chore(deps): bump rack from 2.2.10 to 2.2.13 by dependabot[bot] · Pull Request #316 · railslove/ebicsbox

dependabot · 2025-03-11T02:42:07Z

Bumps rack from 2.2.10 to 2.2.13.

Changelog

[2.2.13] - 2025-03-11

Security

CVE-2025-27610 Local file inclusion in Rack::Static.

[2.2.12] - 2025-03-04

Security

CVE-2025-27111 Possible Log Injection in Rack::Sendfile.

[2.2.11] - 2025-02-12

Security

CVE-2025-25184 Possible Log Injection in Rack::CommonLogger.

Commits

df6c473 Bump patch verison.
cceb70c Update changelog.
873d39e Use a fully resolved file path when confirming if a file can be served by `Ra...
7829663 Bump patch verison.
fadf97e Fix development workflow.
b13bc6b Use #inspect to prevent log injection.
f393916 Fix version number in release notes.
aa5a0f5 Bump patch version.
f8b41c1 Escape non-printable characters when logging.
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

- for sure this time

updates dependencies

sources: - https://nvd.nist.gov/vuln/detail/CVE-2018-16471 - https://nvd.nist.gov/vuln/detail/CVE-2018-16470

docker compose updates

removes remains of blebics & jruby

since migrating to heroku is a thing now, beanstalkd has to go.

- so sparkasse works again

- auto builds docker images

help the user to better find error infos

Bumps [puma](https://github.com/puma/puma) from 6.4.2 to 6.4.3. - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/master/History.md) - [Commits](puma/puma@v6.4.2...v6.4.3) --- updated-dependencies: - dependency-name: puma dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rexml](https://github.com/ruby/rexml) from 3.3.1 to 3.3.9. - [Release notes](https://github.com/ruby/rexml/releases) - [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md) - [Commits](ruby/rexml@v3.3.1...v3.3.9) --- updated-dependencies: - dependency-name: rexml dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [fugit](https://github.com/floraison/fugit) from 1.11.0 to 1.11.1. - [Changelog](https://github.com/floraison/fugit/blob/master/CHANGELOG.md) - [Commits](floraison/fugit@v1.11.0...v1.11.1) --- updated-dependencies: - dependency-name: fugit dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.5.0 to 3.7.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@v3.5.0...v3.7.0) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

since this is only for development we can use the default user instead of expecting the user to be set via env variable

leftover from commit: 19ff95f

https://rubystyle.guide/#safe-assignment-in-condition

cxml version https://github.com/railslove/cmxl/blob/master/CHANGELOG.mdown#145 NOTE: keep the old name since the camt53 gem uses the naming

hide internal method from the public dsl

enrich context to make the app more understandable

similar to a rails project any migration generates a file which reflects the current database layout. additionally similar to a rails project any database related things live in a `db` directory

we can't enforce any linter rules on the schema.rb file because it is generated.

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.7.0 to 3.8.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@v3.7.0...v3.8.0) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

create a unified custom DSL

use the unified custom DSL to simplify our business logic

require the debugger as default to allow debugging anymore without any additional configuration

store invalid import files for later debugging

Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.8.0 to 3.8.1. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](sigstore/cosign-installer@v3.8.0...v3.8.1) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rack](https://github.com/rack/rack) from 2.2.10 to 2.2.13. - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.10...v2.2.13) --- updated-dependencies: - dependency-name: rack dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-02-28T12:49:16Z

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Maxim and others added 30 commits June 8, 2018 10:32

preps 1.0.0

bf27ec6

improves swagger subscriber management documentation

d437d62

fixes incorrect params declaration for subscribers

165a20c

do not trust params without checking

c9ab28d

updates cmxl version

5fc1154

improves default dataset migration

1876794

updates dependencies

be54b74

makes initial migration create users when none exist

a2b15e0

- for sure this time

Merge pull request #169 from railslove/updates-deps-oct-18

12e8617

updates dependencies

hotfixes management accounts not showing test_accounts correctly

6b54485

updates docker compose

0dce66f

updates rack for security reasons

1dddd7b

sources: - https://nvd.nist.gov/vuln/detail/CVE-2018-16471 - https://nvd.nist.gov/vuln/detail/CVE-2018-16470

tells travis to use ruby 2.5.1

98c2a6e

adds updates docker compose

9d52973

adds details to .env.example

9643b6d

lets webapp wait for database setup when launched via docker compose

66b0a93

Merge pull request #171 from railslove/docker-compose

fc106ee

docker compose updates

🔥 blebics & jruby 💀

cfa5522

Merge pull request #172 from railslove/bye-blebics

3a2bf7b

removes remains of blebics & jruby

kills the beans with a sidekiq (#170)

19ff95f

since migrating to heroku is a thing now, beanstalkd has to go.

🔥 prepare the herokucalypse (#173)

f848c6d

removes obsolete swagger theme

0cc416f

updates epics deps

2d71f80

- so sparkasse works again

updates travis.yml

5835e6c

- auto builds docker images

fixes incorrect .travis.yml vars

0328f61

ensures tagged stage only runs when tag is present

a073f94

adds notifactions to slack for travis

4b4e275

preps 1.0.1

5e63caf

removes redundant heroku docker setup

a207f04

updates heroku deployemnt docs

67730c0

janz93 and others added 23 commits December 12, 2024 10:27

chore: enrich error message

b2e21b7

help the user to better find error infos

docs: update changelog

0d92df0

fix: correct postgres docker healthcheck

30b3ef4

since this is only for development we can use the default user instead of expecting the user to be set via env variable

style: order data asc

1f7b660

chore: remove dead code

a665562

leftover from commit: 19ff95f

style: fix rubocop issue

02f6818

https://rubystyle.guide/#safe-assignment-in-condition

fix: use correct method name

dd9c2cf

cxml version https://github.com/railslove/cmxl/blob/master/CHANGELOG.mdown#145 NOTE: keep the old name since the camt53 gem uses the naming

refactor: hide private methods

681e3df

hide internal method from the public dsl

docs: add more context

f5a2da5

enrich context to make the app more understandable

chore: add schema file

0593506

similar to a rails project any migration generates a file which reflects the current database layout. additionally similar to a rails project any database related things live in a `db` directory

style: exclude db directory

22b6f61

we can't enforce any linter rules on the schema.rb file because it is generated.

refactor: add statement mapping class

d5d6452

create a unified custom DSL

refactor: use custom statement DSL

568ab25

use the unified custom DSL to simplify our business logic

test: enable debugging as default

6d43191

require the debugger as default to allow debugging anymore without any additional configuration

chore: update sentry

3d36436

feat: enrich sentry error logging

95a648c

store invalid import files for later debugging

dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Mar 11, 2025

dependabot bot mentioned this pull request Mar 11, 2025

chore(deps): bump rack from 2.2.10 to 2.2.12 #312

Closed

koos closed this Feb 28, 2026

koos force-pushed the main branch from 0384b33 to 4f2e2ed Compare February 28, 2026 12:49

dependabot bot deleted the dependabot/bundler/rack-2.2.13 branch February 28, 2026 12:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump rack from 2.2.10 to 2.2.13#316

chore(deps): bump rack from 2.2.10 to 2.2.13#316
dependabot[bot] wants to merge 1022 commits intomainfrom
dependabot/bundler/rack-2.2.13

dependabot bot commented on behalf of github Mar 11, 2025

Uh oh!

dependabot bot commented on behalf of github Feb 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

dependabot bot commented on behalf of github Mar 11, 2025

[2.2.13] - 2025-03-11

Security

[2.2.12] - 2025-03-04

Security

[2.2.11] - 2025-02-12

Security

Uh oh!

dependabot bot commented on behalf of github Feb 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants