Bump the bundler group across 1 directory with 6 updates

[dependabot]

Bumps the bundler group with 5 updates in the / directory:

Package	From	To
sqlite3	1.4.2	2.9.5
concurrent-ruby	1.3.6	1.3.7
loofah	2.25.1	2.25.2
rails-html-sanitizer	1.7.0	1.7.1
websocket-driver	0.7.5	0.8.2

Updates sqlite3 from 1.4.2 to 2.9.5

Release notes

Sourced from sqlite3's releases.

2.9.5 / 2026-06-07

Dependencies

• Vendored sqlite is updated to v3.53.2 (from v3.53.1). #709 @​flavorjones

Security / Stability

• Fix use-after-free issue with custom functions, when the same function name is used with multiple arities. See GHSA-28hh-pr2h-2w89 for more information. #710 @​flavorjones
• Fix use-after-free issue with aggregate functions, if a statement is used after a soft database close. See GHSA-j7fr-3v8c-3qc3 for more information. #711 @​flavorjones

78075b6337d3d182c6d2b4691049ed45cd220826160c9ea18946bf6a1de200dc  gems/sqlite3-2.9.5-aarch64-linux-gnu.gem
18c801185deb4adc01ddb281e8f672a39e3d1729979ca91e39439cd3eac0402d  gems/sqlite3-2.9.5-aarch64-linux-musl.gem
1bdfca0c7d63998c60b0f4a8e3c8df2d33800ccc4abd2d612eddbbbc92a4c48b  gems/sqlite3-2.9.5-arm-linux-gnu.gem
bae1109d12b2e9f588455967729b008e1ff4feb7761749df695019c9079913c6  gems/sqlite3-2.9.5-arm-linux-musl.gem
d0cf444a70fc9395d513cfbcc1e6719e224aa645314e3824cb0474c721425aa2  gems/sqlite3-2.9.5-arm64-darwin.gem
b00d5697994ee8589b6096694a2130aa5567db64373baca55ea98c9bf958f46a  gems/sqlite3-2.9.5-x64-mingw-ucrt.gem
c94b96b16f17796be6fa099d15218b52e396f55690c4760faaaefa21ebab9dd5  gems/sqlite3-2.9.5-x86-linux-gnu.gem
063a8c13cbadfe7f29453b1706cbdf91fca4a78d244f816ff20bac4fb259f1e4  gems/sqlite3-2.9.5-x86-linux-musl.gem
8e9caae38bd7ebb29cbeee3e7ab1d12dc2327d9a1b92c7fcf0dda05589627a81  gems/sqlite3-2.9.5-x86_64-darwin.gem
233dbcb6714148dd23bc5aeb33e8efd6eac974969564ddd5794c23d5f52b231e  gems/sqlite3-2.9.5-x86_64-linux-gnu.gem
e7d3a7474e8af0f96150c21abc203fbab5437206bfcdf11deab7741c0ca516f2  gems/sqlite3-2.9.5-x86_64-linux-musl.gem
04572973a3f943ad50a8adfffc8dd752a5f06e4c3db2026f71838fed8a982606  gems/sqlite3-2.9.5.gem

2.9.4 / 2026-05-05

• Vendored sqlite is updated to v3.53.1 (from v3.53.0). #704 @​flavorjones

ecabed721e6eaad54601d2685f09029d90025efc8d931040dc89cb3f8a2080ec  gems/sqlite3-2.9.4-aarch64-linux-gnu.gem
ffb4255947fb54c8c3eeca97460c9702b40de91ce390455ef7367ca6a3929a31  gems/sqlite3-2.9.4-aarch64-linux-musl.gem
9ee2008b9fbec984c3c165b0d7eedd2bd2a415100b761bfa3a4c6fbec9208bf6  gems/sqlite3-2.9.4-arm-linux-gnu.gem
8dc1fe4da6977992cd62decf4a93ccf6cc2e124a5e6a340160d52092f70e837a  gems/sqlite3-2.9.4-arm-linux-musl.gem
1d5aad413a815d236e96d43f05a1acc600b6cd086800770342a3f9c2877499ff  gems/sqlite3-2.9.4-arm64-darwin.gem
40997c549b19e2fdfcc5e271f6bdd4d502179742c0bfd678da23d0d09b929848  gems/sqlite3-2.9.4-x64-mingw-ucrt.gem
5cab40ea734796802853501bd23b6162eec391dc37f3bf04bc2ffbda9c8bf93d  gems/sqlite3-2.9.4-x86-linux-gnu.gem
936e2d4a428887fac15f55e26a18671fbb4e522bffaa43969fadf7b40ab25214  gems/sqlite3-2.9.4-x86-linux-musl.gem
f280c476e360b73e86165a5e59b72801385b4a6c3a47f8af5ecefb9d90bec17f  gems/sqlite3-2.9.4-x86_64-darwin.gem
537a3eda71b1df1336d0055cbebe55a7317c34870c192c7b6b9d8d0be6871847  gems/sqlite3-2.9.4-x86_64-linux-gnu.gem
3fc5e865b4be9a85d998203ef8d0c0fdcb92f20acf34a254346ff8a19088efec  gems/sqlite3-2.9.4-x86_64-linux-musl.gem
6161c5b9c17886b289558e6c8082b28a22a814736d2433c9a67f4c6bfcde5c97  gems/sqlite3-2.9.4.gem
</tr></table> 

... (truncated)

Changelog

Sourced from sqlite3's changelog.

2.9.5 / 2026-06-07

Dependencies

• Vendored sqlite is updated to v3.53.2 (from v3.53.1). #709 @​flavorjones

Security / Stability

• Fix use-after-free issue with custom functions, when the same function name is used with multiple arities. See GHSA-28hh-pr2h-2w89 for more information. #710 @​flavorjones
• Fix use-after-free issue with aggregate functions, if a statement is used after a soft database close. See GHSA-j7fr-3v8c-3qc3 for more information. #711 @​flavorjones

2.9.4 / 2026-05-05

• Vendored sqlite is updated to v3.53.1 (from v3.53.0). #704 @​flavorjones

2.9.3 / 2026-04-15

• Vendored sqlite is updated to v3.53.0 (from v3.51.3). #696 @​flavorjones

2.9.2 / 2026-03-15

• Vendored sqlite is updated to v3.51.3 (from v3.51.2). #688 @​flavorjones

2.9.1 / 2026-02-28

• Vendored sqlite is updated to v3.51.2 (from v3.51.1). #683 @​flavorjones

2.9.0 / 2025-12-27

Ruby

• Introduce native gem packages for Ruby 4.0. @​flavorjones
• Drop support for Ruby 3.1. @​flavorjones

Added

• Introduce Statement#named_params to introspect on a parameterized SQL statement. #627 #642 @​captn3m0

Improved

• Small improvements to docstrings and comments. @​flavorjones @​houyuanjie

2.8.1 / 2025-11-29

• Vendored sqlite is updated to v3.51.1 (from v3.51.0). #659 @​flavorjones

... (truncated)

Commits

• 747e7de version bump to v2.9.5
• 2bd436d Fix use-after-free issue with custom functions (#710)
• b24e1e6 Fix use-after-free issue with aggregate functions (#711)
• 9abc955 dep: update vendored sqlite to 3.53.2 (#709)
• a3f8e71 For sqlcipher builds, prefer sqlcipher's header (#708)
• 9292033 build(deps): bump the actions group across 1 directory with 3 updates (#707)
• b79c841 Introduce a security reporting policy
• ae58899 version bump to v2.9.4
• e16df53 Merge pull request #704 from sparklemotion/dep-sqlite-3.53.1
• 2dc95ff dep: update vendored sqlite to 3.53.1
• Additional commits viewable in compare view

Updates concurrent-ruby from 1.3.6 to 1.3.7

Release notes

Sourced from concurrent-ruby's releases.

v1.3.7

There are 3 security fixes in this release, so updating is recommended. These security vulnerabilities are not very likely to be hit in practice and have a corresponding Low severity score.

What's Changed

• CVE-2026-54904 AtomicReference#update livelocks when the stored value is Float::NAN. Fix by @​joshuay03 and @​eregon
• CVE-2026-54905 ReentrantReadWriteLock read-count overflow grants a write lock without exclusivity. Fix by @​joshuay03
• CVE-2026-54906 ReadWriteLock allows wrong-thread write release and stray read-release counter corruption. Fix by @​joshuay03
• concurrent-ruby-ext: fix build on Darwin 32-bit by @​barracuda156 in ruby-concurrency/concurrent-ruby#1064
• Add SECURITY.md by @​eregon in ruby-concurrency/concurrent-ruby#1104
• Add Ruby 4.0 in CI by @​eregon in ruby-concurrency/concurrent-ruby#1106

New Contributors

• @​barracuda156 made their first contribution in ruby-concurrency/concurrent-ruby#1064

Full Changelog: ruby-concurrency/concurrent-ruby@v1.3.6...v1.3.7

Changelog

Sourced from concurrent-ruby's changelog.

Release v1.3.7 (16 June 2026)

concurrent-ruby:

• See the release notes on GitHub.

Commits

• 4c8fc28 Release 1.3.7
• d91ca94 Fix AtomicReference#update livelock when stored value is Float::NAN on JRuby ...
• 7e4d711 Fix ReentrantReadWriteLock read hold overflow into write-lock bit
• 6e37e06 Fix AtomicReference#update livelock when stored value is Float::NAN
• 2825cfa Cleanup spec
• 3fd4932 Fix ReadWriteLock wrong-thread write release and stray read release
• 1974b47 Add Ruby 4.0 in CI
• df8706d Add SECURITY.md (#1104)
• 7a1b789 Bump actions/upload-pages-artifact from 4 to 5
• 9b2dbf7 Bump actions/deploy-pages from 4 to 5
• Additional commits viewable in compare view

Updates loofah from 2.25.1 to 2.25.2

Release notes

Sourced from loofah's releases.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

Changelog

Sourced from loofah's changelog.

2.25.2 / 2026-07-15

Security

• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @​flavorjones
• Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @​flavorjones
• Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @​flavorjones

Improved

• Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @​flavorjones
• Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @​flavorjones
• Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @​flavorjones

Commits

• 2706d7e version bump to v2.25.2
• 1afde0c Merge pull request #308 from flavorjones/security-2252
• f1be9d8 Update allowed_uri? to decode semicolon-less numeric character references
• 5e91af8 Update allowed_uri? to handle named whitespace character references
• 20867b9 Properly restrict SVG href attributes
• 5f3bff4 test: opt into JSON comment parsing for sanitizer testdata (#307)
• b07713d test: do not run in verbose mode
• babe7a8 doc: update CHANGELOG
• a8d8d96 Merge pull request #305 from flavorjones/drop-protocol-typo
• b52f4b0 version bump to 2.25.2.beta1
• Additional commits viewable in compare view

Updates nokogiri from 1.19.3 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

• [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
• [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
• [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
• [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
• [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
• [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
• [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem

Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

• [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
• [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
• [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
• [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
• [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
• [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
• [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

Commits

• 8cfb9da version bump to v1.19.4
• a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
• 6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
• f658a54 fix: JRuby NONET bypass in XML::Schema
• 39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
• 04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
• 7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
• ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
• 5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
• 9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
• Additional commits viewable in compare view

Updates rails-html-sanitizer from 1.7.0 to 1.7.1

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio @​flavorjones

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio

Commits

• 4f37e3d version bump to v1.7.1
• b4673b9 Merge pull request #223 from rails/svg-href-local-ref
• 74dcb80 Properly restrict SVG href attributes
• 11ee440 Adjust data: URI mediatype tests for loofah 2.25.2 (#222)
• bc9622c Harden GitHub Actions workflows (#220)
• 3459ffd dep(dev): update nokogiri (#219)
• 8aa4bb2 build(deps-dev): bump concurrent-ruby from 1.3.6 to 1.3.7 (#218)
• 4ddc0c7 dep(dev): update development dependencies (#217)
• f87abb4 Merge pull request #215 from yuri-zubov/reduce-gem-size
• 527b317 Reduce gem size by excluding test files
• See full diff in compare view

Updates websocket-driver from 0.7.5 to 0.8.2

Changelog

Sourced from websocket-driver's changelog.

0.8.2 / 2026-06-23

• Gracefully handle malformed Host headers in the Server driver

0.8.1 / 2026-06-04

• Close a draft-75/76 connection if a length header grows to exceed the configured max length
• Fail the connection if a message is larger than the configured max length after extension processing
• Limit the total HTTP request line and headers size to 32K

0.8.0 / 2025-05-25

• Emit binary message as a string with Encoding::BINARY instead of an array
• Add the option :binary_data_format to force the previous behaviour

0.7.7 / 2025-01-04

• Add base64 gem to the dependencies to support Ruby 3.4

0.7.6 / 2023-07-25

• Fix handling of default ports in Host headers on Ruby 3.1+

Commits

• 49e230b Bump version to 0.8.2
• 7d6fd87 Gracefully handle malformed Host headers in the Server driver
• 5cab908 Bump version to 0.8.1
• 17b569f Limit the total HTTP request line and headers size to 32K
• fa86417 Fail the connection if a message is larger than the configured max length aft...
• d0141f0 Close a draft-75/76 connection if a length header grows to exceed the configu...
• 1e4475e Test on Ruby 4.0
• 2824edc Update release date for 0.8.0
• befd449 Prefer text frames over binary; if the input is in some non-UTF-8 text encodi...
• e3155f7 Bump version to 0.8.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.