Skip to content

Bump json from 2.18.1 to 2.19.2 in /ruby#552

Closed
dependabot[bot] wants to merge 704 commits intomasterfrom
dependabot/bundler/ruby/json-2.19.2
Closed

Bump json from 2.18.1 to 2.19.2 in /ruby#552
dependabot[bot] wants to merge 704 commits intomasterfrom
dependabot/bundler/ruby/json-2.19.2

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Mar 19, 2026

Bumps json from 2.18.1 to 2.19.2.

Release notes

Sourced from json's releases.

v2.19.2

What's Changed

  • Fix a format string injection vulnerability in JSON.parse(doc, allow_duplicate_key: false). CVE-2026-33210

Full Changelog: ruby/json@v2.19.1...v2.19.2

v2.19.1

What's Changed

  • Fix a compiler dependent GC bug introduced in 2.18.0.

Full Changelog: ruby/json@v2.19.0...v2.19.1

v2.19.0

What's Changed

  • Fix allow_blank parsing option to no longer allow invalid types (e.g. load([], allow_blank: true) now raise a type error).
  • Add allow_invalid_escape parsing option to ignore backslashes that aren't followed by one of the valid escape characters.

Full Changelog: ruby/json@v2.18.1...v2.19.0

Changelog

Sourced from json's changelog.

2026-03-18 (2.19.2)

  • Fix a format string injection vulnerability in JSON.parse(doc, allow_duplicate_key: false). CVE-2026-33210.

2026-03-08 (2.19.1)

  • Fix a compiler dependent GC bug introduced in 2.18.0.

2026-03-06 (2.19.0)

  • Fix allow_blank parsing option to no longer allow invalid types (e.g. load([], allow_blank: true) now raise a type error).
  • Add allow_invalid_escape parsing option to ignore backslashes that aren't followed by one of the valid escape characters.
Commits
  • 54f8a87 Release 2.19.2
  • 393b41c Fix a format string injection vulnerability
  • dbf6bb1 Merge pull request #953 from ruby/dependabot/github_actions/actions/create-gi...
  • 7187315 Bump actions/create-github-app-token from 2 to 3
  • 4a42a04 Release 2.19.1
  • 13689c2 Add missing GC_GUARD in fbuffer_append_str
  • a11acc1 Release 2.19.0
  • 0a4fb79 fbuffer.h: Use size_t over unsigned long
  • a29fcdc Add depth validation to Jruby and TruffleRuby implementations
  • de993aa Reject negative depth; add overflow guards to prevent hang/crash
  • Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

PriyankRandomly and others added 30 commits June 21, 2022 15:34
This reverts commit f5eeac6.
Revert "Update Dockerfile"
link to tiny quickstart
EUWECRY-1084: Refactor Quickstart app for UK/EU payment initiation
Removes [got](https://github.com/sindresorhus/got). It's no longer used after updating ancestor dependency [nodemon](https://github.com/remy/nodemon). These dependencies need to be updated together.


Removes `got`

Updates `nodemon` from 2.0.5 to 2.0.20
- [Release notes](https://github.com/remy/nodemon/releases)
- [Commits](remy/nodemon@v2.0.5...v2.0.20)

---
updated-dependencies:
- dependency-name: got
  dependency-type: indirect
- dependency-name: nodemon
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [shell-quote](https://github.com/ljharb/shell-quote) to 1.7.3 and updates ancestor dependency [react-scripts](https://github.com/facebook/create-react-app/tree/HEAD/packages/react-scripts). These dependencies need to be updated together.


Updates `shell-quote` from 1.7.2 to 1.7.3
- [Release notes](https://github.com/ljharb/shell-quote/releases)
- [Changelog](https://github.com/ljharb/shell-quote/blob/main/CHANGELOG.md)
- [Commits](ljharb/shell-quote@v1.7.2...1.7.3)

Updates `react-scripts` from 4.0.1 to 5.0.1
- [Release notes](https://github.com/facebook/create-react-app/releases)
- [Changelog](https://github.com/facebook/create-react-app/blob/main/CHANGELOG-4.x.md)
- [Commits](https://github.com/facebook/create-react-app/commits/react-scripts@5.0.1/packages/react-scripts)

---
updated-dependencies:
- dependency-name: shell-quote
  dependency-type: indirect
- dependency-name: react-scripts
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
…nd-nodemon--removed

Bump got and nodemon in /node
Bumps [rack](https://github.com/rack/rack) from 2.2.3 to 2.2.4.
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@2.2.3...2.2.4)

---
updated-dependencies:
- dependency-name: rack
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…hell-quote-and-react-scripts-1.7.3

Bump shell-quote and react-scripts in /frontend
Bumps [minimist](https://github.com/minimistjs/minimist) from 1.2.5 to 1.2.7.
- [Release notes](https://github.com/minimistjs/minimist/releases)
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.5...v1.2.7)

---
updated-dependencies:
- dependency-name: minimist
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.14.7 to 1.15.2.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.14.7...v1.15.2)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…ollow-redirects-1.15.2

Bump follow-redirects from 1.14.7 to 1.15.2 in /frontend
…inimist-1.2.7

Bump minimist from 1.2.5 to 1.2.7 in /frontend
phoenixy1 and others added 21 commits December 19, 2025 10:08
Changed all instances of itemID to itemId to follow Java camelCase convention consistently with other variables like userId, accessToken, etc.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
The compiled go/server binary (22MB) should not be tracked in git.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Node.js: 40.0.0 → 41.0.0
- Python: 37.1.0 → 38.0.0
- Go: 40.1.0 → 41.0.0 (updated import path from v40 to v41)
- Java: 38.1.0 → 39.0.0
- Ruby: 44.1.0 → 45.0.0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Add support for new user APIs (see https://plaid.com/docs/api/users/user-apis/)
- Bump dependencies
frontend:
- Update plaid to ^41.1.0 (from ^39.1.0)
- Update plaid-threads to ^14.5.0 (from ^11.2.3)
- Apply safe minor/patch updates to testing libraries, sass, immer

node:
- Update plaid to ^41.1.0 (from ^41.0.0)
- Update express to ^4.22.1
- Update dotenv, nodemon, body-parser, cors
- Apply safe minor/patch updates

Testing: Installation and build tests passed

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Python: plaid_python 38.0.0 → 38.1.0
- Java: plaid-java 39.0.0 → 39.1.0
- Ruby: plaid 45.0.0 → 45.1.0
- Go: already at 41.0.0 (latest)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Python (python/requirements.txt):
- Update plaid_python 38.0.0 -> 38.1.0
- Update werkzeug 3.1.4 -> 3.1.5

Ruby (ruby/Gemfile.lock):
- Update plaid 45.0.0 -> 45.1.0
- Update puma 7.1.0 -> 7.2.0
- Update tilt 2.6.1 -> 2.7.0
- Update public_suffix 7.0.0 -> 7.0.2

Java (java/pom.xml):
- Update plaid-java 39.0.0 -> 39.1.0
- Update jaxb-api 2.3.1 -> 2.4.0
- Update jaxb-impl 2.3.9 -> 2.4.0

Go (go/go.mod):
- Update plaid-go/v41 41.0.0 -> 41.1.0
- Update sonic 1.14.2 -> 1.15.0
- Update quic-go 0.58.0 -> 0.59.0
- Update various golang.org/x/* packages

Testing: All SDKs updated to latest versions

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
- Python: 3.12-alpine → 3.12.12-alpine
- Ruby: 3.3 → 3.3.10
- Go: 1.24 → 1.24.13
- Maven/JDK: 3.9-eclipse-temurin-21 → 3.9.12-eclipse-temurin-21
- Node: 20-alpine → 20.20.0-alpine

All patch-level updates within same minor versions for stability.

Testing: Python and Node containers build successfully

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Run npm update to update all dependencies within their semver ranges.
This updates axios from 1.13.2 to 1.13.5, which includes security fixes
for a Denial of Service vulnerability via __proto__ key in mergeConfig.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
When Docker support was added, Docker Desktop was free. It no longer is
for commercial use, which has significantly reduced usage. Additionally,
users were confused thinking Docker was required to run the quickstart.
Removing Docker files and updating the README to present native language
execution as the single, straightforward path.
Remove Docker support from quickstart
Fix formatting in README.md for Credit Quickstart link
Clarify the description of the main Plaid Quickstart and add links to additional resources.
Bumps [json](https://github.com/ruby/json) from 2.18.1 to 2.19.2.
- [Release notes](https://github.com/ruby/json/releases)
- [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md)
- [Commits](ruby/json@v2.18.1...v2.19.2)

---
updated-dependencies:
- dependency-name: json
  dependency-version: 2.19.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Mar 19, 2026
@phoenixy1
Copy link
Copy Markdown
Collaborator

Closing — Gemfile.lock already has json 2.19.3 (newer than the 2.19.2 target).

@phoenixy1 phoenixy1 closed this Apr 23, 2026
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 23, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/bundler/ruby/json-2.19.2 branch April 23, 2026 00:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.