FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Bump activesupport from 8.1.1 to 8.1.2.1 in /docs by dependabot[bot] · Pull Request #710 · ClearFoundry/ClearScript · GitHub

Bump activesupport from 8.1.1 to 8.1.2.1 in /docs - #710

Merged
ClearScriptLib merged 1 commit into
masterfrom
dependabot/bundler/docs/activesupport-8.1.2.1
Mar 23, 2026
Merged

Bump activesupport from 8.1.1 to 8.1.2.1 in /docs#710
ClearScriptLib merged 1 commit into
masterfrom
dependabot/bundler/docs/activesupport-8.1.2.1

Conversation

dependabot Bot commented on behalf of github Mar 23, 2026

Copy link
Copy Markdown
Contributor

Bumps activesupport from 8.1.1 to 8.1.2.1.

Release notes

Sourced from activesupport's releases.

8.1.2.1

Active Support

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Skip blank attribute names in tag helpers to avoid generating invalid HTML.

    [CVE-2026-33168]

    Mike Dalessio

Action Pack

  • Fix possible XSS in DebugExceptions middleware

    [CVE-2026-33167]

    John Hawthorn

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.2.1 (March 23, 2026)

  • Reject scientific notation in NumberConverter

    [CVE-2026-33176]

    Jean Boussier

  • Fix SafeBuffer#% to preserve unsafe status

    [CVE-2026-33170]

    Jean Boussier

  • Improve performance of NumberToDelimitedConverter

    [CVE-2026-33169]

    Jean Boussier

Rails 8.1.2 (January 08, 2026)

  • Make delegate and delegate_missing_to work in BasicObject subclasses.

    Rafael Mendonça França

  • Fix Inflectors when using a locale that fallbacks to :en.

    Said Kaldybaev

  • Fix ActiveSupport::TimeWithZone#as_json to consistently return UTF-8 strings.

    Previously the returned string would sometime be encoded in US-ASCII, which in some cases may be problematic.

    Now the method consistently always return UTF-8 strings.

    Jean Boussier

  • Fix TimeWithZone#xmlschema when wrapping a DateTime instance in local time.

    Previously it would return an invalid time.

    Dmytro Rymar

  • Implement LocalCache strategy on ActiveSupport::Cache::MemoryStore. The memory store needs to respond to the same interface as other cache stores (e.g. ActiveSupport::NullStore).

    Mikey Gough

... (truncated)

Commits
  • 1db4b89 Preparing for 8.1.2.1 release
  • 1c7d1cf Update changelog
  • ec1a0e2 Improve performance of NumberToDelimitedConverter
  • 50d732a Fix SafeBuffer#% to preserve unsafe status
  • 19dbab5 NumberConverter: reject scientific notation
  • d7c8ae6 Preparing for 8.1.2 release
  • 3ea2701 CHANGELOG sync
  • 0f8014a [8-1-stable] Minitest 6 support
  • 991ccf3 Merge pull request #56393 from rails/add-exclude-keys-to-live-controller
  • c86465f Merge pull request #56353 from rails/rmf-delegation-basic-object
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [activesupport](https://github.com/rails/rails) from 8.1.1 to 8.1.2.1.
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v8.1.1...v8.1.2.1)

---
updated-dependencies:
- dependency-name: activesupport
  dependency-version: 8.1.2.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Mar 23, 2026
ClearScriptLib merged commit 217c0c4 into master Mar 23, 2026
dependabot Bot deleted the dependabot/bundler/docs/activesupport-8.1.2.1 branch March 23, 2026 21:01
mikhail-dcl added a commit to decentraland/ClearScript that referenced this pull request May 12, 2026
* Create CNAME

* Delete CNAME

* Create CNAME

* Update _config.yml

* Update head-custom.html

* Update _config.yml

* Bump rexml from 3.4.1 to 3.4.2 in /docs (ClearFoundry#675)

Bumps [rexml](https://github.com/ruby/rexml) from 3.4.1 to 3.4.2.
- [Release notes](https://github.com/ruby/rexml/releases)
- [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md)
- [Commits](ruby/rexml@v3.4.1...v3.4.2)

---
updated-dependencies:
- dependency-name: rexml
  dependency-version: 3.4.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump nokogiri from 1.18.8 to 1.18.9 in /docs (ClearFoundry#701)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.18.8 to 1.18.9.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.18.8...v1.18.9)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.18.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Update documentation links to the new ClearFoundry organization (ClearFoundry#703)

* Version 7.5.1-preview: [V8] Added support for JavaScript explicit resource management and script-side host object disposal (GitHub Issue ClearFoundry#533); [V8] added support for JavaScript object disposal from the host; added JavaScriptObjectFlags: Iterable, AsyncIterable, Disposable, AsyncDisposable; added IJavaScriptObject.Update; made HostItemFlags.DirectAccess apply to all fully public classes by default (GitHub Discussion ClearFoundry#626); added HostSettings.DisableInteropAssemblyConstruction (GitHub Issue ClearFoundry#645); added ScriptEngine.MarshalEnumAsUnderlyingType and AcceptEnumAsUnderlyingType (GitHub Discussion ClearFoundry#693); [V8] updated V8FastArgs to use ArrayPool; removed initialization script minimization to ease debugging; updated API documentation. Tested with V8 14.3.127.17.

* Bump faraday from 2.14.0 to 2.14.1 in /docs (ClearFoundry#705)

Bumps [faraday](https://github.com/lostisland/faraday) from 2.14.0 to 2.14.1.
- [Release notes](https://github.com/lostisland/faraday/releases)
- [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md)
- [Commits](lostisland/faraday@v2.14.0...v2.14.1)

---
updated-dependencies:
- dependency-name: faraday
  dependency-version: 2.14.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Fixed blog post images.

* Bump nokogiri from 1.18.10 to 1.19.1 in /docs (ClearFoundry#706)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.18.10 to 1.19.1.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.18.10...v1.19.1)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.19.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump json from 2.18.1 to 2.19.2 in /docs (ClearFoundry#709)

Bumps [json](https://github.com/ruby/json) from 2.18.1 to 2.19.2.
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v2.18.1...v2.19.2)

---
updated-dependencies:
- dependency-name: json
  dependency-version: 2.19.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump activesupport from 8.1.1 to 8.1.2.1 in /docs (ClearFoundry#710)

Bumps [activesupport](https://github.com/rails/rails) from 8.1.1 to 8.1.2.1.
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.2.1/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v8.1.1...v8.1.2.1)

---
updated-dependencies:
- dependency-name: activesupport
  dependency-version: 8.1.2.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump addressable from 2.8.8 to 2.9.0 in /docs (ClearFoundry#714)

Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.8.8 to 2.9.0.
- [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md)
- [Commits](sporkmonger/addressable@addressable-2.8.8...addressable-2.9.0)

---
updated-dependencies:
- dependency-name: addressable
  dependency-version: 2.9.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Bump nokogiri from 1.19.1 to 1.19.3 in /docs (ClearFoundry#717)

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.19.1 to 1.19.3.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/nokogiri@v1.19.1...v1.19.3)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-version: 1.19.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* Version 7.5.1: [V8] Added support for JavaScript explicit resource management and script-side host object disposal (GitHub Issue ClearFoundry#533); [V8] added support for JavaScript object disposal from the host; added JavaScriptObjectFlags: Iterable, AsyncIterable, Disposable, AsyncDisposable; added IJavaScriptObject.Update; made HostItemFlags.DirectAccess apply to all fully public classes by default (GitHub Discussion ClearFoundry#626); added HostSettings.DisableInteropAssemblyConstruction (GitHub Issue ClearFoundry#645); added ScriptEngine.MarshalEnumAsUnderlyingType and AcceptEnumAsUnderlyingType (GitHub Discussion ClearFoundry#693); [V8] updated V8FastArgs to use ArrayPool; removed initialization script minimization to ease debugging; updated API documentation. [New] Tested with V8 14.7.173.23.

* Dump V8 build logs in Linux and macOS CI jobs

The Windows job already dumps V8/build/v8/*.log on always(), but Linux
and macOS swallow them. When V8Update.sh fails inside gn or ninja, the
runner output stops at "Building V8 ..." with no diagnostic.

* Add workflow to build a single platform without the Unity package

build.yaml builds all three platforms and aggregates the Unity package;
this workflow exposes a workflow_dispatch input (windows/linux/macos)
that runs only the matching job, for fast iteration on per-platform
binary issues.

* Fix V8 build log paths in CI dump steps

V8Update.sh starts in Unix/ but immediately cd's to ../V8/, so the
build directory is V8/build/, not Unix/build/. The Windows job already
dumps from V8\build\v8\; the Linux and macOS dump steps were looking
at the wrong path and printing nothing.

* Add Unix/build-local.sh to reproduce the Linux CI build on WSL

Mirrors what the Linux CI job does (apt-get install of the arm64
toolchain on demand, then make -f Unix/Makefile [CPU=arm64]) and
dumps V8/build/v8/*.log on failure so the V8 gn/ninja errors are
visible without scrolling. CPU defaults to x64 for fast iteration;
pass arm64 or all to widen the build.

* Install all build prerequisites in Unix/build-local.sh

The script previously only installed the arm64 cross-build toolchain
on demand and assumed the rest was already present. Now it also
installs git, build-essential (make + g++), clang, pkgconf, python3,
curl, and dotnet-sdk-8.0 when missing, so a fresh WSL/Ubuntu 22.04
environment can run it from scratch. Detection is by command-v lookup
to keep repeat invocations fast.

* Fix build-local.sh

* Guard V8 polyfill with C++20 feature-test macros

include/ClearScript/polyfill.h (added to V8 source by V8Patch.txt)
unconditionally defined std::make_unique_for_overwrite and std::format
under #ifdef __linux__. Upstream's release binaries are built against
an Ubuntu 20.04 sysroot with libstdc++ 10 where these aren't yet in the
standard library, so the unguarded polyfill compiles. Modern sysroots
(libstdc++ 12+) provide make_unique_for_overwrite natively, making the
polyfill ambiguous with the standard declaration and breaking the V8
build.

Wrap each block in its standard feature-test macro so the polyfill
only fills in what the active standard library is actually missing.

* Suppress -Wdeprecated-declarations in V8 cflags

libstdc++ 12's std::stable_sort instantiates _Temporary_buffer, which
internally calls std::get_temporary_buffer — a function deprecated in
C++17 and "removed" in C++20 but still present (with a deprecation
attribute) in libstdc++ 12. V8 builds with -std=c++20 -Werror, so the
deprecation became a hard build error in src/heap/factory.cc and
similar translation units that pull in <algorithm>.

This was a libstdc++ 12 bug, fixed in libstdc++ 13. Upstream's release
binaries dodge it by building against an Ubuntu 20.04 sysroot
(libstdc++ 10). For our Ubuntu 22.04 build path, add the warning
suppression to V8's BUILD.gn cflags via the existing patch.

* Tighten Unix/build-local.sh for WSL iteration

- Target Unix/ClearScriptV8/Makefile directly so the local build only
  produces the native .so. The C# sample/test/benchmark projects (now
  on net9.0) are skipped — they need a .NET 9 SDK that isn't in
  jammy's default repos. CI is unaffected because the ubuntu-22.04
  runner image ships .NET 9 preinstalled and continues to use the
  top-level Unix/Makefile.
- Switch to set -Eeuo pipefail so the dump_logs ERR trap is inherited
  into shell functions and actually fires when build_one fails.
- Soft-check for Ubuntu 22.04, set DEBIAN_FRONTEND=noninteractive +
  NEEDRESTART_MODE=a to keep apt from blocking on Ubuntu 22.04's
  needrestart TUI during prereq install.
- Drop the dead ensure_dotnet8 helper.

* Unity Package https://github.com/decentraland/ClearScript/actions/runs/25673525805

* Add the missing meta

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ClearScript Library <ClearScript@microsoft.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Goomba <84668888+GoombaProgrammer@users.noreply.github.com>
Co-authored-by: ClearScript <clearscript@clearfoundry.net>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant


Back | FazBrowse Home | New Git URL