[dependabot]

Bumps the bundler group with 5 updates in the /hub directory:

Package	From	To
actionmailbox	8.1.4	8.1.4.1
actionpack	8.1.4	8.1.4.1
activestorage	8.1.4	8.1.4.1
activesupport	8.1.4	8.1.4.1
nokogiri	1.19.4	1.19.7

Updates actionmailbox from 8.1.4 to 8.1.4.1

Release notes

Sourced from actionmailbox's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from actionmailbox's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Reject Mailgun inbound emails whose timestamp is more than 2 minutes ahead of local time.

  [GHSA-5957-c7qm-m469]

  Mike Dalessio

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• c3a295c Reject Mailgun timestamps from the future
• See full diff in compare view

Updates actionpack from 8.1.4 to 8.1.4.1

Release notes

Sourced from actionpack's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from actionpack's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Apply config.action_dispatch.cookies_same_site_protection to every session store.

  ActionDispatch::Session::CacheStore, MemCacheStore and third-party stores built on AbstractStore or the session mixins sent session cookies with no SameSite attribute. Only CookieStore applied the configured default.

  [GHSA-gmj8-hvj3-49mw]

  Jean Boussier

• Prevent ActionController::Live streams from blocking when a full buffer is closed or aborted.

  [GHSA-rwvh-fw6r-pwvp]

  Jeremy Daer

• Set and extend the Vary header for rendered responses according to the request headers used in format negotiation.

  Vary: Accept was only added when the request carried a usable Accept header. A response to a request without one, negotiated to HTML or JavaScript, could be stored by a shared cache and served to later clients that requested a different representation.

  Responses now vary on Accept and X-Requested-With whenever the format is not given by the URL. XHR requests without Accept also vary on Content-Type, which Rails uses as a legacy format fallback. When config.action_dispatch.ignore_accept_header is enabled, responses vary only on X-Requested-With.

  These fields are appended to an existing Vary value without duplicating fields case-insensitively. Vary: * remains unchanged.

  [GHSA-r9jg-fmfx-2gv6]

  Jeremy Daer

• Skip writing a CacheStore session that another request deleted while this one ran.

  A request that loaded a session from ActionDispatch::Session::CacheStore wrote it back when it finished, even after a concurrent reset_session or a server-side delete had removed it, so the old session ID worked again.

  [GHSA-2586-8ghr-69fj]

... (truncated)

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 2d9f502 Apply cookies_same_site_protection to every session store
• ccbfc09 Avoid blocking Live buffer termination
• 7a955ca Vary rendered responses by negotiation headers
• d479192 Skip writing a CacheStore session deleted mid-request
• 849a6c3 Don't write upgraded cookies to a response that skips the session
• 2a01a5a Detect conflicts in Forwarded and X-Forwarded-For in ActionDispatch::RemoteIp
• 8ba746e Return self from Parameters#each_key with a block
• See full diff in compare view

Updates activestorage from 8.1.4 to 8.1.4.1

Release notes

Sourced from activestorage's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from activestorage's changelog.

Rails 8.1.4.1 (November 03, 2026)

• Preserve committed proxy responses when a storage error interrupts a streamed download.

  [GHSA-4v2w-w6g6-f8f8]

  Jeremy Daer

• Derive ActiveStorage::Filename#base and #extension from the sanitized filename.

  This prevents null bytes and invalid byte sequences in stored filename metadata from raising when a blob is opened or represented. Existing blob records are handled without a data migration.

  [GHSA-p2pm-g2h6-7j5j]

  Jeremy Daer

• Ship an ImageMagick security policy and apply it to every ImageMagick process MiniMagick spawns.

  ImageMagick chooses a coder from the content of the file it is given, and some coders act on files named inside the image rather than on the image itself. Active Storage constrained none of them, so an uploaded file could reach any coder the host's policy allowed, through the ImageMagick analyzer at attach time, with no variant or analyze call in the application.

  Active Storage now ships a policy.xml in ActiveStorage::ImageMagick::POLICY_DIRECTORY and prepends that directory to MAGICK_CONFIGURE_PATH through MiniMagick.cli_env. ImageMagick applies every policy file on its search path, so the shipped policy adds to the host's policy rather than replacing it. A MAGICK_CONFIGURE_PATH set in the environment or in MiniMagick.cli_env, including by an initializer or dotenv, is kept after the shipped directory.

  The shipped policy denies the coders that script ImageMagick (MSL), read or delete files other than the image (TEXT, EPHEMERAL), fetch remote references (URL, HTTP, HTTPS, FTP), display to a screen (SHOW, WIN, PLT), or hand the file to Ghostscript (the PS, EPS, EPT and PDF coders, every alias of them, and the gs delegate), or reach a file directly (FILE, MPC, XPS, PCL), and it refuses @filename indirection. The policy applies to every ImageMagick command MiniMagick runs, not only Active Storage's.

  These applications must act:

  • One whose variant processor is :mini_magick has to use mini_magick 5.1 or later, which applying the policy requires. With an older mini_magick,

... (truncated)

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 3c67a69 Preserve committed Active Storage streams after errors
• 60f22af Sanitize Active Storage filename parts
• 849a6c3 Don't write upgraded cookies to a response that skips the session
• 468aa9a Ship an ImageMagick security policy for every MiniMagick process
• e19916c Enforce the content length on GCS direct uploads
• 8d93f6a Sign GCS direct uploads with V2 when cache_control is set
• 72136ff Active Storage: tempfile extension must match the blob's content type
• 3b1f262 Restrict the formats ffmpeg and ffprobe may open
• See full diff in compare view

Updates activesupport from 8.1.4 to 8.1.4.1

Release notes

Sourced from activesupport's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 8.1.4.1 (November 03, 2026)

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 4ca0906 ActiveSupport::MessagePack preserve SafeBuffer html_safe status
• 95aa9e4 Avoid dynamic regexp in safe_constantize LoadError handling
• See full diff in compare view

Updates nokogiri from 1.19.4 to 1.19.7

Release notes

Sourced from nokogiri's releases.

v1.19.7 / 2026-11-02

Fixed

• [CRuby] Compile against Ruby 4.1.0-preview1, which defines HAVE_RB_LEN_T but not RB_FIX2LEN. (#3755) @​andrewfader

8f5e15d299602456406e1f03a9f3456cceb33a0722811e818d2ee2214eb4c84a  nokogiri-1.19.7-aarch64-linux-gnu.gem
efe0c3602e6e54521bc21c681930ce5568e2d11203de17400710b2b3ca2e4cb4  nokogiri-1.19.7-aarch64-linux-musl.gem
7fd1907125691aa89e838cc91161761c758b4e17bb32f0dd9b5515a82cc759af  nokogiri-1.19.7-arm-linux-gnu.gem
28d0ff0c87b6bb2e56580323a6fb049d5d4a02b94f0958fdd47e9ac146991c77  nokogiri-1.19.7-arm-linux-musl.gem
f27d7f25f4873fbc3aa35a2cc2fb680c98555fec1925348da439d0869d541142  nokogiri-1.19.7-arm64-darwin.gem
3c97c2874993b890386ac487c41578d173e10621d80c2063830d032839487c3b  nokogiri-1.19.7-java.gem
9ab6ea96ab479a5ff391196de73b5abf660926ea7e4c57cb1f35adf754f1d066  nokogiri-1.19.7-x64-mingw-ucrt.gem
508e81e8c5f84aaa240dce981bf1c43faae60808726f0ce7024ee92effc5cafe  nokogiri-1.19.7-x86_64-darwin.gem
25865ccb462f714e712fdf8906fde07849cb6704a808e3d629d75baa5af5dd3b  nokogiri-1.19.7-x86_64-linux-gnu.gem
464d1f3dfb0d53cf54c0c6a7e23e8e91cf68ec3cafc2b27dc4a7682f2d9bf546  nokogiri-1.19.7-x86_64-linux-musl.gem
abe94507c54cb18f872777b16bdca4aad32b1abdc4c52fe843f1c80fbdf992b8  nokogiri-1.19.7.gem

---

Full Changelog: sparklemotion/nokogiri@v1.19.6...v1.19.7

v1.19.6 / 2026-11-02

Fixed

• [JRuby] Parsing or reparenting an HTML4 element that has an xmlns attribute and a child element no longer raises NullPointerException. This was a regression in v1.19.5. (#3753) @​flavorjones

746fca23be3cd3f121cabab65cb44c52049e4cf9f0d36e7e8c3c0eb6cc298c57  nokogiri-1.19.6-aarch64-linux-gnu.gem
4a5620da1c52150e0343bd2bba7dbd9b3899b5eb41687dc1942c9092d81e52a3  nokogiri-1.19.6-aarch64-linux-musl.gem
574e50ddd99ed71aaa868027d84eb3b9f051e55fe07ddc844e4fdd654be953fc  nokogiri-1.19.6-arm-linux-gnu.gem
c20ea8d8c92cbaa475f0952f755dea88cf6e3ace8b49d634a0a5385a1feaea10  nokogiri-1.19.6-arm-linux-musl.gem
0a89005ba8cf40c7bd580f4c0873f5f11e5866a99e364764fb59ac6516f560d0  nokogiri-1.19.6-arm64-darwin.gem
4068744c2afb9c2596666a5b02fe633be1c58abb3bf2c9d06c962ede95c55fba  nokogiri-1.19.6-java.gem
b5768c5dab09abe39e6e1329f692db191688398964f7d2c18caaa19aa00f5421  nokogiri-1.19.6-x64-mingw-ucrt.gem
8f15f820fa1373d8685ae48cdd8020d923b4104db74d149d1235ddae956469a6  nokogiri-1.19.6-x86_64-darwin.gem
ad1e228c3bc873e4f4fc4f845d7e37b4d3648af537acd7b5e8463cce5693065b  nokogiri-1.19.6-x86_64-linux-gnu.gem
c92b29e897f4ddc19bea67188695aab667f695e74592a5c8741642ecb25d34d9  nokogiri-1.19.6-x86_64-linux-musl.gem
a61e7192fc2691c23bc0241907c4dbcb70ada6ab904796ce2426a57171022c8f  nokogiri-1.19.6.gem
</tr></table> 

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.7 / 2026-11-02

Fixed

• [CRuby] Compile against Ruby 4.1.0-preview1, which defines HAVE_RB_LEN_T but not RB_FIX2LEN. (#3755) @​andrewfader

v1.19.6 / 2026-11-02

Fixed

• [JRuby] Parsing or reparenting an HTML4 element that has an xmlns attribute and a child element no longer raises NullPointerException. This was a regression in v1.19.5. (#3753) @​flavorjones

v1.19.5 / 2026-11-01

Security

• [CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via Node#[]= or Node#lang= while Ruby objects still reference the attribute's children. See GHSA-3w22-6jfg-527w for more information.
• [CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless the document was parsed with parse_noscript_content_as_text: true, preventing a mutation XSS in applications that allow noscript in sanitized HTML. A fragment now parses noscript content the same way as its document, and raises ArgumentError if given a conflicting parse_noscript_content_as_text: value. Comments and raw-text elements inside noscript are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true or remove noscript elements. See GHSA-4p39-36wj-23h4 for more information.
• [JRuby] (Low) NONET now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as 127.1, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with DTDLOAD or NOENT, potentially enabling SSRF. See GHSA-v995-44v6-5fqm for more information.

Improved

• [CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (#3393) @​flavorjones
• [CRuby] Improved XPath argument marshalling performance by using ALLOCV_N instead of rb_gc_register_address. (#3648) @​jhawthorn

Fixed

• Node#namespace= now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from Node#namespace_definitions. (#3459, #3462) @​flavorjones
• XML::Reader is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (#3694) @​flavorjones
• Node#namespace = false now raises TypeError. Previously it crashed the process on CRuby and raised ClassCastException on JRuby. (#3719) @​flavorjones
• XML::XPathContext.new and XML::XPathContext#node= raise TypeError when the argument is not a Node. Previously, on CRuby, most such arguments crashed the process. (#3720) @​flavorjones
• CSS an+b selectors with a zero or negative step now follow the Selectors spec: :nth-child(0n+3) matches only the third element (previously nothing), 0n-1 matches nothing instead of raising ZeroDivisionError, and -n+0 / -2n match nothing instead of every (or every other) element. @​afurm
• CSS #id, .class and attribute selectors whose value contains a quote character, such as #it\'s or [a=\'b\'], now match that value. Previously they raised Nokogiri::XML::XPath::SyntaxError or generated an XPath query with a different meaning. An #id selector containing an escaped newline no longer drops the text after it. (#3724, #3727) @​flavorjones
• CSS :contains() arguments, custom pseudo-class string arguments, and element names containing a CSS escape, such as p:contains('it\'s') or a\-b, now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An element name that is not an XML name after unescaping, such as a\!b, raises Nokogiri::CSS::SyntaxError, except as an unprefixed name in an HTML5 document, where it matches by local name. In ids, classes, attribute values, element names and string arguments, an escape for U+0000, a surrogate, or a code point above U+10FFFF now decodes to U+FFFD, and a vertical tab after a hexadecimal escape is no longer dropped, as CSS Syntax Level 3 requires. (#3728, #3729) @​flavorjones
• CSS attribute names containing a CSS escape, such as [a\-b], now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An unprefixed attribute name that cannot be written as an XPath name test after unescaping, such as [\@click] or [\:class], matches an attribute with that exact name in no namespace. The HTML parsers create such attributes. A prefixed one, such as [x|a\!b], raises Nokogiri::CSS::SyntaxError. (#3732, #3735) @​flavorjones
• [CRuby] The HTML5 serializer escapes < and > in attribute values as < and >, following whatwg/html#6362. Previously they were written literally. (#3529, #3741) @​flavorjones
• [CRuby] Reparenting removes a node's declaration of a prefix that the new parent binds to the same URI. (#3462) @​flavorjones
• [CRuby] Builder now correctly builds namespaced nodes that define their own namespace when that ns prefix collides with one defined by the parent (or another ancestor). (#3458, #3461) @​flavorjones
• [CRuby] Reader.outer_xml and .inner_xml properly capture syntax errors. (#3558) @​flavorjones
• [CRuby] XML::SAX::PushParser and HTML4::SAX::PushParser keep parsing correctly after GC compaction relocates their SAX parser. (#3665) @​zanker
• [CRuby] XML::Reader keeps reading correctly when GC compaction runs. Previously, compaction could move the IO or String the reader was created from, and the reader then crashed or parsed the wrong bytes. (#3666, #3668) @​zanker
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs. Previously, after compaction moved a stylesheet that uses an extension module, a later transform raised an exception or crashed. (#3667) @​jeremy
• [CRuby] XSLT::Stylesheet#transform passes the correct params when GC compaction runs while it converts a param with #to_str. Previously, compaction could move the bytes of earlier short params, and the transform raised RuntimeError or silently left a param empty. (#3670) @​flavorjones
• [CRuby] XML::SAX::ParserContext.io and HTML4::SAX::ParserContext.io keep parsing correctly after GC compaction relocates the IO. (#3669) @​zanker
• [CRuby] Document#canonicalize passes the correct inclusive namespace prefixes when it converts a prefix with #to_str, and when GC compaction runs during canonicalization. Previously, libxml2 could read freed or moved memory, and the output lost namespaces or Ruby crashed. Raising on a prefix with a null byte also no longer leaks memory. (#3714, #3750) @​Priyank-gouda678 @​flavorjones
• [CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs during the transform. Previously, compaction could move an extension handler instance, and a later call to one of its functions raised an exception or crashed. (#3748) @​flavorjones

... (truncated)

Commits

• cb8cd03 version bump to v1.19.7
• 51ffdd7 Merge pull request #3756 from sparklemotion/card-940-rb-fix2len-preview1-v1-19-x
• 0ad11d1 doc: say Ruby 4.1.0-preview1 lacks only RB_FIX2LEN
• d884dcf Define RB_NUM2LEN and RB_FIX2LEN independently of HAVE_RB_LEN_T
• b0702e6 version bump to v1.19.6
• 9d2cf65 Merge pull request #3754 from sparklemotion/card-936-jruby-relink-namespace-n...
• cbb5855 fix(jruby): avoid NPE on HTML4 elements with an xmlns attribute
• 724ef47 version bump to v1.19.5
• 60e801b Merge pull request #3752 from sparklemotion/card-931-v1-19-5-backport
• ce1a138 ci: bump ruby/setup-ruby to v1.335.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[UserArham]

Cool.