Skip to content

🚨 [security] Update rubocop 1.75.6 → 1.88.2 (minor)#367

Open
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/rubocop-1.88.2
Open

🚨 [security] Update rubocop 1.75.6 → 1.88.2 (minor)#367
depfu[bot] wants to merge 1 commit into
masterfrom
depfu/update/rubocop-1.88.2

Conversation

@depfu

@depfu depfu Bot commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rubocop (1.75.6 → 1.88.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ bundler-audit (0.9.2 → 0.9.3) · Repo · Changelog

Release Notes

0.9.3

  • Officially support Ruby 3.4, 3.5, and 4.0.
  • Added support for Bundler 4.x.
  • Fixed typos in API documentation.

CLI

  • Ensure that the bundler-audit check command honors the BUNDLER_AUDIT_DB environment variable.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ json (indirect, 2.12.0 → 2.20.0) · Repo · Changelog

Security Advisories 🚨

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ language_server-protocol (indirect, 3.17.0.5 → 3.17.0.6) · Repo · Changelog

Release Notes

3.17.0.6 (from changelog)

  • Regenerate protocol files with the Ruby generator (#141)
    • Add missing LSP 3.17 interfaces and constants
  • Include RBS signature files in the gem package
  • Add dependent gem test workflow (#142)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 31 commits:

↗️ parallel (indirect, 1.27.0 → 1.28.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ parser (indirect, 3.3.8.0 → 3.3.11.1) · Repo · Changelog

Release Notes

3.3.11.1 (from changelog)

API modifications:

  • Bump maintenance branches to 3.2.11 (#1089) (Koichi ITO)

3.3.11.0 (from changelog)

API modifications:

  • Bump maintenance branches to 3.3.11 (#1088) (Koichi ITO)

3.3.10.2 (from changelog)

Features implemented:

  • add blocknilarg for prism (#1087) (Earlopain)

3.3.10.1 (from changelog)

API modifications:

  • Bump maintenance branches to 3.2.10 (#1085) (Koichi ITO)

3.3.10.0 (from changelog)

API modifications:

  • Bump maintenance branches to 3.3.10 (#1083) (Koichi ITO)

3.3.9.0 (from changelog)

API modifications:

  • Bump maintenance branches to 3.3.9 (#1080) (Koichi ITO)
  • Bump maintenance branches to 3.2.9 (#1079) (Koichi ITO)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

↗️ prism (indirect, 1.4.0 → 1.9.0) · Repo · Changelog

Release Notes

1.9.0

Added

  • Lots of work on the Ripper translation layer to make it more compatible and efficient.
  • Alias Prism::Node#breadth_first_search to Prism::Node#find.
  • Add Prism::Node#breadth_first_search_all/Prism::Node#find_all for finding all nodes matching a condition.

Changed

  • Fixed location of opening tokens when invalid syntax is parsed.
  • Fix RBI for parsing options.

1.8.1

Changes

  • Fix not binding power in endless methods.
  • Correctly handle and? and similar on Ruby 4.0.
  • Fix error message for block/lambda with ... argument.
  • Fix in handling.

1.8.0

Added

  • Optimize ruby visitor.
  • Report unterminated construct errors at opening token.

Changed

  • Correctly expose ripper state.
  • Use one file for versioned parser classes.
  • Fix denominator of rational float literal.
  • Decouple ripper translator from ripper library.
  • Sync Prism::Translation::ParserCurrent with Ruby 4.0.

1.7.0

Added

  • Support 4.1 as a version option.
  • Add equal_loc to CallNode.
  • Add len()/is_empty() to ConstantList and NodeList in the Rust API.

Changed

  • Rename version 3.5 to version 4.0.
  • Fix compiling the gem from source on Windows.
  • Fix parsing of unary method calls like 42.~@.
  • Reject def f a, (b) = 1.
  • Reject endless method as a block parameter default.
  • Reject variable capture in alternative pattern.
  • Many fixes in regards to memory safety, found through fuzzing.
  • Many fixes to better handle invalid syntax, also found through fuzzing.
  • Fix the ruby version used by the ripper translator.
  • Fix ruby_parser translation comment processing.

1.6.0

Added

  • Add support for passing "current" as the version option to Prism.* APIs.

Changed

  • Remove a compiler warning for a missing unsigned cast for a shift value.

1.5.2

Changed

  • Fix character literal forced encoding when a unicode escape sequence is used.
  • Reject 1 if foo = bar baz.
  • Clear static literal flag on interpolated strings.
  • Reject optional argument/endless method definition ambiguity.

1.5.1

Changed

  • Revert of a bug introduced with static literal flags on interpolated strings.

1.5.0

Added

  • Add Prism::Translation::ParserCurrent.
  • Add Integer::to_u32_digits for the Rust API.
  • Add pm_comment_type_t field for the Rust API.
  • Support leading logical operators for CRuby 3.5+.

Changed

  • Mark Prism as ractor-safe.
  • Enforce a minimum version for the parser translation layer.
  • Many fixes to the parser translation layer.
  • Accept a newline after the defined? keyword.
  • Reject true && not true.
  • Make it = it assign nil to match parse.y behavior [Bug #21139].
  • Some fixes to the ruby parser translation layer.
  • Ensure call nodes have the correct ending location.
  • Reject foo && return bar.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ regexp_parser (indirect, 2.10.0 → 2.12.0) · Repo · Changelog

Release Notes

2.12.0 (from changelog)

Added

  • support for new unicode properties of Ruby 4.0.0

2.11.3 (from changelog)

Fixed

  • correctly emit backslash-escaped UTF8 characters in character classes as one token (#104)

2.11.2 (from changelog)

Added

Fixed

  • scan with correct encoding when passing regopt individually (#102)

2.11.1 (from changelog)

Fixed

  • restored compatibility with Ruby < 2.6, broken in regexp_parser v2.11.0

2.11.0 (from changelog)

Added

  • a new token :escape, :utf8_hex and expression EscapeSequence::UTF8Hex
    • used for UTF-8 hex escapes, e.g. \xE2\x82\xAC representing U+20AC "€"

Fixed

  • detection of numeric backrefs > 9, e.g. ((((((((((foo))))))))))\10
    • these are only backrefs in Ruby if sufficient groups have been opened
    • they were previously always scanned as octal or literal escapes

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 35 commits:

↗️ rubocop-ast (indirect, 1.44.1 → 1.50.0) · Repo · Changelog

Release Notes

1.50.0 (from changelog)

Bug fixes

  • #412: Fix Node#argument? returning true for receivers that are structurally equal to an argument (e.g. the receiver in foo.bar(foo)). (@bbatsov)
  • #401: Avoid intermediate array allocations in HashNode#each_key/each_value. (@bbatsov)
  • #409: Fix Node#chained? and MethodDispatchNode#block_literal? returning true for nodes that are merely structurally equal to the receiver or send node (e.g. the argument in foo.bar(foo)). (@bbatsov)
  • #407: Fix the blockless form of the deprecated each_when, each_in_pattern, each_condition, and each_branch methods, which returned an unusable Enumerator. (@bbatsov)
  • #401: Fix force_encoding being a no-op for frozen string inputs. (@bbatsov)
  • #408: Fix ProcessedSource#preceding_line returning the last line of the file for tokens on the first line. (@bbatsov)

Changes

  • #411: Speed up filtered node traversals (each_descendant(:send) etc.) by not allocating an array per visited node, and add the non-splatting Node#type_in? predicate. (@bbatsov)
  • #404: Improve parser_prism performance by building tokens only when they are first accessed. (@bbatsov)
  • #408: Memoize ProcessedSource#checksum and skip the token sort when the tokens are already in order. (@bbatsov)
  • #410: Reduce allocations in keyword? and the method-name predicates (predicate_method?, bang_method?, etc.). (@bbatsov)
  • #405: Use Prism by default when analyzing Ruby 3.3 code. (@bbatsov)

1.49.1 (from changelog)

Bug fixes

  • #399: Fix unification variables not persisting in any-order nodes. (@marcandre)

1.49.0

New features

  • #394: Support Ruby 4.1 (experimental). (@koic)

1.48.0

New features

  • #391: Support Ruby 4.0 (experimental). (@koic)

1.47.1 (from changelog)

Bug fixes

  • #386: Fix parsing of node patterns that match against the empty string. (@earloapin)

1.47.0 (from changelog)

New features

1.46.0

New features

  • #379: Support RuboCop::AST::ComplexNode. ([@koic][])

Bug fixes

  • #380: Fix RuboCop::AST::NumericNode#sign? to return boolean. ([@viralpraxis][])

1.45.1

Bug fixes

  • #382: Fix an error when using Parser gem with prism_result. (@koic)

1.45.0

New features

  • #381: Support AST::Node#any_match_pattern_type? method. (@koic)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ unicode-display_width (indirect, 3.1.4 → 3.2.0) · Repo · Changelog

Release Notes

3.2.0 (from changelog)

  • Unicode 17.0

3.1.5 (from changelog)

  • Cache Emoji support level for performance reasons #30, patch by @Earlopain:

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 6 commits:

↗️ unicode-emoji (indirect, 4.0.4 → 4.2.0) · Repo · Changelog

Release Notes

4.2.0 (from changelog)

  • Allow Ruby 4.0
  • Remove Non-Emoji pictographs from spec, since they have been removed in Unicode 17
  • Update valid subdivisions to CLDR 48 (no changes)

4.1.0 (from changelog)

  • Unicode 17
  • Update valid subdivisions to CLDR 47 (no changes)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Jul 9, 2026
@depfu depfu Bot mentioned this pull request Jul 9, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants