Bump the bundler group across 1 directory with 6 updates

[dependabot]

Bumps the bundler group with 3 updates in the /templates/rails directory: actionpack, net-imap and rexml.

Updates actionpack from 7.1.4.1 to 7.1.5.1

Release notes

Sourced from actionpack's releases.

7.1.5.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Add validation to content security policies to disallow spaces and semicolons. Developers should use multiple arguments, and different directive methods instead.

  [CVE-2024-54133]

  Gannon McGibbon

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

... (truncated)

Commits

• 14c115b Preparing for 7.1.5.1 release
• 5558e72 Add CSP directive validation
• 625ec92 Preparing for 7.1.5 release
• 3ddbd08 Merge remote-tracking branch 'origin/7-1-sec' into 7-1-stable
• e52d670 Preparing for 7.1.4.2 release
• 7021f21 [ci skip] Fix CHANGELOG lint errors
• d3ceb6c Merge remote-tracking branch 'origin/7-1-sec' into 7-1-stable
• 7379f7c Backport Ruby 3.4 compatibility fixes for actionpack
• cce9ecb Merge pull request #53202 from byroot/ruby-3.4-hash-inspect
• 471eb56 [7.1] Fix URI::DEFAULT_PARSER warnings
• Additional commits viewable in compare view

Updates net-imap from 0.4.10 to 0.4.19

Release notes

Sourced from net-imap's releases.

v0.4.19

What's Changed

🔒 Security Fix

Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can exhaust client memory by sending APPENDUID or COPYUID responses with very large uid-set ranges. Net::IMAP::UIDPlusData expands these ranges into arrays of integers.

Fix with minor API changes

Set config.parser_use_deprecated_uidplus_data to false to replace UIDPlusData with AppendUIDData and CopyUIDData. These classes store their UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of integers). Code that does not handle APPENDUID or COPYUID responses should not see any difference. Code that does handle these responses may need to be updated.

For v0.3.8, this option is not available For v0.4.19, the default value is true. For v0.5.6, the default value is :up_to_max_size. For v0.6.0, the only allowed value will be false (UIDPlusData will be removed from v0.6).

Mitigate with backward compatible API

Adjust config.parser_max_deprecated_uidplus_data_size to limit the maximum UIDPlusData UID set size. When config.parser_use_deprecated_uidplus_data == true, larger sets will crash. When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger sets will use AppendUIDData or CopyUIDData.

For v0.3,8, this limit is hard-coded to 10,000. For v0.4.19, this limit defaults to 1000. For v0.5.6, this limit defaults to 100. For v0.6.0, the only allowed value will be 0 (UIDPlusData will be removed from v0.6).

Please Note: unhandled responses

If the client does not add response handlers to prune unhandled responses, a malicious server can still eventually exhaust all client memory, by repeatedly sending malicious responses. However, net-imap has always retained unhandled responses, and it has always been necessary for long-lived connections to prune these responses. This is not significantly different from connecting to a trusted server with a long-lived connection. To limit the maximum number of retained responses, a simple handler might look something like the following:

limit = 1000
imap.add_response_handler do |resp|
  next unless resp.respond_to?(:name) && resp.respond_to?(:data)
  name = resp.name
  code = resp.data.code&.name if resp.data.in?(Net::IMAP::ResponseText)
  imap.responses(name) { _1.slice!(0...-limit) }
  imap.responses(code) { _1.slice!(0...-limit) }
end

Added

• 🔧 ResponseParser config is mutable and non-global (backports #381) by @​nevans in ruby/net-imap#382
• ✨ SequenceSet ordered entries methods (backports to v0.4-stable) by @​nevans in ruby/net-imap#402 Backports the following:
  • ✨ Add SequenceSet methods for querying about duplicates by @​nevans in ruby/net-imap#384
  • ✨ Add SequenceSet#each_ordered_number by @​nevans in ruby/net-imap#386
  • ✨ Add SequenceSet#find_ordered_index by @​nevans in ruby/net-imap#396
  • ✨ Add SequenceSet#ordered_at by @​nevans in ruby/net-imap#397
• ✨ Backport UIDPlusData, AppendUIDData, CopyUIDData to v0.4 by @​nevans in ruby/net-imap#404 Backports the following:
  • ✨ Add AppendUIDData and CopyUIDData classes by @​nevans in ruby/net-imap#400

... (truncated)

Commits

• 4c4ed09 🔖 Bump version to 0.4.19
• c8c5a64 Merge commit from fork
• abff00f 🔧 Add :up_to_max_size config for UIDPlusData
• 34a1f27 🔧 Add config option for max UIDPlusData size
• 6613d57 🔒 Limit exponential memory usage to parse uid-set
• e4d57b1 🔀 Merge pull request #404 from ruby/backport-0.4-uidplus-deprecation
• d32320a 🐛 Fix missing Data.define for new classes
• 3c592fc 🔧🗑️ Deprecate UIDPlusData, with config to upgrade
• 7e58ef3 ✨ Add CopyUIDData (to replace UIDPlusData)
• 4c601c3 ✨ Add AppendUIDData (to replace UIDPlusData)
• Additional commits viewable in compare view

Updates nokogiri from 1.16.7 to 1.18.5

Release notes

Sourced from nokogiri's releases.

v1.18.5 / 2025-03-19

Fixed

• [JRuby] Update JRuby's XML serialization so it outputs namespaces exactly like CRuby. (#3455, #3456) @​johnnyshields

3f12540863e45db38236257be30a8605cd1d2d074c38a63c6f1307fd968a477c  nokogiri-1.18.5-aarch64-linux-gnu.gem
296a9e346d9a816526ee0944b5df26e947d91ec09225897bf2fc14561e8861ca  nokogiri-1.18.5-aarch64-linux-musl.gem
df7731e550a7653c003ed142cc8bc3c611c15fae3b7be4ff317b61dfe32842d9  nokogiri-1.18.5-arm64-darwin.gem
25fc71081c671fc4e983eac76ad1b3c8ee2707c467dcdb96a066f749f978eaba  nokogiri-1.18.5-arm-linux-gnu.gem
8682d38ac2015ffa3b0c23925c579ced7e455f16931130ab434f26ff1c2846fa  nokogiri-1.18.5-arm-linux-musl.gem
c8a6f8da9418ac21345124bc79b94701f036fa05b27dfec4a6dc148d5fa136dc  nokogiri-1.18.5.gem
22354b83a81acefd028e7622d4dd832c1e3cc305bf152f7f77e7db9c820b59d0  nokogiri-1.18.5-java.gem
874080a907a550a60b28febd56fe8ae921e6a7e0bb0ae61aaecd6c71665dc604  nokogiri-1.18.5-x64-mingw-ucrt.gem
28659cf43eedb652ae2fb94a8c7a14d368b6944db97e63b4158c8d5d5b4f49d8  nokogiri-1.18.5-x86_64-darwin.gem
195f4a139961f3c892ac22fda6ae4e665919e6573149f0adc786adc8c20402be  nokogiri-1.18.5-x86_64-linux-gnu.gem
8c2786d259e3c73687f8c595e1ab040a66809799ad066dad8eb492fd58f4f8fd  nokogiri-1.18.5-x86_64-linux-musl.gem

v1.18.4 / 2025-03-14

Security

• [CRuby] Vendored libxslt is updated to v1.1.43 to address CVE-2025-24855 and CVE-2024-55549. See GHSA-mrxw-mxhj-p664 for more information.

8f2263cef9953ce09bd5293d76c9bbd3013d2f94d1cca67783dfe6635c529deb  nokogiri-1.18.4-aarch64-linux-gnu.gem
4e231f8ba3128cfc2ef0cc0bdc807d7ce71fc62cb6a78216e817be8631fe6a96  nokogiri-1.18.4-aarch64-linux-musl.gem
73902663b23b1123282b9c0b6d9654b1fb286dfee8d65cb1f6029087b7f0d037  nokogiri-1.18.4-arm64-darwin.gem
cc2945e2c19560a61a97737e6bd3b329edb1f82ca204d46a18e5e98ad0a550a6  nokogiri-1.18.4-arm-linux-gnu.gem
4fb7f44de0cd85abfa869e4cfb619410da174ebf9fbe26ae0caa65462b818bcb  nokogiri-1.18.4-arm-linux-musl.gem
bb7820521c1bbae1d3e0092ff03b27a8e700912b37d80f962b7e4567947a64ac  nokogiri-1.18.4.gem
cbc0bab72eb5a9573efa7b98351fdd44c609e8d4585456ca1be18db2b7764b64  nokogiri-1.18.4-java.gem
bd567cb509eb75de8f27ca6ecaf4a38bf0563482188991f9bcccccac9c3b9a2f  nokogiri-1.18.4-x64-mingw-ucrt.gem
e4776f58eea9b94d05caf8bf351e3c6aa1cce01edcc2ed530f3c302c13178965  nokogiri-1.18.4-x86_64-darwin.gem
b1c6407b346b88704e97a342a80acd4755175324e624da34d0c5cfdc8d34191e  nokogiri-1.18.4-x86_64-linux-gnu.gem
ea7c0356a70f3d2d0d76315b533877013d20368d5c9f437c38e0bd462c4844dc  nokogiri-1.18.4-x86_64-linux-musl.gem

v1.18.3 / 2025-02-18

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.18.5 / 2025-03-19

Fixed

• [JRuby] Update JRuby's XML serialization so it outputs namespaces exactly like CRuby. (#3455, #3456) @​johnnyshields

v1.18.4 / 2025-03-14

Security

• [CRuby] Vendored libxslt is updated to v1.1.43 to address CVE-2025-24855 and CVE-2024-55549. See GHSA-mrxw-mxhj-p664 for more information.

v1.18.3 / 2025-02-18

Security

• [CRuby] Vendored libxml2 is updated v2.13.6 to address CVE-2025-24928 and CVE-2024-56171. See GHSA-vvfq-8hwr-qm4m for more information.

v1.18.2 / 2024-01-19

Fixed

• When performing a CSS selector query, an XML document's root namespace declarations should not be applied to wildcard selectors ("*"). Fixes a bug introduced in v1.17.0. (#3411) @​flavorjones

v1.18.1 / 2024-12-29

Fixed

• [CRuby] XML::SAX::ParserContext keeps a reference to the input to avoid a potential use-after-free issue that's existed since v1.4.0 (2009). (#3395) @​flavorjones

v1.18.0 / 2024-12-25

Notable Changes

Ruby

This release introduces native gem support for Ruby 3.4.

This release ends support for Ruby 3.0, for which upstream support ended 2024-04-23.

This release ships separate precompiled GNU and Musl gems for all linux platforms. Previously both GNU and Musl target systems could use and install the same gem, e.g., the platform gem for x86_64-linux. Now, however, the precompiled gem platforms would be x86_64-linux-gnu and x86_64-linux-musl. So long as you're on bundler >= 2.5.6 this should be seamless other than perhaps needing to update the platforms in your "Gemfile.lock".

This release drops precompiled native platform gems for x86-linux and x86-mingw32. These platforms are still supported. Users on these platforms must install the "ruby platform" gem which requires a compiler toolchain. See Installing the ruby platform gem in the installation docs. (#3369, #3081)

... (truncated)

Commits

• 58823ff version bump to v1.18.5
• 4473261 Fix MRI Ruby vs. JRuby XML child namespace output differences (backport v1.18...
• 6cac169 doc: update CHANGELOG
• 28978c6 Fix MRI Ruby vs. JRuby XML child namespace output differences (#3456)
• 80edf1c version bump to v1.18.4
• 3c12e35 dep: update libxslt to 1.1.43 (v1.18.x branch) (#3467)
• 395c085 dep: update libxslt to 1.1.43
• 4125715 ci: tired of waiting for gnome mirrors
• 35faaa3 doc: update CHANGELOG with GHSA
• fd3ca2e version bump to v1.18.3
• Additional commits viewable in compare view

Updates rack from 3.1.8 to 3.1.12

Changelog

Sourced from rack's changelog.

[3.1.12] - 2025-03-11

Security

• CVE-2025-27610 Local file inclusion in Rack::Static.

[3.1.11] - 2025-03-04

Security

• CVE-2025-27111 Possible Log Injection in Rack::Sendfile.

[3.1.10] - 2025-02-12

Security

• CVE-2025-25184 Possible Log Injection in Rack::CommonLogger.

[3.1.9] - 2025-01-31

Fixed

• Rack::MediaType#params now handles parameters without values. (#2263, @​AllyMarthaJ)

Commits

• e8f4760 Bump patch version.
• 413b834 Update changelog.
• 70cb322 Use a fully resolved file path when confirming if a file can be served by `Ra...
• c827c33 Bump patch version.
• aeac570 Use #inspect to prevent log injection.
• 0349488 Bump patch version.
• 4aa1978 Escape non-printable characters when logging.
• e217a39 Bump patch version.
• 3383cf2 Update changelog.
• edb0869 fix: malformed charset param (#2263) (#2277)
• Additional commits viewable in compare view

Updates rails-html-sanitizer from 1.6.0 to 1.6.2

Release notes

Sourced from rails-html-sanitizer's releases.

v1.6.2 / 2024-12-12

• PermitScrubber fully supports frozen "allowed tags".

  v1.6.1 introduced safety checks that may remove unsafe tags from the allowed list, which introduced a regression for applications passing a frozen array of allowed tags. Tags and attributes are now properly copied when they are passed to the scrubber.

  Fixes #195.

  Mike Dalessio

1.6.1 / 2024-12-02

This is a performance and security release which addresses several possible XSS vulnerabilities.

• The dependency on Nokogiri is updated to v1.15.7 or >=1.16.8.

  This change addresses CVE-2024-53985 (GHSA-w8gc-x259-rc7x).

  Mike Dalessio

• Disallowed tags will be pruned when they appear in foreign content (i.e. SVG or MathML content), regardless of the prune: option value. Previously, disallowed tags were "stripped" unless the gem was configured with the prune: true option.

  The CVEs addressed by this change are:

  • CVE-2024-53986 (GHSA-638j-pmjw-jq48)
  • CVE-2024-53987 (GHSA-2x5m-9ch4-qgrr)

  Mike Dalessio

• The tags "noscript", "mglyph", and "malignmark" will not be allowed, even if explicitly added to the allowlist. If applications try to allow any of these tags, a warning is emitted and the tags are removed from the allow-list.

  The CVEs addressed by this change are:

  • CVE-2024-53988 (GHSA-cfjx-w229-hgx5)
  • CVE-2024-53989 (GHSA-rxv5-gxqc-xx8g)

  Please note that we may restore support for allowing "noscript" in a future release. We do not expect to ever allow "mglyph" or "malignmark", though, especially since browser support is minimal for these tags.

  Mike Dalessio

... (truncated)

Changelog

Sourced from rails-html-sanitizer's changelog.

v1.6.2 / 2024-12-12

• PermitScrubber fully supports frozen "allowed tags".

  v1.6.1 introduced safety checks that may remove unsafe tags from the allowed list, which introduced a regression for applications passing a frozen array of allowed tags. Tags and attributes are now properly copied when they are passed to the scrubber.

  Fixes #195.

  Mike Dalessio

1.6.1 / 2024-12-02

This is a performance and security release which addresses several possible XSS vulnerabilities.

• The dependency on Nokogiri is updated to v1.15.7 or >=1.16.8.

  This change addresses CVE-2024-53985 (GHSA-w8gc-x259-rc7x).

  Mike Dalessio

• Disallowed tags will be pruned when they appear in foreign content (i.e. SVG or MathML content), regardless of the prune: option value. Previously, disallowed tags were "stripped" unless the gem was configured with the prune: true option.

  The CVEs addressed by this change are:

  • CVE-2024-53986 (GHSA-638j-pmjw-jq48)
  • CVE-2024-53987 (GHSA-2x5m-9ch4-qgrr)

  Mike Dalessio

• The tags "noscript", "mglyph", and "malignmark" will not be allowed, even if explicitly added to the allowlist. If applications try to allow any of these tags, a warning is emitted and the tags are removed from the allow-list.

  The CVEs addressed by this change are:

  • CVE-2024-53988 (GHSA-cfjx-w229-hgx5)
  • CVE-2024-53989 (GHSA-rxv5-gxqc-xx8g)

  Please note that we may restore support for allowing "noscript" in a future release. We do not expect to ever allow "mglyph" or "malignmark", though, especially since browser support is minimal for these tags.

  Mike Dalessio

• Improve performance by eliminating needless operations on attributes that are being removed. #188

... (truncated)

Commits

• 9160d49 version bump to v1.6.2
• 5843d4d fix: PermitScrubber accepts frozen tags
• 5e96b19 version bump to v1.6.1
• 383cc7c doc: update CHANGELOG with assigned CVEs
• a7b0cfe Combine the noscript/mglyph prevention blocks
• 5658335 Merge branch 'h1-2509647-noscript' into flavorjones-2024-security-fixes
• 65fb72f Merge branch 'h1-2519936-mglyph-foster-parenting' into flavorjones-2024-secur...
• 3fe22a8 Merge branch 'h1-2519936-foreign-ns-confusion' into flavorjones-2024-security...
• d7a94c1 Merge branch 'h1-2503220-nokogiri-serialization' into flavorjones-2024-securi...
• 3fd6e65 doc: update CHANGELOG
• Additional commits viewable in compare view

Updates rexml from 3.3.6 to 3.3.9

Release notes

Sourced from rexml's releases.

REXML 3.3.9 - 2024-10-24

Improvements

• Improved performance.
  • GH-210
  • Patch by NAITOH Jun.

Fixes

• Fixed a parse bug for text only invalid XML.

  • GH-215
  • Patch by NAITOH Jun.

• Fixed a parse bug that &#0x...; is accepted as a character reference.

Thanks

• NAITOH Jun

REXML 3.3.8 - 2024-09-29

Improvements

• SAX2: Improve parse performance.
  • GH-207
  • Patch by NAITOH Jun.

Fixes

• Fixed a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported.
  • GH-208
  • Patch by KITAITI Makoto

Thanks

• NAITOH Jun

• KITAITI Makoto

REXML 3.3.7 - 2024-09-04

Improvements

• Added local entity expansion limit methods
  • GH-192
  • GH-202
  • Reported by takuya kodama.

... (truncated)

Changelog

Sourced from rexml's changelog.

3.3.9 - 2024-10-24 {#version-3-3-9}

Improvements

• Improved performance.
  • GH-210
  • Patch by NAITOH Jun.

Fixes

• Fixed a parse bug for text only invalid XML.

  • GH-215
  • Patch by NAITOH Jun.

• Fixed a parse bug that &#0x...; is accepted as a character reference.

Thanks

• NAITOH Jun

3.3.8 - 2024-09-29 {#version-3-3-8}

Improvements

• SAX2: Improve parse performance.
  • GH-207
  • Patch by NAITOH Jun.

Fixes

• Fixed a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported.
  • GH-208
  • Patch by KITAITI Makoto

Thanks

• NAITOH Jun

• KITAITI Makoto

3.3.7 - 2024-09-04 {#version-3-3-7}

Improvements

• Added local entity expansion limit methods
  • GH-192
  • GH-202
  • Reported by takuya kodama.

... (truncated)

Commits

• 38eaa86 Add 3.3.9 entry
• ce59f2e parser: fix a bug that &#0x...; is accepted as a character reference
• a09646d test: fix indent
• cf0fb9c Fix IOSource#readline for @pending_buffer (#215)
• 1d0c362 Optimize IOSource#read_until method (#210)
• 622011f Bump version
• 036d508 test: avoid using needless non ASCII characters
• 4197054 Add 3.3.8 entry
• 78f8712 Fix handling with "xml:" prefixed namespace (#208)
• 2e1cd64 Optimize SAX2Parser#get_namespace (#207)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by Sourcery

Bump the bundler group in the /templates/rails directory, updating actionpack, net-imap, nokogiri, rack, rails-html-sanitizer and rexml gems.

Bug Fixes:

• Fixes a parse bug for text only invalid XML in rexml.
• Fixes a parse bug that &#0x...; is accepted as a character reference in rexml.
• Fixes a bug that unexpected attribute namespace conflict error for the predefined "xml" namespace is reported in rexml.
• Fix MRI Ruby vs. JRuby XML child namespace output differences in nokogiri.
• Fixes a regression in rails-html-sanitizer where PermitScrubber did not fully support frozen "allowed tags".
• Fixes malformed charset param in rack.
• Use a fully resolved file path when confirming if a file can be served by Rack::Static in rack.
• Escape non-printable characters when logging in rack.
• Fixes a use-after-free issue in nokogiri's XML::SAX::ParserContext.
• Fixes a bug in nokogiri where an XML document's root namespace declarations should not be applied to wildcard selectors ("*").

Enhancements:

• Improves performance in rexml.
• Improves SAX2 parse performance in rexml.
• Adds local entity expansion limit methods in rexml.
• Adds SequenceSet ordered entries methods to net-imap.
• Adds mutable and non-global ResponseParser config to net-imap.
• Updates JRuby's XML serialization in nokogiri so it outputs namespaces exactly like CRuby.
• Improves performance by eliminating needless operations on attributes that are being removed in rails-html-sanitizer.
• Adds validation to content security policies to disallow spaces and semicolons in actionpack.
• Updates vendored libxml2 in nokogiri to v2.13.6 to address CVE-2025-24928 and CVE-2024-56171.
• Updates vendored libxslt in nokogiri to v1.1.43 to address CVE-2025-24855 and CVE-2024-55549.
• Updates Nokogiri dependency in rails-html-sanitizer to v1.15.7 or >=1.16.8 to address CVE-2024-53985.
• Adds native gem support for Ruby 3.4 in nokogiri.
• Adds separate precompiled GNU and Musl gems for all linux platforms in nokogiri.
• Rack::MediaType#params now handles parameters without values in rack.
• Use #inspect to prevent log injection in rack.
• Adds AppendUIDData and CopyUIDData classes to net-imap to replace UIDPlusData.
• Adds config option for max UIDPlusData size to net-imap.
• Adds :up_to_max_size config for UIDPlusData to net-imap.
• Limits exponential memory usage to parse uid-set in net-imap.
• Disallowed tags will be pruned when they appear in foreign content in rails-html-sanitizer.
• The tags "noscript", "mglyph", and "malignmark" will not be allowed in rails-html-sanitizer.
• Possible Log Injection in Rack::Sendfile in rack.
• Possible Log Injection in Rack::CommonLogger in rack.
• Local file inclusion in Rack::Static in rack.
• Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can exhaust client memory by sending APPENDUID or COPYUID responses with very large uid-set ranges in net-imap.
• Fixes CVE-2025-27610 Local file inclusion in Rack::Static in rack.
• Fixes CVE-2025-27111 Possible Log Injection in Rack::Sendfile in rack.
• Fixes CVE-2025-25184 Possible Log Injection in Rack::CommonLogger in rack.
• Fixes CVE-2024-53985 in rails-html-sanitizer.
• Fixes CVE-2024-53986 in rails-html-sanitizer.
• Fixes CVE-2024-53987 in rails-html-sanitizer.
• Fixes CVE-2024-53988 in rails-html-sanitizer.
• Fixes CVE-2024-53989 in rails-html-sanitizer.

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request updates multiple gems in the /templates/rails directory. The updates include security fixes, performance improvements, and bug fixes for actionpack, net-imap, nokogiri, rack, rails-html-sanitizer, and rexml. Reviewers should pay close attention to the security-related changes and ensure that the application remains secure after these updates.

No diagrams generated as the changes look simple and do not need a visual representation.

File-Level Changes

Change	Details	Files
Updated actionpack gem to version 7.1.5.1. This update includes a security fix that adds validation to content security policies to disallow spaces and semicolons.	Updated from version 7.1.4.1 to 7.1.5.1 Added validation to content security policies to disallow spaces and semicolons to address CVE-2024-54133.	templates/rails/Gemfile.lock
Updated net-imap gem to version 0.4.19. This update includes a security fix for CVE-2025-25186, which addresses a potential denial-of-service vulnerability where a malicious server could exhaust client memory.	Updated from version 0.4.10 to 0.4.19 Addressed CVE-2025-25186 by limiting memory usage when parsing UID sets in APPENDUID or COPYUID responses. Introduced AppendUIDData and CopyUIDData classes to replace UIDPlusData for storing UIDs as Net::IMAP::SequenceSet objects. Added configuration options to manage the use and size limits of UIDPlusData. Backported improvements and features related to SequenceSet and response parsing configuration from later versions.	templates/rails/Gemfile.lock
Updated nokogiri gem to version 1.18.5. This update includes security fixes and improvements, including updates to vendored libraries and a fix for XML serialization on JRuby.	Updated from version 1.16.7 to 1.18.5 Updated vendored libxslt to v1.1.43 to address CVE-2025-24855 and CVE-2024-55549. Updated vendored libxml2 to v2.13.6 to address CVE-2025-24928 and CVE-2024-56171. Fixed XML serialization differences between MRI Ruby and JRuby. Introduced native gem support for Ruby 3.4 and dropped support for Ruby 3.0. Shipped separate precompiled GNU and Musl gems for all Linux platforms.	templates/rails/Gemfile.lock
Updated rack gem to version 3.1.12. This update includes security fixes addressing potential log injection vulnerabilities and a local file inclusion vulnerability in Rack::Static.	Updated from version 3.1.8 to 3.1.12 Addressed CVE-2025-27610, a local file inclusion vulnerability in Rack::Static. Addressed CVE-2025-27111, a possible log injection vulnerability in Rack::Sendfile. Addressed CVE-2025-25184, a possible log injection vulnerability in Rack::CommonLogger. Fixed handling of media type parameters without values in Rack::MediaType#params.	templates/rails/Gemfile.lock
Updated rails-html-sanitizer gem to version 1.6.2. This update includes security fixes for potential XSS vulnerabilities and a fix for handling frozen allowed tags in PermitScrubber.	Updated from version 1.6.0 to 1.6.2 Addressed CVE-2024-53985 by updating the Nokogiri dependency to v1.15.7 or >=1.16.8. Addressed CVE-2024-53986 and CVE-2024-53987 by pruning disallowed tags in foreign content. Addressed CVE-2024-53988 and CVE-2024-53989 by disallowing the noscript, mglyph, and malignmark tags. Fixed a regression in PermitScrubber related to handling frozen allowed tags. Improved performance by eliminating needless operations on attributes that are being removed.	templates/rails/Gemfile.lock
Updated rexml gem to version 3.3.9. This update includes performance improvements and fixes for parsing bugs.	Updated from version 3.3.6 to 3.3.9 Improved performance of IOSource#read_until and SAX2 parsing. Fixed a parsing bug for text-only invalid XML. Fixed a parsing bug where &#0x...; was accepted as a character reference. Fixed a bug that caused unexpected attribute namespace conflict errors for the predefined "xml" namespace.	templates/rails/Gemfile.lock

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!
• Generate a plan of action for an issue: Comment @sourcery-ai plan on
  an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>, please review it.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai generate docstrings to generate docstrings for this PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[sourcery-ai]

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, dependabot[bot]!). We assume it knows what it's doing!

[dependabot]

Superseded by #3.