Bump the bundler group across 2 directories with 4 updates by dependabot[bot] · Pull Request #1 · admin-world/buildpack-samples

dependabot · 2026-03-05T21:20:22Z

Bumps the bundler group with 2 updates in the /sample-ruby directory: sinatra and webrick.
Bumps the bundler group with 2 updates in the /sample-functions-framework-ruby directory: rack and puma.

Updates sinatra from 2.2.3 to 4.2.0

Changelog

Sourced from sinatra's changelog.

4.2.0 / 2025-10-08

New: Add :static_headers setting for custom headers in static file responses (#2089)

Fix: Fix regex in etag_matches? to prevent ReDoS (#2121)

Fix: PATH_INFO can never be empty (#2114)

Fix: Fix malformed Content-Type headers (#2081)

Fix: Avoid crash for integer values in content_type parameters (#2078)

4.1.1 / 2024-11-20

Fix: Restore WEBrick support (#2067)

4.1.0 / 2024-11-18

New: Add host_authorization setting (#2053)

Defaults to .localhost, .test and any IP address in development mode.

Security: addresses CVE-2024-21510.

Fix: Return an instance of Sinatra::IndifferentHash when calling #except (#2044)

Fix: Address warning from URI for Ruby 3.4 (#2060)

Fix: rackup no longer depends on WEBrick, recommend Puma instead (4a558503)

Fix: Zeitwerk 2.7.0+ compatibility (#2050)

Fix: Address warning about Hash construction for Ruby 3.4 (#2028)

Fix: Declare missing dependencies for Ruby 3.5 (#2032)

Fix: Compatibility with --enable-frozen-string-literal (#2033)

Fix: Rack 3.1 compatibility (#2035)

Don't depend on Rack::Logger

Don't delete content-length header when Rack::Files is used

4.0.1 / 2025-05-24

Rack 3.1 compatibility (#2035)

Fix malformed Content-Type headers (#2081)

Avoid crash for integer values in content_type parameters (#2078)

Fix compatibility with --enable-frozen-string-literal (#2033)

Declare missing dependencies for Ruby 3.5 (#2032)

Fix warning about Hash construction. (#2028)

Support Zeitwerk 2.7.0+ (#2050)

Address URI depreciation (#2060)

#2035: sinatra/sinatra#2035 #2081: sinatra/sinatra#2081 #2078: sinatra/sinatra#2078 #2033: sinatra/sinatra#2033

... (truncated)

Commits

f2ad45f 4.2.0 release (#2122)
3fe8c38 Fix regex in etag_matches? to prevent ReDoS (#2121)
fa99a21 PATH_INFO can never be empty. (#2114)
ea0d3fa Skip broken tests. (#2115)
5e15985 Sync changelog for v4.0.1
91cfb54 Add :static_headers setting for custom headers in static file responses (#2089)
c918134 Set rubygems_mfa_required for the sinatra gem (#2087)
ac3ff23 README: Remove duplicate mention of installing puma (#2091)
cfcc70d CI: don't use Rack::Lint on invalid hostname (#2086)
c235249 CI: Test with Ruby 3.4 (#2083)
Additional commits viewable in compare view

Updates webrick from 1.7.0 to 1.8.2

Release notes

Sourced from webrick's releases.

v1.8.2

What's Changed

Drop commented-out line by @olleolleolle in ruby/webrick#108

Add Ruby 3.1 & 3.2 to CI matrix by @tricknotes in ruby/webrick#109

Fix/redos by @ooooooo-q in ruby/webrick#114

Raise HTTPStatus::BadRequest for requests with invalid/duplicate content-length headers by @jeremyevans in ruby/webrick#120

Bump actions/checkout from 3 to 4 by @dependabot in ruby/webrick#121

Improve CI by @hsbt in ruby/webrick#123

Fix WEBrick::TestFileHandler#test_short_filename test not working on mswin by @KJTsanaktsidis in ruby/webrick#128

Fix bug chunk extension detection by @jeremyevans in ruby/webrick#125

Fix CI. by @ioquatix in ruby/webrick#131

Merge multiple cookie headers, preserving semantic correctness. by @ioquatix in ruby/webrick#130

Test on macos-latest by @byroot in ruby/webrick#132

Require CRLF line endings in request line and headers by @jeremyevans in ruby/webrick#138

Prefer squigly heredocs. by @ioquatix in ruby/webrick#143

Only strip space and horizontal tab in headers by @jeremyevans in ruby/webrick#141

Treat missing CRLF separator after headers as an EOFError by @jeremyevans in ruby/webrick#142

Return 400 response for chunked requests with unexpected data after chunk by @jeremyevans in ruby/webrick#136

Fix reference to URI::REGEXP::PATTERN::HOST by @casperisfine in ruby/webrick#144

Prevent request smuggling by @jeremyevans in ruby/webrick#146

New Contributors

@tricknotes made their first contribution in ruby/webrick#109

@ooooooo-q made their first contribution in ruby/webrick#114

@KJTsanaktsidis made their first contribution in ruby/webrick#128

@byroot made their first contribution in ruby/webrick#132

@casperisfine made their first contribution in ruby/webrick#144

Full Changelog: ruby/webrick@v1.8.1...v1.8.2

v1.8.1

What's Changed

Body should be non-frozen by default. by @ioquatix in ruby/webrick#103

Join test thread. by @ioquatix in ruby/webrick#104

Fix several regexp warnings. by @ioquatix in ruby/webrick#105

Full Changelog: ruby/webrick@v1.8.0...v1.8.1

v1.8.0

What's Changed

Use frozen strings by @kirs in ruby/webrick#65

Use test-unit by @hsbt in ruby/webrick#66

More rubies on CI, deprecating ruby 2.3 due to test failure by @mathieujobin in ruby/webrick#68

Adds common mime types by @gotoken in ruby/webrick#75

add mime type for .webmanifest extension by @olleolleolle in ruby/webrick#76

CI: use bundler-cache: true by @olleolleolle in ruby/webrick#79

Typo by @printfinn in ruby/webrick#78

s/RubyVM::JIT/RubyVM::MJIT/g by @k0kubun in ruby/webrick#82

Fix invalid use of IP addresses in SNI by @jeremyevans in ruby/webrick#83

... (truncated)

Commits

0fb9de6 Bump up v1.8.2
b9a4c81 Removed trailing spaces
f5faca9 Prevent request smuggling
0c600e1 Fix reference to URI::REGEXP::PATTERN::HOST
15a9391 Return 400 response for chunked requests with unexpected data after chunk
2b38d56 Treat missing CRLF separator after headers as an EOFError
e4efb4a Remove unnecessary gsub calls in test_httprequest.rb
426e214 Only strip space and horizontal tab in headers
e72cb69 Prefer squigly heredocs. (#143)
ee60354 Require CRLF line endings in request line and headers
Additional commits viewable in compare view

Updates rack from 2.2.8 to 3.2.5

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

v2.2.8

What's Changed

Limit file extension length of multipart tempfiles (2.2 backport) by @dentarg in rack/rack#2075

CHANGELOG: Add missing 2.2.7 by @tisba in rack/rack#2081

Update cookie.rb by @dchandekstark in rack/rack#2092

Prefer ubuntu-latest for testing. by @ioquatix in rack/rack#2095

Fix inefficient assert pattern in Rack::Lint [2-2-stable] by @skipkayhil in rack/rack#2101

Regenerate SPEC [2-2-stable] by @skipkayhil in rack/rack#2102

New Contributors

@tisba made their first contribution in rack/rack#2081

@dchandekstark made their first contribution in rack/rack#2092

Full Changelog: rack/rack@v2.2.7...v2.2.8

v2.2.7

What's Changed

Correct the year number in the changelog by @kimulab in rack/rack#2015

Support underscore in host names for Rack 2.2 (Fixes #2070) by @jeremyevans in rack/rack#2071

New Contributors

@kimulab made their first contribution in rack/rack#2015

Full Changelog: rack/rack@v2.2.6.4...v2.2.7

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.

CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

SPEC Changes

Define rack.response_finished callback arguments more strictly. (#2365, @skipkayhil)

Added

Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @codergeek121)

Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @skipkayhil)

Add support for streaming bodies when using Rack::Events. (#2375, @unflxw)

Add deflaters option to Rack::Deflater to enable custom compression algorithms like zstd. (#2168, @alexanderadam)

Add Rack::Request#prefetch? for identifying requests with Sec-Purpose: prefetch header set. (#2405, @glaszig)

Add rack.request.trusted_proxy environment key to indicate whether the request is coming from a trusted proxy.

Changed

Raise before exceeding a part limit, not after. (#2362, @matthew-puku)

Rack::Deflater now uses a fixed GZip mtime value. (#2372, @bensheldon)

Multipart parser drops support for RFC 2231 filename* parameter (prohibited by RFC 7578) and now properly handles UTF-8 encoded filenames via percent-encoding and direct UTF-8 bytes. (#2398, @wtn)

The query parser now raises Rack::QueryParser::IncompatibleEncodingError if we try to parse params that are not ASCII compatible. (#2416, @bquorning)

Fixed

Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @alpaca-tc, @willnet, @krororo)

Fix Rack::MockResponse#body when the body is a Proc. (#2420, #2423, @tavianator, [@ioquatix])

[3.2.4] - 2025-11-03

Fixed

Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @alpaca-tc, @willnet, @krororo)

[3.2.3] - 2025-10-10

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

... (truncated)

Commits

0cc2e00 Bump patch version.
a5725c0 Prevent directory traversal via root prefix bypass.
175e7d2 XSS injection via malicious filename in Rack::Directory.
3472037 Fix changelog.
851dc02 Bump patch version.
1e6aeda Allow Multipart head to span read boundary. (#2392)
6ef5915 Bump patch version.
4e2c903 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
fba2c8b Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
ed3d834 Normalize adivsories links.
Additional commits viewable in compare view

Updates rack from 2.2.6.4 to 2.2.22

Release notes

Sourced from rack's releases.

v2.2.8.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v2.2.8...v2.2.8.1

v2.2.8

What's Changed

Limit file extension length of multipart tempfiles (2.2 backport) by @dentarg in rack/rack#2075

CHANGELOG: Add missing 2.2.7 by @tisba in rack/rack#2081

Update cookie.rb by @dchandekstark in rack/rack#2092

Prefer ubuntu-latest for testing. by @ioquatix in rack/rack#2095

Fix inefficient assert pattern in Rack::Lint [2-2-stable] by @skipkayhil in rack/rack#2101

Regenerate SPEC [2-2-stable] by @skipkayhil in rack/rack#2102

New Contributors

@tisba made their first contribution in rack/rack#2081

@dchandekstark made their first contribution in rack/rack#2092

Full Changelog: rack/rack@v2.2.7...v2.2.8

v2.2.7

What's Changed

Correct the year number in the changelog by @kimulab in rack/rack#2015

Support underscore in host names for Rack 2.2 (Fixes #2070) by @jeremyevans in rack/rack#2071

New Contributors

@kimulab made their first contribution in rack/rack#2015

Full Changelog: rack/rack@v2.2.6.4...v2.2.7

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.

CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

SPEC Changes

Define rack.response_finished callback arguments more strictly. (#2365, @skipkayhil)

Added

Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @codergeek121)

Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @skipkayhil)

Add support for streaming bodies when using Rack::Events. (#2375, @unflxw)

Add deflaters option to Rack::Deflater to enable custom compression algorithms like zstd. (#2168, @alexanderadam)

Add Rack::Request#prefetch? for identifying requests with Sec-Purpose: prefetch header set. (#2405, @glaszig)

Add rack.request.trusted_proxy environment key to indicate whether the request is coming from a trusted proxy.

Changed

Raise before exceeding a part limit, not after. (#2362, @matthew-puku)

Rack::Deflater now uses a fixed GZip mtime value. (#2372, @bensheldon)

Multipart parser drops support for RFC 2231 filename* parameter (prohibited by RFC 7578) and now properly handles UTF-8 encoded filenames via percent-encoding and direct UTF-8 bytes. (#2398, @wtn)

The query parser now raises Rack::QueryParser::IncompatibleEncodingError if we try to parse params that are not ASCII compatible. (#2416, @bquorning)

Fixed

Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @alpaca-tc, @willnet, @krororo)

Fix Rack::MockResponse#body when the body is a Proc. (#2420, #2423, @tavianator, [@ioquatix])

[3.2.4] - 2025-11-03

Fixed

Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @alpaca-tc, @willnet, @krororo)

[3.2.3] - 2025-10-10

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

... (truncated)

Commits

0cc2e00 Bump patch version.
a5725c0 Prevent directory traversal via root prefix bypass.
175e7d2 XSS injection via malicious filename in Rack::Directory.
3472037 Fix changelog.
851dc02 Bump patch version.
1e6aeda Allow Multipart head to span read boundary. (#2392)
6ef5915 Bump patch version.
4e2c903 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.
fba2c8b Improper handling of proxy headers in Rack::Sendfile may allow proxy bypass.
ed3d834 Normalize adivsories links.
Additional commits viewable in compare view

Updates puma from 5.6.7 to 5.6.9

Changelog

Sourced from puma's changelog.

5.6.9 / 2024-09-19

Security

Discards any headers using underscores if the non-underscore version also exists. Without this, an attacker could overwrite values set by intermediate proxies (e.g. X-Forwarded-For). (CVE-2024-45614/GHSA-9hf4-67fc-4vf4)

JRuby

Must use at least Java >= 9 to compile. You can no longer build from source on Java 8.

5.6.8 / 2024-01-08

Security

Limit the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. (GHSA-c2f4-cvqm-65w2)

Commits

f196b23 Merge commit from fork
24eec19 5.6.9
3c8e8b0 5.6.9 release note [ci skip]
1293573 5.6.8
bbb880f Merge pull request from GHSA-c2f4-cvqm-65w2
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the bundler group with 2 updates in the /sample-ruby directory: [sinatra](https://github.com/sinatra/sinatra) and [webrick](https://github.com/ruby/webrick). Bumps the bundler group with 2 updates in the /sample-functions-framework-ruby directory: [rack](https://github.com/rack/rack) and [puma](https://github.com/puma/puma). Updates `sinatra` from 2.2.3 to 4.2.0 - [Changelog](https://github.com/sinatra/sinatra/blob/main/CHANGELOG.md) - [Commits](sinatra/sinatra@v2.2.3...v4.2.0) Updates `webrick` from 1.7.0 to 1.8.2 - [Release notes](https://github.com/ruby/webrick/releases) - [Commits](ruby/webrick@v1.7.0...v1.8.2) Updates `rack` from 2.2.8 to 3.2.5 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.6.4...v2.2.22) Updates `rack` from 2.2.6.4 to 2.2.22 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.6.4...v2.2.22) Updates `puma` from 5.6.7 to 5.6.9 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/main/History.md) - [Commits](puma/puma@v5.6.7...v5.6.9) --- updated-dependencies: - dependency-name: sinatra dependency-version: 4.2.0 dependency-type: direct:production dependency-group: bundler - dependency-name: webrick dependency-version: 1.8.2 dependency-type: direct:production dependency-group: bundler - dependency-name: rack dependency-version: 3.2.5 dependency-type: indirect dependency-group: bundler - dependency-name: rack dependency-version: 2.2.22 dependency-type: indirect dependency-group: bundler - dependency-name: puma dependency-version: 5.6.9 dependency-type: indirect dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Mar 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the bundler group across 2 directories with 4 updates#1

Bump the bundler group across 2 directories with 4 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/sample-ruby/bundler-f2d154f27f

dependabot bot commented on behalf of github Mar 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 5, 2026

4.2.0 / 2025-10-08

4.1.1 / 2024-11-20

4.1.0 / 2024-11-18

4.0.1 / 2025-05-24

v1.8.2

What's Changed

New Contributors

v1.8.1

What's Changed

v1.8.0

What's Changed

v2.2.8.1

What's Changed

v2.2.8

What's Changed

New Contributors

v2.2.7

What's Changed

New Contributors

Changelog

Unreleased

Security

SPEC Changes

Added

Changed

Fixed

[3.2.4] - 2025-11-03

Fixed

[3.2.3] - 2025-10-10

Security

v2.2.8.1

What's Changed

v2.2.8

What's Changed

New Contributors

v2.2.7

What's Changed

New Contributors

Changelog

Unreleased

Security

SPEC Changes

Added

Changed

Fixed

[3.2.4] - 2025-11-03

Fixed

[3.2.3] - 2025-10-10

Security

5.6.9 / 2024-09-19

5.6.8 / 2024-01-08

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants