Bump the bundler group across 1 directory with 4 updates by dependabot[bot] · Pull Request #1439 · rootstrap/rails_api_base

dependabot · 2026-08-07T18:43:49Z

Bumps the bundler group with 3 updates in the / directory: aws-sdk-s3, devise and rubocop.

Updates aws-sdk-s3 from 1.228.1 to 1.228.2

Changelog

1.228.2 (2026-07-30)

Issue - S3 Encryption Client, encryptionV2 and encryptionV3, returns a decryption error for a malformed material description.

Commits

See full diff in compare view

Updates devise from 4.9.4 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

security fixes

Fix open redirect in FailureApp via unvalidated Referer header on non-GET session timeout. CVE-2026-40295 GHSA-jp94-3292-c3xv

5.0.3 - 2026-03-16

security fixes

Fix race condition vulnerability on confirmable "change email" which would allow confirming an email they don't own CVE-2026-32700 GHSA-57hq-95w6-v4fc #5783 #5784

5.0.2 - 2026-02-18

enhancements

Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825

Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.

Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

bug fixes

Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31
breaking changes
Drop support to Ruby < 2.7

Drop support to Rails < 7.0

Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

Remove deprecated Devise.activerecord51? method.
Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

This is potentially a breaking change because Devise previously used the following order to find a secret key:
app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base
Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645
Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

Change <br> tags separating form elements to wrapping them in <p> tags #5494

Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

... (truncated)

Commits

9ea459d Release v5.0.4 with sec fix for timeoutable
025fe21 Merge commit from fork
7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
605de86 Update links to https [ci skip]
5e3a8bf Bundle update
5d20277 Cleanup old Rails.version check for db migration path
4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
2f80920 Release v5.0.3
5334707 Add CVE to changelog [ci skip]
0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
Additional commits viewable in compare view

Updates devise_token_auth from 1.2.6 to 1.3.0

Commits

b02076a Support Rails 8.0 and 8.1 (#1686)
ec19d94 Fix clean_old_tokens purging freshly-created token at device cap (#1685)
bcdc3a5 Update devise to 5 (#1675)
See full diff in compare view

Updates rubocop from 1.88.2 to 1.89.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.89.0

New features

#15492: Add AllCops/ProjectIndexIncludesGems for bundle-wide indexing. ([@bbatsov][])

#15498: Add DelegatingMethods option to Lint/DuplicateMethods to register custom delegate-shaped methods. ([@bbatsov][])

#15042: Add DisallowedCops configuration option to Style/DisableCopsWithinSourceCodeDirective. ([@hammadxcm][])

#15441: Add new AllowYARDCommentBlockSeparator option to Layout/LeadingCommentSpace. ([@koic][])

#15466: Add new Lint/DeprecatedReference cop to detect references to methods and constants documented as @deprecated, powered by the project index. ([@bbatsov][])

#15491: Add new Lint/NameTypo cop. ([@bbatsov][])

#15468: Add new Lint/UnusedPrivateMethod cop for project-wide dead-code detection via the project index (disabled by default). ([@bbatsov][])

#14598: Make Style/DisableCopsWithinSourceCodeDirective impossible to disable via directive comments when explicitly enabled with Enabled: true. ([@rafaelfranca][])

#15511: Support textDocument/codeAction requests in the built-in language server, so LSP clients that request code actions (Eglot, Helix, Flycheck, ...) can apply RuboCop's autocorrects, not only clients that read them off the published diagnostic. ([@bbatsov][])

#8565: Support NewCops in department configuration to enable pending cops per department, including cops added up to a specific version (e.g. Style: NewCops: '1.19'). ([@koic][])

#9373: Support autocorrection for tab indentation in Layout/IndentationWidth and Style/ClassAndModuleChildren. ([@ioquatix][], [@koic][])

Bug fixes

#15257: Fix a false negative for Lint/ToEnumArguments when explicit extra keyword arguments are passed (e.g. def m(x:); to_enum(:m, x: x, y: 1); end), which raises ArgumentError when the enumerator is used. ([@RedZapdos123][])

#15452: Fix a false positive for Layout/HashAlignment when using EnforcedHashRocketStyle: table and a hash key spans multiple lines. ([@dduugg][])

#12269: Fix a false positive for Lint/UselessAssignment with modifier conditions. ([@bbatsov][])

#13786: Fix a false positive for Lint/Void with setter methods. ([@bbatsov][])

#15507: Fix a false positive for Naming/VariableNumber when using an empty symbol hash key. ([@koic][])

#15284: Fix a false positive for Style/MutableConstant with Data.define. ([@bbatsov][])

#15483: Fix a false positive for Style/MissingRespondToMissing when respond_to_missing? is defined in a reopening of the class and UseProjectIndex is enabled. ([@bbatsov][])

#15500: Fix an error for Lint/LiteralAsCondition when a literal condition has an empty branch. ([@koic][])

#15499: Fix an error for Lint/UselessRuby2Keywords when ruby2_keywords is used with a symbol but no method definition is found. ([@koic][])

#15453: Fix an error for Metrics/MethodLength when a method contains a heredoc and __ENCODING__. ([@koic][])

#15442: Fix an error for Style/ArrayIntersect cop when the block-based check calls member?/include? without an explicit receiver. ([@dduugg][])

#15434: Fix an error for Style/NegativeArrayIndex cop. ([@viralpraxis][])

#15469: Fix an error for Style/RedundantFormat when a format string uses a positional argument number beyond the 64-bit range. ([@koic][])

#15454: Fix an error for Style/RedundantFormat when the argument for a positional variable width is missing. ([@koic][])

#15298: Fix an incorrect autocorrect for Lint/LiteralInInterpolation. ([@bbatsov][])

#15515: Fix an incorrect autocorrect for Style/ArrayIntersect when using safe navigation none? with a block. ([@koic][])

#15364: Fix an incorrect autocorrect for Style/MultipleComparison that dropped an allowed method comparison appearing between the compared values. ([@bbatsov][])

#15367: Fix an incorrect autocorrect for Style/RedundantFileExtensionInRequire that produced invalid Ruby when a backslash preceded the .rb extension. ([@bbatsov][])

#12017: Fix Lint/Void to no longer autocorrect a constant used in a void context, since removing it can change behavior through constant autoloading side effects. ([@bbatsov][])

#14797: Avoid cache writes during server checks. ([@sjh9714][])

#15484: Fix false negatives for Lint/InheritException when Exception is inherited indirectly through a project class (UseProjectIndex). ([@bbatsov][])

#15357: Fix a false negative for Lint/AmbiguousAssignment when using attribute or index assignment. ([@sngsmz][])

#9571: Fix false negatives in Layout/ClassStructure when class body elements are wrapped in begin blocks. ([@koic][])

#9570: Fix false negatives in Layout/ClassStructure when using private_class_method or public_class_method def modifiers. ([@koic][])

#15438: Fix false positives in Style/ArrayIntersect when the receiver of include? in a block is not an array literal. ([@koic][])

#15445: Fix false positives in Style/MultilineIfThen when using the Prism parser engine and an elsif without then follows a branch using then with a body on the same line. ([@koic][])

#15058: Fix false positives in Lint/DuplicateMethods for anonymous classes (Class.new) passed as arguments to the same named-receiver method call (e.g. T.cast). Each Class.new block is an independent class, so methods defined in different blocks should not be treated as duplicates. ([@rafaelfranca][])

#15486: Fix false negatives for Style/RedundantConstantBase inside namespaces when the constant provably resolves identically without :: (UseProjectIndex). ([@bbatsov][])

#15505: Fix incompatible autocorrect between Style/Lambda and Style/SymbolProc producing a syntax error like ->(x)(&:method) when both cops run on lambda { |x| x.method }. ([@koic][])

#15481: Fix cross-file offenses depending on which files are inspected: the project index now always covers the whole project (UseProjectIndex). ([@bbatsov][])

#13794: Fix Layout/LineLength autocorrection for endless methods with block bodies. ([@hervetatche][])

#15462: Fix an error for Lint/ConstantReassignment when a built-in constant name is assigned and UseProjectIndex is enabled. ([@bbatsov][])

#15321: Fix Style/ClassAndModuleChildren ignoring EnforcedStyleForClasses and EnforcedStyleForModules, and skip autocorrection when mixed per-type styles make the result ambiguous. ([@bbatsov][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.89.0 (2026-08-04)

New features

#15492: Add AllCops/ProjectIndexIncludesGems for bundle-wide indexing. ([@bbatsov][])

#15498: Add DelegatingMethods option to Lint/DuplicateMethods to register custom delegate-shaped methods. ([@bbatsov][])

#15042: Add DisallowedCops configuration option to Style/DisableCopsWithinSourceCodeDirective. ([@hammadxcm][])

#15441: Add new AllowYARDCommentBlockSeparator option to Layout/LeadingCommentSpace. ([@koic][])

#15466: Add new Lint/DeprecatedReference cop to detect references to methods and constants documented as @deprecated, powered by the project index. ([@bbatsov][])

#15491: Add new Lint/NameTypo cop. ([@bbatsov][])

#15468: Add new Lint/UnusedPrivateMethod cop for project-wide dead-code detection via the project index (disabled by default). ([@bbatsov][])

#14598: Make Style/DisableCopsWithinSourceCodeDirective impossible to disable via directive comments when explicitly enabled with Enabled: true. ([@rafaelfranca][])

#15511: Support textDocument/codeAction requests in the built-in language server, so LSP clients that request code actions (Eglot, Helix, Flycheck, ...) can apply RuboCop's autocorrects, not only clients that read them off the published diagnostic. ([@bbatsov][])

#8565: Support NewCops in department configuration to enable pending cops per department, including cops added up to a specific version (e.g. Style: NewCops: '1.19'). ([@koic][])

#9373: Support autocorrection for tab indentation in Layout/IndentationWidth and Style/ClassAndModuleChildren. ([@ioquatix][], [@koic][])

Bug fixes

#15257: Fix a false negative for Lint/ToEnumArguments when explicit extra keyword arguments are passed (e.g. def m(x:); to_enum(:m, x: x, y: 1); end), which raises ArgumentError when the enumerator is used. ([@RedZapdos123][])

#15452: Fix a false positive for Layout/HashAlignment when using EnforcedHashRocketStyle: table and a hash key spans multiple lines. ([@dduugg][])

#12269: Fix a false positive for Lint/UselessAssignment with modifier conditions. ([@bbatsov][])

#13786: Fix a false positive for Lint/Void with setter methods. ([@bbatsov][])

#15507: Fix a false positive for Naming/VariableNumber when using an empty symbol hash key. ([@koic][])

#15284: Fix a false positive for Style/MutableConstant with Data.define. ([@bbatsov][])

#15483: Fix a false positive for Style/MissingRespondToMissing when respond_to_missing? is defined in a reopening of the class and UseProjectIndex is enabled. ([@bbatsov][])

#15500: Fix an error for Lint/LiteralAsCondition when a literal condition has an empty branch. ([@koic][])

#15499: Fix an error for Lint/UselessRuby2Keywords when ruby2_keywords is used with a symbol but no method definition is found. ([@koic][])

#15453: Fix an error for Metrics/MethodLength when a method contains a heredoc and __ENCODING__. ([@koic][])

#15442: Fix an error for Style/ArrayIntersect cop when the block-based check calls member?/include? without an explicit receiver. ([@dduugg][])

#15434: Fix an error for Style/NegativeArrayIndex cop. ([@viralpraxis][])

#15469: Fix an error for Style/RedundantFormat when a format string uses a positional argument number beyond the 64-bit range. ([@koic][])

#15454: Fix an error for Style/RedundantFormat when the argument for a positional variable width is missing. ([@koic][])

#15298: Fix an incorrect autocorrect for Lint/LiteralInInterpolation. ([@bbatsov][])

#15515: Fix an incorrect autocorrect for Style/ArrayIntersect when using safe navigation none? with a block. ([@koic][])

#15364: Fix an incorrect autocorrect for Style/MultipleComparison that dropped an allowed method comparison appearing between the compared values. ([@bbatsov][])

#15367: Fix an incorrect autocorrect for Style/RedundantFileExtensionInRequire that produced invalid Ruby when a backslash preceded the .rb extension. ([@bbatsov][])

#12017: Fix Lint/Void to no longer autocorrect a constant used in a void context, since removing it can change behavior through constant autoloading side effects. ([@bbatsov][])

#14797: Avoid cache writes during server checks. ([@sjh9714][])

#15484: Fix false negatives for Lint/InheritException when Exception is inherited indirectly through a project class (UseProjectIndex). ([@bbatsov][])

#15357: Fix a false negative for Lint/AmbiguousAssignment when using attribute or index assignment. ([@sngsmz][])

#9571: Fix false negatives in Layout/ClassStructure when class body elements are wrapped in begin blocks. ([@koic][])

#9570: Fix false negatives in Layout/ClassStructure when using private_class_method or public_class_method def modifiers. ([@koic][])

#15438: Fix false positives in Style/ArrayIntersect when the receiver of include? in a block is not an array literal. ([@koic][])

#15445: Fix false positives in Style/MultilineIfThen when using the Prism parser engine and an elsif without then follows a branch using then with a body on the same line. ([@koic][])

#15058: Fix false positives in Lint/DuplicateMethods for anonymous classes (Class.new) passed as arguments to the same named-receiver method call (e.g. T.cast). Each Class.new block is an independent class, so methods defined in different blocks should not be treated as duplicates. ([@rafaelfranca][])

#15486: Fix false negatives for Style/RedundantConstantBase inside namespaces when the constant provably resolves identically without :: (UseProjectIndex). ([@bbatsov][])

#15505: Fix incompatible autocorrect between Style/Lambda and Style/SymbolProc producing a syntax error like ->(x)(&:method) when both cops run on lambda { |x| x.method }. ([@koic][])

#15481: Fix cross-file offenses depending on which files are inspected: the project index now always covers the whole project (UseProjectIndex). ([@bbatsov][])

#13794: Fix Layout/LineLength autocorrection for endless methods with block bodies. ([@hervetatche][])

#15462: Fix an error for Lint/ConstantReassignment when a built-in constant name is assigned and UseProjectIndex is enabled. ([@bbatsov][])

... (truncated)

Commits

65854e6 Cut 1.89
f5dbd74 Update Changelog
2f96cd7 Add new Lint/NameTypo cop
9a91e2b Promote the resolved-ancestry guard to ProjectIndexHelp
e917b65 Merge pull request #15522 from joklek-vinted/fix/mise-toml-with-single-quotes
619e3d2 Fix Ruby version detection from mise.toml with single quotes
7999d1a [Fix #15501] Improve Style/RedundantLineContinuation performance on adjacen...
63d9361 Advertise executeCommandProvider in the language server
893a02f Cache the LSP project index across requests
3b9755f Merge pull request #15516 from koic/fix_a_flaky_line_length_spec_timeout_on_j...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the bundler group with 3 updates in the / directory: [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby), [devise](https://github.com/heartcombo/devise) and [rubocop](https://github.com/rubocop/rubocop). Updates `aws-sdk-s3` from 1.228.1 to 1.228.2 - [Release notes](https://github.com/aws/aws-sdk-ruby/releases) - [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-ruby/commits) Updates `devise` from 4.9.4 to 5.0.4 - [Release notes](https://github.com/heartcombo/devise/releases) - [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md) - [Commits](heartcombo/devise@v4.9.4...v5.0.4) Updates `devise_token_auth` from 1.2.6 to 1.3.0 - [Changelog](https://github.com/lynndylanhurley/devise_token_auth/blob/master/CHANGELOG.md) - [Commits](lynndylanhurley/devise_token_auth@v1.2.6...v1.3.0) Updates `rubocop` from 1.88.2 to 1.89.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.88.2...v1.89.0) --- updated-dependencies: - dependency-name: aws-sdk-s3 dependency-version: 1.228.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler - dependency-name: devise dependency-version: 5.0.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: bundler - dependency-name: devise_token_auth dependency-version: 1.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bundler - dependency-name: rubocop dependency-version: 1.89.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 7, 2026

Navigation Menu

Uh oh!

Bump the bundler group across 1 directory with 4 updates - #1439

Bump the bundler group across 1 directory with 4 updates#1439
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-bb041401ec

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026

1.228.2 (2026-07-30)

v5.0.4

v5.0.3

v5.0.2

v5.0.1

v5.0.0

v5.0.0.rc

5.0.4 - 2026-05-08

5.0.3 - 2026-03-16

5.0.2 - 2026-02-18

5.0.1 - 2026-02-13

5.0.0 - 2026-01-23

5.0.0.rc - 2025-12-31

RuboCop v1.89.0

New features

Bug fixes

1.89.0 (2026-08-04)

New features

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants