Skip to content

Repository navigation

Bump rubyzip from 3.2.2 to 3.4.0 in the bundler group across 1 directory - #465

Merged
rsmoke merged 2 commits into
stagingfrom
dependabot/bundler/bundler-84b9212a27
Oct 14, 2026
Merged

Bump rubyzip from 3.2.2 to 3.4.0 in the bundler group across 1 directory#465
rsmoke merged 2 commits into
stagingfrom
dependabot/bundler/bundler-84b9212a27

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 1 update in the / directory: rubyzip.

Updates rubyzip from 3.2.2 to 3.4.0

Release notes

Sourced from rubyzip's releases.

v3.4.0

Version 3.4.0

3.4.0 adds lib/rubyzip.rb to make including rubyzip in your Gemfile easier. See README.md for details.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.3.1

Version 3.3.1

The 3.3.x line ensures that Zip::InputStream behaves more like standard Ruby IO classes.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

v3.3.0

Version 3.3.0

The 3.3.x line ensures that Zip::InputStream behaves more like standard Ruby IO classes.

⚠️ There are breaking changes in the 3.x series ⚠️

Please see the README and Updating to version 3.x in the wiki for help upgrading from version 2.4.x to version 3.x.

Changelog

Sourced from rubyzip's changelog.

3.4.0 (2026-06-14)

  • Prevent entries from being extracted outside specified directory. #664. Thanks to @​connorshea for additional reporting on this.
  • Use SecureRandom in place of insecure Random.
  • Stop reading the central directory on first error.
  • Add a check on number of declared entries in a zip file. Thanks to @​connorshea for reporting this.
  • Add note to README re reporting security issues privately.
  • Add lib/rubyzip.rb for Bundler auto-require. #660

Tooling/internal:

  • Replace the test Excel spreadsheet fixture.
  • Use assert_silent shorthand when expecting no output from a test.
  • Clean up CentralDirectory instance variables.
  • Add Ruby 4.0 to the Windows CI and update CI matrix in the README.
  • List ZIP docs that we store here and link to online versions. #657

3.3.1 (2026-05-30)

  • Reinstate default param for InputStream#sysread. #663

3.3.0 (2026-05-02)

  • Refactor InputStream and AbstractInputStream. #661

Tooling/internal:

  • Update Actions to use checkout@v5.
  • Add Ruby4.0 to the CI matrix. #659
Commits
  • 93f9e6f Update version number and Changelog for release.
  • 17edfbf Prevent entries from being extracted outside specified directory.
  • c590916 Replace the test Excel spreadsheet fixture.
  • d07ee79 Use SecureRandom in place of insecure Random.
  • ef5af4f Use assert_silent shorthand when expecting no output from a test.
  • 31dfe7a Stop reading the central directory on first error.
  • 8637792 Add a check on number of declared entries in a zip file.
  • 73b4455 Clean up CentralDirectory instance variables.
  • 033d0cf Add note to README re reporting security issues privately.
  • c1ba5b3 Add Ruby 4.0 to the Windows CI and update CI matrix in the README.
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump rubyzip from 3.2.2 to 3.4.0 in the bundler group across 1 directory
a5aee66 
Bumps the bundler group with 1 update in the / directory: [rubyzip](https://github.com/rubyzip/rubyzip).


Updates `rubyzip` from 3.2.2 to 3.4.0
- [Release notes](https://github.com/rubyzip/rubyzip/releases)
- [Changelog](https://github.com/rubyzip/rubyzip/blob/main/Changelog.md)
- [Commits](rubyzip/rubyzip@v3.2.2...v3.4.0)

---
updated-dependencies:
- dependency-name: rubyzip
  dependency-version: 3.4.0
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Oct 1, 2026
@rsmoke
rsmoke merged commit 1619b8a into staging Oct 14, 2026
5 checks passed
@rsmoke
rsmoke deleted the dependabot/bundler/bundler-84b9212a27 branch October 14, 2026 17:11
rsmoke added a commit that referenced this pull request Oct 14, 2026
@rsmoke @cursor
@cursoragent @dependabot @britaumich
Fix support modal (#479)
e20105f 
* Update tailwindcss dependencies, modify Procfile for CSS watch command, and enhance support info modal with improved accessibility and styling.

* Add DepartmentApi and SentryMetrics regression specs (#462)

Cover department lookup success/failure shaping used by BuildingsApi room
updates, and ensure Sentry metric failures are swallowed so jobs/rake keep
running.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add stale-room deactivation regression specs for media preservation. (#463)

Cover the success path that hides rooms via visible=false while keeping
contacts, characteristics, and Active Storage panoramas/images, plus the
already-hidden fail-closed invariant in BuildingsApi and ClassroomApi.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add ApiUpdateDatabase PhaseResult/RunResult regression specs (#464)

Cover structured phase/run reporting and runner early-exit when auth
token acquisition fails, so nightly classroom sync failures stay
visible in ApiUpdateLog without continuing later phases.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Bump rubyzip from 3.2.2 to 3.4.0 in the bundler group across 1 directory (#465)

Bumps the bundler group with 1 update in the / directory: [rubyzip](https://github.com/rubyzip/rubyzip).


Updates `rubyzip` from 3.2.2 to 3.4.0
- [Release notes](https://github.com/rubyzip/rubyzip/releases)
- [Changelog](https://github.com/rubyzip/rubyzip/blob/main/Changelog.md)
- [Commits](rubyzip/rubyzip@v3.2.2...v3.4.0)

---
updated-dependencies:
- dependency-name: rubyzip
  dependency-version: 3.4.0
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: rsmokeUM <rsmoke@umich.edu>

* Add TaskResultLog, TokenStore, and Okta display_name regression specs (#467)

* Add TaskResultLog, TokenStore, and Okta display_name regression specs

Cover nightly API update logging status/payload persistence, token
cache expiry and failure paths, and Okta SAML display_name mapping on
omniauth callback so auth/name regressions are caught early.

Co-authored-by: rsmoke <rsmoke@umich.edu>

* Improve error logging in ApiUpdateLog by including detailed error messages when save fails.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add ApplicationHelper api_status/api_log_text regression specs (#470)

* Add ApplicationHelper api_status and api_log_text regression specs.

Cover the admin header banner signals for missing nightly runs, error vs success
recency, and blank log fallback so false-positive or missed API failure alerts
are less likely to regress.

Co-authored-by: rsmoke <rsmoke@umich.edu>

* Potential fix for pull request finding 'Test does not verify log recency filtering'

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Add FloorPolicy authorization regression specs (#471)

* Add FloorPolicy authorization regression specs.

Lock viewer show vs admin mutation permissions and deny show when
membership groups are empty outside production.

Co-authored-by: rsmoke <rsmoke@umich.edu>

* Improve error logging in TaskResultLog specs by including specific error messages for invalid records

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add AnalyticsDashboard and ApiUpdateLog policy regression specs. (#476)

Lock admin-only index/show/refresh gates so non-admin viewers cannot
access API update logs or refresh the analytics dashboard.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* restore allowed_clock_drift in saml attributes (#478)

Co-authored-by: rsmokeUM <rsmoke@umich.edu>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: cursor[bot] <206951365+cursor[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Margarita Barvinok <56089936+britaumich@users.noreply.github.com>
rsmoke added a commit that referenced this pull request Oct 21, 2026
@rsmoke @cursor
@cursoragent @dependabot @britaumich
Update dependencies, enhance accessibility, and add regression specs (#…
ecba528 
…480)

* Update tailwindcss dependencies, modify Procfile for CSS watch command, and enhance support info modal with improved accessibility and styling.

* Add DepartmentApi and SentryMetrics regression specs (#462)

Cover department lookup success/failure shaping used by BuildingsApi room
updates, and ensure Sentry metric failures are swallowed so jobs/rake keep
running.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add stale-room deactivation regression specs for media preservation. (#463)

Cover the success path that hides rooms via visible=false while keeping
contacts, characteristics, and Active Storage panoramas/images, plus the
already-hidden fail-closed invariant in BuildingsApi and ClassroomApi.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add ApiUpdateDatabase PhaseResult/RunResult regression specs (#464)

Cover structured phase/run reporting and runner early-exit when auth
token acquisition fails, so nightly classroom sync failures stay
visible in ApiUpdateLog without continuing later phases.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Bump rubyzip from 3.2.2 to 3.4.0 in the bundler group across 1 directory (#465)

Bumps the bundler group with 1 update in the / directory: [rubyzip](https://github.com/rubyzip/rubyzip).


Updates `rubyzip` from 3.2.2 to 3.4.0
- [Release notes](https://github.com/rubyzip/rubyzip/releases)
- [Changelog](https://github.com/rubyzip/rubyzip/blob/main/Changelog.md)
- [Commits](rubyzip/rubyzip@v3.2.2...v3.4.0)

---
updated-dependencies:
- dependency-name: rubyzip
  dependency-version: 3.4.0
  dependency-type: indirect
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: rsmokeUM <rsmoke@umich.edu>

* Add TaskResultLog, TokenStore, and Okta display_name regression specs (#467)

* Add TaskResultLog, TokenStore, and Okta display_name regression specs

Cover nightly API update logging status/payload persistence, token
cache expiry and failure paths, and Okta SAML display_name mapping on
omniauth callback so auth/name regressions are caught early.

Co-authored-by: rsmoke <rsmoke@umich.edu>

* Improve error logging in ApiUpdateLog by including detailed error messages when save fails.

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add ApplicationHelper api_status/api_log_text regression specs (#470)

* Add ApplicationHelper api_status and api_log_text regression specs.

Cover the admin header banner signals for missing nightly runs, error vs success
recency, and blank log fallback so false-positive or missed API failure alerts
are less likely to regress.

Co-authored-by: rsmoke <rsmoke@umich.edu>

* Potential fix for pull request finding 'Test does not verify log recency filtering'

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Add FloorPolicy authorization regression specs (#471)

* Add FloorPolicy authorization regression specs.

Lock viewer show vs admin mutation permissions and deny show when
membership groups are empty outside production.

Co-authored-by: rsmoke <rsmoke@umich.edu>

* Improve error logging in TaskResultLog specs by including specific error messages for invalid records

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* Add AnalyticsDashboard and ApiUpdateLog policy regression specs. (#476)

Lock admin-only index/show/refresh gates so non-admin viewers cannot
access API update logs or refresh the analytics dashboard.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: rsmoke <rsmoke@umich.edu>

* restore allowed_clock_drift in saml attributes (#478)

Co-authored-by: rsmokeUM <rsmoke@umich.edu>

* Count already-hidden rooms as deactivated so the API sync can finish.

A stale classroom that was already hidden aborted the rooms phase and skipped the rest of the update.

Co-authored-by: Cursor <cursoragent@cursor.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: cursor[bot] <206951365+cursor[bot]@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Margarita Barvinok <56089936+britaumich@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@rsmoke