Update dependencies with advisories, and add Dependabot version updates for bundler - #1920
Open
igor-alexandrov wants to merge 1 commit into
Open
Update dependencies with advisories, and add Dependabot version updates for bundler#1920igor-alexandrov wants to merge 1 commit into
igor-alexandrov wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates development and Docker dependencies to address advisories and enables ongoing Bundler updates through Dependabot.
Changes:
- Updates vulnerable and related gems in
Gemfile.lock. - Adds weekly grouped Bundler dependency updates.
Tip
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
Gemfile.lock |
Updates locked development and Docker dependencies. |
.github/dependabot.yml |
Configures weekly grouped Bundler updates. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
igor-alexandrov
changed the title
…ndler The lockfile carries four gems with advisories, all pulled in through railties: nokogiri 1.19.3, loofah 2.25.1, rails-html-sanitizer 1.6.2 and crass 1.0.6. They only affect the Docker image and local development, since the gemspec doesn't ship Gemfile.lock. Also picks up net-ssh 7.3.3, sshkit 1.25.1, activesupport 8.1.3.1, zeitwerk 2.8.2, thor 1.5.0 and concurrent-ruby 1.3.8. No constraint changes in the gemspec. Security updates already cover bundler, which is where basecamp#1888 came from, but there's no bundler entry for scheduled version updates, so routine bumps never get proposed. This adds one. bundle-audit is clean and the unit tests pass.
igor-alexandrov
force-pushed
the
update-dependencies
branch
from
July 30, 2026 20:55
2d2b2cf to
9a233da
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The lockfile is carrying four gems with advisories, all pulled in through railties:
These only affect the Docker image and local development. The gemspec doesn't ship Gemfile.lock, so
gem install kamalwas never exposed.While updating I also picked up net-ssh 7.3.3, sshkit 1.25.1, activesupport 8.1.3.1, zeitwerk 2.8.2, thor 1.5.0 and concurrent-ruby 1.3.8. No constraint changes — everything is within what the gemspec already allows.
The dependabot.yml change is a separate point. Security updates are already on for bundler, which is where #1888 came from, but there's no bundler entry for scheduled version updates, so routine bumps never get proposed. Adding one would keep the lockfile from drifting between advisories. Happy to drop that part if it's deliberate.
bundle-audit is clean with these versions and the unit tests pass. I didn't run the integration suite locally.