Sitelet https://github.com/chubchenko/errbit/pull/13
Skip to content

Bump devise, rails, dotenv-rails, mongoid and selenium-webdriver - #13

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/multi-b288ffc889
Open

Bump devise, rails, dotenv-rails, mongoid and selenium-webdriver#13
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/multi-b288ffc889

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Mar 17, 2026

Copy link
Copy Markdown

Bumps devise, rails, dotenv-rails, mongoid and selenium-webdriver. These dependencies needed to be updated together.
Updates devise from 4.9.4 to 5.0.3

Release notes

Sourced from devise's releases.

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

Changelog

Sourced from devise's changelog.

5.0.3 - 2026-03-16

  • security fixes
    • Fix race condition vulnerability on confirmable "change email" which would allow confirming an email they don't own CVE-2026-32700 #5783 #5784

5.0.2 - 2026-02-18

  • enhancements
    • Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825
      • Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.
    • Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

  • bug fixes
    • Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31

  • breaking changes

    • Drop support to Ruby < 2.7

    • Drop support to Rails < 7.0

    • Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

    • Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

    • Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

    • Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

    • Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

    • Remove deprecated Devise.activerecord51? method.

    • Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

      This is potentially a breaking change because Devise previously used the following order to find a secret key:

      app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base

      Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645

    • Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

    • Change <br> tags separating form elements to wrapping them in <p> tags #5494

    • Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

      If you are using an older version of Turbo and the default devise template, you'll need to copy it over to your app and change that back to [data-turbo-cache=false].

  • enhancements

    • Add Rails 8 support.

... (truncated)

Commits
  • 2f80920 Release v5.0.3
  • 5334707 Add CVE to changelog [ci skip]
  • 0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
  • 879f79f Bundle update
  • 0f4493b Configure default permissions as read-only for the workflow
  • 8c78576 Ignore test/** folder for GH default code scanning
  • c9e655e Bundle update, clear dependabot security issues
  • 3fd0610 Add a note to the changelog about an edge case issue some users ran into
  • 5b008ed Release v5.0.2
  • 916f94e Add sign_in_after_reset_password? check hook to passwords controller (#5826)
  • Additional commits viewable in compare view

Updates rails from 6.1.7.10 to 8.1.2

Release notes

Sourced from rails's releases.

8.1.2

Active Support

  • Make delegate and delegate_missing_to work in BasicObject subclasses.

    Rafael Mendonça França

  • Fix Inflectors when using a locale that fallbacks to :en.

    Said Kaldybaev

  • Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings.

    Previously the returned string would sometime be encoded in US-ASCII, which in some cases may be problematic.

    Now the method consistently always return UTF-8 strings.

    Jean Boussier

  • Fix TimeWithZone#xmlschema when wrapping a DateTime instance in local time.

    Previously it would return an invalid time.

    Dmytro Rymar

  • Implement LocalCache strategy on ActiveSupport::Cache::MemoryStore. The memory store needs to respond to the same interface as other cache stores (e.g. ActiveSupport::NullStore).

    Mikey Gough

  • Fix ActiveSupport::Inflector.humanize with international characters.

    ActiveSupport::Inflector.humanize("áÉÍÓÚ")  # => "Áéíóú"
ActiveSupport::Inflector.humanize("аБВГДЕ") # => "Абвгде"

    Jose Luis Duran

Active Model

  • No changes.

Active Record

  • Fix counting cached queries in ActiveRecord::RuntimeRegistry.

... (truncated)

Commits
  • d7c8ae6 Preparing for 8.1.2 release
  • 695ac6d Update Gemfile.lock
  • 01263f1 Merge pull request #56512 from byroot/remove-minitest-ci
  • 3ea2701 CHANGELOG sync
  • d3fe83f Merge pull request #56541 from rails/remove-system-test-from-default-ci-template
  • 5283514 Merge pull request #56012 from jmalcic/restore-default-adc-for-gcs-iam-client
  • 53e82ef Merge pull request #56534 from khasinski/fix-sqlite3-schema-dump-default-nil
  • d2509f8 Allow backburner warning
  • 8c48fd1 Merge pull request #56535 from eglitobias/8-1-stable
  • adcface Fix PostgreSQL schema_search_path after reconnect and reset
  • Additional commits viewable in compare view

Updates dotenv-rails from 2.8.1 to 3.2.0

Release notes

Sourced from dotenv-rails's releases.

v3.2.0

What's Changed

New Contributors

Full Changelog: bkeepers/dotenv@v3.1.8...v3.2.0

v3.1.8

Thanks to Stoked Seagull Software for sponsoring this release of dotenv!
Need help with a software project but don't know where to begin? Stoked Seagull can help.

Interested in sponsoring dotenv?

What's Changed

New Contributors

Full Changelog: bkeepers/dotenv@v3.1.7...v3.1.8

v3.1.7

What's Changed

Full Changelog: bkeepers/dotenv@v3.1.6...v3.1.7

3.1.6

What's Changed

Full Changelog: bkeepers/dotenv@v3.1.5...v3.1.6

v3.1.5

What's Changed

... (truncated)

Commits
  • 34156bf Prepare for 3.2.0 release
  • ab47820 Merge pull request #531 from grosser/grosser/warn
  • fae6120 Merge branch 'main' into grosser/warn
  • 4f510f4 Merge pull request #532 from grosser/grosser/fixes
  • 959e1da Merge pull request #539 from bkeepers/dependabot/github_actions/actions/check...
  • 041451e Update spec message
  • b300f26 Bump actions/checkout from 4 to 6
  • 5f4ca01 Merge branch 'main' into grosser/warn
  • 209dca4 Merge pull request #540 from i7an/handle-parentheses
  • 48c4956 Merge branch 'main' into handle-parentheses
  • Additional commits viewable in compare view

Updates mongoid from 9.0.6 to 9.0.10

Release notes

Sourced from mongoid's releases.

9.0.10

The MongoDB Ruby team is pleased to announce version 9.0.10 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 9.0.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 9.0.10 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '9.0.10'

Have any feedback? Click on through to MongoDB's JIRA and open a new ticket to let us know what's on your mind 🧠.

New Features

  • MONGOID-5864 Include Rails framework version in client metadata on initial handshake (PR)

Bug Fixes

  • MONGOID-5899 Write conflict error when accessing embedded documents via [] operator after direct DB update (PR)
  • MONGOID-5919 Restrict Criteria.from_hash method (PR)

9.0.9

The MongoDB Ruby team is pleased to announce version 9.0.9 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 9.0.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 9.0.9 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '9.0.9'

Have any feedback? Click on through to MongoDB's JIRA and open a new ticket to let us know what's on your mind 🧠.

Bug Fixes

9.0.8

... (truncated)

Commits

Updates selenium-webdriver from 4.30.1 to 4.41.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.41.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

... (truncated)

Changelog

Sourced from selenium-webdriver's changelog.

4.41.0 (2026-02-19)

  • Support CDP versions: v143, v144, v145
  • remove stored atoms these get generated by build (#16971)
  • output driver logs when SE_DEBUG is enabled (#16901)
  • Update lint configuration and fix rubocop offenses (#17008)
  • add missing unit tests (#17025)
  • [grid] Add session event API for server-side event bus integration (#17015)
  • Update dependencies (#17111)

4.40.0 (2026-01-18)

  • add synchronization and error handling for socket interactions (#16487)
  • mark low level bidi implementation as private api (#16475)
  • ensure driver process is always stopped (#15635)
  • create user-friendly method for enabling bidi (#14284)
  • Add force encoding to remove warnings caused by json 3.0 (#16728)
  • use SE_DEBUG to enable debugging (#16816)
  • ensure the grid is properly restarted in tests when there is a problem (#16842)
  • wait for grid to be ready when starting server (#16896)
  • check driver status endpoint rather than socket connection (#16877)
  • [build] update ruby gems with bazel (#16924)

4.39.0 (2025-12-06)

  • Add CDP for Chrome 143 and remove 140

4.38.0 (2025-10-24)

  • Add CDP for Chrome 142 and remove 139
  • Fix BiDi Network issue by removing nil values on network requests (#16442)
  • Remove cruft from old CI environment (#16473)
  • [bidi] remove deprecated classes for log inspector (#16474)

4.37.0 (2025-10-16)

  • Add CDP for Chrome 141 and remove 138
  • Update Chrome/Edge args for test environment (#16376)
  • Remove prism dependency (#16437)
  • Remove json version constraint (#16436)

4.36.0 (2025-09-18)

  • Add CDP for Chrome 140 and remove 137
  • [BiDi] Create browser module, added user context related methods (#15371)
  • BiDi get client windows (#16211)
  • Fix links to exception documentation on website (#16305)
  • Update unhandled_prompt_behavior capability to support hash syntax (#16289)

4.35.0 (2025-08-12)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump devise, rails, dotenv-rails, mongoid and selenium-webdriver
08ef055 
Bumps [devise](https://github.com/heartcombo/devise), [rails](https://github.com/rails/rails), [dotenv-rails](https://github.com/bkeepers/dotenv), [mongoid](https://github.com/mongodb/mongoid) and [selenium-webdriver](https://github.com/SeleniumHQ/selenium). These dependencies needed to be updated together.

Updates `devise` from 4.9.4 to 5.0.3
- [Release notes](https://github.com/heartcombo/devise/releases)
- [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md)
- [Commits](heartcombo/devise@v4.9.4...v5.0.3)

Updates `rails` from 6.1.7.10 to 8.1.2
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v6.1.7.10...v8.1.2)

Updates `dotenv-rails` from 2.8.1 to 3.2.0
- [Release notes](https://github.com/bkeepers/dotenv/releases)
- [Changelog](https://github.com/bkeepers/dotenv/blob/main/Changelog.md)
- [Commits](bkeepers/dotenv@v2.8.1...v3.2.0)

Updates `mongoid` from 9.0.6 to 9.0.10
- [Release notes](https://github.com/mongodb/mongoid/releases)
- [Changelog](https://github.com/mongodb/mongoid/blob/master/CHANGELOG.md)
- [Commits](mongodb/mongoid@v9.0.6...v9.0.10)

Updates `selenium-webdriver` from 4.30.1 to 4.41.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](https://github.com/SeleniumHQ/selenium/commits/selenium-4.41.0)

---
updated-dependencies:
- dependency-name: devise
  dependency-version: 5.0.3
  dependency-type: direct:production
- dependency-name: rails
  dependency-version: 8.1.2
  dependency-type: direct:production
- dependency-name: dotenv-rails
  dependency-version: 3.2.0
  dependency-type: direct:production
- dependency-name: mongoid
  dependency-version: 9.0.10
  dependency-type: direct:production
- dependency-name: selenium-webdriver
  dependency-version: 4.41.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Mar 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants