🚨 [security] Update rails 7.0.10 → 8.0.2.1 (major) by depfu[bot] · Pull Request #575 · sanger/gatekeeper

depfu · 2025-08-14T01:05:43Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Rails has possible XSS Vulnerability in Action Controller

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ minitest-rails (7.0.1 → 8.0.0) · Repo · Changelog

↗️ actioncable (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailbox (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailer (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Possible ReDoS vulnerability in block_format in Action Mailer

🚨 Possible ReDoS vulnerability in block_format in Action Mailer

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionpack (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Possible Content Security Policy bypass in Action Dispatch

🚨 Possible Content Security Policy bypass in Action Dispatch

🚨 Possible Content Security Policy bypass in Action Dispatch

🚨 Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

🚨 Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

🚨 Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

🚨 Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

🚨 Missing security headers in Action Pack on non-HTML responses

🚨 Rails has possible ReDoS vulnerability in Accept header parsing in Action Dispatch

🚨 Rails has possible XSS Vulnerability in Action Controller

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actiontext (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

🚨 Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

🚨 ActionText ContentAttachment can Contain Unsanitized HTML

🚨 Trix Editor Arbitrary Code Execution Vulnerability

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionview (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Rails has a possible XSS vulnerability in its Action View tag helpers

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activejob (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activemodel (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activerecord (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Active Record logging vulnerable to ANSI escape injection

🚨 Active Record logging vulnerable to ANSI escape injection

🚨 Active Record logging vulnerable to ANSI escape injection

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activestorage (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

🚨 Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

🚨 Rails Active Storage has possible content type bypass via metadata in direct uploads

🚨 Rails Active Storage has possible Path Traversal in DiskService

🚨 Rails Active Storage has possible glob injection in its DiskService

🚨 Active Storage allowed transformation methods that were potentially unsafe

🚨 Active Storage allowed transformation methods that were potentially unsafe

🚨 Active Storage allowed transformation methods that were potentially unsafe

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activesupport (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

🚨 Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

🚨 Rails Active Support has a possible DoS vulnerability in its number helpers

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ globalid (indirect, 1.3.0 → 1.4.0) · Repo · Changelog

Release Notes

1.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mail (indirect, 2.9.0 → 2.9.1) · Repo · Changelog

Release Notes

2.9.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ marcel (indirect, 1.1.0 → 1.2.1) · Repo · Changelog

Release Notes

1.2.1

1.2.0

1.1.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ net-imap (indirect, 0.5.15 → 0.6.6) · Repo · Changelog

Security Advisories 🚨

🚨 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument

🚨 Net::IMAP: Denial of Service via incomplete raw argument validation

🚨 Net::IMAP: Command Injection via ID command argument

🚨 net-imap vulnerable to command Injection via unvalidated Symbol inputs

🚨 net-imap vulnerable to STARTTLS stripping via invalid response timing

🚨 net-imap vulnerable to command Injection via "raw" arguments to multiple commands

🚨 net-imap has quadratic complexity when reading response literals

🚨 net-imap vulnerable to denial of service via high iteration count for `SCRAM-*` authentication

Release Notes

0.6.6

0.6.5

0.6.4.1

0.6.4

0.6.3

0.6.2

0.6.1

0.6.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rack (indirect, 2.2.23 → 3.2.6) · Repo · Changelog

Security Advisories 🚨

🚨 Rack::Static prefix matching can expose unintended files under the static root

🚨 Rack::Request accepts invalid Host characters, enabling host allowlist bypass

🚨 Rack has Content-Length mismatch in Rack::Files error responses

🚨 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

🚨 Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

🚨 Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

🚨 Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

🚨 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

🚨 Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

🚨 Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

🚨 Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

🚨 Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

🚨 Rack:: Static header_rules bypass via URL-encoded paths

🚨 Rack::Static prefix matching can expose unintended files under the static root

🚨 Rack::Request accepts invalid Host characters, enabling host allowlist bypass

🚨 Rack has Content-Length mismatch in Rack::Files error responses

🚨 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

🚨 Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

🚨 Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

🚨 Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

🚨 Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

🚨 Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

🚨 Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

🚨 Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

🚨 Rack:: Static header_rules bypass via URL-encoded paths

🚨 Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

🚨 Rack has a Directory Traversal via Rack:Directory

🚨 Rack has a Directory Traversal via Rack:Directory

🚨 Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

🚨 Rack has a Possible Information Disclosure Vulnerability

🚨 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

🚨 Rack has a Possible Information Disclosure Vulnerability

🚨 Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

🚨 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

🚨 Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

🚨 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

🚨 Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

🚨 Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

🚨 Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

🚨 ReDoS Vulnerability in Rack::Multipart handle_mime_head

🚨 Rack has an Unbounded-Parameter DoS in Rack::QueryParser

🚨 Rack has an Unbounded-Parameter DoS in Rack::QueryParser

🚨 Local File Inclusion in Rack::Static

🚨 Local File Inclusion in Rack::Static

🚨 Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

🚨 Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

🚨 Possible Log Injection in Rack::CommonLogger

🚨 Rack ReDoS Vulnerability in HTTP Accept Headers Parsing

🚨 Rack has possible DoS Vulnerability with Range Header

🚨 Rack Header Parsing leads to Possible Denial of Service Vulnerability

🚨 Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)

🚨 Possible Denial of Service Vulnerability in Rack's header parsing

🚨 Rack has possible DoS Vulnerability in Multipart MIME parsing

🚨 Denial of service via multipart parsing in Rack

🚨 Denial of Service Vulnerability in Rack Content-Disposition parsing

🚨 Denial of service via header parsing in Rack

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ railties (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rake (indirect, 13.3.1 → 13.4.2) · Repo · Changelog

Release Notes

13.4.2

13.4.1

13.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ thor (indirect, 1.4.0 → 1.5.0) · Repo · Changelog

Release Notes

1.5.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ zeitwerk (indirect, 2.7.3 → 2.8.2) · Repo · Changelog

Release Notes

2.8.1 (from changelog)

2.8.0 (from changelog)

2.7.5 (from changelog)

2.7.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 connection_pool (added, 3.0.2)

🆕 erb (added, 6.0.6)

🆕 io-console (added, 0.8.2)

🆕 irb (added, 1.18.0)

🆕 pp (added, 0.6.4)

🆕 prettyprint (added, 0.2.0)

🆕 rack-session (added, 2.1.2)

🆕 rackup (added, 2.3.1)

🆕 rbs (added, 4.1.0)

🆕 rdoc (added, 8.0.0)

🆕 reline (added, 0.6.3)

🆕 tsort (added, 0.2.0)

🆕 useragent (added, 0.16.11)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

codecov · 2026-07-22T00:36:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.24%. Comparing base (08e27cb) to head (8149a1a).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #575   +/-   ##
========================================
  Coverage    84.24%   84.24%           
========================================
  Files           43       43           
  Lines          660      660           
========================================
  Hits           556      556           
  Misses         104      104

Flag	Coverage Δ
feature_tests	`69.88% <ø> (ø)`
pull_request	`84.24% <ø> (ø)`
push	`84.24% <ø> (ø)`
unit_tests	`83.19% <ø> (-0.75%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

depfu Bot added dependencies Pull requests that update a dependency file Security Update A label to identify dependency updates containing security fixes Technical Debt labels Aug 14, 2025

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from d7e2509 to 94dd5b6 Compare August 20, 2025 02:55

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 94dd5b6 to c2a3652 Compare August 27, 2025 14:21

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 3 times, most recently from 0c27f69 to b040ea1 Compare October 16, 2025 15:45

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 2 times, most recently from dcdc3f8 to 6f35e87 Compare October 30, 2025 02:05

depfu Bot changed the title ~~🚨 [security] Update rails 7.0.8.7 → 8.0.2.1 (major)~~ 🚨 [security] Update rails 7.0.10 → 8.0.2.1 (major) Oct 30, 2025

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 6f35e87 to 41335aa Compare November 1, 2025 03:40

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 41335aa to 0d6ebd8 Compare November 15, 2025 23:35

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 0d6ebd8 to 0b7c6db Compare November 23, 2025 19:55

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 0b7c6db to e89f8a7 Compare December 18, 2025 22:20

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 2 times, most recently from 30ae219 to 1eff811 Compare December 31, 2025 23:50

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 3 times, most recently from 41bf1e9 to 598470c Compare January 28, 2026 19:55

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 2 times, most recently from 014d765 to f15499e Compare February 6, 2026 11:30

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from f15499e to bd40877 Compare February 17, 2026 18:35

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from bd40877 to 5fd94f8 Compare March 2, 2026 09:25

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 2 times, most recently from b55d2f4 to 6bc705c Compare April 3, 2026 18:10

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 6bc705c to d330f64 Compare April 8, 2026 02:40

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 3 times, most recently from 01d6511 to 255b0a2 Compare April 19, 2026 19:25

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 2 times, most recently from 5543381 to 44b6c8c Compare April 23, 2026 21:25

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 44b6c8c to 0af0bc1 Compare May 5, 2026 01:25

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 0af0bc1 to f4118f8 Compare June 1, 2026 21:05

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from f4118f8 to 2cfde77 Compare June 9, 2026 21:30

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from 2cfde77 to 33357b8 Compare June 19, 2026 23:10

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch 2 times, most recently from b3d0917 to ced880e Compare July 22, 2026 00:35

Update rails to version 8.0.2.1

8149a1a

depfu Bot force-pushed the depfu/update/group/rails-8.0.2.1 branch from ced880e to 8149a1a Compare July 28, 2026 08:55

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚨 [security] Update rails 7.0.10 → 8.0.2.1 (major) - #575

🚨 [security] Update rails 7.0.10 → 8.0.2.1 (major)#575
depfu[bot] wants to merge 1 commit into
developfrom
depfu/update/group/rails-8.0.2.1

depfu Bot commented Aug 14, 2025 •

edited

Loading

Uh oh!

codecov Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

depfu Bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed?

✳️ rails (7.0.10 → 8.0.2.1) · Repo · Changelog

✳️ minitest-rails (7.0.1 → 8.0.0) · Repo · Changelog

↗️ actioncable (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ actionmailbox (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ actionmailer (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ actionpack (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ actiontext (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ actionview (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ activejob (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ activemodel (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ activerecord (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ activestorage (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ activesupport (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ globalid (indirect, 1.3.0 → 1.4.0) · Repo · Changelog

↗️ mail (indirect, 2.9.0 → 2.9.1) · Repo · Changelog

↗️ marcel (indirect, 1.1.0 → 1.2.1) · Repo · Changelog

↗️ net-imap (indirect, 0.5.15 → 0.6.6) · Repo · Changelog

↗️ rack (indirect, 2.2.23 → 3.2.6) · Repo · Changelog

↗️ railties (indirect, 7.0.10 → 8.0.2.1) · Repo · Changelog

↗️ rake (indirect, 13.3.1 → 13.4.2) · Repo · Changelog

↗️ thor (indirect, 1.4.0 → 1.5.0) · Repo · Changelog

↗️ zeitwerk (indirect, 2.7.3 → 2.8.2) · Repo · Changelog

2.8.1 (from changelog)

2.8.0 (from changelog)

2.7.5 (from changelog)

depfu Bot commented Aug 14, 2025 •

edited

Loading