Skip to content

🚨 [security] [ruby] Update rubocop-minitest 0.38.1 → 0.40.0 (major)#136

Open
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/rubocop-minitest-0.40.0
Open

🚨 [security] [ruby] Update rubocop-minitest 0.38.1 → 0.40.0 (major)#136
depfu[bot] wants to merge 1 commit into
mainfrom
depfu/update/rubocop-minitest-0.40.0

Conversation

@depfu

@depfu depfu Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rubocop-minitest (0.38.1 → 0.40.0) · Repo · Changelog

Release Notes

0.40.0

New features

  • #355: Add new RuboCop::TestCase as a stable API for testing custom cops with Minitest. The cop under test is derived from the test class name and can be configured with cop_class, cop_config, other_cops, and target_ruby_version. (@koic)

Changes

  • #345: Fix false positives and negatives in Minitest/NonExecutableTestMethod for nested test classes and for test methods defined before the test class. (@amckinnie)
  • #278: (Breaking) Remove the cop argument from inspect_source and investigate in the Minitest test support; the cop under test is now resolved automatically. The test configuration now merges the default configuration for the cop under test and sets AllCops: TargetRubyVersion explicitly. (@koic)

0.39.1

Bug fixes

  • #347: Fix false positives in Minitest/AssertIncludes and Minitest/RefuteIncludes cops. (@koic)

0.39.0

Changes

  • #344: Disable Minitest/AssertEmptyLiteral by default. (@koic)
  • #315: Make Minitest/AssertIncludes and Minitest/RefuteIncludes aware of key?, has_key?, and member? alias methods. (@koic)

0.38.2

Bug fixes

  • #321: Fix false positives for Minitest/MultipleAssertions when the assertion has a receiver. (@earlopain)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 57 commits:

✳️ rubocop (1.81.1 → 1.88.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ json (indirect, 2.15.1 → 2.21.1) · Repo · Changelog

Security Advisories 🚨

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🚨 Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ language_server-protocol (indirect, 3.17.0.5 → 3.17.0.6) · Repo · Changelog

Release Notes

3.17.0.6 (from changelog)

  • Regenerate protocol files with the Ruby generator (#141)
    • Add missing LSP 3.17 interfaces and constants
  • Include RBS signature files in the gem package
  • Add dependent gem test workflow (#142)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 31 commits:

↗️ parallel (indirect, 1.27.0 → 2.1.0) · Repo · Changelog

Release Notes

2.1.0 (from changelog)

Added

  • support different serializers
  • support for HMac verified serializer to secure hardened environments

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 27 commits:

↗️ parser (indirect, 3.3.9.0 → 3.3.12.0) · Repo · Changelog

Release Notes

3.3.12.0 (from changelog)

API modifications:

  • Bump maintenance branches to 3.3.12 (#1091) (Koichi ITO)

3.3.11.1 (from changelog)

API modifications:

  • Bump maintenance branches to 3.2.11 (#1089) (Koichi ITO)

3.3.11.0 (from changelog)

API modifications:

  • Bump maintenance branches to 3.3.11 (#1088) (Koichi ITO)

3.3.10.2 (from changelog)

Features implemented:

  • add blocknilarg for prism (#1087) (Earlopain)

3.3.10.1 (from changelog)

API modifications:

  • Bump maintenance branches to 3.2.10 (#1085) (Koichi ITO)

3.3.10.0 (from changelog)

API modifications:

  • Bump maintenance branches to 3.3.10 (#1083) (Koichi ITO)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ prism (indirect, 1.5.2 → 1.9.0) · Repo · Changelog

Release Notes

1.9.0

Added

  • Lots of work on the Ripper translation layer to make it more compatible and efficient.
  • Alias Prism::Node#breadth_first_search to Prism::Node#find.
  • Add Prism::Node#breadth_first_search_all/Prism::Node#find_all for finding all nodes matching a condition.

Changed

  • Fixed location of opening tokens when invalid syntax is parsed.
  • Fix RBI for parsing options.

1.8.1

Changes

  • Fix not binding power in endless methods.
  • Correctly handle and? and similar on Ruby 4.0.
  • Fix error message for block/lambda with ... argument.
  • Fix in handling.

1.8.0

Added

  • Optimize ruby visitor.
  • Report unterminated construct errors at opening token.

Changed

  • Correctly expose ripper state.
  • Use one file for versioned parser classes.
  • Fix denominator of rational float literal.
  • Decouple ripper translator from ripper library.
  • Sync Prism::Translation::ParserCurrent with Ruby 4.0.

1.7.0

Added

  • Support 4.1 as a version option.
  • Add equal_loc to CallNode.
  • Add len()/is_empty() to ConstantList and NodeList in the Rust API.

Changed

  • Rename version 3.5 to version 4.0.
  • Fix compiling the gem from source on Windows.
  • Fix parsing of unary method calls like 42.~@.
  • Reject def f a, (b) = 1.
  • Reject endless method as a block parameter default.
  • Reject variable capture in alternative pattern.
  • Many fixes in regards to memory safety, found through fuzzing.
  • Many fixes to better handle invalid syntax, also found through fuzzing.
  • Fix the ruby version used by the ripper translator.
  • Fix ruby_parser translation comment processing.

1.6.0

Added

  • Add support for passing "current" as the version option to Prism.* APIs.

Changed

  • Remove a compiler warning for a missing unsigned cast for a shift value.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ regexp_parser (indirect, 2.11.3 → 2.12.0) · Repo · Changelog

Release Notes

2.12.0 (from changelog)

Added

  • support for new unicode properties of Ruby 4.0.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

↗️ rubocop-ast (indirect, 1.47.1 → 1.50.0) · Repo · Changelog

Release Notes

1.50.0 (from changelog)

Bug fixes

  • #412: Fix Node#argument? returning true for receivers that are structurally equal to an argument (e.g. the receiver in foo.bar(foo)). (@bbatsov)
  • #401: Avoid intermediate array allocations in HashNode#each_key/each_value. (@bbatsov)
  • #409: Fix Node#chained? and MethodDispatchNode#block_literal? returning true for nodes that are merely structurally equal to the receiver or send node (e.g. the argument in foo.bar(foo)). (@bbatsov)
  • #407: Fix the blockless form of the deprecated each_when, each_in_pattern, each_condition, and each_branch methods, which returned an unusable Enumerator. (@bbatsov)
  • #401: Fix force_encoding being a no-op for frozen string inputs. (@bbatsov)
  • #408: Fix ProcessedSource#preceding_line returning the last line of the file for tokens on the first line. (@bbatsov)

Changes

  • #411: Speed up filtered node traversals (each_descendant(:send) etc.) by not allocating an array per visited node, and add the non-splatting Node#type_in? predicate. (@bbatsov)
  • #404: Improve parser_prism performance by building tokens only when they are first accessed. (@bbatsov)
  • #408: Memoize ProcessedSource#checksum and skip the token sort when the tokens are already in order. (@bbatsov)
  • #410: Reduce allocations in keyword? and the method-name predicates (predicate_method?, bang_method?, etc.). (@bbatsov)
  • #405: Use Prism by default when analyzing Ruby 3.3 code. (@bbatsov)

1.49.1 (from changelog)

Bug fixes

  • #399: Fix unification variables not persisting in any-order nodes. (@marcandre)

1.49.0

New features

  • #394: Support Ruby 4.1 (experimental). (@koic)

1.48.0

New features

  • #391: Support Ruby 4.0 (experimental). (@koic)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 52 commits:

↗️ unicode-emoji (indirect, 4.1.0 → 4.2.0) · Repo · Changelog

Release Notes

4.2.0 (from changelog)

  • Allow Ruby 4.0
  • Remove Non-Emoji pictographs from spec, since they have been removed in Unicode 17
  • Update valid subdivisions to CLDR 48 (no changes)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu Bot added the depfu label Jul 21, 2026
@depfu depfu Bot mentioned this pull request Jul 21, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants