hobbypunk/rails-base_app

Watch

Fork 2

chore(deps): update dependency image_processing to v2 #73

Merged

hobbypunk merged 1 commit from renovate/image_processing-2.x into main

2026-09-28 14:37:50 +00:00

renovate commented

2026-09-28 14:32:24 +00:00

Collaborator

This PR contains the following updates:

Package	Change	Age	Confidence
image_processing (changelog)	`"~> 1.2"` → `"~> 2.0"`

Release Notes

janko/image_processing (image_processing)

`v2.1.0`

Compare Source

[minimagick] Add inherit_fds: so a loader can name an already-open input (thanks to @flavorjones)

`v2.0.3`

Compare Source

Prevent remote code execution when operation names come from user input, closing bypasses through the #operation meta-builder, #method_missing, and nested #send calls (reported by @szymonsec)
[minimagick] Prevent remote code execution through unsafe public methods (e.g. #instance_eval, #send) passed as loader/saver option names

`v2.0.2`

Compare Source

Raise LoadError instead of ImageProcessing::Error when soft dependencies are missing (@bdewater-thatch)

`v2.0.1`

Compare Source

[minimagick] Prevent remote shell execution when passing loader/saver options from user input

`v2.0.0`

Compare Source

mini_magick/ruby-vips are now soft dependencies and need to be manually added to the Gemfile (@janko)
Avoid remote shell execution vulnerability in #apply when arguments are coming from user input (@janko)
[vips] Unfuzzed loaders are now blocked by default (@janko)
[vips] Sharpening after resize has been disabled by default (@janko)
[minimagick] Remove deprecated :compose and :geometry keyword arguments for #composite (@janko)
Ruby 3.0+ is now required (@janko)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [image_processing](https://github.com/janko/image_processing) ([changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)) | `"~> 1.2"` → `"~> 2.0"` | ![age](https://developer.mend.io/api/mc/badges/age/rubygems/image_processing/2.1.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/image_processing/1.14.0/2.1.0?slim=true) | --- ### Release Notes <details> <summary>janko/image_processing (image_processing)</summary> ### [`v2.1.0`](https://github.com/janko/image_processing/blob/HEAD/CHANGELOG.md#210-2026-09-01) [Compare Source](https://github.com/janko/image_processing/compare/v2.0.3...v2.1.0) - \[minimagick] Add `inherit_fds:` so a loader can name an already-open input (thanks to [@flavorjones](https://github.com/flavorjones)) ### [`v2.0.3`](https://github.com/janko/image_processing/blob/HEAD/CHANGELOG.md#203-2026-08-06) [Compare Source](https://github.com/janko/image_processing/compare/v2.0.2...v2.0.3) - Prevent remote code execution when operation names come from user input, closing bypasses through the `#operation` meta-builder, `#method_missing`, and nested `#send` calls (reported by [@szymonsec](https://github.com/szymonsec)) - \[minimagick] Prevent remote code execution through unsafe public methods (e.g. `#instance_eval`, `#send`) passed as loader/saver option names ### [`v2.0.2`](https://github.com/janko/image_processing/blob/HEAD/CHANGELOG.md#202-2026-06-03) [Compare Source](https://github.com/janko/image_processing/compare/v2.0.1...v2.0.2) - Raise `LoadError` instead of `ImageProcessing::Error` when soft dependencies are missing ([@bdewater-thatch](https://github.com/bdewater-thatch)) ### [`v2.0.1`](https://github.com/janko/image_processing/blob/HEAD/CHANGELOG.md#201-2026-05-22) [Compare Source](https://github.com/janko/image_processing/compare/v2.0.0...v2.0.1) - \[minimagick] Prevent remote shell execution when passing loader/saver options from user input ### [`v2.0.0`](https://github.com/janko/image_processing/blob/HEAD/CHANGELOG.md#200-2026-05-20) [Compare Source](https://github.com/janko/image_processing/compare/v1.14.0...v2.0.0) - `mini_magick`/`ruby-vips` are now soft dependencies and need to be manually added to the Gemfile ([@janko](https://github.com/janko)) - Avoid remote shell execution vulnerability in `#apply` when arguments are coming from user input ([@janko](https://github.com/janko)) - \[vips] Unfuzzed loaders are now blocked by default ([@janko](https://github.com/janko)) - \[vips] Sharpening after resize has been disabled by default ([@janko](https://github.com/janko)) - \[minimagick] Remove deprecated `:compose` and `:geometry` keyword arguments for `#composite` ([@janko](https://github.com/janko)) - Ruby 3.0+ is now required ([@janko](https://github.com/janko)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

renovate added 1 commit

2026-09-28 14:32:24 +00:00

chore(deps): update dependency image_processing to v2

renovate/stability-days Updates have met minimum release age requirement

Details

PR Triage / triage (pull_request) Successful in 59s

Details

CI / scan_ruby (pull_request) Successful in 1m53s

Details

CI / lint (pull_request) Successful in 2m1s

Details

CI / test (pull_request) Successful in 2m33s

Details

CI / system-test (pull_request) Successful in 2m41s

Details

CI / coverage (pull_request) Successful in 47s

Details

f0fc4cda99

forgejo-actions added the

dependency

label

2026-09-28 14:32:59 +00:00

forgejo-actions commented

2026-09-28 14:35:50 +00:00

📊 Coverage

Metrik	Abdeckung
Zeilen	97.69% (2619/2681)
Branches	81.46% (637/782)
Methoden	96.95% (413/426)

Patch-Coverage: keine getrackten Zeilen geändert

Schwächste Dateien im Projekt

Datei	Abdeckung
app/models/concerns/has_uuid_v7.rb	54.55%
app/components/form/select.rb	72.41%
app/components/layout/flash.rb	84.0%
app/components/concerns/actionable.rb	86.67%
app/components/layout/sidebar.rb	89.47%
app/controllers/settings/security_controller.rb	90.24%
app/controllers/sessions_controller.rb	90.32%
app/components/concerns/inferrable.rb	90.63%
app/components/users/avatar.rb	91.23%
app/controllers/settings/security/otps_controller.rb	91.67%

🔍 Report im Browser ansehen · 📄 Run-Artifact „coverage-report“

## 📊 Coverage | Metrik | Abdeckung | |---|---| | Zeilen | 97.69% (2619/2681) | | Branches | 81.46% (637/782) | | Methoden | 96.95% (413/426) | **Patch-Coverage**: keine getrackten Zeilen geändert **Schwächste Dateien im Projekt** | Datei | Abdeckung | |---|---| | app/models/concerns/has_uuid_v7.rb | 54.55% | | app/components/form/select.rb | 72.41% | | app/components/layout/flash.rb | 84.0% | | app/components/concerns/actionable.rb | 86.67% | | app/components/layout/sidebar.rb | 89.47% | | app/controllers/settings/security_controller.rb | 90.24% | | app/controllers/sessions_controller.rb | 90.32% | | app/components/concerns/inferrable.rb | 90.63% | | app/components/users/avatar.rb | 91.23% | | app/controllers/settings/security/otps_controller.rb | 91.67% | [🔍 Report im Browser ansehen](https://pages.hoppe-dev.eu/hobbypunk/rails-base_app/pr-73/coverage) · [📄 Run-Artifact „coverage-report“](https://code.hoppe-dev.eu/hobbypunk/rails-base_app/actions/runs/1757/artifacts/coverage-report)