"info","subject":"CronJob","message":["Task completed"]}

# Now with MAILTO set, it outputs human-readable format:
# 0.1s info: CronJob
# | Task completed

This change is conservative and only affects environments where MAILTO is explicitly set, ensuring compatibility with existing deployments.

1.30.0 (from changelog)

Introduce Console::Config for fine grained configuration.

Introduced a new explicit configuration interface via config/console.rb to enhance logging setup in complex applications. This update gives the application code an opportunity to load files if required and control aspects such as log level, output, and more. Users can override default behaviors (e.g., make_output, make_logger, and log_level) for improved customization.

# config/console.rb
def log_level(env = ENV)
# Set a custom log level, e.g., force debug mode:
:debug
end

def make_logger(output = $stderr, env = ENV, **options)
# Custom logger configuration with verbose output:
options[:verbose] = true

 <span class="pl-v">Logger</span><span class="pl-kos">.</span><span class="pl-en">new</span><span class="pl-kos">(</span><span class="pl-s1">output</span><span class="pl-kos">,</span> **<span class="pl-s1">options</span><span class="pl-kos">)</span>

end

This approach provides a standard way to hook into the log setup process, allowing tailored adjustments for reliable and customizable logging behavior.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 49 commits:

• Bump minor version.
• Add depth and size limits to Console::Format::Safe (#86)
• Bump patch version.
• Fix gem metadata.
• Add missing context files to gemspec.
• Bump minor version.
• Fix handling of Errno::ENODEV when getting terminal size. (#85)
• Modernize code.
• Align decimals in elapsed time display. (#84)
• Bump patch version.
• Fix `Console::Filter` dynamic class creation and severity chaining. (#83)
• Bump patch version.
• Make safe output a bit less likely to truncate data.
• Fix tests.
• Bump patch version.
• Modernize code.
• Improved serialized log format.
• Bump minor version.
• Allow options in compatible logger. (#79)
• Modernize code.
• Fix `Ractor` tests.
• Fix env handling in `Console::Output.new`.
• Bump minor version.
• Explicit support for GitHub actions.
• Bump minor version.
• 100% documentation coverage.
• Limit Ractor support to 3.4+.
• Modernize code.
• Log fiber_id in serialized output.
• Bump minor version.
• Fix Ractor compatibility by freezing default configuration
• RuboCop.
• Fix symbol log level handling in Filter initialization.
• Prefer text output when MAILTO is set for cron job email readability.
• `Terminal::Text` print style reset before newline (#76)
• Modernize code.
• Fix #78: Add missing to_hash method to Console::Event::Generic
• Bump patch version.
• Add missing require.
• Bump patch version.
• Update copyrights.
• Remove circular require
• Fix test.
• Bump minor version.
• Updated guides.
• More test coverage.
• Introduce `Console::Config` for better control over log setup. (#70)
• 100% documentation coverage. (#71)
• Add missing `logger` gem for tests on Ruby head.

↗️ fiber-storage (indirect, 1.0.0 → 1.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 5 commits:

• Bump patch version.
• fiber-storage.gemspec: Repeat homepage_uri metadata
• Test coverage on multiple Ruby versions.
• Add release notes.
• Modernize code.

↗️ io-event (indirect, 1.9.0 → 1.16.4) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ json (indirect, 2.10.2 → 2.20.0) · Repo · Changelog

Security Advisories 🚨

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ metrics (indirect, 0.12.1 → 0.15.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 13 commits:

• Bump minor version.
• Improved `Metrics::Tags.normalize(tags, into = nil)`.
• Bump patch version.
• Modernize code.
• Bump minor version.
• Add agent context.
• Don't call `prepare` in `metrics/provider.rb`.
• Bump minor version.
• Add `bake metrics:provider:list` command.
• Modernize code.
• Bump patch version.
• Modernize code.
• Fix warn log test.

↗️ traces (indirect, 0.15.2 → 0.18.2) · Repo · Changelog

Release Notes

0.18.1 (from changelog)

• Don't call prepare in traces/provider.rb. It can cause circular loading warnings.

0.18.0 (from changelog)

• W3C Baggage Support - Full support for W3C Baggage specification for application-specific context propagation.

New Context Propagation Interfaces

Traces#trace_context and Traces.trace_context are insufficient for efficient inter-process tracing when using OpenTelemetry. That is because OpenTelemetry has it's own "Context" concept with arbitrary key-value storage (of which the current span is one such key/value pair). Unfortunately, OpenTelemetry requires those values to be propagated "inter-process" while ignores them for "intra-process" tracing.

Therefore, in order to propagate this context, we introduce 4 new methods:

• Traces.current_context - Capture the current trace context for local propagation between execution contexts (threads, fibers).
• Traces.with_context(context) - Execute code within a specific trace context, with automatic restoration when used with blocks.
• Traces.inject(headers = nil, context = nil) - Inject W3C Trace Context headers into a headers hash for distributed propagation.
• Traces.extract(headers) - Extract trace context from W3C Trace Context headers.

The default implementation is built on top of Traces.trace_context, however these methods can be replaced by the backend. In that case, the context object is opaque, in other words it is library-specific, and you should not assume it is an instance of Traces::Context.

0.17.0 (from changelog)

• Remove support for resource: keyword argument with no direct replacement – use an attribute instead.

0.16.0 (from changelog)

• Introduce traces:provider:list command to list all available trace providers.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 20 commits:

• Bump patch version.
• Modernize code.
• Bump patch version.
• Don't call `prepare` in `traces/provider.rb`.
• Bump minor version.
• Missing documentation.
• Use test backend for testing.
• Modernize code.
• Add `Traces.current_context` and `Traces.with_context`.
• Bump minor version.
• Clean up bake task output.
• Drop support for `resource:` keyword argument.
• Bump patch version.
• Restore missing documentation.
• Bump patch version.
• Add missing bake files.
• Bump minor version.
• Modernize code.
• Add `traces:provider:list` bake command.
• Remove unused sus-fixtures-console test dependency.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

Go to the Depfu Dashboard to see the state of your dependencies and to customize how Depfu works.