[dependabot]

Updates the requirements on activesupport, net-ssh, zeitwerk, minitest and railties to permit the latest version.
Updates activesupport from 8.1.3.1 to 8.1.4

Release notes

Sourced from activesupport's releases.

8.1.4

Active Support

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.4 (September 24, 2026)

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

• Fix ActiveSupport::Inflector#transliterate mutating the caller's string.

... (truncated)

Commits

• c3466ea Preparing for 8.1.4 release
• e6288a8 Update CHANGELOGs for 8-1-stable backports
• 215952f Merge pull request #58727 from marcoroth/multiline-syntax-errors
• 6785886 Merge pull request #58688 from byroot/upgrade-rubocop
• e0d220c Fixed guard around AS::TC.run_order
• a3bcedd Merge pull request #58639 from moizafzal936/fix-fetch-multi-local-cache-order
• 5b7765c AS::JSON.decode: handle nil options
• c8b51db Merge pull request #58601 from Earlopain/json-3.0-compat
• 888d752 [8-1-stable] Silence Time.rfc3339 redefinition warning
• c957a6b Merge pull request #58324 from hammadxcm/fix-parameterize-nil-separator
• Additional commits viewable in compare view

Updates net-ssh from 7.3.3 to 7.3.4

Changelog

Sourced from net-ssh's changelog.

=== Unreleased

• Net::SSH.start no longer modifies the options hash passed to it [#989, #1046]
• Security: diffie-hellman-group-exchange-sha1/sha256 now requires groups of at least 2048 bits and requests sizes from the negotiated ciphers, as OpenSSH since 7.2, and rejects invalid server groups and DH public values; like OpenSSH, the requested group size is capped at 4096 bits for Cisco servers. Pass minimum_dh_bits: 1024 to connect to legacy servers that only offer 1024-bit groups. minimum_dh_bits values other than 1024 no longer fail key exchange with "could not verify server signature" #1049
• Session#exec! with a block now returns an empty string with exitstatus (like the non-block form) instead of nil [#848, #1045]
• Security: diffie-hellman-group14-sha1 is no longer offered by default for key exchange, as in OpenSSH since 8.2; add KexAlgorithms +diffie-hellman-group14-sha1 in ssh_config (or kex: '+diffie-hellman-group14-sha1') or pass append_all_supported_algorithms: true to re-enable [#705, #1042]
• ssh_config KexAlgorithms is now honoured and maps to :kex, including +, - and ^; it was previously ignored #1042
• Net::SSH::Proxy::Jump.new accepts options:, a Hash of ssh_config options passed to the jump host's ssh command as escaped -o Key=value arguments, e.g. options: { 'StrictHostKeyChecking' => 'no' } [#915, #1041]
• Net::SSH::Proxy::Jump no longer fails with "unknown key" or substitutes the target host when the config: path contains % #1041

=== 8.0.0 rc4

• Security: RSA signatures using SHA-1 (ssh-rsa, ssh-rsa-cert-v01@openssh.com) are no longer offered by default for host keys or public key authentication, as in OpenSSH since 8.8; RSA keys keep working via rsa-sha2-256/512. For servers that only support SHA-1 add HostKeyAlgorithms +ssh-rsa / PubkeyAcceptedAlgorithms +ssh-rsa in ssh_config (or host_key: '+ssh-rsa' / pubkey_algorithms: %w[+ssh-rsa]), or pass append_all_supported_algorithms: true #1039
• Security: ssh_config PubkeyAcceptedAlgorithms (and its old name PubkeyAcceptedKeyTypes) is now honoured, including +, - and ^, and pubkey_algorithms now applies to all key types instead of only RSA, adding rsa-sha2-512; DSA (ssh-dss) keys are no longer offered by default, as in OpenSSH since 7.0 — add +ssh-dss or pass append_all_supported_algorithms: true to re-enable #923
• Security: ssh_config Ciphers, MACs, KexAlgorithms and HostKeyAlgorithms lists starting with +, - or ^ now append to, remove from or prepend to the default list, as in OpenSSH, instead of silently enabling every supported algorithm including weak ones that are off by default; every listed item is honoured and - accepts wildcards. Pass append_all_supported_algorithms: true to also get the full supported list #925
• Support agent-backed FIDO/U2F security keys (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) for publickey auth #1007
• Port forwarding no longer buffers a whole stream in memory when one side reads slowly: like OpenSSH, window is granted only as data is written to the local socket, and the local socket is read only while the remote window has room. An application that writes everything to a forwarded port before reading anything now blocks once the window fills, as it would with ssh -L or a direct TCP connection; the old unbounded buffering hid this [#1037, #1003]
• Data forwarded to a local socket just before the remote end sends EOF or closes the channel is no longer truncated or dropped: it is written out before the socket is shut down or closed, without blocking the event loop until the local application reads #1037
• Multi-factor authentication works when the server's AuthenticationMethods order differs from net-ssh's: after each partial success the allowed methods are tried again, as OpenSSH does [#873, #872]
• HostKeyError#host, #port and #ip now return the connected host, port and IP (ip is nil through a ProxyCommand) instead of always nil #963
• OpenSSH-format private keys with Windows (CRLF) line endings now load [#922, #921]
• Send CHANNEL_EOF before CHANNEL_CLOSE when closing a session's remaining channels, as OpenSSH does; fixes hangs at close with servers that wait for EOF, such as some SFTP servers #672
• ssh_config: trailing # comments are now ignored, as in OpenSSH; a # inside quotes or in the middle of a word is kept #990

=== 8.0.0 rc3

• Fix "Calling Net::SSH::Buffer methods on HostKeyEntries PubKey is deprecated" warnings printed on every connection to a host in known_hosts [#1026, #1027]
• ProxyJump none now means no proxy instead of jumping through a host named "none", and ProxyCommand none is matched case-insensitively, as in OpenSSH [#893, #972, #1030]
• Send SIGHUP to the ProxyCommand process on close, as OpenSSH does, so tunnels such as EC2 Instance Connect Endpoint no longer hang at exit #947
• Reconnect when the ssh-agent closes the connection on the legacy version request (e.g. older Proton Pass) instead of raising FrozenError #1008
• ssh_config: parse Key = value lines like OpenSSH (the value no longer keeps the leading space, and the keyword ends at the first =), and honor ProxyJump/ProxyCommand before the first Host #1034

=== 8.0.0 rc2

• Security: refuse agent channels opened by the server unless agent forwarding was requested (forward_agent, ForwardAgent, or Forward#agent); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
• Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
• Security: reject OpenSSH private keys claiming more than 2**20 bcrypt rounds, and only run the KDF once a passphrase is given [GHSA-rpq3-v334-f5pm]
• Security: bound the server's identification banner like OpenSSH (8192-byte lines, 1024 lines), and apply :timeout to the whole version exchange instead of only its first byte [GHSA-r75w-7fhp-84w8]
• Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
• Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]

=== 8.0.0 rc1

• BREAKING: TCP_NODELAY is now set on the connection socket by default, as OpenSSH does; pass no_delay: false to keep Nagle's algorithm on #1017
• Ruby 4.0 support: add logger as a runtime dependency; Windows Pageant users on Ruby 4.0 need fiddle in their Gemfile [#984, #1012]
• Close the socket when connection setup fails, e.g. on a server version timeout #1013
• Ignore SSH_MSG_EXT_INFO from servers that send it unrequested #1020
• Fix undefined method 'to_pem' for ECDSA key_data when an agent is running #982
• Agent forwarding connects to the agent set by identity_agent/IdentityAgent #974
• Keyboard-interactive prompts show input when the server asks for it to be echoed #1014

... (truncated)

Commits

• 804bbdd bump version
• af514b9 Merge pull request #1010 from mfazekas/backport/cert-authority-7-3
• 50ff18c Add CHANGES entry for @​cert-authority host certificate verification #1010
• a722b78 Match host-certificate principals as shell globs, not exact strings
• 5bb788b Enforce cert type and critical options, and fail closed on every verifier
• 1fd0db4 Verify SSH certificate principals and validity in Always verifier
• d467764 Add failing regression tests for @​cert-authority host-cert bypass (GHSA-vxj5-...
• See full diff in compare view

Updates zeitwerk from 2.8.2 to 2.8.3

Changelog

Sourced from zeitwerk's changelog.

2.8.3 (1 Aug 2026)

• 2.8.0 introduced a regression: Collapsed directories that were also configured as eager load exclusions were eager loaded. The exclusion was not honored. This has been fixed.

Commits

• 607973f Ready for 2.8.3
• 8f09b96 Let eager loading skip collapsed eager loading exceptions
• f548f2c Remove unused variables
• See full diff in compare view

Updates minitest from 5.27.0 to 6.0.6

Changelog

Sourced from minitest's changelog.

=== 6.0.6 / 2026-04-30

• 2 bug fixes:

  • Fix using assert_equal/same/nil w/ BasicObject by comparing w/ nil == exp. (mtasaka)
  • Removed private Assertions#_where as it is no longer used.

=== 6.0.5 / 2026-04-20

• 2 bug fixes:

  • Avoid circular requires in lib/minitest/server_plugin.rb.
  • Raise TypeError if assert_raises is passed anything but modules/classes.

=== 6.0.4 / 2026-04-14

• 1 bug fix:

  • Fixed refute_predicate to call assert_respond_to w/ include_all:true like assert_predicate does. (jparker)

=== 6.0.3 / 2026-03-31

• 1 bug fix:

  • assert_same(nil, value) no longer allowed. Use assert_nil to be explicit. (paddor)

=== 6.0.2 / 2026-02-23

• 7 bug fixes:

  • Added missing drb dependency from minitest-server. (y-yagi)
  • Cleaned up bisect's sub-commands to load files directly, not ruby+require.
  • Fixed bisect to use same cmd ($0) to run tests as original invocation.
  • load server_plugin if server is loaded. (y-yagi)
  • Manipulate local args instead of ARGV in Sprint.run.
  • Only show --bisect in usage if using minitest.
  • Remove -Itest:lib from bisect's rb_flags since bin/minitest adds them.

=== 6.0.1 / 2025-12-26

• 1 minor enhancement:

  • Added new rake task test:fu to Minitest::TestTask, to only run tests with FU (focused units?) in their name. This should mostly obviate the need for the minitest-focus plugin.

• 5 bug fixes:

  • Fixed --help and --version exiting 1. (grosser)
  • Fixed method signature of Minitest::Benchmark.run. (flavorjones)

... (truncated)

Commits

• f6180b0 prepped for release
• 23bc7f2 - Removed private Assertions#_where as it is no longer used.
• c471347 - Fix using assert_equal/same/nil w/ BasicObject by comparing w/ nil == exp...
• 89c3e62 Branching minitest to version 6.0.5
• 6790f86 - Raise TypeError if assert_raises is passed anything but modules/classes.
• 235fa5b - Avoid circular requires in lib/minitest/server_plugin.rb.
• 5f0482e prepped for release
• b12f87f - Fixed refute_predicate to call assert_respond_to w/ include_all:true like a...
• 649b075 prepped for release
• a2d0904 - assert_same(nil, value) no longer allowed. Use assert_nil to be explicit. (...
• Additional commits viewable in compare view

Updates railties from 8.1.3.1 to 8.1.4

Release notes

Sourced from railties's releases.

8.1.4

Active Support

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

... (truncated)

Changelog

Sourced from railties's changelog.

Rails 8.1.4 (September 24, 2026)

• Include the offending value in the secret_key_base= error message.

  Jean Boussier

• Load database config when a connection is absent from the shared section.

  database_configuration no longer raises NoMethodError when a shared config section is missing a subsection for a particular connection name.

  Kenta Ishizaki

• Round-trip the null: false attribute modifier in GeneratedAttribute#to_s.

  rails generate now emits the ! modifier for attributes with null: false, so the generated command string can be used to regenerate the same migration.

  Kenta Ishizaki

• Fix infinite route reload when after_routes_loaded hooks access routes.

  The :loading state is now held across after_routes_loaded hooks, so a hook that touches routes no longer triggers a redundant reload.

  Chedli Bourguiba

• Fix LazyRouteSet thrashing when url_helpers are included into Object.

  method_missing and respond_to_missing? now only trigger a route reload for methods ending in _path or _url, preventing every respond_to? call from re-entering the route loader.

  Chedli Bourguiba

• Add RoutesReloader#loaded to check whether routes have been loaded.

  Rafael Mendonça França

• Mark routes as loaded when the routes reloader executes standalone.

  RoutesReloader#execute now sets the load state to loaded, so calling it directly (outside of execute_unless_loaded) no longer leaves the reloader in a state where routes are considered unloaded.

  Kenta Ishizaki

• Make mounted route helpers (e.g. main_app, engine mount proxies) trigger the lazy route load instead of raising NoMethodError when called before routes are drawn.

... (truncated)

Commits

• c3466ea Preparing for 8.1.4 release
• e6288a8 Update CHANGELOGs for 8-1-stable backports
• 6785886 Merge pull request #58688 from byroot/upgrade-rubocop
• d6cc1f4 Merge pull request #58519 from seuros/fix-lazy-route-set-mounted-helpers
• fd258d8 Merge pull request #58423 from 55728/fix-routes-reloader-execute-loaded-state
• f4eb07b Fix RoutesReloaderTest to not get stuck
• 454f45c Merge pull request #58405 from rails/rmf-loaded-routes-reloader
• bf26808 Merge branch '8-1-sec' into 8-1-stable
• 9cc88f6 Merge pull request #58278 from chaadow/fix-lazy-route-set-respond-to-missing-...
• 6509ef8 Merge pull request #58252 from chaadow/fix-routes-reloader-after-hooks-reload...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions