Bump the ruby group with 3 updates by dependabot[bot] · Pull Request #16 · katalyst/basic-auth

dependabot · 2026-04-02T04:03:17Z

Bumps the ruby group with 3 updates: activesupport, rack and rubocop.

Updates activesupport from 8.1.2 to 8.1.3

Release notes

Sourced from activesupport's releases.

8.1.3

Active Support
Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result.

Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"}

After: hash.to_json # => {"custom_123":"value"}

Dan Sharp
Fix inflections to better handle overlapping acronyms.
ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "USD"
  inflect.acronym "USDC"
end
"USDC".underscore # => "usdc"
Said Kaldybaev
Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

zzak
Active Model

Fix Ruby 4.0 delegator warning when calling inspect on attributes.

Hammad Khan

Fix NoMethodError when deserialising Type::Integer objects marshalled under Rails 8.0.

The performance optimisation that replaced @range with @max/@min broke Marshal compatibility. Objects serialised under 8.0 (with @range) and deserialised under 8.1 (expecting @max/@min) would crash with undefined method '<=' for nil because Marshal.load restores instance variables without calling initialize.

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.3 (March 24, 2026)
Fix JSONGemCoderEncoder to correctly serialize custom object hash keys.

When hash keys are custom objects whose as_json returns a Hash, the encoder now calls to_s on the original key object instead of on the as_json result.

Before: hash = {CustomKey.new(123) => "value"} hash.to_json # => {"{:id=>123}":"value"}

After: hash.to_json # => {"custom_123":"value"}

Dan Sharp
Fix inflections to better handle overlapping acronyms.
ActiveSupport::Inflector.inflections(:en) do |inflect|
  inflect.acronym "USD"
  inflect.acronym "USDC"
end
"USDC".underscore # => "usdc"
Said Kaldybaev
Silence Dalli 4.0+ warning when using ActiveSupport::Cache::MemCacheStore.

zzak
Rails 8.1.2.1 (March 23, 2026)

Reject scientific notation in NumberConverter

[CVE-2026-33176]

Jean Boussier

Fix SafeBuffer#% to preserve unsafe status

[CVE-2026-33170]

Jean Boussier

Improve performance of NumberToDelimitedConverter

... (truncated)

Commits

fa8f081 Preparing for 8.1.3 release
63cef3d Merge branch '8-1-sec' into 8-1-stable
1db4b89 Preparing for 8.1.2.1 release
1c7d1cf Update changelog
ec1a0e2 Improve performance of NumberToDelimitedConverter
50d732a Fix SafeBuffer#% to preserve unsafe status
19dbab5 NumberConverter: reject scientific notation
c315744 Merge pull request #56889 from alpaca-tc/support-spring-on-test-environment
2ac86a8 Revert benchmark.rb to a silent shim (#56832)
8e8c955 Merge pull request #56785 from drsharp/dan/fix-json-encoder-bug
Additional commits viewable in compare view

Updates rack from 3.2.5 to 3.2.6

Release notes

Sourced from rack's releases.

v3.2.6

Full Changelog: rack/rack@v3.2.5...v3.2.6

Changelog

Sourced from rack's changelog.

[3.2.6] - 2026-04-01

Security

CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.

CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.

CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.

CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.

CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.

CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.

CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.

CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.

CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.

CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.

CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters.

CVE-2026-26962 Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.

Commits

e1f22fd Bump patch version.
31989fd Fix typo in test.
d268165 Fix test expectation.
8f425de Add Ruby v4.0 to the test matrix.
bf83042 Drop EOL Rubies from external tests.
d50c4d3 Implement OBS unfolding for multipart requests per RFC 5322 2.2.3
bfb6914 Limit the number of quoted escapes during multipart parsing
b3e5945 Add Content-Length size check in Rack::Multipart::Parser
7a8f326 Fix root prefix bug in Rack::Static
a57bc14 Only do a simple substitution on the x-accel-mapping paths
Additional commits viewable in compare view

Updates rubocop from 1.85.0 to 1.86.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.86.0

New features

#15000: Display ZJIT usage when running under LSP. (@koic)

#14961: Add AllowedParentClasses option to Style/EmptyClassDefinition. (@hammadkhan)

#14977: Support AllowedReceivers for Style/HashLookupMethod. (@koic)

Bug fixes

#15015: Fix Style/ConcatArrayLiterals autocorrect deleting code for percent literals with interpolation. (@bbatsov)

#14897: Detect constant reassignment after class/module definition in Lint/ConstantReassignment. (@ydakuka)

#11829: Fix false negatives for Lint/DuplicateMethods when duplicate methods are defined in anonymous classes and modules not assigned to a constant. (@Darhazer)

#14988: Fix false negative in Style/RedundantParentheses when redundant parentheses around range literals in block body. (@koic)

#14916: Fix false positive for Layout/MultilineMethodCallIndentation when method chain is inside a hash pair value passed to a multiline chained method call. (@ydakuka)

#15010: Fix a false positive for Lint/DuplicateMethods when modules blocks are passed as method arguments. (@5hun-s)

#15028: Fix a false positive for Lint/DuplicateMethods when the same method is defined in different anonymous module blocks passed to a no-receiver call (e.g. stub_const). (@Darhazer)

#15021: Fix false positives in Layout/EmptyLineAfterGuardClause when using a guard clause followed by a multi-line guard clause with raise, fail, return, break, or next. (@koic)

#15001: Fix false positives in Layout/RedundantLineBreak when setting InspectBlocks: true and using rescue or ensure in the block. (@koic)

#14997: Fix false positives in Style/FileOpen when assigning File.open to an instance variable, class variable, global variable, or constant. (@koic)

#15019: Fix false positives in Lint/DuplicateMethods when the same method is defined in anonymous module blocks passed to different receivers. (@koic)

#14987: Complete ERB and Haml autocorrection in a single run. (@alpaca-tc)

#15039: Fix incorrect autocorrect in Style/IfWithSemicolon when return with value is in the else branch. (@koic)

#14930: Fix incorrect autocorrection for Style/IfUnlessModifier when multiple if/unless modifier forms are on the same line inside a collection. (@ydakuka)

#14985: Fix incorrect autocorrection in Lint/SafeNavigationChain when chaining a method call after safe navigation in the if branch of a ternary. (@koic)

#15009: Fix infinite loop in Layout/EndAlignment when end is followed by || or &&. (@koic)

#14981: Fix spurious warning "does not support Safe/SafeAutoCorrect parameter" when those parameters are set for cops that don't have them in their default configuration. ([@dduugg][])

#15043: Fix an error for Lint/UselessDefaultValueArgument when fetch without a receiver is inside a fetch block. (@koic)

#15034: Fix incorrect autocorrection in Style/IfWithSemicolon when using single-line unless / ; / end. (@koic)

#15015: Fix Style/NonNilCheck autocorrect for receivers containing spaces. (@bbatsov)

#15015: Fix Style/RaiseArgs to allow anonymous keyword forwarding (raise Ex.new(**)). (@bbatsov)

#14890: Fix a false positive for Lint/RedundantCopDisableDirective when a rubocop:disable comment is used to suppress Lint/EmptyWhen, Lint/EmptyConditionalBody, Lint/EmptyInPattern, or Style/SymbolProc. ([@eugeneius][])

#15015: Fix false negative in Style/RedundantPercentQ for %q strings with interpolation-like syntax. (@bbatsov)

#14984: Fix Style/AndOr adding unnecessary parentheses around return without arguments. ([@eugeneius][])

#14945: Support files with multiple modifiers in Lint/UselessConstantScoping. ([@h-lame][])

#15015: Fix Style/TrailingMethodEndStatement to detect singleton methods (def self.foo). (@bbatsov)

#10822: Don't store results in cache if there are warnings. ([@jonas054][])

Changes

#14718: Allow setting MaxFilesInCache to false to entirely disable cache pruning. ([@byroot][])

#14989: Make Lint/RedundantSafeNavigation aware of safe navigation in conditional true branch. (@koic)

#15041: Remove mcp gem from runtime dependencies. (@koic)

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.86.0 (2026-03-23)

New features

#15000: Display ZJIT usage when running under LSP. ([@koic][])

#14961: Add AllowedParentClasses option to Style/EmptyClassDefinition. ([@hammadkhan][])

#14977: Support AllowedReceivers for Style/HashLookupMethod. ([@koic][])

Bug fixes

#15015: Fix Style/ConcatArrayLiterals autocorrect deleting code for percent literals with interpolation. ([@bbatsov][])

#14897: Detect constant reassignment after class/module definition in Lint/ConstantReassignment. ([@ydakuka][])

#11829: Fix false negatives for Lint/DuplicateMethods when duplicate methods are defined in anonymous classes and modules not assigned to a constant. ([@Darhazer][])

#14988: Fix false negative in Style/RedundantParentheses when redundant parentheses around range literals in block body. ([@koic][])

#14916: Fix false positive for Layout/MultilineMethodCallIndentation when method chain is inside a hash pair value passed to a multiline chained method call. ([@ydakuka][])

#15010: Fix a false positive for Lint/DuplicateMethods when modules blocks are passed as method arguments. ([@5hun-s][])

#15028: Fix a false positive for Lint/DuplicateMethods when the same method is defined in different anonymous module blocks passed to a no-receiver call (e.g. stub_const). ([@Darhazer][])

#15021: Fix false positives in Layout/EmptyLineAfterGuardClause when using a guard clause followed by a multi-line guard clause with raise, fail, return, break, or next. ([@koic][])

#15001: Fix false positives in Layout/RedundantLineBreak when setting InspectBlocks: true and using rescue or ensure in the block. ([@koic][])

#14997: Fix false positives in Style/FileOpen when assigning File.open to an instance variable, class variable, global variable, or constant. ([@koic][])

#15019: Fix false positives in Lint/DuplicateMethods when the same method is defined in anonymous module blocks passed to different receivers. ([@koic][])

#14987: Complete ERB and Haml autocorrection in a single run. ([@alpaca-tc][])

#15039: Fix incorrect autocorrect in Style/IfWithSemicolon when return with value is in the else branch. ([@koic][])

#14930: Fix incorrect autocorrection for Style/IfUnlessModifier when multiple if/unless modifier forms are on the same line inside a collection. ([@ydakuka][])

#14985: Fix incorrect autocorrection in Lint/SafeNavigationChain when chaining a method call after safe navigation in the if branch of a ternary. ([@koic][])

#15009: Fix infinite loop in Layout/EndAlignment when end is followed by || or &&. ([@koic][])

#14981: Fix spurious warning "does not support Safe/SafeAutoCorrect parameter" when those parameters are set for cops that don't have them in their default configuration. ([@dduugg][])

#15043: Fix an error for Lint/UselessDefaultValueArgument when fetch without a receiver is inside a fetch block. ([@koic][])

#15034: Fix incorrect autocorrection in Style/IfWithSemicolon when using single-line unless / ; / end. ([@koic][])

#15015: Fix Style/NonNilCheck autocorrect for receivers containing spaces. ([@bbatsov][])

#15015: Fix Style/RaiseArgs to allow anonymous keyword forwarding (raise Ex.new(**)). ([@bbatsov][])

#14890: Fix a false positive for Lint/RedundantCopDisableDirective when a rubocop:disable comment is used to suppress Lint/EmptyWhen, Lint/EmptyConditionalBody, Lint/EmptyInPattern, or Style/SymbolProc. ([@eugeneius][])

#15015: Fix false negative in Style/RedundantPercentQ for %q strings with interpolation-like syntax. ([@bbatsov][])

#14984: Fix Style/AndOr adding unnecessary parentheses around return without arguments. ([@eugeneius][])

#14945: Support files with multiple modifiers in Lint/UselessConstantScoping. ([@h-lame][])

#15015: Fix Style/TrailingMethodEndStatement to detect singleton methods (def self.foo). ([@bbatsov][])

#10822: Don't store results in cache if there are warnings. ([@jonas054][])

Changes

#14718: Allow setting MaxFilesInCache to false to entirely disable cache pruning. ([@byroot][])

#14989: Make Lint/RedundantSafeNavigation aware of safe navigation in conditional true branch. ([@koic][])

#15041: Remove mcp gem from runtime dependencies. ([@koic][])

1.85.1 (2026-03-03)

Bug fixes

#14958: Fix false positives in Style/FileOpen when File.open is passed as an argument or returned from a method. ([@sferik][])

#14973: Fix Style/ReduceToHash false positive when accumulator is read in key/value. ([@sferik][])

... (truncated)

Commits

2c1b30a Cut 1.86
d96701a Update Changelog
9b019c7 [Fix rubocop#14916] Fix false positive for `Layout/MultilineMethodCallIndenta...
a49271d Fix incorrect autocorrection for Style/IfUnlessModifier when multiple if/...
8d25311 Document MaxFilesInCache: false option for disabling cache pruning
12c7d39 Detect constant reassignment after class/module definition in `Lint/ConstantR...
fbf175c Allow disabling cache cleanup
3fcae5d [Fix #14961] Add AllowedParentClasses option to Style/EmptyClassDefinition
4eba3e6 Memoize forwarded arg lookups in ArgumentsForwarding
fc300c7 [Fix #10822] Don't cache if there are warnings
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the ruby group with 3 updates: [activesupport](https://github.com/rails/rails), [rack](https://github.com/rack/rack) and [rubocop](https://github.com/rubocop/rubocop). Updates `activesupport` from 8.1.2 to 8.1.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v8.1.3/activesupport/CHANGELOG.md) - [Commits](rails/rails@v8.1.2...v8.1.3) Updates `rack` from 3.2.5 to 3.2.6 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v3.2.5...v3.2.6) Updates `rubocop` from 1.85.0 to 1.86.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.85.0...v1.86.0) --- updated-dependencies: - dependency-name: activesupport dependency-version: 8.1.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ruby - dependency-name: rack dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ruby - dependency-name: rubocop dependency-version: 1.86.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Apr 2, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the ruby group with 3 updates#16

Bump the ruby group with 3 updates#16
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/bundler/ruby-492aa63064

dependabot bot commented on behalf of github Apr 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 2, 2026

8.1.3

Active Support

Active Model

Rails 8.1.3 (March 24, 2026)

Rails 8.1.2.1 (March 23, 2026)

v3.2.6

[3.2.6] - 2026-04-01

Security

RuboCop v1.86.0

New features

Bug fixes

Changes

1.86.0 (2026-03-23)

New features

Bug fixes

Changes

1.85.1 (2026-03-03)

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants