Skip to content

Bump the bundler group across 1 directory with 4 updates#86

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/bundler-8e99459302
Open

Bump the bundler group across 1 directory with 4 updates#86
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/bundler-8e99459302

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 23, 2026

Bumps the bundler group with 4 updates in the / directory: cocoapods-downloader, i18n, json and tzinfo.

Updates cocoapods-downloader from 1.1.3 to 1.6.3

Release notes

Sourced from cocoapods-downloader's releases.

1.6.3

Enhancements
  • None.
Bug Fixes
  • None.

1.6.2

Enhancements
  • None.
Bug Fixes
  • None.

1.6.1

Enhancements
  • None.
Bug Fixes
  • None.

1.6.0

Enhancements
  • None.
Bug Fixes
  • Adds a check for command injections in the input for hg and git.
    orta #124

1.5.1

Enhancements
  • None.
Bug Fixes
  • Fix "can't modify frozen string" errors when pods are integrated using the branch option
    buju77 #10920

1.5.0

... (truncated)

Changelog

Sourced from cocoapods-downloader's changelog.

1.6.3 (2022-04-01)

Enhancements
  • None.
Bug Fixes
  • None.

1.6.2 (2022-03-28)

Enhancements
  • None.
Bug Fixes
  • None.

1.6.1 (2022-03-23)

Enhancements
  • None.
Bug Fixes
  • None.

1.6.0 (2022-03-22)

Enhancements
  • None.
Bug Fixes
  • Adds a check for command injections in the input for hg and git.
    orta #124

1.5.1 (2021-09-07)

Enhancements
  • None.

... (truncated)

Commits
  • c03e2ed Release 1.6.3
  • f75bccc Disable Bazaar tests due to macOS 12.3 not including python2
  • 52a0d54 Merge pull request #128 from CocoaPods/validate_before_dl
  • d27c983 Ensure that the git pre-processor doesn't accidentally bail also
  • 3adfe1f [CHANGELOG] Add empty Master section
  • 591167a Release 1.6.2
  • d2564c3 Merge pull request #127 from CocoaPods/validate_before_dl
  • 99fec61 Switches where we check for invalid input, to move it inside the download fun...
  • 96679f2 [CHANGELOG] Add empty Master section
  • 3a7c54b Release 1.6.1
  • Additional commits viewable in compare view

Updates i18n from 0.7.0 to 0.8.0

Release notes

Sourced from i18n's releases.

v0.8.0

This release is the same as the v0.8.0.beta1 gem.

Notable changes

  • You can now set I18n.cache_key_digest to determine how cache keys are calculated. If you were seeing issues where the same value stored in a cache produced a different key, then this fix will interest you. For more information, see #285.
  • You can now override translate_format in I18n::Backend classes to customize how localize will perform. See svenfuchs/i18n#347 for more details.
  • You can now interpolate the value of a key inside another key. See #300 for more information.
  • The exists? method was added to the fallback backend, to match other backend implementations - #326
  • Added N_ to GetText::Helpers - #121
  • Added a :default option for I18n.localize - #251

Bug fixes

  • Reverted a commit which made it so that the great documentation for I18n.translate wasn't made visible through a yard documentation generation. - bc926ebf98a9ae8f2db843ce16a33a5282d18d35
  • I18n.MissingTranslation.new can now be called with two arguments. It will no longer raise a "TypeError: can't dup NilClass" exception - #295
  • I18n's Hash#slice method no longer fails if the hash does not have the specified key - #289
  • I18n::Backend::Metadata will now no longer attempt to set @translation_metadata on frozen objects - #305
  • Added missing many rule to pl translation rules - #346
  • Calling I18n.t(:foo, default: nil) Or I18n.t(:foo, default: false) will now return nil or false, rather than returning a missing translation exception - #144
  • Setting I18n.load_path via I18n.load_path= will now reset the @@available_locales_set setting. - #348 & #173
  • The subclasses of Hash when calling Hash#slice are maintained - #250
  • Fixed I18n.interpolate behaviour when it was passed an ActiveSupport::SafeBuffer object - #216

0.8.0.beta1

Notable changes

  • You can now set I18n.cache_key_digest to determine how cache keys are calculated. If you were seeing issues where the same value stored in a cache produced a different key, then this fix will interest you. For more information, see #285.
  • You can now override translate_format in I18n::Backend classes to customize how localize will perform. See svenfuchs/i18n#347 for more details.
  • You can now interpolate the value of a key inside another key. See #300 for more information.
  • The exists? method was added to the fallback backend, to match other backend implementations - #326
  • Added N_ to GetText::Helpers - #121
  • Added a :default option for I18n.localize - #251

Bug fixes

  • Reverted a commit which made it so that the great documentation for I18n.translate wasn't made visible through a yard documentation generation. - bc926ebf98a9ae8f2db843ce16a33a5282d18d35
  • I18n.MissingTranslation.new can now be called with two arguments. It will no longer raise a "TypeError: can't dup NilClass" exception - #295
  • I18n's Hash#slice method no longer fails if the hash does not have the specified key - #289
  • I18n::Backend::Metadata will now no longer attempt to set @translation_metadata on frozen objects - #305
  • Added missing many rule to pl translation rules - #346
  • Calling I18n.t(:foo, default: nil) Or I18n.t(:foo, default: false) will now return nil or false, rather than returning a missing translation exception - #144
  • Setting I18n.load_path via I18n.load_path= will now reset the @@available_locales_set setting. - #348 & #173
  • The subclasses of Hash when calling Hash#slice are maintained - #250
  • Fixed I18n.interpolate behaviour when it was passed an ActiveSupport::SafeBuffer object - #216
Commits
  • 529fc5b Bump to 0.8.0
  • d5fb5dd fix references to i18n in Gemfiles
  • 5cd5c9f Add link to i18n guide to README
  • 27d7ab7 Remove Gemfile.lock from source control
  • 4f0331d Bump dependencies
  • 210feb6 Update bundler
  • 7b205f2 Add issue template
  • 6f3a5bb Bump to 0.8.0.beta1
  • 5e1af91 Merge pull request #252 from Chipairon/fix-tests-for-stored-procs
  • e532e61 Merge pull request #216 from bogdan/interpolate-rails-safe-buffer
  • Additional commits viewable in compare view

Updates json from 1.8.6 to 2.3.0

Release notes

Sourced from json's releases.

v2.3.0

What's Changed

New Contributors

Full Changelog: ruby/json@v2.2.0...v2.3.0

v2.2.0

What's Changed

New Contributors

Full Changelog: ruby/json@v2.1.0...v2.2.0

v2.1.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from json's changelog.

2019-12-11 (2.3.0)

  • Fix default of create_additions to always be false for JSON(user_input) and JSON.parse(user_input, nil). Note that JSON.load remains with default true and is meant for internal serialization of trusted data. [CVE-2020-10663]
  • Fix passing args all #to_json in json/add/*.
  • Fix encoding issues
  • Fix issues of keyword vs positional parameter
  • Fix JSON::Parser against bigdecimal updates
  • Bug fixes to JRuby port

2019-02-21 (2.2.0)

  • Adds support for 2.6 BigDecimal and ruby standard library Set datetype.

2017-04-18 (2.1.0)

  • Allow passing of decimal_class option to specify a class as which to parse JSON float numbers.

2017-03-23 (2.0.4)

  • Raise exception for incomplete unicode surrogates/character escape sequences. This problem was reported by Daniel Gollahon (dgollahon).
  • Fix arbitrary heap exposure problem. This problem was reported by Ahmad Sherif (ahmadsherif).

2017-01-12 (2.0.3)

  • Set required_ruby_version to 1.9
  • Some small fixes

2016-07-26 (2.0.2)

  • Specify required_ruby_version for json_pure.
  • Fix issue #295 failure when parsing frozen strings.

2016-07-01 (2.0.1)

  • Fix problem when requiring json_pure and Parser constant was defined top level.
  • Add RB_GC_GUARD to avoid possible GC problem via Pete Johns.
  • Store current_nesting on stack by Aaron Patterson.

2015-09-11 (2.0.0)

  • Now complies to newest JSON RFC 7159.
  • Implements compatibility to ruby 2.4 integer unification.
  • Removed support for quirks_mode option.
  • Drops support for old rubies whose life has ended, that is rubies < 2.0. Also see https://www.ruby-lang.org/en/news/2014/07/01/eol-for-1-8-7-and-1-9-2/
  • There were still some mentions of dual GPL licensing in the source, but JSON has just the Ruby license that itself includes an explicit dual-licensing clause that allows covered software to be distributed under the terms of the Simplified BSD License instead for all ruby versions >= 1.9.3. This is however a GPL compatible license according to the Free Software Foundation. I changed these mentions to be consistent with the Ruby license setting in the gemspec files which were already correct now.
Commits

Updates tzinfo from 1.2.2 to 1.2.10

Release notes

Sourced from tzinfo's releases.

v1.2.10

  • Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
  • Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v1.2.10 on RubyGems.org

v1.2.9

  • Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

v1.2.8

  • Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
  • Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

v1.2.7

  • Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
  • Fixed warnings when running on Ruby 2.8. #112.

TZInfo v1.2.7 on RubyGems.org

v1.2.6

  • Timezone#strftime('%s', time) will now return the correct number of seconds since the epoch. #91.
  • Removed the unused TZInfo::RubyDataSource::REQUIRE_PATH constant.
  • Fixed "SecurityError: Insecure operation - require" exceptions when loading data with recent Ruby releases in safe mode.
  • Fixed warnings when running on Ruby 2.7. #106 and #111.

TZInfo v1.2.6 on RubyGems.org

v1.2.5

  • Support recursively (deep) freezing Country and Timezone instances. #80.
  • Allow negative daylight savings time offsets to be derived when reading from zoneinfo files. The utc_offset and std_offset are now derived correctly for Europe/Dublin in the 2018a and 2018b releases of the Time Zone Database.

TZInfo v1.2.5 on RubyGems.org

v1.2.4

  • Ignore the leapseconds file that is included in zoneinfo directories installed with version 2017c and later of the Time Zone Database.

TZInfo v1.2.4 on RubyGems.org

v1.2.3

  • Reduce the number of String objects allocated when loading zoneinfo files. #54.
  • Make Timezone#friendly_identifier compatible with frozen string literals.
  • Improve the algorithm for deriving the utc_offset from zoneinfo files. This now correctly handles Pacific/Apia switching from one side of the International Date Line to the other whilst observing daylight savings time. #66.
  • Fix an UnknownTimezone exception when calling transitions_up_to or offsets_up_to on a TimezoneProxy instance obtained from Timezone.get_proxy.
  • Allow the Factory zone to be obtained from the Zoneinfo data source.
  • Ignore the /usr/share/zoneinfo/timeconfig symlink included in Slackware distributions. #64.

... (truncated)

Changelog

Sourced from tzinfo's changelog.

Version 1.2.10 - 19-Jul-2022

  • Fixed a relative path traversal bug that could cause arbitrary files to be loaded with require when used with RubyDataSource. Please refer to GHSA-5cm2-9h8c-rvfx for details. CVE-2022-31163.
  • Ignore the SECURITY file from Arch Linux's tzdata package. #134.

Version 1.2.9 - 16-Dec-2020

  • Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

Version 1.2.8 - 8-Nov-2020

  • Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
  • Rubinius is no longer supported.

Version 1.2.7 - 2-Apr-2020

  • Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
  • Fixed warnings when running on Ruby 2.8. #112.

Version 1.2.6 - 24-Dec-2019

  • Timezone#strftime('%s', time) will now return the correct number of seconds since the epoch. #91.
  • Removed the unused TZInfo::RubyDataSource::REQUIRE_PATH constant.
  • Fixed "SecurityError: Insecure operation - require" exceptions when loading data with recent Ruby releases in safe mode.
  • Fixed warnings when running on Ruby 2.7. #106 and #111.

Version 1.2.5 - 4-Feb-2018

  • Support recursively (deep) freezing Country and Timezone instances. #80.
  • Allow negative daylight savings time offsets to be derived when reading from zoneinfo files. The utc_offset and std_offset are now derived correctly for Europe/Dublin in the 2018a and 2018b releases of the Time Zone Database.

... (truncated)

Commits
  • 0814dcd Fix the release date.
  • fd05e2a Preparing v1.2.10.
  • b98c32e Merge branch 'fix-directory-traversal-1.2' into 1.2
  • ac3ee68 Remove unnecessary escaping of + within regex character classes.
  • 9d49bf9 Fix relative path loading tests.
  • 394c381 Remove private_constant for consistency and compatibility.
  • 5e9f990 Exclude Arch Linux's SECURITY file from the time zone index.
  • 17fc9e1 Workaround for 'Permission denied - NUL' errors with JRuby on Windows.
  • 6bd7a51 Update copyright years.
  • 9905ca9 Fix directory traversal in Timezone.get when using Ruby data source
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the bundler group across 1 directory with 4 updates
c184272 
Bumps the bundler group with 4 updates in the / directory: [cocoapods-downloader](https://github.com/CocoaPods/cocoapods-downloader), [i18n](https://github.com/ruby-i18n/i18n), [json](https://github.com/ruby/json) and [tzinfo](https://github.com/tzinfo/tzinfo).


Updates `cocoapods-downloader` from 1.1.3 to 1.6.3
- [Release notes](https://github.com/CocoaPods/cocoapods-downloader/releases)
- [Changelog](https://github.com/CocoaPods/cocoapods-downloader/blob/master/CHANGELOG.md)
- [Commits](CocoaPods/cocoapods-downloader@1.1.3...1.6.3)

Updates `i18n` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/ruby-i18n/i18n/releases)
- [Changelog](https://github.com/ruby-i18n/i18n/blob/master/CHANGELOG.md)
- [Commits](ruby-i18n/i18n@v0.7.0...v0.8.0)

Updates `json` from 1.8.6 to 2.3.0
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v1.8.6...v2.3.0)

Updates `tzinfo` from 1.2.2 to 1.2.10
- [Release notes](https://github.com/tzinfo/tzinfo/releases)
- [Changelog](https://github.com/tzinfo/tzinfo/blob/master/CHANGES.md)
- [Commits](tzinfo/tzinfo@v1.2.2...v1.2.10)

---
updated-dependencies:
- dependency-name: cocoapods-downloader
  dependency-version: 1.6.3
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: i18n
  dependency-version: 0.8.0
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: json
  dependency-version: 2.3.0
  dependency-type: indirect
  dependency-group: bundler
- dependency-name: tzinfo
  dependency-version: 1.2.10
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Mar 23, 2026
This was referenced Mar 23, 2026
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants