build(deps): bump the per-dependency group in /bindings/ruby with 2 updates - #20
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps the per-dependency group in /bindings/ruby with 2 updates: [minitest](https://github.com/minitest/minitest) and [rb_sys](https://github.com/oxidize-rb/rb-sys). Updates `minitest` from 6.0.2 to 6.0.3 - [Changelog](https://github.com/minitest/minitest/blob/master/History.rdoc) - [Commits](minitest/minitest@v6.0.2...v6.0.3) Updates `rb_sys` from 0.9.124 to 0.9.125 - [Release notes](https://github.com/oxidize-rb/rb-sys/releases) - [Commits](oxidize-rb/rb-sys@v0.9.124...v0.9.125) --- updated-dependencies: - dependency-name: minitest dependency-version: 6.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency - dependency-name: rb_sys dependency-version: 0.9.125 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: per-dependency ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/bundler/bindings/ruby/per-dependency-b554073848
branch
April 3, 2026 14:52
anakrish
pushed a commit
that referenced
this pull request
Jun 19, 2026
Port comparisons on `input.dest_port` (`>=`, `>`, `<=`, `<`, and a closed
range `lo <= port <= hi`) now lower into a single inclusive port-range clause
row and are enforced soundly, instead of being dropped.
Core changes:
- abi/plan: add `ScalarMatch::Range { min, max }` (inclusive). A range requires
the field to be present, mirroring a Rego comparison over a missing field
(`missing_matches = false`, fail-closed).
- plan: `lower_clause` now gathers atoms per field; `dest_port` accepts multiple
`Cmp` atoms which are intersected into one range. Ge/Gt/Le/Lt map to half-open
bounds clamped to `[0, u16::MAX]`; an empty intersection drops the clause
(sound). `Ne`, a `negation_complement` Cmp, or any Cmp/Eq/Membership mix on
the port field rejects the whole clause (fail-closed). Eq/Membership behaviour
is unchanged.
- enforcer: `scalar_matches` handles `Range` (None never matches).
- bpf/egress.bpf.c: extend `struct clause_entry` with `port_min`/`port_max` and a
`MATCH_RANGE` port_kind; `port_matches` handles the inclusive range. Host byte
order and the bounded loop are unchanged; still compiles against live BTF.
Tests:
- tests/portrange.rs: 19 tests — unit lowering (Ge/Le/closed/strict/empty-drop/
Ne-reject/negation-complement-reject/range+proto+CIDR/range+Exact-conflict/
single-point) plus triple-path conformance (full_eval vs sim vs enforce) over
a fuzzed port sweep, asserting never-over-permit and exact agreement within
the kernel-observable u16 window.
- tests/fail_closed_unsupported.rs: 6 tests + design notes locking down #18
(IPv6/connect6), #19 (deny-lists), #20 (other hooks, note-only), and #21
(per-uid/cgroup scoping) as sound/fail-closed.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the per-dependency group in /bindings/ruby with 2 updates: minitest and rb_sys.
Updates
minitestfrom 6.0.2 to 6.0.3Changelog
Sourced from minitest's changelog.
Commits
649b075prepped for releasea2d0904- assert_same(nil, value) no longer allowed. Use assert_nil to be explicit. (...Updates
rb_sysfrom 0.9.124 to 0.9.125Release notes
Sourced from rb_sys's releases.
Commits
e55987bBump to v0.9.125b42b5fbMerge pull request #713 from oxidize-rb/bump-bindgened7b266Bump bingen4c9848eMerge pull request #714 from rwstauner/cargo-metadata-jsoncd3078aUse JSON.parse instead of Gem::SafeYAML for cargo metadata3978510Merge pull request #710 from reid-rigo/reid-rigo-release-workflow-updatesfba02b4Update checkout action from v4 to v6fa2abf0Updates to deployment.mdx5e29781Merge pull request #709 from oxidize-rb/dependabot/bundler/standard-tw-1.54.044e5140chore(deps): update standard requirement from ~> 1.52.0 to ~> 1.54.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions