build(deps): bump rubocop from 1.88.0 to 1.88.2 in /dependencies by dependabot[bot] · Pull Request #72 · step-security/super-linter

dependabot · 2026-07-08T22:34:16Z

Bumps rubocop from 1.88.0 to 1.88.2.

Release notes

RuboCop v1.88.2

Bug fixes

#15417: Fix a false negative for Lint/ToJSON, which did not flag singleton def self.to_json definitions. (@bbatsov)

#15418: Fix a false negative for Lint/UnreachableCode, which only flagged the first statement after a flow-of-control statement instead of every unreachable statement that followed it. (@bbatsov)

#15416: Fix a false negative for Lint/UselessNumericOperation, which only flagged bare method-call receivers and ignored local variables, instance/class/global variables, and constants (e.g. @x + 0, CONST * 1). (@bbatsov)

#15419: Fix a false negative for Lint/Void where safe-navigation calls to nonmutating methods (e.g. x&.sort) were not flagged when CheckForMethodsWithNoSideEffects is enabled. (@bbatsov)

#15421: Fix a false negative for Style/ArrayIntersect with the block form using include? (e.g. array1.any? { |e| array2.include?(e) }), which was only detected for member?. (@bbatsov)

#15420: Fix a false negative for Style/CollectionCompact, which did not flag grep_v(nil)/grep_v(NilClass) on a safe-navigation call (e.g. array&.grep_v(nil)). (@bbatsov)

#15422: Fix a false negative for Style/DefWithParentheses with a single-line definition whose body follows a semicolon (e.g. def foo(); end), where the parentheses can be safely omitted. (@bbatsov)

#15388: Fix a false negative for Style/MixinUsage when including multiple modules in one statement. (@bbatsov)

#15388: Fix a false negative for Style/ModuleFunction when the module body is a single statement. (@bbatsov)

#15388: Fix a false negative for Style/RedundantCurrentDirectoryInPath with double-quoted strings containing interpolation. (@bbatsov)

#15395: Fix a false negative for Style/RedundantHeredocDelimiterQuotes with double-quoted delimiters whose body contains interpolation or escapes. (@bbatsov)

#15409: Fix a false positive for Gemspec/DuplicatedAssignment with multiple specifications. (@bbatsov)

#15403: Fix a false positive for Layout/CommentIndentation with a comment above an inline access modifier (e.g. private def foo) when Layout/AccessModifierIndentation is configured with EnforcedStyle: outdent. (@grk)

#15372: Fix a false positive for Style/InvertibleUnlessCondition with a multi-statement begin condition. (@bbatsov)

#15360: Fix an incorrect autocorrect for Style/ArgumentsForwarding and Style/MethodDefParentheses when autocorrection conflicts while adding parentheses to method definition arguments. (@koic)

#15417: Fix an incorrect autocorrect for Lint/ToJSON that produced invalid Ruby (def to_json(*_args)()) when the method had explicit empty parentheses. (@bbatsov)

#15426: Fix an incorrect autocorrect for Style/MethodCallWithoutArgsParentheses when empty parentheses span multiple lines and the method call has a block. (@koic)

#15328: Fix a false positive for Style/HashConversion with a splat argument, which previously produced an invalid hash literal. (@bbatsov)

#15338: Fix a false positive for Style/HashLookupMethod with safe navigation, where the suggested bracket form would be the unreadable hash&.[](https://github.com/rubocop/rubocop/blob/HEAD/key). (@bbatsov)

#15397: Fix an incorrect autocorrect for Style/IdenticalConditionalBranches that hoisted the moved expression to column zero instead of matching the surrounding indentation. (@bbatsov)

#15372: Fix an incorrect autocorrect for Style/InvertibleUnlessCondition with mixed &&/|| conditions, which lost the required parentheses when inverting. (@bbatsov)

#15428: Fix an incorrect autocorrect for Style/TrivialAccessors when AllowPredicates: false is set and a trivial reader is defined as a predicate class method. (@koic)

#15402: Fix an infinite loop and file corruption for Layout/LineLength with SplitStrings when an over-long string is indented under a multi-line parent. (@bbatsov)

#15384: Fix a false positive and a false negative for Style/MissingRespondToMissing when method_missing is defined at the top level or alongside sibling classes. (@bbatsov)

#15432: Fix false positives in Layout/ElseAlignment when using else within a block that is part of a larger expression. (@koic)

#15423: Fix false positives in Layout/MultilineMethodCallIndentation when a method chain is nested inside a parenthesized argument list or a grouped expression within a hash pair value. (@koic)

#15424: Fix Style/StructInheritance autocorrect dropping leading indentation when class is inside a module or namespace. (@amckinnie)

#15325: Fix Style/DocumentationMethod ignoring AllowedMethods for inline modifier defs. (@bbatsov)

#15369: Fix a false positive for Style/LambdaCall when the argument list contains a comment, which the autocorrect would have dropped. (@bbatsov)

Changes

#15430: Improve performance of offense reporting by not allocating a new source range per offense outside of embedded sources. (@bbatsov)

#15430: Improve investigation performance by dispatching on_new_investigation, on_investigation_end, and on_other_file only to cops that refine them, and by skipping after_* dispatch when no cop needs it. (@bbatsov)

#15430: Improve performance of the per-file cop relevancy check by skipping gem requirement evaluation for cops without gem requirements. (@bbatsov)

#15430: Improve Lint/Debugger performance on code without debugger calls. (@bbatsov)

#15430: Improve autocorrection performance by keeping corrections in memory across inspection iterations and writing each corrected file only once. (@bbatsov)

#15415: Mark Lint/NumericOperationWithConstantResult autocorrect as unsafe because it drops the operands, discarding their side effects and silencing cases where the result is not actually constant (e.g. x / x raises when x is 0). (@bbatsov)

#15430: Improve performance of cops using AllowedPatterns, ForbiddenPatterns, and AllowedMethods by compiling the configured patterns only once. (@bbatsov)

#15430: Improve performance of Style/IfUnlessModifier and other modifier cops on files with many comments or conditionals. (@bbatsov)

RuboCop v1.88.1

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.88.2 (2026-07-08)

Bug fixes

#15417: Fix a false negative for Lint/ToJSON, which did not flag singleton def self.to_json definitions. ([@bbatsov][])

#15418: Fix a false negative for Lint/UnreachableCode, which only flagged the first statement after a flow-of-control statement instead of every unreachable statement that followed it. ([@bbatsov][])

#15416: Fix a false negative for Lint/UselessNumericOperation, which only flagged bare method-call receivers and ignored local variables, instance/class/global variables, and constants (e.g. @x + 0, CONST * 1). ([@bbatsov][])

#15419: Fix a false negative for Lint/Void where safe-navigation calls to nonmutating methods (e.g. x&.sort) were not flagged when CheckForMethodsWithNoSideEffects is enabled. ([@bbatsov][])

#15421: Fix a false negative for Style/ArrayIntersect with the block form using include? (e.g. array1.any? { |e| array2.include?(e) }), which was only detected for member?. ([@bbatsov][])

#15420: Fix a false negative for Style/CollectionCompact, which did not flag grep_v(nil)/grep_v(NilClass) on a safe-navigation call (e.g. array&.grep_v(nil)). ([@bbatsov][])

#15422: Fix a false negative for Style/DefWithParentheses with a single-line definition whose body follows a semicolon (e.g. def foo(); end), where the parentheses can be safely omitted. ([@bbatsov][])

#15388: Fix a false negative for Style/MixinUsage when including multiple modules in one statement. ([@bbatsov][])

#15388: Fix a false negative for Style/ModuleFunction when the module body is a single statement. ([@bbatsov][])

#15388: Fix a false negative for Style/RedundantCurrentDirectoryInPath with double-quoted strings containing interpolation. ([@bbatsov][])

#15395: Fix a false negative for Style/RedundantHeredocDelimiterQuotes with double-quoted delimiters whose body contains interpolation or escapes. ([@bbatsov][])

#15409: Fix a false positive for Gemspec/DuplicatedAssignment with multiple specifications. ([@bbatsov][])

#15403: Fix a false positive for Layout/CommentIndentation with a comment above an inline access modifier (e.g. private def foo) when Layout/AccessModifierIndentation is configured with EnforcedStyle: outdent. ([@grk][])

#15372: Fix a false positive for Style/InvertibleUnlessCondition with a multi-statement begin condition. ([@bbatsov][])

#15360: Fix an incorrect autocorrect for Style/ArgumentsForwarding and Style/MethodDefParentheses when autocorrection conflicts while adding parentheses to method definition arguments. ([@koic][])

#15417: Fix an incorrect autocorrect for Lint/ToJSON that produced invalid Ruby (def to_json(*_args)()) when the method had explicit empty parentheses. ([@bbatsov][])

#15426: Fix an incorrect autocorrect for Style/MethodCallWithoutArgsParentheses when empty parentheses span multiple lines and the method call has a block. ([@koic][])

#15328: Fix a false positive for Style/HashConversion with a splat argument, which previously produced an invalid hash literal. ([@bbatsov][])

#15338: Fix a false positive for Style/HashLookupMethod with safe navigation, where the suggested bracket form would be the unreadable hash&.[](https://github.com/rubocop/rubocop/blob/master/key). ([@bbatsov][])

#15397: Fix an incorrect autocorrect for Style/IdenticalConditionalBranches that hoisted the moved expression to column zero instead of matching the surrounding indentation. ([@bbatsov][])

#15372: Fix an incorrect autocorrect for Style/InvertibleUnlessCondition with mixed &&/|| conditions, which lost the required parentheses when inverting. ([@bbatsov][])

#15428: Fix an incorrect autocorrect for Style/TrivialAccessors when AllowPredicates: false is set and a trivial reader is defined as a predicate class method. ([@koic][])

#15402: Fix an infinite loop and file corruption for Layout/LineLength with SplitStrings when an over-long string is indented under a multi-line parent. ([@bbatsov][])

#15384: Fix a false positive and a false negative for Style/MissingRespondToMissing when method_missing is defined at the top level or alongside sibling classes. ([@bbatsov][])

#15432: Fix false positives in Layout/ElseAlignment when using else within a block that is part of a larger expression. ([@koic][])

#15423: Fix false positives in Layout/MultilineMethodCallIndentation when a method chain is nested inside a parenthesized argument list or a grouped expression within a hash pair value. ([@koic][])

#15424: Fix Style/StructInheritance autocorrect dropping leading indentation when class is inside a module or namespace. ([@amckinnie][])

#15325: Fix Style/DocumentationMethod ignoring AllowedMethods for inline modifier defs. ([@bbatsov][])

#15369: Fix a false positive for Style/LambdaCall when the argument list contains a comment, which the autocorrect would have dropped. ([@bbatsov][])

Changes

#15430: Improve performance of offense reporting by not allocating a new source range per offense outside of embedded sources. ([@bbatsov][])

#15430: Improve investigation performance by dispatching on_new_investigation, on_investigation_end, and on_other_file only to cops that refine them, and by skipping after_* dispatch when no cop needs it. ([@bbatsov][])

#15430: Improve performance of the per-file cop relevancy check by skipping gem requirement evaluation for cops without gem requirements. ([@bbatsov][])

#15430: Improve Lint/Debugger performance on code without debugger calls. ([@bbatsov][])

#15430: Improve autocorrection performance by keeping corrections in memory across inspection iterations and writing each corrected file only once. ([@bbatsov][])

#15415: Mark Lint/NumericOperationWithConstantResult autocorrect as unsafe because it drops the operands, discarding their side effects and silencing cases where the result is not actually constant (e.g. x / x raises when x is 0). ([@bbatsov][])

#15430: Improve performance of cops using AllowedPatterns, ForbiddenPatterns, and AllowedMethods by compiling the configured patterns only once. ([@bbatsov][])

#15430: Improve performance of Style/IfUnlessModifier and other modifier cops on files with many comments or conditionals. ([@bbatsov][])

1.88.1 (2026-07-01)

Bug fixes

#15408: Fix a crash for Bundler/GemComment with a non-literal gem option key. ([@bbatsov][])

... (truncated)

Commits

ceb6377 Cut 1.88.2
ee87be8 Update Changelog
e161fe6 Keep autocorrections in memory during the inspection loop
c8e0c83 Speed up Style/IfUnlessModifier eligibility checks
ef10f8a Dispatch investigation callbacks only to cops that refine them
4de41ea Avoid allocating a Range per offense in the common case
be1bb58 Fast-path the gem requirements check in cop relevancy
278525b Memoize compiled regexps in pattern mixins
28b6cd6 Improve Lint/Debugger performance on non-debugger code
1066e7b Merge pull request #15434 from koic/fix_else_alignment_for_block_in_expression
Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

github-actions · 2026-07-08T23:26:10Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        3        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized  │
│                 │                │          │        │                   │               │ lock release and...                                        │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                  │
│                 │                │          │        │                   │               │ AtomicReference#update...                                  │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock     │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                 │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-08T23:26:30Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY

trivy filesystem --config /github/workspace/.github/linters/trivy.yaml /github/workspace

Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        3        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized  │
│                 │                │          │        │                   │               │ lock release and...                                        │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                  │
│                 │                │          │        │                   │               │ AtomicReference#update...                                  │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock     │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                 │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-08T23:26:39Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        3        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized  │
│                 │                │          │        │                   │               │ lock release and...                                        │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                  │
│                 │                │          │        │                   │               │ AtomicReference#update...                                  │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock     │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                 │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

github-actions · 2026-07-08T23:26:59Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅
TRIVY	Fail ❌

Super-linter detected linting errors

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

TRIVY


Report Summary

┌─────────────────────────────────────┬────────────┬─────────────────┬───────────────────┬─────────┐
│               Target                │    Type    │ Vulnerabilities │ Misconfigurations │ Secrets │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/Gemfile.lock           │  bundler   │        3        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/composer/composer.lock │  composer  │        0        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ dependencies/package-lock.json      │    npm     │        4        │         -         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ Dockerfile                          │ dockerfile │        -        │         0         │    -    │
├─────────────────────────────────────┼────────────┼─────────────────┼───────────────────┼─────────┤
│ test/linters/trivy/good/Dockerfile  │ dockerfile │        -        │         0         │    -    │
└─────────────────────────────────────┴────────────┴─────────────────┴───────────────────┴─────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


dependencies/Gemfile.lock (bundler)
===================================
Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 1, CRITICAL: 1)

┌─────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│     Library     │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                            │
├─────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ concurrent-ruby │ CVE-2026-54906 │ CRITICAL │ fixed  │ 1.3.6             │ >= 1.3.7      │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Synchronization flaw in ReadWriteLock allows unauthorized  │
│                 │                │          │        │                   │               │ lock release and...                                        │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54906                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54904 │ HIGH     │        │                   │               │ concurrent-ruby: rubygem-concurrent-ruby: concurrent-ruby: │
│                 │                │          │        │                   │               │ Denial of Service due to infinite loop in                  │
│                 │                │          │        │                   │               │ AtomicReference#update...                                  │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54904                 │
│                 ├────────────────┼──────────┤        │                   │               ├────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-54905 │ MEDIUM   │        │                   │               │ concurrent-ruby: Concurrent-ruby: Incorrect write lock     │
│                 │                │          │        │                   │               │ granting leading to broken mutual exclusion                │
│                 │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-54905                 │
└─────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘

dependencies/package-lock.json (npm)
====================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 0, CRITICAL: 0)

┌─────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│   Library   │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                            │
├─────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ js-yaml     │ CVE-2026-53550 │ MEDIUM   │ fixed  │ 3.14.2            │ 4.2.0, 3.15.0 │ js-yaml: js-yaml: Denial of Service via crafted YAML merge  │
│             │                │          │        │                   │               │ keys                                                        │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-53550                  │
│             │                │          │        ├───────────────────┤               │                                                             │
│             │                │          │        │ 4.1.1             │               │                                                             │
│             │                │          │        │                   │               │                                                             │
│             │                │          │        │                   │               │                                                             │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ markdown-it │ CVE-2026-48988 │          │        │ 14.1.1            │ 14.2.0        │ markdown-it is a Markdown parser. Versions 14.1.1 and below │
│             │                │          │        │                   │               │ contain a ...                                               │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-48988                  │
├─────────────┼────────────────┤          │        ├───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ postcss     │ CVE-2026-41305 │          │        │ 8.4.31            │ 8.5.10        │ postcss: PostCSS: Cross-Site Scripting (XSS) via improper   │
│             │                │          │        │                   │               │ escaping of style closing tags...                           │
│             │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2026-41305                  │
└─────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.88.0 to 1.88.2. - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.88.0...v1.88.2) --- updated-dependencies: - dependency-name: rubocop dependency-version: 1.88.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-07-15T05:09:13Z

Super-linter summary

Language	Validation result
BIOME_FORMAT	Pass ✅
BIOME_LINT	Pass ✅
CHECKOV	Pass ✅
EDITORCONFIG	Pass ✅
GITLEAKS	Pass ✅
GIT_COMMITLINT	Pass ✅
GIT_MERGE_CONFLICT_MARKERS	Pass ✅
JSCPD	Pass ✅
PRE_COMMIT	Pass ✅
SPELL_CODESPELL	Pass ✅

All files and directories linted successfully

For more information, see the
GitHub Actions workflow run

Powered by Super-linter

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Jul 8, 2026

dependabot Bot mentioned this pull request Jul 8, 2026

build(deps): bump rubocop from 1.86.2 to 1.88.1 in /dependencies #69

Closed

dependabot Bot changed the title ~~build(deps): bump rubocop from 1.86.2 to 1.88.2 in /dependencies~~ build(deps): bump rubocop from 1.88.0 to 1.88.2 in /dependencies Jul 15, 2026

dependabot Bot force-pushed the dependabot/bundler/dependencies/rubocop-1.88.2 branch from 73233ed to 923671b Compare July 15, 2026 04:15

Navigation Menu

Uh oh!

build(deps): bump rubocop from 1.88.0 to 1.88.2 in /dependencies - #72

build(deps): bump rubocop from 1.88.0 to 1.88.2 in /dependencies#72
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/dependencies/rubocop-1.88.2

dependabot Bot commented on behalf of github Jul 8, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

RuboCop v1.88.2

Bug fixes

Changes

RuboCop v1.88.1

1.88.2 (2026-07-08)

Bug fixes

Changes

1.88.1 (2026-07-01)

Bug fixes

Uh oh!

github-actions Bot commented Jul 8, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jul 8, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jul 8, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jul 8, 2026

Super-linter summary

Uh oh!

github-actions Bot commented Jul 15, 2026

Super-linter summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 8, 2026 •

edited

Loading