Skip to content

[TASK]: bump the serverspec group in /tests/serverspec with 16 updates - #607

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/tests/serverspec/serverspec-fc264db106
Open

[TASK]: bump the serverspec group in /tests/serverspec with 16 updates#607
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/tests/serverspec/serverspec-fc264db106

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 11, 2026

Copy link
Copy Markdown
Contributor

Bumps the serverspec group in /tests/serverspec with 16 updates:

Package From To
rake 13.0.3 13.4.2
rspec-core 3.10.1 3.13.6
serverspec 2.41.5 2.43.0
docker-api 2.1.0 2.5.0
diff-lcs 1.4.4 1.6.2
excon 0.81.0 1.12.0
multi_json 1.15.0 1.21.2
net-scp 3.0.0 4.2.1
net-ssh 6.1.0 8.1.2
net-telnet 0.1.1 0.2.0
rspec 3.10.0 3.13.2
rspec-expectations 3.10.1 3.13.6
rspec-its 1.3.0 2.0.0
rspec-mocks 3.10.2 3.13.9
rspec-support 3.10.2 3.13.8
specinfra 2.82.25 2.95.2

Updates rake from 13.0.3 to 13.4.2

Changelog

Sourced from rake's changelog.

=== 13.2.1

  • Suppressed "internal:array:52:in 'Array#each'" from backtrace by @​hsbt in #554
  • Bump actions/configure-pages from 4 to 5 by @​dependabot in #553

=== 13.2.0

=== 13.1.0

... (truncated)

Commits
  • 503b8ec v13.4.2
  • 46038e7 Merge pull request #723 from ruby/fix/testopts-preserve-existing-value
  • 604a3d9 Isolate TESTOPTS env in TestRakeTestTask setup/teardown
  • 5886caa Preserve ENV["TESTOPTS"] when verbose is enabled
  • 92193ac v13.4.1
  • b74be0b Merge pull request #721 from ruby/fix/add-options-to-gemspec
  • 829f66d Add lib/rake/options.rb to gemspec
  • 2d55bc4 v13.4.0
  • 1415070 Exclude dependabot updates from release note
  • b3dc948 Merge pull request #713 from pvdb/simplify_standard_system_dir
  • Additional commits viewable in compare view

Updates rspec-core from 3.10.1 to 3.13.6

Changelog

Sourced from rspec-core's changelog.

3.13.6 / 2025-10-19

Full Changelog

Bug Fixes:

3.13.5 / 2025-06-25

Full Changelog

Bug Fixes:

  • Fix finding failed lines from frozen backtrace arrays. (Jon Rowe, rspec/rspec#225)

3.13.4 / 2025-05-27

Full Changelog

Bug Fixes:

  • Fix links in gemspec to point to the monorepo / homepage.

3.13.3 / 2025-02-06

Full Changelog

Bug fixes:

  • Fix reporter memorisation of ExamplesNotification used in RSpec::Core::Reporter#finish by reusing an instance across notifcations. (Maxime Lapointe, rspec/rspec#172)
  • Fix memorisation of RSpec::Core::Example#location_rerun_argument. (Maxime Lapointe, rspec/rspec#173)

3.13.2 / 2024-10-18

Full Changelog

Bug fixes:

  • RSpec::Configuration#requires will reflect files already required, whilst requiring them. (Jon Rowe, rspec/rspec-core#3117)

3.13.1 / 2024-09-02

Full Changelog

Bug fixes:

3.13.0 / 2024-02-04

Full Changelog

... (truncated)

Commits

Updates serverspec from 2.41.5 to 2.43.0

Updates docker-api from 2.1.0 to 2.5.0

Commits

Updates diff-lcs from 1.4.4 to 1.6.2

Changelog

Sourced from diff-lcs's changelog.

1.6.2 / 2025-05-12

  • Handle upcoming changes to the cgi gem in Ruby 3.5 (#147[pull-147])

  • Fix issues found with htmldiff in Ruby 1.8 (which is used approximately never, since the code change which broke Ruby 1.8 was made 6 years ago). #148[pull-148]

  • Fixed some standardrb formatting and configuration issues.

1.6.1 / 2025-03-25

  • Performed further work on Diff::LCS::Ldiff improvements (#46[issue-46]) and resolve several thread safety issues cleanly by making it a class. #129[pull-129]

  • Restructure the project to be more consistent with the rest of the projects that I manage.

  • Increased GitHub action security.

  • Added [trusted publishing][tp] for fully automated releases.

1.6.0 / 2025-02-13

  • Baptiste Courtois ([@​annih][gh-user-annih]) has done significant work on making bin/ldiff work better, contributing a number of issues and pull requests. These include:

    • Separation of command parsing from diff-generation in Diff::LCS::Ldiff code extraction making it easier to use separately from the bin/ldiff command in #103[pull-103]. This partially resolves #46[issue-46].

    • Improvement of binary and empty file detection and tests in #104[pull-104] and #105[pull-105]. This resolves issues #100[issue-100], #102[issue-102].

    • Various ldiff fixes for output #101[pull-101] resolves issues #106[issue-106] (ldiff ed scripts are inverted), #107[issue-107] (ldiff hunk ranges are incorrect; regression or incorrect fix for #60[issue-60]), and #95[issue-95].

  • Patrick Linnane fixed various minor typos. #93[pull-93]

  • Mark Young added a Changelog link to the RubyGems metadata. #92[pull-92] This has been modified to incorporate it into the README.

  • Updated the documentation on Diff::LCS#lcs to be clearer about the requirements for object equality comparison. This resolves #70[issue-70].

... (truncated)

Commits
  • aca4bd7 Bump actions/dependency-review-action from 4.6.0 to 4.7.0
  • a56cd23 Update gemspec for 1.6.2
  • f5e9ac5 chore: Fix Ruby 1.8 and formatting issues
  • 2d7411f Update changelog
  • d1b5380 Replace usage of cgi gem for Ruby 3.5
  • 6b7ed57 Bump ruby/setup-ruby from 1.235.0 to 1.237.0
  • 1d8235d Bump astral-sh/setup-uv from 6.0.0 to 6.0.1
  • 6bad0c9 Bump github/codeql-action from 3.28.16 to 3.28.17
  • 1996222 Bump github/codeql-action from 3.28.15 to 3.28.16
  • 210d1e7 Bump ruby/setup-ruby from 1.233.0 to 1.235.0
  • Additional commits viewable in compare view

Updates excon from 0.81.0 to 1.12.0

Changelog

Sourced from excon's changelog.

v1.12.0 2026-11-10

  • add NUL to unsafe chars check for header keys and values as per RFC 9110
  • raise on unsafe chars in host, method, path, or query to prevent injection
  • add Excon::Error::InvalidHost, InvalidMethod, InvalidPath and InvalidQuery; these and the InvalidHeaderKey/InvalidHeaderValue errors are now subclasses of Excon::Error::InvalidParameter, so rescuing it catches every request validation error
  • raise Excon::Error::InvalidHost (a subclass of InvalidParameter, which was raised before) when the host is missing

v1.11.0 2026-11-06

  • add Excon.stub_call_count(stub), the number of requests a stub has answered, and Excon.verify_stubs(*stubs), which raises Excon::Error::StubNotCalled for stubs that answered none (#434)
  • redact Proxy-Authorization in the CONNECT request kept by Excon::Error::ProxyConnectionError#request, which previously held the proxy credentials
  • treat any 2xx answer to an HTTPS proxy's CONNECT as the tunnel being open, as RFC 9110 specifies, instead of raising ProxyConnectionError for anything but 200
  • raise Excon::Error::SOCKS5Error, a subclass of Excon::Error::Socket, when a SOCKS5 proxy handshake fails, instead of an Excon::Error::Socket wrapped in another one (whose message ended "(Exception) (Excon::Error::Socket)"); Excon::Error::Socket errors are no longer wrapped again, and Excon::Error::Socket.new accepts a message
  • raise Excon::Error::ProxyConnectionError when a proxy refuses a CONNECT, instead of wrapping it in an Excon::Error::Socket; it is now a subclass of Excon::Error::Socket, so it is still rescued and retried as one, and its socket_error returns itself
  • remove dead fallback to OpenSSL::PKey::RSA.new for client keys; OpenSSL::PKey.read is always available on supported Rubies (CRuby and JRuby)
  • parse a String :proxy (including one from the proxy environment variables) with the connection's :uri_parser instead of always using URI (#412)

v1.10.0 2026-10-29

  • don't reuse a socket left partway through a request or response by an interrupt (e.g. Timeout.timeout or Thread#raise), which could give a later request the earlier request's response; previously this happened on non-persistent connections, on persistent connections shared between threads, and when pipelining

v1.9.1 2026-10-29

  • read a nonblocking connect's result from SO_ERROR, so a refused connect on macOS 27 tries the host's next address instead of failing later with "Broken pipe" (#982)

v1.9.0 2026-10-28

  • RedirectFollower returns a 301, 302, 303, 307 or 308 response without a Location header instead of raising ArgumentError
  • move test fixtures from tests/ to test/fixtures/
  • remove shindo dev dependency; all tests now run on minitest
  • remove unused rdoc dev dependency and stale .document file
  • remove activesupport and delorean dev dependencies, migrate instrumentation tests to minitest
  • remove sinatra-contrib dev dependency (use rack cookie helpers in test rackup)
  • remove sinatra dev dependency (test rackups are now plain rack apps)
  • escape hostnames in no_proxy patterns while preserving the * wildcard
  • remove logger gem runtime dependency; excon now has no runtime dependencies. The default LoggingInstrumentor output to $stderr keeps Logger's format. Requiring excon no longer loads Logger, so code relying on that should require 'logger' itself (minor version bump)
  • Excon.stub copies its request params, so looking up or unstubbing with the same hash (stub_for, unstub) no longer stops the stub from matching
  • RedirectFollower drops Content-Type and the other content headers when a 301, 302 or 303 turns the request into a GET
  • guard a connection's per-thread socket cache with a mutex, so threads sharing a connection on JRuby can't lose each other's sockets mid-request (#801)
  • RedirectFollower drops headers when following a redirect regardless of casing; previously only the exact REDACTION_HEADERS casing was dropped, so e.g. authorization was forwarded

1.8.0 2026-10-21

  • remove json gem dev dependency (should be available via stdlib)

... (truncated)

Commits

Updates multi_json from 1.15.0 to 1.21.2

Release notes

Sourced from multi_json's releases.

v1.21.2

What's Changed

New Contributors

Full Changelog: sferik/multi_json@v1.21.1...v1.21.2

v1.21.1

Full Changelog: sferik/multi_json@v1.21.0...v1.21.1

v1.21.0

Full Changelog: sferik/multi_json@v1.20.1...v1.21.0

Changelog

Sourced from multi_json's changelog.

[1.21.2] - 2026-09-07

Added

  • Support json 3.x in the json_gem adapter (thanks [@​byroot], #67). json 3.0 raises ArgumentError on unknown keyword arguments, so the adapter now passes parse options as keywords and only sets the create_additions: false / quirks_mode: true defaults on json 2.x, where they still exist. Note that the oj adapter can still fail to dump Time values when json 3.x is installed: Oj forwards its own options hash to Time#to_json in compat mode, and json 3 rejects them. That is an upstream Oj issue and does not affect the json_gem adapter.

Changed

  • Prefer the JSON gem over jrjackson in the JRuby adapter preference list, so json_gem now leads on every engine. The json gem's Java extension outperforms JrJackson across the bundled benchmark matrix on JRuby 10. Affects auto-detection only when neither adapter is preloaded; explicitly selecting an adapter with MultiJSON.use(:jr_jackson) is unchanged.

Fixed

  • Honor a falsy :pretty option in the json_gem and oj adapters (#70). Both adapters branched on the presence of the key rather than its value, so MultiJSON.generate(object, pretty: false) returned pretty-printed JSON. This regressed in 1.20.0.

[1.21.1] - 2026-05-04

Fixed

  • Fix MultiJson.method(:load) resolving to Kernel#load instead of the legacy-constant forwarder (#66). The 1.21.0 shim forwarded calls via method_missing, but Module#method doesn't consult method_missing, so libraries that capture decoders as Method objects (Sawyer, used by Octokit and Danger) crashed with LoadError when the captured method tried to interpret the JSON string as a file path. Define an explicit singleton method on MultiJson for every public method MultiJSON exposes so Module#method finds the forwarder directly.

[1.21.0] - 2026-05-02

Every deprecation introduced here will be removed in 2.0.0. Upgrade to 1.21.0, run your app or test suite with ruby -W:deprecated to surface the warnings, migrate each call site to the new canonical names, then pin ~> 2.0 once 2.0.0 ships.

Added

  • Rename the MultiJson constant to MultiJSON (all-caps) to match the project name, Ruby stdlib JSON, and the all-caps treatment of the JSON acronym across other languages. The legacy MultiJson constant continues to work as a thin delegator via method_missing and const_missing, so MultiJson.parse(...), MultiJson::Adapters::Oj, and rescue MultiJson::ParseError all resolve to their MultiJSON counterparts.
  • Add MultiJSON.parse and MultiJSON.generate as the new canonical names for the primary parse and generate methods, matching Ruby stdlib JSON.parse / JSON.generate, the JSON spec (RFC 8259), and sister library MultiXml.
  • Add MultiJSON.parse_options / MultiJSON.parse_options= and MultiJSON.generate_options / MultiJSON.generate_options= as the new canonical option setters.
  • Accept symbolize_names: as the canonical option name matching Ruby stdlib's JSON.parse(str, symbolize_names: true). The deprecated symbolize_keys: option continues to work and emits a one-time warning when passed at any of the three option layers (call-site, MultiJSON.parse_options=, adapter defaults :load).
  • Replace the two-adapter Benchmark.ips smoke test in benchmark.rb with a full adapter comparison matrix (parse + dump across nine workloads) and promote it to a top-level rake benchmark task. A new --verify-preference flag asserts that MultiJSON::AdapterSelector::ADAPTERS matches the observed throughput ranking, with a 10% tolerance for adjacent ties; CI runs it on every push so the ordering can't silently drift.

Changed

  • Reorder MultiJSON::AdapterSelector::ADAPTERS so the JSON gem is tried before fast_jsonparser/oj/yajl on MRI and TruffleRuby, matching the throughput ranking in the bundled benchmark suite on Ruby 3.4+. The hash is split per platform so JRuby still prefers jr_jackson. Affects auto-detection only when more than one of those adapters is loaded; explicitly selecting an adapter with MultiJSON.use(:adapter) is unchanged.

Deprecated

  • The MultiJson constant in favor of MultiJSON.
  • MultiJSON.load in favor of MultiJSON.parse.
  • MultiJSON.dump in favor of MultiJSON.generate.
  • MultiJSON.load_options / MultiJSON.load_options= in favor of MultiJSON.parse_options / MultiJSON.parse_options=.
  • MultiJSON.dump_options / MultiJSON.dump_options= in favor of MultiJSON.generate_options / MultiJSON.generate_options=.
  • The :symbolize_keys parse option in favor of :symbolize_names.

All deprecated names continue to work and emit a one-time warning on first use. Warnings are tagged with Ruby's :deprecated category, so noisy apps can silence the whole set with Warning[:deprecated] = false and deprecation-aware tooling (ruby -W:deprecated, CI linters) picks them up. The old names will be removed in 2.0.

[1.20.1] - 2026-04-12

Added

... (truncated)

Commits
  • c44e92e Prepare 1.21.2 release
  • 2c0c31d Let the tests matrix finish instead of cancelling on the first failure
  • 635c992 Tighten two tests, run CI on LTS branches, and rename a shadowing parameter
  • 7d14b25 Merge pull request #67 from byroot/json-3.x
  • f8c3e5e Make multi_json compatible with json 3.x
  • 6cedb56 Honor falsy :pretty in the JsonGem and OjCommon adapters
  • 5149d63 Bump actions/checkout from 6 to 7
  • cb323bb Bump rubygems/configure-rubygems-credentials from 1.0.0 to 2.1.0
  • 3f19f54 Add Dependabot configuration for GitHub Actions and Bundler
  • cc9b23a Prefer json_gem over JrJackson on JRuby
  • Additional commits viewable in compare view

Updates net-scp from 3.0.0 to 4.2.1

Changelog

Sourced from net-scp's changelog.

=== 4.2.1

=== 4.2.0

  • BREAKING: Require Ruby 2.6 or later. Bundler on Ruby 2.3-2.5 resolves to 4.1.3. #114
  • Package only lib, CHANGES.txt, LICENSE.txt and README.md in the gem, about 40% smaller. Thanks @​yuri-zubov #118
  • An exception raised during a transfer, such as upload! of a missing local file or an error from a progress callback, no longer leaves the channel registered and re-raises on later operations on the same session; the original error is raised once, library-opened files are closed and caller-passed IO is left open. Thanks @​ThomasSevestre and @​OskarEichler [Feature/use rename for php debugger switch #107, #26, #97]

=== 4.1.3

  • Load again on Ruby 2.3-2.5 (4.1.2 needed 2.5), and declare required_ruby_version >= 2.3 [⬆️ Upgrade alpine-3.3 to alpine-3.4 #112, #110]
  • Add a quote: option to upload/download for the remote path: :posix (default), :windows for Win32-OpenSSH under cmd.exe or PowerShell (double-quoted, \ sent as /, paths containing ", $, `, %, !, curly quotes, CR, LF or NUL rejected), :none to send the path unchanged to servers without a shell, or a callable. By default a leading ~ or ~/ is now left for the remote shell to expand to the home directory; such paths previously referred to a literal ~ entry in the login directory and usually failed. Thanks @​ArtsiomMusin for the Windows patch in #34 [Add monitoring solution #109, #34, #9]
  • Recursive uploads no longer abort on a broken symlink: it is skipped with a warning, the rest is uploaded, and a Net::SCP::Error listing the skipped paths is raised at the end, like OpenSSH scp. Based on #23 by @​maage. [Add Phantomjs Containers #108, #23]

=== 4.1.2

  • Security: Downloads no longer apply setuid, setgid or sticky bits sent by the server, check that a server-chosen local name matches the requested remote basename (as OpenSSH does since CVE-2019-6111), and refuse to follow an existing local symlink at a server-named path instead of writing through it. The local path passed by the caller may still be a symlink. O_NOFOLLOW suggested in net-sftp#162 by srosenhamer #104
  • Security: Recursive downloads, and downloads into a directory, reject file names from the server that are not a single path component (such as ../x or a/b) instead of writing outside the target directory. Reported in net-sftp#162 by srosenhamer #103
  • Raise Net::SCP::Error when the server ends a transfer before the SCP protocol finishes, instead of reporting a truncated transfer as successful [Image make stopped with error #105, #96]
  • Opening an scp:// URI through uri/open-scp now percent-decodes the user, password and path (once, keeping a literal +) and passes an IPv6 address to SSH without its brackets, so scp://user@[::1]/a%20b downloads /a b from ::1. Thanks @​OskarEichler #94
  • Opening an scp:// URI through uri/open-scp now writes the download into the OpenURI buffer as it arrives, so large files spill to a temporary file instead of being held in memory twice. Thanks @​OskarEichler #93
  • Parsing an scp:// URI with a valueless query entry (?flag) or an empty one (?a=1&&b=2) no longer raises NoMethodError, and URI::SCP#options reflects the current query after query=. Thanks @​OskarEichler #92
  • Opening an scp:// URI through uri/open-scp now calls :progress_proc with the number of bytes received, as OpenURI documents, instead of with the SCP progress arguments (which raised ArgumentError for a lambda), and calls :content_length_proc once with the file size. Thanks @​OskarEichler #91
  • Opening an scp:// URI through uri/open-scp now uses the port and password given in the URI; they were passed outside the :ssh options and ignored. Options given in :ssh still take precedence. Thanks @​OskarEichler #90
  • Close the local file net-scp opened for an upload or download when the transfer fails, so it is not left open (and locked on Windows) [Make FPM port public on php*-dev #89, #20]
  • With preserve: true, recursive downloads now keep directories' modification times, which were overwritten when their contents were created. Thanks @​OskarEichler #88
  • upload/upload! with a zero, negative or non-Integer :chunk_size now raises ArgumentError before opening a channel; previously 0 hung forever sending empty chunks, a negative value or a String failed only after the channel was open, and a Float was silently truncated. Thanks @​OskarEichler #87
  • Uploading from an IO that isn't at its start now announces only the remaining bytes, instead of the full size, which made the transfer hang or fail. Thanks @​OskarEichler #86
  • Accept a Pathname as the local path for uploads and downloads; previously uploads looped forever and downloads kept only the last chunk. Thanks @​OskarEichler [Error in alert message for provisionnig deprecated #85, #29]

=== 4.1.1

  • Allow net-ssh 8
  • Fix frozen string literal compatibility [npezza93, mfazekas]
    • Use mutable string for scp command construction
    • Use mutable string for error_string initialization
  • Add Ruby 3.4 and ruby-head to CI matrix
  • Add Ruby 4.0+ compatibility (logger, rdoc gems)
  • Drop EOL Ruby 2.3-2.5 from CI
Commits
  • 64b6399 bump version
  • 26c0970 Merge pull request #119 from net-ssh/scp-limit
  • 441bfb2 Add :limit option to cap transfer bandwidth
  • d01f112 bump version
  • 1a6bea9 Merge pull request #118 from yuri-zubov/reduce-gem-size
  • caf3b7f Reduce gem size by excluding unnecessary file
  • 04ad685 Merge pull request #117 from net-ssh/vbump-minor
  • 57c5766 Add rake vbump:minor
  • 194c539 Merge pull request #115 from net-ssh/pin-ubuntu-24.04
  • 0151965 Add changelog fragment
  • Additional commits viewable in compare view

Updates net-ssh from 6.1.0 to 8.1.2

Changelog

Sourced from net-ssh's changelog.

=== 8.1.2

  • Security: verify the proxy's certificate and hostname in Net::SSH::Proxy::HTTPS by default, and the hostname with any verifying :ssl_context; any certificate was accepted, exposing the proxy credentials to a man-in-the-middle. A self-signed or private CA proxy now needs an :ssl_context that trusts it, or one with verify_mode = OpenSSL::SSL::VERIFY_NONE to skip verification. Thanks @​fuzzyrichie [GHSA-qcf4-j55x-72hv]

=== 8.1.1

  • Security: refuse host keys marked @revoked in known_hosts, and certificates of such a key or signed by it, by raising the new Net::SSH::HostKeyRevoked, which remember_host! can't override; these lines were loaded as trusted keys, so every verifier except :never accepted the revoked key [GHSA-hjwv-j52r-xcg7]

=== 8.1.0

  • BREAKING: Publickey auth offers each RSA key and certificate once, with the first pubkey_algorithms entry the server lists in RFC 8308 server-sig-algs, as OpenSSH does, so refused RSA keys no longer use up MaxAuthTries two or three at a time. Servers that send no server-sig-algs (OpenSSH 7.1 and older, some other servers) are offered RSA keys only as ssh-rsa, and only when it's enabled (e.g. pubkey_algorithms: %w[+ssh-rsa]); by default RSA keys are skipped there instead of being tried with rsa-sha2-512/256; OpenSSH 7.2 to 9.5 servers that accept only ssh-rsa still list rsa-sha2-* in server-sig-algs, so they need ssh-rsa first (pubkey_algorithms: %w[^ssh-rsa]) [#886, #1077]
  • BREAKING: A Match block containing a condition net-ssh does not support (exec, canonical, final, localnetwork, tagged, ...) no longer matches and prints a warning, where the condition used to be ignored; Match User, OriginalHost and LocalUser are now evaluated, so e.g. Match User x Host y no longer applies to every user [#782, #1076]
  • BREAKING: Net::SSH.start no longer prompts for passwords, passphrases or keyboard-interactive responses when $stdin is not a TTY, matching OpenSSH; this fixes Errno::EPIPE in background jobs. Pass prompt_without_tty: true to prompt anyway, e.g. for a piped password [#967, #1073]
  • Package only lib, CHANGES.txt, LICENSE.txt and README.md in the gem, about 10% smaller. Thanks @​yuri-zubov #1081
  • Buffer#append now forces BINARY encoding so Channel#send_data chunks multibyte UTF-8 data by bytes instead of characters and no longer exceeds the remote maximum packet size [#1080, #1079]
  • The default password prompt runs the SSH_ASKPASS program when there is no terminal, following the OpenSSH SSH_ASKPASS_REQUIRE and DISPLAY rules #1075
  • Publickey and hostbased authentication now log key fingerprints using :fingerprint_hash (default SHA256) instead of MD5, fixing a crash with debug logging on FIPS-enabled OpenSSL [#936, #1074]

=== 8.0.4

  • Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as evil/x&$(cmd) ran cmd through the shell [GHSA-g2r2-x3p2-5677]

=== 8.0.3

  • Add preopen_channels option: keep a spare session channel open so each command saves a round trip #1071

=== 8.0.2

  • Fixed Session#close raising EOFError: cannot send data if channel has declared eof when a forwarded connection still had unread data from its local client; data net-ssh had already read is still sent before the EOF and, as in OpenSSH, the rest is dropped; a regression in 8.0.0 [#1066, #1067]

=== 8.0.1

  • Fixed unexpected packet type 94 during initial key exchange (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with rekey_limit, or after about 1 GB); a regression in 7.3.5 and 8.0.0 #1063
  • control_master: :auto now ignores forward_agent (logged at info level) instead of raising ArgumentError, and logs the ignored connection options at info instead of warn level, so it works with sshkit (Kamal, Capistrano), which always passes forward_agent: true, keys, known_hosts and keepalive #1062

=== 8.0.0

  • No changes since 8.0.0 rc5.

=== 8.0.0 rc5

  • BREAKING: Security: a custom verify_host_key verifier must now implement verify_signature (deprecated since 5.1.0) or ArgumentError is raised; such verifiers were previously wrapped so the server's host key signature was never checked #1050
  • BREAKING: Unsupported key types now raise Net::SSH::UnsupportedKeyType (a Net::SSH::Exception) instead of NotImplementedError; code that rescued NotImplementedError around key loading or connecting should rescue the new class [#945, #1060]
  • BREAKING: Net::SSH.start raises ArgumentError for option values that are nil or arrays containing nil (deprecated since 4.0.0); omit the option to use the default or ssh_config value, the error names a value that turns it off where one exists (e.g. proxy: false, keys: [], config: false). password: nil and passphrase: nil are still accepted [fix apache2 pid path for alpine #458, #1053]
  • BREAKING: removed the :paranoid option (deprecated since 4.2.0); use :verify_host_key with the same values. Passing :paranoid raises ArgumentError #1050
  • BREAKING: removed the verify_host_key values false, true, :very and :secure (deprecated since 5.0.0); use :never, :accept_new_or_local_tunnel, :accept_new and :always respectively. The old values raise ArgumentError naming the replacement #1050
  • BREAKING: Net::SSH::HostKeyEntries::PubKey (the known_hosts entries returned by KnownHosts.search_for) no longer forwards methods to the wrapped key (deprecated since 7.0.0); use ssh_type, to_blob or matches_key?, or the new key reader for the wrapped public key #1050
  • Security: append_all_supported_algorithms: true no longer enables the none cipher and MAC; name them explicitly (encryption: '+none', hmac: '+none') to use them #1051
  • Security: diffie-hellman-group-exchange-sha1/sha256 now requires groups of at least 2048 bits and requests sizes from the negotiated ciphers, as OpenSSH since 7.2, and rejects invalid server groups and DH public values; like OpenSSH, the requested group size is capped at 4096 bits for Cisco servers. Pass minimum_dh_bits: 1024 to connect to legacy servers that only offer 1024-bit groups. minimum_dh_bits values other than 1024 no longer fail key exchange with "could not verify server signature" #1049
  • Security: diffie-hellman-group14-sha1 is no longer offered by default for key exchange, as in OpenSSH since 8.2; add KexAlgorithms +diffie-hellman-group14-sha1 in ssh_config (or kex: '+diffie-hellman-group14-sha1') or pass append_all_supported_algorithms: true to re-enable [#705, #1042]

... (truncated)

Commits

Updates net-telnet from 0.1.1 to 0.2.0

Release notes

Sourced from net-telnet's releases.

v0.2.0

What's Changed

New Contributors

Full Changelog: ruby/net-telnet@v0.1.1...v0.2.0

Commits
  • 8a900c1 Bump version to 0.2.0
  • 385f683 Merge pull request #13 from k-tsj/eliminate-warning
  • d287427 Eliminate mismatched indentations warning
  • 0be4bc8 Merge pull request #10 from nicolasleger/test-ruby-versions
  • 32d23ad Test on new Ruby versions
  • 59d7151 Merge pull request #9 from hisas/add_license_to_gemspec
  • baa9bef Add license to gemspec
  • b9080a1 Merge pull request #7 from junaruga/feature/update-travis
  • 904e2ac Use Ruby 2.4.1, 2.3.4.
  • cac00fb Merge branch 'TiagoCardoso1983-io_wait'
  • Additional commits viewable in compare view

Updates rspec from 3.10.0 to 3.13.2

Commits

Updates rspec-expectations from 3.10.1 to 3.13.6

Changelog

Sourced ...

Description has been truncated

@dependabot
[TASK]: bump the serverspec group in /tests/serverspec with 16 updates
4a6af05 
Bumps the serverspec group in /tests/serverspec with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [rake](https://github.com/ruby/rake) | `13.0.3` | `13.4.2` |
| [rspec-core](https://github.com/rspec/rspec) | `3.10.1` | `3.13.6` |
| [serverspec](http://serverspec.org/) | `2.41.5` | `2.43.0` |
| [docker-api](https://github.com/upserve/docker-api) | `2.1.0` | `2.5.0` |
| [diff-lcs](https://github.com/halostatue/diff-lcs) | `1.4.4` | `1.6.2` |
| [excon](https://github.com/excon/excon) | `0.81.0` | `1.12.0` |
| [multi_json](https://github.com/sferik/multi_json) | `1.15.0` | `1.21.2` |
| [net-scp](https://github.com/net-ssh/net-scp) | `3.0.0` | `4.2.1` |
| [net-ssh](https://github.com/net-ssh/net-ssh) | `6.1.0` | `8.1.2` |
| [net-telnet](https://github.com/ruby/net-telnet) | `0.1.1` | `0.2.0` |
| [rspec](https://github.com/rspec/rspec) | `3.10.0` | `3.13.2` |
| [rspec-expectations](https://github.com/rspec/rspec) | `3.10.1` | `3.13.6` |
| [rspec-its](https://github.com/rspec/rspec-its) | `1.3.0` | `2.0.0` |
| [rspec-mocks](https://github.com/rspec/rspec) | `3.10.2` | `3.13.9` |
| [rspec-support](https://github.com/rspec/rspec) | `3.10.2` | `3.13.8` |
| [specinfra](https://github.com/mizzy/specinfra) | `2.82.25` | `2.95.2` |


Updates `rake` from 13.0.3 to 13.4.2
- [Release notes](https://github.com/ruby/rake/releases)
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc)
- [Commits](ruby/rake@v13.0.3...v13.4.2)

Updates `rspec-core` from 3.10.1 to 3.13.6
- [Changelog](https://github.com/rspec/rspec/blob/rspec-core-v3.13.7/rspec-core/Changelog.md)
- [Commits](https://github.com/rspec/rspec/commits/rspec-core-v3.13.6)

Updates `serverspec` from 2.41.5 to 2.43.0

Updates `docker-api` from 2.1.0 to 2.5.0
- [Release notes](https://github.com/upserve/docker-api/releases)
- [Commits](https://github.com/upserve/docker-api/commits)

Updates `diff-lcs` from 1.4.4 to 1.6.2
- [Changelog](https://github.com/halostatue/diff-lcs/blob/main/CHANGELOG.md)
- [Commits](halostatue/diff-lcs@v1.4.4...v1.6.2)

Updates `excon` from 0.81.0 to 1.12.0
- [Changelog](https://github.com/excon/excon/blob/master/changelog.txt)
- [Commits](excon/excon@v0.81.0...v1.12.0)

Updates `multi_json` from 1.15.0 to 1.21.2
- [Release notes](https://github.com/sferik/multi_json/releases)
- [Changelog](https://github.com/sferik/multi_json/blob/main/CHANGELOG.md)
- [Commits](sferik/multi_json@v1.15.0...v1.21.2)

Updates `net-scp` from 3.0.0 to 4.2.1
- [Changelog](https://github.com/net-ssh/net-scp/blob/master/CHANGES.txt)
- [Commits](net-ssh/net-scp@v3.0.0...v4.2.1)

Updates `net-ssh` from 6.1.0 to 8.1.2
- [Changelog](https://github.com/net-ssh/net-ssh/blob/master/CHANGES.txt)
- [Commits](net-ssh/net-ssh@v6.1.0...v8.1.2)

Updates `net-telnet` from 0.1.1 to 0.2.0
- [Release notes](https://github.com/ruby/net-telnet/releases)
- [Commits](ruby/net-telnet@v0.1.1...v0.2.0)

Updates `rspec` from 3.10.0 to 3.13.2
- [Commits](https://github.com/rspec/rspec/commits/rspec-v3.13.2)

Updates `rspec-expectations` from 3.10.1 to 3.13.6
- [Changelog](https://github.com/rspec/rspec/blob/rspec-expectations-v3.13.6/rspec-expectations/Changelog.md)
- [Commits](https://github.com/rspec/rspec/commits/rspec-expectations-v3.13.6)

Updates `rspec-its` from 1.3.0 to 2.0.0
- [Changelog](https://github.com/rspec/rspec-its/blob/main/Changelog.md)
- [Commits](rspec/rspec-its@v1.3.0...v2.0.0)

Updates `rspec-mocks` from 3.10.2 to 3.13.9
- [Changelog](https://github.com/rspec/rspec/blob/rspec-mocks-v3.13.9/rspec-mocks/Changelog.md)
- [Commits](https://github.com/rspec/rspec/commits/rspec-mocks-v3.13.9)

Updates `rspec-support` from 3.10.2 to 3.13.8
- [Changelog](https://github.com/rspec/rspec/blob/rspec-support-v3.13.8/rspec-support/Changelog.md)
- [Commits](https://github.com/rspec/rspec/commits/rspec-support-v3.13.8)

Updates `specinfra` from 2.82.25 to 2.95.2
- [Release notes](https://github.com/mizzy/specinfra/releases)
- [Commits](mizzy/specinfra@v2.82.25...v2.95.2)

---
updated-dependencies:
- dependency-name: rake
  dependency-version: 13.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: rspec-core
  dependency-version: 3.13.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: serverspec
  dependency-version: 2.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: docker-api
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: diff-lcs
  dependency-version: 1.6.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: excon
  dependency-version: 1.12.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: serverspec
- dependency-name: multi_json
  dependency-version: 1.21.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: net-scp
  dependency-version: 4.2.1
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: serverspec
- dependency-name: net-ssh
  dependency-version: 8.1.2
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: serverspec
- dependency-name: net-telnet
  dependency-version: 0.2.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: rspec
  dependency-version: 3.13.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: rspec-expectations
  dependency-version: 3.13.6
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: rspec-its
  dependency-version: 2.0.0
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: serverspec
- dependency-name: rspec-mocks
  dependency-version: 3.13.9
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: rspec-support
  dependency-version: 3.13.8
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
- dependency-name: specinfra
  dependency-version: 2.95.2
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: serverspec
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Nov 11, 2026
@sonarqubecloud

sonarqubecloud Bot commented Nov 11, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Kanti Kanti mentioned this pull request Nov 11, 2026
Draft
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants