Skip to content

Bump the bundler-dependencies group across 1 directory with 10 updates - #3065

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-dependencies-0af43ea208
Open

Bump the bundler-dependencies group across 1 directory with 10 updates#3065
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-dependencies-0af43ea208

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bundler-dependencies group with 10 updates in the / directory:

Package From To
faker 3.6.1 3.8.0
globalid 1.3.0 1.4.0
image_processing 2.0.2 2.1.0
standard 1.54.0 1.56.0
selenium-webdriver 4.41.0 4.49.0
timecop 0.9.10 0.9.11
webmock 3.26.2 3.26.4
actionpack 8.1.3 8.1.3.1
actionview 8.1.3 8.1.3.1
activerecord 8.1.3 8.1.3.1

Updates faker from 3.6.1 to 3.8.0

Release notes

Sourced from faker's releases.

v3.8.0

Changes

Enabling lazy load

This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.

Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:

1 - Set lazy load as a Faker Config

Faker::Config.lazy_loading = true

2 - Set lazy load as an environment variable

FAKER_LAZY_LOAD = 1

We hope you get to see the improvement by enabling it. Please file a bug report for any issues!

Thanks to @​jeremyevans for the mentoring, and to @​thdaraujo for pairing and code reviews.

Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0

v3.7.1

Thanks to all contributors!

Drops support for Ruby 3.1

What's changed

Update development dependencies

New Contributors

Full Changelog: faker-ruby/faker@v3.6.1...v3.7.1

Changelog

Sourced from faker's changelog.

v3.8.0 (2026-04-16)

Enabling lazy load

This version introduces lazy loading. It means users will only pay for what they use. Faker loads 2x faster when it's enabled.

Lazy loading the generators is disabled by default. To enable it, choose one of the configuration options below:

1 - Set lazy load as a Faker Config

Faker::Config.lazy_loading = true

2 - Set lazy load as an environment variable

FAKER_LAZY_LOAD = 1

We hope you get to see the improvement by enabling it. Please file a bug report for any issues!

Thanks to @​jeremyevans for the mentoring, and to @​thdaraujo for pairing and code reviews.

Full Changelog: faker-ruby/faker@v3.7.1...v3.8.0

v3.7.1 (2026-04-14)

Thanks to all contributors!

Drops support for Ruby 3.1

What's changed

Update development dependencies

New Contributors

... (truncated)

Commits

Updates globalid from 1.3.0 to 1.4.0

Release notes

Sourced from globalid's releases.

v1.4.0

What's Changed

New Contributors

Full Changelog: rails/globalid@v1.3.0...v1.4.0

Commits
  • c81267b Release 1.4.0
  • ce280b7 Frozen string literals
  • 9325789 Merge pull request #203 from xijo/support_model_class_override_for_custom_loc...
  • 241657b Allow custom locators to override model class derivation
  • dc5bc56 Merge pull request #204 from paulRbr/dont-constantize-model-when-not-needed
  • 2649897 Don't try to constantize GID's class too soon
  • 018ccf1 Merge pull request #202 from Drowze/swappable-uri-parser
  • 0f2efb5 Change the underlying URI parser (from RFC2396 to RFC3986)
  • 4fd30dd Merge pull request #206 from rosa/fetch
  • 948503f Add GlobalID::Locator.fetch with distinct not-found and unavailable errors
  • Additional commits viewable in compare view

Updates image_processing from 2.0.2 to 2.1.0

Changelog

Sourced from image_processing's changelog.

2.1.0 (2026-09-01)

  • [minimagick] Add inherit_fds: so a loader can name an already-open input (thanks to @​flavorjones)

2.0.3 (2026-08-06)

  • Prevent remote code execution when operation names come from user input, closing bypasses through the #operation meta-builder, #method_missing, and nested #send calls (reported by @​szymonsec)

  • [minimagick] Prevent remote code execution through unsafe public methods (e.g. #instance_eval, #send) passed as loader/saver option names

Commits

Updates standard from 1.54.0 to 1.56.0

Changelog

Sourced from standard's changelog.

1.56.0

1.55.0

Commits
  • d695ba0 🏆⚽️ v1.56.0
  • 86a92fa Merge pull request #823 from standardrb/upgrade-2026-07-15
  • dfcaef8 Fixes Parallel's overzealous update
  • 5e68710 Updates rubocop to 1.88
  • 95f959b Merge pull request #822 from standardrb/dependabot/bundler/ruby-lsp-0.26.10
  • 42c9d35 Bump ruby-lsp from 0.26.9 to 0.26.10
  • 79cd977 Merge pull request #818 from standardrb/dependabot/bundler/language_server-pr...
  • 3011204 Bump language_server-protocol from 3.17.0.5 to 3.17.0.6
  • 505e8e6 Merge pull request #797 from standardrb/dependabot/bundler/ruby-lsp-0.26.9
  • af5498a Merge pull request #816 from standardrb/dependabot/github_actions/step-securi...
  • Additional commits viewable in compare view

Updates selenium-webdriver from 4.41.0 to 4.49.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.49.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

... (truncated)

Changelog

Sourced from selenium-webdriver's changelog.

4.49.0 (2026-09-09)

  • Support CDP versions: v151, v152, v153
  • derive BiDi field names and enum value types in the schema (#17966)
  • [build] Automated CDDL Spec Update (#17990)
  • [build] ship prebuilt Selenium Manager Linux arm64 binary in all bindings (#17999)
  • [build] Automated Browser Version Update (major) with CDP (#18005)

4.48.0 (2026-08-27)

  • Support CDP versions: v150, v151, v152
  • add low-level BiDi protocol integration specs (#17878)
  • [build] Automated Browser Version Update (major) with CDP (#17910)
  • fix silent hang on oversized WebSocket frames (#17655)
  • always reject a missing required inbound BiDi field (#17936)
  • accept a whole-valued float for an integer BiDi field (#17939)
  • reject an inbound BiDi scalar outside its union's declared arms (#17947)

4.47.0 (2026-08-10)

  • Support CDP versions: v149, v150, v151
  • support WebDriver BiDi on Safari Preview and move #bidi onto Driver (#17729)
  • link generated BiDi elements to their spec definitions (#17781)
  • add objectOnly/preserveExtras/scalar-primitive BiDi schema signals (#17784)
  • construct the BiDi transport inside the domain from a connection (#17796)
  • route BiDiBridge navigation through the generated Protocol::BrowsingContext (#17785)
  • resolve spec runfiles via Bazel::Runfiles (#17810)
  • [build] standardize generated-file license and not to edit markers across generators (#17816)
  • validate nullable-constant BiDi params outbound (#17818)
  • [build] upgrade rules_ruby to 0.28.0 and drop vendored Bazel::Runfiles workaround (#17824)
  • [build] Merge vendor cddl files into shared BiDi schema and implement custom Firefox webExtension options (#17840)
  • [grid] honor client-advertised se:remoteUrl for reachable BiDi/CDP/VNC URLs (#17790)
  • tolerate and warn on missing required inbound BiDi fields, with SE_BIDI_STRICT to escalate (#17844)
  • remove deprecated FTP proxy support (#17846)
  • prevent CDP access with Firefox (#17849)
  • test matchers assert log entries by id and optional messages and match severity (#17848)
  • [bidi] Correct float/enum type fidelity in the shared schema and validate primitives outbound in Ruby (#17852)
  • [bidi] mark BiDi types extensible per spec and update Ruby handling (#17853)
  • raise typed WebDriver errors for BiDi from a generated error-code map (#17855)
  • allow pending test guards to require matching provided exception (#17859)
  • pass --enable-chrome-logs unless CHROME_LOG_FILE is set (#17858)
  • support custom vendor specific capabilities in options classes (#17862)
  • validate BiDi outbound ref fields against their declared type (#17861)
  • generate BiDi domain type accessors and union variant factories (#17865)
  • deprecate invalid Firefox profile code (#17871)
  • [build] Automated Browser Version Update with CDP (#17873)

4.46.0 (2026-07-10)

  • Support CDP versions: v148, v149, v150

... (truncated)

Commits
  • bedb24f [build] Prepare for release of selenium-4.49.0 (#18012)
  • 0536451 [build] Automated Browser Version Update (major) with CDP (#18005)
  • 0aaee1e [build] ship prebuilt Selenium Manager Linux arm64 binary in all bindings (#1...
  • 59ea9e0 [rb] stop serializing BiDi and DevTools specs under remote execution
  • 6776d37 [build] Automated CDDL Spec Update (#17990)
  • f4721fd [build] Automated Dependency Update (#17991)
  • 507b67e [rb] guard the Firefox Linux screencast failure to stable only
  • 4eaa35b [rb] request the configured browser version when finding drivers
  • f7f60f9 [rb] wait for both downloads to finish before listing them
  • dc4fc25 [rb] give the Grid two minutes to become ready in remote specs
  • Additional commits viewable in compare view

Updates timecop from 0.9.10 to 0.9.11

Changelog

Sourced from timecop's changelog.

v0.9.11

  • Fix Time.new keyword arguments on JRuby 10 (#443)
  • Fix time-only DateTime.parse (HH:MM format) incorrectly using host clock under freeze (#440)
  • Require Ruby >= 2.1.0 (#423)
  • Revert travel_offset precision change (#430)
Commits
  • b3c9a5a get ready for our next release 0.9.11 (#444)
  • 4e84492 Fix Time.new keyword arguments on JRuby 10 (#443)
  • b06405e (434) strptime_with_mock_date :: Fix year boundary (#437)
  • bb4a3c1 Fix time-only DateTime.parse under freeze (#440)
  • e4bba8c Improve and fix CI (#439)
  • d695c6f Require Ruby >= 2.1.0 (#423)
  • ce3e6bb Revert "Calculate travel_offset to align with the precision of argument to Ti...
  • 477ce9a add ruby 3.3 to ci matrix (#429)
  • e05c2c0 Calculate travel_offset to align with the precision of argument to Timecop.tr...
  • See full diff in compare view

Updates webmock from 3.26.2 to 3.26.4

Release notes

Sourced from webmock's releases.

3.26.4

  • Fix race condition in HTTPClient adapter async requests by @​koic in #1131

3.26.3

  • Confirm to work with curb 1.3.7

    Thanks to Josch Bockler

  • Fix NameError in async-http adapter on protocol-http1 >= 0.40

    Thanks to Leslie Hoare

Changelog

Sourced from webmock's changelog.

3.26.4

  • Fix race condition in HTTPClient adapter async requests by @​koic in #1131

3.26.3

  • Confirm to work with curb 1.3.7

    Thanks to Josch Bockler

  • Fix NameError in async-http adapter on protocol-http1 >= 0.40

    Thanks to Leslie Hoare

Commits
  • 0fdbad0 Version 3.26.4
  • b187df8 Merge pull request #1131 from koic/fix_race_condition_in_httpclient_adapter_a...
  • f275724 Fix race condition in HTTPClient adapter async requests
  • ee409ac Version 3.26.3
  • 2c976d5 Merge pull request #1127 from jbockler/curb-1.3
  • 5b40155 Confirm to work with curb 1.3.7
  • f685e7e Merge pull request #1130 from lesleh/fix-async-http-status-description
  • a50557e Fix NameError in async-http adapter on protocol-http1 >= 0.40
  • See full diff in compare view

Updates actionpack from 8.1.3 to 8.1.3.1

Release notes

Sourced from actionpack's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.
Commits

Updates actionview from 8.1.3 to 8.1.3.1

Release notes

Sourced from actionview's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from actionview's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.
Commits

Updates activerecord from 8.1.3 to 8.1.3.1

Release notes

Sourced from activerecord's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 8.1.3.1 (July 29, 2026)

  • No changes.
Commits

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
selenium-webdriver [< 4.10, > 4.9.0]
selenium-webdriver [>= 4.11.a, < 4.12]

@dependabot dependabot Bot added dependencies changes or issues relating to a dependency ruby Pull requests that update Ruby code labels Sep 9, 2026
@dependabot
Bump the bundler-dependencies group across 1 directory with 10 updates
071775f 
Bumps the bundler-dependencies group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [faker](https://github.com/faker-ruby/faker) | `3.6.1` | `3.8.0` |
| [globalid](https://github.com/rails/globalid) | `1.3.0` | `1.4.0` |
| [image_processing](https://github.com/janko/image_processing) | `2.0.2` | `2.1.0` |
| [standard](https://github.com/standardrb/standard) | `1.54.0` | `1.56.0` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.41.0` | `4.49.0` |
| [timecop](https://github.com/travisjeffery/timecop) | `0.9.10` | `0.9.11` |
| [webmock](https://github.com/bblimke/webmock) | `3.26.2` | `3.26.4` |
| [actionpack](https://github.com/rails/rails) | `8.1.3` | `8.1.3.1` |
| [actionview](https://github.com/rails/rails) | `8.1.3` | `8.1.3.1` |
| [activerecord](https://github.com/rails/rails) | `8.1.3` | `8.1.3.1` |



Updates `faker` from 3.6.1 to 3.8.0
- [Release notes](https://github.com/faker-ruby/faker/releases)
- [Changelog](https://github.com/faker-ruby/faker/blob/main/CHANGELOG.md)
- [Commits](faker-ruby/faker@v3.6.1...v3.8.0)

Updates `globalid` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/rails/globalid/releases)
- [Commits](rails/globalid@v1.3.0...v1.4.0)

Updates `image_processing` from 2.0.2 to 2.1.0
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](janko/image_processing@v2.0.2...v2.1.0)

Updates `standard` from 1.54.0 to 1.56.0
- [Release notes](https://github.com/standardrb/standard/releases)
- [Changelog](https://github.com/standardrb/standard/blob/main/CHANGELOG.md)
- [Commits](standardrb/standard@v1.54.0...v1.56.0)

Updates `selenium-webdriver` from 4.41.0 to 4.49.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.41.0...selenium-4.49.0)

Updates `timecop` from 0.9.10 to 0.9.11
- [Changelog](https://github.com/travisjeffery/timecop/blob/master/History.md)
- [Commits](travisjeffery/timecop@v0.9.10...v0.9.11)

Updates `webmock` from 3.26.2 to 3.26.4
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.26.2...v3.26.4)

Updates `actionpack` from 8.1.3 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionpack/CHANGELOG.md)
- [Commits](rails/rails@v8.1.3...v8.1.3.1)

Updates `actionview` from 8.1.3 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionview/CHANGELOG.md)
- [Commits](rails/rails@v8.1.3...v8.1.3.1)

Updates `activerecord` from 8.1.3 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activerecord/CHANGELOG.md)
- [Commits](rails/rails@v8.1.3...v8.1.3.1)

---
updated-dependencies:
- dependency-name: actionpack
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler-dependencies
- dependency-name: actionview
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler-dependencies
- dependency-name: activerecord
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler-dependencies
- dependency-name: faker
  dependency-version: 3.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler-dependencies
- dependency-name: globalid
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler-dependencies
- dependency-name: image_processing
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler-dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.48.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler-dependencies
- dependency-name: standard
  dependency-version: 1.56.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler-dependencies
- dependency-name: timecop
  dependency-version: 0.9.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler-dependencies
- dependency-name: webmock
  dependency-version: 3.26.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/bundler-dependencies-0af43ea208 branch from e8f92f5 to 071775f Compare September 16, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies changes or issues relating to a dependency ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants