Skip to content

Update haml-rails 3.0.0 → 3.1.0 (minor) - #1914

Merged
danidoni merged 1 commit into
masterfrom
depfu/update/haml-rails-3.1.0
Jul 20, 2026
Merged

Update haml-rails 3.0.0 → 3.1.0 (minor)#1914
danidoni merged 1 commit into
masterfrom
depfu/update/haml-rails-3.1.0

Conversation

@depfu

@depfu depfu Bot commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ haml-rails (3.0.0 → 3.1.0) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ cgi (indirect, 0.5.1 → 0.5.2) · Repo · Changelog

Release Notes

0.5.2

What's Changed

  • Improve readme copy/paste + update URLs to HTTPS by @tas50 in #101
  • Add changelog URI to cgi.gemspec metadata by @phallstrom in #105
  • Fix escape_html/h aliases to use C extension instead of pure Ruby fallback by @ianks in #110
  • [DOC] More on CGI.new by @BurdetteLamar in #95
  • [DOC] Doc for CGI#http_header by @BurdetteLamar in #98
  • [DOC] Doc for accept_charset and accept_charset= by @BurdetteLamar in #97
  • [DOC] Fix examples in accept_charset and http_header docs by @hsbt in #125
  • Add 'digest' option by @nobu in #62
  • Handle POST without Content-Length by @hsbt in #126
  • Fix CGI.unescapeHTML CompatibilityError in the pure-Ruby fallback by @hsbt in #127

New Contributors

Full Changelog: v0.5.1...v0.5.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ crass (indirect, 1.0.6 → 1.0.7) · Repo · Changelog

Release Notes

1.0.7

Security

  • High: Fixed a denial of service vulnerability in which a large numeric exponent could consume disproportionate CPU and memory before the value was clamped. Exponents are now bounded before 10**exponent is computed. (GHSA-6wmf-3r64-vcwv)

  • Moderate: Fixed a scenario in which deeply nested simple blocks or functions could exhaust the Ruby stack and raise SystemStackError, or could result in excessive memory usage. Parser nesting is now limited to a configurable maximum depth via a new option (:maximum_depth, with a conservative default of 25). Constructs nested more deeply are discarded as an :error node with the value "maximum-depth-exceeded". (GHSA-6jxj-px6v-747w)

  • Moderate: Fixed a scenario in which a long run of adjacent comments could exhaust the Ruby stack and raise SystemStackError. Discarded comments are now skipped iteratively rather than recursively. (GHSA-wwpr-jff3-395c)

  • Moderate: Fixed a denial of service vulnerability in which inputs containing many non-ASCII characters could cause excessive CPU usage due to inefficient handling of multi-byte characters during tokenization. (GHSA-8vfg-2r28-hvhj)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ haml (indirect, 6.3.0 → 7.2.0) · Repo · Changelog

Release Notes

7.2.0

What's Changed

New Contributors

Full Changelog: v7.1.0...v7.2.0

7.1.0

What's Changed

  • Support xhtml format for boolean nested data attributes by @risen in #1200

New Contributors

Full Changelog: v7.0.2...v7.1.0

7.0.2

What's Changed

New Contributors

Full Changelog: v7.0.1...v7.0.2

7.0.1

What's Changed

New Contributors

Full Changelog: v7.0.0...v7.0.1

7.0.0

What's Changed

  • Change the default attr_quote from ' to " #1188
  • Bump required Ruby version to 3.2 #1176

Full Changelog: v6.4.0...v7.0.0

6.4.0

What's Changed

New Contributors

Full Changelog: v6.3.1...v6.4.0

6.3.1

What's Changed

New Contributors

Full Changelog: v6.3.0...v6.3.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ loofah (indirect, 2.25.1 → 2.25.2) · Repo · Changelog

Release Notes

2.25.2

2.25.2 / 2026-07-15

Security

  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes numeric character references without semicolons (e.g. javascript&#58alert(1)), which browsers decode and execute, and rejects schemes split by them. See GHSA-5qhf-9phg-95m2. @flavorjones
  • Ensure Loofah::HTML5::Scrub.allowed_uri? recognizes the named character references 	 and 
, which CGI.unescapeHTML does not decode and browsers strip from URIs, and rejects schemes split by them (e.g. java	script:alert(1)). See GHSA-8whx-365g-h9vv. @flavorjones
  • Ensure that both href and xlink:href attributes on SVG elements like use are restricted to local (same-document) references. Previously only xlink:href was restricted, allowing the SVG 2 href attribute to reference external documents. See GHSA-9wjq-cp2p-hrgf. @flavorjones

Improved

  • Harden data: URI mediatype parsing in Loofah::HTML5::Scrub.allowed_uri?. The mediatype is now parsed following the WHATWG data: URL spec and RFC 2397 instead of simply being split on a colon. A data: URI with an omitted or malformed mediatype is now treated as text/plain and allowed, and one without the required comma is now rejected. #305 @flavorjones
  • Remove feed from the default set of allowed protocols. The feed URI scheme was never accepted as a standard protocol, and no major browser supports it. Removing it reduces the attack surface particularly for non-browser contexts. #304 @flavorjones
  • Remove a vestigial &#x70 alternative from Loofah::HTML5::SafeList::PROTOCOL_SEPARATOR. This appears to be an ancient typo dating back to pre-extraction Rails circa 2007. #305 @flavorjones

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ pp (indirect, 0.6.3 → 0.6.4) · Repo

Release Notes

0.6.4

What's Changed

  • Add a workflow to sync commits to ruby/ruby by @k0kubun in #62
  • [DOC] Suppress documentation for internals by @nobu in #65
  • Support private instance_variables_to_inspect by @hamajyotan in #70

New Contributors

Full Changelog: v0.6.3...v0.6.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rails-html-sanitizer (indirect, 1.7.0 → 1.7.1) · Repo · Changelog

Release Notes

1.7.1

v1.7.1 / 2026-07-15

  • SVG reference elements now restrict both href and xlink:href to local references.

    Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF,
    so a plain href attribute on those elements could reference an external document. Applications
    are only affected if the allowed tags are overridden to include an SVG reference element such as
    use; the default configuration is not affected.

    This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now
    ~> 2.25, >= 2.25.2.

    Mike Dalessio @flavorjones

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rdoc (indirect, 7.2.0 → 8.0.0) · Repo · Changelog

Release Notes

8.0.0

What's Changed

💥 Breaking Changes

  • Change default ruby parser to RDoc::Parser::PrismRuby by @tompng in #1581
  • Remove deprecated CLI options and directives by @st0012 in #1616
  • Refactor formatter options by @st0012 in #1623
  • Remove unused memoized caches from Context by @st0012 in #1644
  • Add server mode with live reload (rdoc --server) by @st0012 in #1620
  • Drop Ripper-based parser by @st0012 in #1690

✨ Enhancements

🐛 Bug Fixes

  • Stop generating a separate page file for main_page by @st0012 in #1624
  • Fix markdown table parser consuming lines without pipes as table rows by @st0012 in #1626
  • Fix section comments with the prism parser by @Earlopain in #1639
  • Fix deadlock on Ctrl+C in server mode by @st0012 in #1649
  • Fix server mode live reload for C files by @st0012 in #1647
  • Don't auto-link to non-text source files in cross-references by @st0012 in #1646
  • Fix encoding error when C parser reads external source files by @st0012 in #1657
  • Fix page links returning 404 in server mode by @st0012 in #1671
  • Fix indentation not being preserved on first line in code fences by @extern-c in #1672
  • Fix broken sidebar links for chained class aliases by @st0012 in #1675
  • Preserve # prefix for unresolved cross-references by @st0012 in #1676
  • Fix Markdown blockquote parsing by @st0012 in #1627
  • Stop lazy alias resolver from overwriting real classes (#1662) by @st0012 in #1689
  • Strip markdown HTML comments within paragraph by @tompng in #1698
  • Remove obsolete -V short flag from --visibility option by @st0012 in #1703
  • Change "check syntax" message when it isn't a ruby file by @rwstauner in #1715
  • Avoid detecting encoding comments in documentation text by @st0012 in #1727
  • Fix colorization of imaginary/rational numbers by @Earlopain in #1733
  • Simplify CrossReference resolve by @tompng in #1571

📚 Documentation

  • [DOC] Move RubygemsHook doc to the right place by @st0012 in #1629
  • Add comparison with GitHub Flavored Markdown spec by @st0012 in #1550
  • Add user-facing configuration reference by @st0012 in #1692
  • Add RDoc logo to documentation by @st0012 in #1734

🛠 Other Changes

New Contributors

Full Changelog: v7.2.0...v8.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ tilt (indirect, 2.6.1 → 2.8.0) · Repo · Changelog

Release Notes

2.8.0 (from changelog)

  • Support rdoc 8 in the rdoc template (jeremyevans)
  • Support options added in recent Commonmarker versions in the Commonmarker template (halo) (#26)

2.7.0 (from changelog)

  • Support passing template-specific options to Tilt::Pipeline.new (LevitatingBusinessMan) (#24)
  • Remove deprecated creole template (jeremyevans)
  • Make the rendering of Prawn templates idempotent (rickenharp) (#20)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 rbs (added, 4.0.3)

🗑️ psych (removed)

🗑️ stringio (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Jul 16, 2026
@danidoni
danidoni merged commit b76a77d into master Jul 20, 2026
3 checks passed
@depfu
depfu Bot deleted the depfu/update/haml-rails-3.1.0 branch July 20, 2026 08:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@danidoni danidoni danidoni approved these changes

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@danidoni