Bump devise, rails, coffee-rails, sass-rails, jquery-rails and jbuilder in /Server

[dependabot]

Bumps devise, rails, coffee-rails, sass-rails, jquery-rails and jbuilder. These dependencies needed to be updated together.
Updates devise from 3.2.4 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

v4.9.4

https://github.com/heartcombo/devise/blob/v4.9.4/CHANGELOG.md#494---2024-04-10

v4.9.3

https://github.com/heartcombo/devise/blob/v4.9.3/CHANGELOG.md#493---2023-10-11

v4.9.2

https://github.com/heartcombo/devise/blob/v4.9.2/CHANGELOG.md#unreleased

v4.9.1

https://github.com/heartcombo/devise/blob/v4.9.1/CHANGELOG.md#491---2023-03-31

v4.9.0

https://github.com/heartcombo/devise/blob/v4.9.0/CHANGELOG.md#490---2023-02-17

v4.8.1

No release notes provided.

v4.8.0

No release notes provided.

v4.7.1

No release notes provided.

v4.7.0

No release notes provided.

v4.6.2

No release notes provided.

v4.6.1

No release notes provided.

... (truncated)

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

• security fixes
  • Fix open redirect in FailureApp via unvalidated Referer header on non-GET session timeout. CVE-2026-40295 GHSA-jp94-3292-c3xv

5.0.3 - 2026-03-16

• security fixes
  • Fix race condition vulnerability on confirmable "change email" which would allow confirming an email they don't own CVE-2026-32700 GHSA-57hq-95w6-v4fc #5783 #5784

5.0.2 - 2026-02-18

• enhancements
  • Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825
    • Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.
  • Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

• bug fixes
  • Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31

• breaking changes

  • Drop support to Ruby < 2.7

  • Drop support to Rails < 7.0

  • Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

  • Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

  • Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

  • Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

  • Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

  • Remove deprecated Devise.activerecord51? method.

  • Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

    This is potentially a breaking change because Devise previously used the following order to find a secret key:

    app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base
    

    Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645

  • Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

  • Change <br> tags separating form elements to wrapping them in <p> tags #5494

  • Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

... (truncated)

Commits

• 9ea459d Release v5.0.4 with sec fix for timeoutable
• 025fe21 Merge commit from fork
• 7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
• 605de86 Update links to https [ci skip]
• 5e3a8bf Bundle update
• 5d20277 Cleanup old Rails.version check for db migration path
• 4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
• 2f80920 Release v5.0.3
• 5334707 Add CVE to changelog [ci skip]
• 0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
• Additional commits viewable in compare view

Updates rails from 4.1.4 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• Disable libvips's unfuzzed image loaders and savers.

  libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits

• 3989ebf Preparing for 8.1.3.1 release
• 349e7a5 Disable libvips's unfuzzed image loaders and savers
• fa8f081 Preparing for 8.1.3 release
• 63cef3d Merge branch '8-1-sec' into 8-1-stable
• 1db4b89 Preparing for 8.1.2.1 release
• 1c7d1cf Update changelog
• e91694b Update CHANGELOG (8.1 only)
• 6752711 Fix XSS in debug exceptions copy-to-clipboard
• 63f5ad8 Skip blank attribute names in Action View tag helpers
• 8c9676b Prevent glob injection in ActiveStorage DiskService#delete_prefixed
• Additional commits viewable in compare view

Updates coffee-rails from 4.0.1 to 5.0.0

Changelog

Sourced from coffee-rails's changelog.

5.0.0 (Apr 23, 2019)

• Remove support to Rails < 5.2.
• Support Rails 6.

4.2.2 (May 24, 2017)

• Support digest resolution for coffee templates.

4.2.1 (June 30, 2016)

• Fix error in the gem package.

4.2.0 (June 30, 2016)

• Override js_template hook in the Rails generator to allow Rails to be CoffeeScript agnostic.

4.1.1 (December 18, 2015)

• Allow Rails 5.

  Rafael Mendonça França

4.1.0 (October 12, 2014)

• Default to .coffee extension instead of .js.coffee

  Joshua Peek

• Register coffee extension for rake notes.

  Roberto Miranda

Commits

• 32a2939 Prepare to 5.0.0
• 6507f0a Set the javascripts generator option as true in the railtie
• 5f0e005 Point to rails repository
• 74214e8 Merge pull request #114 from larouxn/rails_6_support
• eff9c00 Revert folder structure changes, remove --javascripts flag
• e7ce694 Fix for exclusively Rails 6
• 69e6782 TESTING, use my fork of Rails
• fc8c48c Conditionally use Rails 6 folder stucture
• 5df5816 Merge pull request #111 from larouxn/stop_testing_below_ruby_2.2
• 9bead93 Merge pull request #112 from larouxn/update_travis_jruby_version
• Additional commits viewable in compare view

Updates sass-rails from 4.0.5 to 6.0.0

Release notes

Sourced from sass-rails's releases.

6.0.0

Breaking change

• Move the implementation to sassc-rails.

  This gem is now only just a wrapper around sassc-rails. For more information on how sassc differs from Ruby sass see https://github.com/sass/sassc-rails#libsass-compatibility-with-ruby-sass.

v5.0.7

• Remove ruby warnings

v5.0.6

• Fixes deprecation warnings on Sprockets 3 (#382)

  Richard Schneeman

5.0.5

• Support Rails 5

5.0.4

• Allow Tilt 2 usage
• Allow no compression for all environments

5.0.3

• Fixed file permissions

5.0.2

• Configure assets environment inside a configure block. This fixes an issue with sprockets-rails' master branch.

5.0.1

• Fixed @import glob related caching bug

5.0.0

• Register scss and sass extensions for rake notes
• Make possible to use sprocktes > 2.8 and < 4
• Make possible to use sass ~> 3.1
• Deprecate .css.scss and .css.sass extensions
• Limit =require to .css only files and @import to .scss files. Avoid mixing the two.

Commits

• a77240c Prepare to 6.0.0
• 8dbe4dc Bump version to 6.0.0.beta3
• 830a8ec Bump minimum version of sassc-rails
• ff54c20 Fix open-ended dependency
• ebe9ef7 Bump version to v6.0.0.beta2
• 409d871 Merge pull request #424 from rails/sassc-rails
• d809900 Recomend to use SassC::Rails::Importer to users requiring sass/rails/importer
• 706526d Make sass-rails an wrapper for sassc-rails to allow a smooth upgrade path
• ac38f1e Merge pull request #423 from gregmolnar/master
• d61b999 remove gemnasium badge from readme
• Additional commits viewable in compare view

Updates jquery-rails from 3.1.2 to 4.6.1

Changelog

Sourced from jquery-rails's changelog.

4.6.1

• update jquery to 3.7.1

4.6.0

• update jquery to 3.7.0

4.5.1

• update jquery to 3.6.1
• update jquery-ujs to 1.2.3

4.5.0

• update jquery to 3.6.0

4.4.0

• update jquery to 3.5.1 (note: 3.5.0 contains important security updates)
• unescape dollar signs and backticks in assert_select_jquery to match Rails updated behavior.

4.3.5

• update jquery to 3.4.1

4.3.4

• update jquery to 3.4.0

4.3.3

• update jquery to 3.3.1

4.3.2

• update jquery to 3.3.0
• Add possibility to test HTML: all, attribute prefix, attribute contains, attribute ends with, child, and class selectors
• Fix matching multiple calls for the same selector/function exception

4.3.1

• update jquery to 3.2.1

4.3.0

• update jquery to 3.2.0
• Add possibility to test HTML attribute selectors

... (truncated)

Commits

• 0342960 Release v4.6.1 with jQuery v3.7.1
• 039b12e Update jquery to v3.7.1 (#305)
• 12869da Release v4.6.0 with jQuery v3.7.0
• 65a9c73 Update jquery to 3.7.0
• fb5a7a8 Merge pull request #293 from MichaelHoste/patch-1
• d9dfbe1 Merge pull request #296 from okuramasafumi/patch-1
• f34a439 Update CHANGELOG.md
• b9e5aa7 Fix typo in CHANGELOG.md (usj => ujs)
• de8792d Release v4.5.1 with jquery 3.6.1 and jquery-ujs 1.2.3
• 7e6f508 Update jquery-ujs to latest v1.2.3
• Additional commits viewable in compare view

Updates jbuilder from 2.2.11 to 2.15.1

Release notes

Sourced from jbuilder's releases.

v2.15.1

What's Changed

• Fix partial for Active Model when extra locals are passed in by @​rafaelfranca in rails/jbuilder#617

New Contributors

• @​rafaelfranca made their first contribution in rails/jbuilder#617

Full Changelog: rails/jbuilder@v2.15.0...v2.15.1

v2.15.0

What's Changed

• Optimize KeyFormatter on cache hits by @​moberegger in rails/jbuilder#607
• Make method_missing private by @​alexceder in rails/jbuilder#614
• Optimize array! and set! by @​moberegger in rails/jbuilder#604
• Use :unprocessable_content for scaffolds with Rack 3.1 or higher by @​taketo1113 in rails/jbuilder#603
• Optimize _map_collection by @​moberegger in rails/jbuilder#612
• fix: Preserve locals when rendering inline partial for object by @​moberegger in rails/jbuilder#613

New Contributors

• @​mayur-kambariya made their first contribution in rails/jbuilder#609
• @​alexceder made their first contribution in rails/jbuilder#614
• @​taketo1113 made their first contribution in rails/jbuilder#603

Full Changelog: rails/jbuilder@v2.14.1...v2.15.0

v2.14.1

What's Changed

• Ensure that Jbuilder.encode properly forwards arguments to .new by @​flavorjones in rails/jbuilder#601

New Contributors

• @​flavorjones made their first contribution in rails/jbuilder#601

Full Changelog: rails/jbuilder@v2.14.0...v2.14.1

v2.14.0

What's Changed

• Drop support to Ruby < 3.0 and Rails < 7.0
• Test against Rails 8 and fix Rails 7 logger dependency by @​excid3 in rails/jbuilder#582
• Add status: :see_other to update action by @​excid3 in rails/jbuilder#583
• Force close final statement in templates by @​ienders in rails/jbuilder#578
• Optimize _is_collection? method by @​moberegger in rails/jbuilder#590
• Add #frozen_string_literal: true to all files by @​moberegger in rails/jbuilder#599
• Optimize _key to prevent string allocation when formatting Symbols by @​moberegger in rails/jbuilder#593
• Optimize key formatter by @​moberegger in rails/jbuilder#597
• Optimize internal extract! calls to save on memory allocation by @​moberegger in rails/jbuilder#598
• Fix regression in API controllers with view_cache_dependencies helper by @​excid3 in rails/jbuilder#575
• Optimize method_missing via alias_method by @​moberegger in rails/jbuilder#600
• Cleanup project for Rails 7+ support by @​moberegger in rails/jbuilder#594
• Fix warnings and prevent Jbuilder::VERSION constant from being obliterated by @​pixeltrix in rails/jbuilder#574
• Optimize memory allocation when rendering partials by @​moberegger in rails/jbuilder#591

... (truncated)

Commits

• 31eb6e9 Prepare for 2.15.1
• 154b0fe Merge pull request #617 from rails/rm-fix-616
• d3e763b Fix partial for Active Model when extra locals are passed in
• 018083d Prepare for 2.15.0
• 72cf067 Update devcontainer image to Ruby 4.0.4 and add devcontainer-lock.json
• d35a962 Merge pull request #615 from taketo1113/ci-rails8.1-ruby4.0
• cc42e7e CI: Add Rails 8.1 & Ruby 4.0 to CI Matrix
• cd7482e Merge pull request #613 from affinity/moberegger/fix-inline-partial-locals-be
• 58283a0 Merge pull request #612 from affinity/moberegger/optimize-_map_collection
• 09ca3e1 Merge pull request #603 from taketo1113/update-rack-unprocessable_content
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.