Bump avo from 3.30.3 to 4.0.25 - #136
Conversation
Bumps [avo](https://github.com/avo-hq/avo) from 3.30.3 to 4.0.25. - [Release notes](https://github.com/avo-hq/avo/releases) - [Changelog](https://github.com/avo-hq/avo/blob/main/RELEASE.MD) - [Commits](avo-hq/avo@v3.30.3...v4.0.25) --- updated-dependencies: - dependency-name: avo dependency-version: 4.0.25 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![superagent-security[bot]](https://avatars.githubusercontent.com/in/3287076?s=60&v=4){kind=small}
| xpath (3.2.0) | ||
| nokogiri (~> 1.8) | ||
| zeitwerk (2.8.2) | ||
| yaml (0.4.0) |
There was a problem hiding this comment.
P1: yaml@0.4.0 has metadata typosquatting risk
This package closely resembles the following package names, and might be a typosquatting attempt: yajl-ruby, ruby-saml, haml. Rules: typosquatting
Review yaml@0.4.0 before merging. Remove or replace it if this behavior is unexpected.
AI prompt
Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.
<file name="Gemfile.lock">
<violation number="1" location="Gemfile.lock:519">
<priority>P1</priority>
<title>yaml@0.4.0 has metadata typosquatting risk</title>
<evidence>This package closely resembles the following package names, and might be a typosquatting attempt: yajl-ruby, ruby-saml, haml. Rules: typosquatting
Dependency path: Gemfile.lock → yaml</evidence>
<recommendation>Review yaml@0.4.0 before merging. Remove or replace it if this behavior is unexpected.</recommendation>
</violation>
</file>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3ee650d188
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| nokogiri (1.19.4-x86_64-linux-gnu) | ||
| racc (~> 1.4) | ||
| pagy (9.3.4) | ||
| pagy (43.6.1) |
There was a problem hiding this comment.
This lockfile pulls in Pagy 43 through Avo 4, but the app still has the pre-43 Pagy integration: config/initializers/pagy.rb:155 actively requires the discontinued pagy/extras/trim, the paginated controllers still include Pagy::Backend, and app/helpers/application_helper.rb:2 includes Pagy::Frontend / calls pagy_url_for. Pagy 43 removed extras and replaced the old Backend/Frontend API with Pagy::Method, so after this bundle update the app can fail during initialization or when hitting the article/FAQ/stocks pagination routes. Please migrate those usages or keep Pagy below 43 before landing the Avo bump.
Useful? React with 👍 / 👎.
Bumps avo from 3.30.3 to 4.0.25.
Release notes
Sourced from avo's releases.
... (truncated)
Commits
646b190Bump avo to v4.0.25b1b917fList the assistant's Cmd/Ctrl+J shortcut in the shortcuts modal (#4688)a47016bfix(panel): space sibling cards inside a panel body (#4686)48370b3fix: attach and detach a record on a has_one :through association (#4678)2c8fdc6Add footer slot to DropdownComponent (#4682)357770dBump avo to v4.0.2400686a6Inline search for popover dropdowns (#4680)5dd8c97Bump avo to v4.0.23f294cbffix(assets): let the host app's Tailwind build win avo/application.css under ...f2d5230docs: recommend an engine initializer for register_configuration (#4677)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)