[dependabot]

Bumps activesupport from 7.2.3.1 to 8.0.5.2.

Release notes

Sourced from activesupport's releases.

8.0.5.2

Active Support

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

• Fix strip_tags to encode " and ' in its output.

  strip_tags returns an html_safe string, but was not encoding quotation marks. The method now encodes all five HTML-significant characters (&, <, >, ", '), consistent with the existing html_safe convention.

  Output used outside HTML, such as in a text template or JSON, now contains " and &[#39](https://github.com/rails/rails/issues/39); where it contained " and '. CGI.unescapeHTML decodes them.

  [GHSA-rq8q-p985-fjq7]

... (truncated)

Commits

• 235c597 Preparing for 8.0.5.2 release
• 210ac22 Avoid dynamic regexp in safe_constantize LoadError handling
• beef74d Preparing for 8.0.5.1 release
• eb126bb Preparing for 8.0.5 release
• f7fe4a5 Merge branch '8-0-sec' into 8-0-stable
• a79efed Preparing for 8.0.4.1 release
• ac7979b Update changelog
• 29154f1 Improve performance of NumberToDelimitedConverter
• 6e8a811 Fix SafeBuffer#% to preserve unsafe status
• ee2c59e NumberConverter: reject scientific notation
• Additional commits viewable in compare view

[duglin]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the lockfile conflict and merged main into the PR branch. Merge commit: 42bb0d5.