Bump the bundler group across 1 directory with 6 updates

[dependabot]

Bumps the bundler group with 4 updates in the / directory: oauth2, activestorage, msgpack and websocket-driver.

Updates oauth2 from 2.0.18 to 2.0.22

Release notes

Sourced from oauth2's releases.

v2.0.22

2.0.22 - 2026-06-07

• TAG: v2.0.22
• COVERAGE: 100.00% -- 542/542 lines in 15 files
• BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
• 88.35% documented

Changed

• Raised generated development tooling floors to kettle-dev >= 2.1.1 and version_gem >= 1.1.11.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• [GHSA-pp92-crg2-gfv9] Prevent protocol-relative redirect Location values from changing request authority, and strip Authorization headers from cross-origin redirects.

Official Discord 👉️

Many paths lead to being a sponsor or a backer of this project. Are you on such a path?

... (truncated)

Changelog

Sourced from oauth2's changelog.

[2.0.22] - 2026-06-07

• TAG: [v2.0.22][2.0.22t]
• COVERAGE: 100.00% -- 542/542 lines in 15 files
• BRANCH COVERAGE: 100.00% -- 180/180 branches in 15 files
• 88.35% documented

Changed

• Raised generated development tooling floors to kettle-dev >= 2.1.1 and version_gem >= 1.1.11.
• Raised the runtime dependency floor for snaky_hash to >= 2.0.5.

Security

• GHSA-pp92-crg2-gfv9 Prevent protocol-relative redirect Location values from changing request authority, and strip Authorization headers from cross-origin redirects by @​tonghuaroot and @​pboling

[2.0.21] - 2026-06-06

• TAG: [v2.0.21][2.0.21t]
• COVERAGE: 100.00% -- 525/525 lines in 15 files
• BRANCH COVERAGE: 100.00% -- 174/174 branches in 15 files
• 88.35% documented

Added

• gh!730 - Alternatives section to README by @​jonathangrinstead
• Updates to alternatives section - by @​pboling

• Added conditional appraisal2-rubocop Appraisal root loading on modern Ruby so generated Appraisal gemfiles are normalized during generation - by @​pboling

Changed

• Raised generated version_gem dependency floor to version_gem >= 1.1.10 - by @​pboling
• Raised the runtime dependency floor for auth-sanitizer to >= 0.2.1 so OAuth2 consumers get hash and nested-attribute inspect redaction fixes plus downstream RBS duplicate-declaration fixes - by @​pboling
• Refreshed generated package metadata, support documentation, CI workflows, and development dependency floors from the current kettle-jem template - by @​pboling
• Documented the current per-version Ruby, JRuby, and TruffleRuby CI matrix in generated README badges and compatibility tables - by @​pboling
• Removed the post-install message from the gemspec to keep installs quieter - by @​pboling
• Refreshed generated README support badges so Ruby 2.3 is listed as supported but untested - by @​pboling
• Refreshed generated project metadata from the current kettle-jem template - by @​pboling

... (truncated)

Commits

• 551f434 🔖 Prepare release v2.0.22
• 849e7e5 🧪 Strengthen redirect security specs
• 442c160 📝 Reference GHSA in security changelog
• f6fed86 ⬆️ Raise snaky_hash floor
• 26bfeda 🔧 Refresh kettle-jem templates
• 0f0a474 Fix credential leakage on redirects
• 1118527 🔒️ Checksums for v2.0.21
• 3f41549 🔖 Prepare release v2.0.21
• 3311b5b Raise auth-sanitizer floor to 0.2.1
• 5659d89 🔖 Prepare release v2.0.21
• Additional commits viewable in compare view

Updates activestorage from 8.1.3 to 8.1.3.1

Release notes

Sourced from activestorage's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.3.1 (July 29, 2026)

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

  This is a breaking change for applications that process image types with an unfuzzed loader or saver. Variant transformation of BMP, ICO, and PSD attachments will raise Vips::Error, and analysis of these and other types such as SVG, JPEG XL, JPEG 2000, and Netpbm will no longer record width and height. Requesting an unfuzzed output format, typically FITS, JXL, or anything delegated to ImageMagick, will also raise Vips::Error. Attaching, storing, and downloading are unchanged.

  An application seeing Vips::Error raised during image transformation may wish to remove the affected content types from config.active_storage.variable_content_types in an initializer. Active Storage will then treat those attachments as not variable and will not generate variants for them. This most often matters to an application that transforms images during a request rather than in a background job, where the failure surfaces as an error response instead of a failed job.

  Rails.application.config.active_storage.variable_content_types -=
    %w[ image/bmp image/vnd.microsoft.icon image/vnd.adobe.photoshop ]

  Applications using the :mini_magick variant processor will see no change in how their attachments are processed, but the loaders and savers will be disabled process-wide whenever ruby-vips is installed, and the version requirements below will still apply. Such an application may remove ruby-vips from its Gemfile to avoid both.

  The minimum supported version of libvips is now 8.13, and the minimum supported version of ruby-vips is now 2.2.1. These are the earliest versions that are capable of disabling untrusted operations. When ruby-vips is installed and either minimum is not met, Active Storage will raise a RuntimeError while booting rather than run in an unsecurable environment.

  [GHSA-xr9x-r78c-5hrm] [CVE-2026-66066]

  Mike Dalessio

Commits

• 3989ebf Preparing for 8.1.3.1 release
• 349e7a5 Disable libvips's unfuzzed image loaders and savers
• See full diff in compare view

Updates loofah from 2.25.1 to 2.25.2

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

Commits

• 2706d7e version bump to v2.25.2
• 1afde0c Merge pull request #308 from flavorjones/security-2252
• f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
• 5e91af8 Update allowed_uri? to handle named whitespace character references
• 20867b9 Properly restrict SVG href attributes
• 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
• b07713d test: do not run in verbose mode
• babe7a8 doc: update CHANGELOG
• a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
• b52f4b0 version bump to 2.25.2.beta1
• Additional commits viewable in compare view

Updates msgpack from 1.8.0 to 1.8.2

Changelog

Sourced from msgpack's changelog.

2026-06-09 1.8.2

• Fix Buffer#clear to properly reset memory chunks before adding them back to the pool. This could have caused data to leak across buffers when using the MessagePack::Buffer API directly. [CVE-2026-54522].

2026-05-28 1.8.1

• Workaround rare compilation issue when rb_hash_new_capa isn't properly detected.
• Never pre-allocate strings larger than the buffered size.

Commits

• 09c914d Release 1.8.2
• 9cfd2ab Stop testing ruby 2.5 on macOS
• 50245ac Merge commit from fork
• 5627d71 _msgpack_buffer_shift_chunk: reset rmem pointers when fully empty
• cce2485 Release 1.8.1
• 677e6b8 Merge pull request #389 from msgpack/str-limit
• f0b6281 Update CI matrix
• abe9066 Update CI matrix
• 8ba8702 Don't pre-allocate strings larger than the buffered size
• 199e88f Merge pull request #386 from msgpack/fix-valgrind-ci
• Additional commits viewable in compare view

Updates rails-html-sanitizer from 1.7.0 to 1.7.1

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio @​flavorjones

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio

Commits

• 4f37e3d version bump to v1.7.1
• b4673b9 Merge pull request #223 from rails/svg-href-local-ref
• 74dcb80 Properly restrict SVG href attributes
• 11ee440 Adjust data: URI mediatype tests for loofah 2.25.2 (#222)
• bc9622c Harden GitHub Actions workflows (#220)
• 3459ffd dep(dev): update nokogiri (#219)
• 8aa4bb2 build(deps-dev): bump concurrent-ruby from 1.3.6 to 1.3.7 (#218)
• 4ddc0c7 dep(dev): update development dependencies (#217)
• f87abb4 Merge pull request #215 from yuri-zubov/reduce-gem-size
• 527b317 Reduce gem size by excluding test files
• See full diff in compare view

Updates websocket-driver from 0.8.0 to 0.8.2

Changelog

Sourced from websocket-driver's changelog.

0.8.2 / 2026-06-23

• Gracefully handle malformed Host headers in the Server driver

0.8.1 / 2026-06-04

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing
• Limit the total HTTP request line and headers size to 32K

Commits

• 49e230b Bump version to 0.8.2
• 7d6fd87 Gracefully handle malformed Host headers in the Server driver
• 5cab908 Bump version to 0.8.1
• 17b569f Limit the total HTTP request line and headers size to 32K
• fa86417 Fail the connection if a message is larger than the configured max length aft...
• d0141f0 Close a draft-75/76 connection if a length header grows to exceed the configu...
• 1e4475e Test on Ruby 4.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.