Skip to content

Bump the bundler group across 1 directory with 5 updates - #19

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/bundler-79f38f38c1
Open

Bump the bundler group across 1 directory with 5 updates#19
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/bundler-79f38f38c1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 3 updates in the / directory: tzinfo, commonmarker and faraday.

Updates tzinfo from 1.2.7 to 1.2.10

Release notes

Sourced from tzinfo's releases.

v1.2.10

  • Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
  • Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v1.2.10 on RubyGems.org

v1.2.9

  • Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

v1.2.8

  • Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
  • Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

Changelog

Sourced from tzinfo's changelog.

Version 1.2.10 - 19-Jul-2022

  • Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
  • Ignore the SECURITY file from Arch Linux's tzdata package. #134.

Version 1.2.9 - 16-Dec-2020

  • Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

Version 1.2.8 - 8-Nov-2020

  • Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
  • Rubinius is no longer supported.
Commits
  • 0814dcd Fix the release date.
  • fd05e2a Preparing v1.2.10.
  • b98c32e Merge branch 'fix-directory-traversal-1.2' into 1.2
  • ac3ee68 Remove unnecessary escaping of + within regex character classes.
  • 9d49bf9 Fix relative path loading tests.
  • 394c381 Remove private_constant for consistency and compatibility.
  • 5e9f990 Exclude Arch Linux's SECURITY file from the time zone index.
  • 17fc9e1 Workaround for 'Permission denied - NUL' errors with JRuby on Windows.
  • 6bd7a51 Update copyright years.
  • 9905ca9 Fix directory traversal in Timezone.get when using Ruby data source
  • Additional commits viewable in compare view

Updates commonmarker from 0.17.13 to 0.23.10

Release notes

Sourced from commonmarker's releases.

v0.23.10

What's Changed

Full Changelog: gjtorikian/commonmarker@v0.23.9...v0.23.10

v0.23.9

What's Changed

Full Changelog: gjtorikian/commonmarker@v0.23.8...v0.23.9

v0.23.8

What's Changed

New Contributors

Full Changelog: gjtorikian/commonmarker@v0.23.7...v0.23.8

v0.23.7

What's Changed

Full Changelog: gjtorikian/commonmarker@v0.23.6...v0.23.7

v0.23.7.pre1

What's Changed

Full Changelog: gjtorikian/commonmarker@v0.23.6...v0.23.7.pre1

v0.23.6

What's Changed

This release includes two updates from the upstream cmark-gfm library, namely:

v0.23.4

No release notes provided.

v0.22.0

... (truncated)

Changelog

Sourced from commonmarker's changelog.

[v0.23.10] (2023-07-31)

v0.23.4 (2022-03-03)

Full Changelog

Fixed bugs:

  • #render_html way slower than #render_doc.to_html #141

Closed issues:

  • allow keeping text content of unknown tags #169
  • STRIKETHROUGH_DOUBLE_TILDE not working #168
  • Allow disabling 4-space code blocks #167
  • tables with escaped pipes are not recognized #166

Merged pull requests:

v0.23.2 (2021-09-17)

Full Changelog

Merged pull requests:

v0.23.1 (2021-09-03)

Full Changelog

Closed issues:

  • Incorrect processing of list and next block of code #146

Merged pull requests:

v0.23.0 (2021-08-30)

... (truncated)

Commits

Updates faraday from 1.0.1 to 2.14.1

Release notes

Sourced from faraday's releases.

v2.14.1

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

New Contributors

Full Changelog: lostisland/faraday@v2.14.0...v2.14.1

v2.14.0

What's Changed

New features ✨

Fixes 🐞

Misc/Docs 📄

New Contributors

Full Changelog: lostisland/faraday@v2.13.4...v2.14.0

v2.13.4

What's Changed

Full Changelog: lostisland/faraday@v2.13.3...v2.13.4

v2.13.3

What's Changed

... (truncated)

Changelog

Sourced from faraday's changelog.

Faraday Changelog

The changelog has moved!

This file is not being updated anymore. Instead, please check the Releases page.

2.2.0 (2022-02-03)

  • Reintroduce the possibility to register middleware with symbols, strings or procs in #1391

2.1.0 (2022-01-15)

2.0.1 (2022-01-05)

2.0.0 (2022-01-04)

The next major release is here, and it comes almost 2 years after the release of v1.0!

This release changes the way you use Faraday and embraces a new paradigm of Faraday as an ecosystem, rather than a library.

What does that mean? It means that Faraday is less of a bundled tool and more of a framework for the community to build on top of.

As a result, all adapters and some middleware have moved out and are now shipped as standalone gems 🙌!

But this doesn't mean that upgrading from Faraday 1.x to Faraday 2.0 should be hard, in fact we've listed everything you need to do in the UPGRADING.md doc.

Moreover, we've setup a new awesome-faraday repository that will showcase a curated list of adapters and middleware 😎.

This release was the result of the efforts of the core team and all the contributors, new and old, that have helped achieve this milestone 👏.

What's Changed

... (truncated)

Commits
  • 16cbd38 Version bump to 2.14.1
  • a6d3a3a Merge commit from fork
  • b23f710 Explicit top-level namespace reference (#1657)
  • 49ba4ac Bump actions/checkout from 5 to 6 (#1655)
  • 51a49bc Ensure Claude reads the guidelines and allow to plan in a gitignored .ai/PLAN...
  • 894f65c Add RFC document for Options architecture refactoring plan (#1644)
  • 397e3de Add comprehensive AI agent guidelines for Claude, Cursor, and GitHub Copilot ...
  • d98c65c Update Faraday-specific AI agent guidelines
  • 56c18ec Add AI agent guidelines specific to Faraday repository
  • 3201a42 Version bump to 2.14.0
  • Additional commits viewable in compare view

Updates kramdown from 1.17.0 to 2.4.0

Commits

Updates nokogiri from 1.12.5 to 1.19.0

Release notes

Sourced from nokogiri's releases.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

11a97ecc3c0e7e5edcf395720b10860ef493b768f6aa80c539573530bc933767  nokogiri-1.19.0-aarch64-linux-gnu.gem
eb70507f5e01bc23dad9b8dbec2b36ad0e61d227b42d292835020ff754fb7ba9  nokogiri-1.19.0-aarch64-linux-musl.gem
572a259026b2c8b7c161fdb6469fa2d0edd2b61cd599db4bbda93289abefbfe5  nokogiri-1.19.0-arm-linux-gnu.gem
23ed90922f1a38aed555d3de4d058e90850c731c5b756d191b3dc8055948e73c  nokogiri-1.19.0-arm-linux-musl.gem
0811dfd936d5f6dd3f6d32ef790568bf29b2b7bead9ba68866847b33c9cf5810  nokogiri-1.19.0-arm64-darwin.gem
5f3a70e252be641d8a4099f7fb4cc25c81c632cb594eec9b4b8f2ca8be4374f3  nokogiri-1.19.0-java.gem
05d7ed2d95731edc9bef2811522dc396df3e476ef0d9c76793a9fca81cab056b  nokogiri-1.19.0-x64-mingw-ucrt.gem
1dad56220b603a8edb9750cd95798bffa2b8dd9dd9aa47f664009ee5b43e3067  nokogiri-1.19.0-x86_64-darwin.gem
f482b95c713d60031d48c44ce14562f8d2ce31e3a9e8dd0ccb131e9e5a68b58c  nokogiri-1.19.0-x86_64-linux-gnu.gem
1c4ca6b381622420073ce6043443af1d321e8ed93cc18b08e2666e5bd02ffae4  nokogiri-1.19.0-x86_64-linux-musl.gem
e304d21865f62518e04f2bf59f93bd3a97ca7b07e7f03952946d8e1c05f45695  nokogiri-1.19.0.gem

v1.18.10 / 2025-09-15

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.
  • [CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18
7fb87235d729c74a2be635376d82b1d459230cc17c50300f8e4fcaabc6195344  nokogiri-1.18.10-aarch64-linux-gnu.gem
7e74e58314297cc8a8f1b533f7212d1999dbe2639a9ee6d97b483ea2acc18944  nokogiri-1.18.10-aarch64-linux-musl.gem
51f4f25ab5d5ba1012d6b16aad96b840a10b067b93f35af6a55a2c104a7ee322  nokogiri-1.18.10-arm-linux-gnu.gem
1c6ea754e51cecc85c30ee8ab1e6aa4ce6b6e134d01717e9290e79374a9e00aa  nokogiri-1.18.10-arm-linux-musl.gem
c2b0de30770f50b92c9323fa34a4e1cf5a0af322afcacd239cd66ee1c1b22c85  nokogiri-1.18.10-arm64-darwin.gem
cd431a09c45d84a2f870ba0b7e8f571199b3727d530f2b4888a73639f76510b5  nokogiri-1.18.10-java.gem
64f40d4a41af9f7f83a4e236ad0cf8cca621b97e31f727b1bebdae565a653104  nokogiri-1.18.10-x64-mingw-ucrt.gem
536e74bed6db2b5076769cab5e5f5af0cd1dccbbd75f1b3e1fa69d1f5c2d79e2  nokogiri-1.18.10-x86_64-darwin.gem
ff5ba26ba2dbce5c04b9ea200777fd225061d7a3930548806f31db907e500f72  nokogiri-1.18.10-x86_64-linux-gnu.gem
0651fccf8c2ebbc2475c8b1dfd7ccac3a0a6d09f8a41b72db8c21808cb483385  nokogiri-1.18.10-x86_64-linux-musl.gem
d5cc0731008aa3b3a87b361203ea3d19b2069628cb55e46ac7d84a0445e69cc1  nokogiri-1.18.10.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.0 / 2025-12-28

Ruby

This release is focused on changes to Ruby version support, and is otherwise functionally identical to v1.18.10.

v1.18.10 / 2025-09-15

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.13.9. Note that the security fixes published in v2.13.9 were already present in Nokogiri v1.18.9.
  • [CRuby] [Windows and MacOS] Vendored libiconv is updated to v1.18

v1.18.9 / 2025-07-20

Security

v1.18.8 / 2025-04-21

Security

v1.18.7 / 2025-03-31

Dependencies

  • [CRuby] Vendored libxml2 is updated to v2.13.7, which is a bugfix release.

v1.18.6 / 2025-03-24

Fixed

  • [JRuby] In HTML documents, Node#attribute now returns the correct attribute. This has been broken, and returning nil, since v1.17.0. (#3487) @​flavorjones

v1.18.5 / 2025-03-19

Fixed

... (truncated)

Commits
  • d77bfb6 version bump to v1.19.0
  • 1eb5c2c dev: convert scripts/test-gem-set to use mise
  • 88a120f dep: Add native Ruby 4 support, drop Ruby 3.1 support (v1.19.x) (#3592)
  • f8c8f74 Skip the parser compression test for Windows system libs
  • e91c0fc ci: temporarily pin to setup-ruby with windows ruby 4
  • 1b08acc dep: update to minitest 6
  • 404487d dep: require JRuby >= 10.0
  • 19b22ea dep: add support for native Ruby 4.0 gem
  • ec57d11 ci: bump versions in CI images
  • f7b640f ci: avoid bundler collisions in downstream tests
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 3 updates in the / directory: [tzinfo](https://github.com/tzinfo/tzinfo), [commonmarker](https://github.com/gjtorikian/commonmarker) and [faraday](https://github.com/lostisland/faraday).


Updates `tzinfo` from 1.2.7 to 1.2.10
- [Release notes](https://github.com/tzinfo/tzinfo/releases)
- [Changelog](https://github.com/tzinfo/tzinfo/blob/master/CHANGES.md)
- [Commits](tzinfo/tzinfo@v1.2.7...v1.2.10)

Updates `commonmarker` from 0.17.13 to 0.23.10
- [Release notes](https://github.com/gjtorikian/commonmarker/releases)
- [Changelog](https://github.com/gjtorikian/commonmarker/blob/v0.23.10/CHANGELOG.md)
- [Commits](gjtorikian/commonmarker@v0.17.13...v0.23.10)

Updates `faraday` from 1.0.1 to 2.14.1
- [Release notes](https://github.com/lostisland/faraday/releases)
- [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md)
- [Commits](lostisland/faraday@v1.0.1...v2.14.1)

Updates `kramdown` from 1.17.0 to 2.4.0
- [Release notes](https://github.com/gettalong/kramdown/releases)
- [Changelog](https://github.com/gettalong/kramdown/blob/master/doc/news.page)
- [Commits](https://github.com/gettalong/kramdown/commits)

Updates `nokogiri` from 1.12.5 to 1.19.0
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.12.5...v1.19.0)

---
updated-dependencies:
- dependency-name: tzinfo
  dependency-version: 1.2.10
  dependency-type: direct:production
  dependency-group: bundler
- dependency-name: commonmarker
  dependency-version: 0.23.10
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: faraday
  dependency-version: 2.14.1
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: kramdown
  dependency-version: 2.4.0
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: nokogiri
  dependency-version: 1.19.0
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Feb 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants