[dependabot]

Updates the requirements on tomlrb to permit the latest version.

Release notes

Sourced from tomlrb's releases.

2.0.5

Security release. Upgrade if you parse TOML you do not fully trust.

• Fix exponential backtracking (ReDoS) when scanning unterminated basic and literal strings (GHSA-gq8g-3x53-v8fh)
• Fix SystemStackError and quadratic scan time on long runs of spaces/tabs (GHSA-mc56-vpwf-3m26)
• Literal strings no longer treat \' as an escaped quote, per the TOML spec
• Add SECURITY.md: report vulnerabilities through GitHub private vulnerability reporting
• Declare racc as a runtime dependency: Ruby 3.3 made it a bundled gem, so under Bundler require "tomlrb" failed unless the app's Gemfile pulled racc in
• Stop shipping the unused parser.y grammar source in the gem

Both vulnerabilities were reported by @​tsigouris007, advised by @​kpatsakis. Thank you!

Full changelog: fbernier/tomlrb@v2.0.4...v2.0.5

Changelog

Sourced from tomlrb's changelog.

2.0.5 - 2026-10-15

• Fix exponential backtracking (ReDoS) when scanning unterminated basic and literal strings (GHSA-gq8g-3x53-v8fh)
• Fix SystemStackError and quadratic scan time on long runs of spaces/tabs (GHSA-mc56-vpwf-3m26)
• Literal strings no longer treat \' as an escaped quote, per the TOML spec
• Add SECURITY.md: report vulnerabilities through GitHub private vulnerability reporting
• Declare racc as a runtime dependency: Ruby 3.3 made it a bundled gem, so under Bundler require "tomlrb" failed unless the app's Gemfile pulled racc in
• Stop shipping the unused parser.y grammar source in the gem

Both vulnerabilities were reported by @​tsigouris007, advised by @​kpatsakis.

2.0.4 - 2025-12-18

• Update Racc to v1.8.1
• Code cleanup
• Fix conformance to TOML v1.0.0

2.0.3 - 2022-05-28

• Enable symbolize_keys: true for inline tables

2.0.2 - 2022-05-25

• Conform to TOML v1.0.0

2.0.1 - 2020-12-20

• Fix error with table nested under array-of-tables
• Some performance improvements

2.0.0 - 2020-11-26

• Conform to TOML v1.0.0-rc3

Breanking Changes

TOML v0.5.0 introduced new value types: Local Date-Time, Local Date and Local Time which represent time without time zone information. Tomlrb also introduced corresponding classes starting from v2.0.0. By this change, some table values such as 2020-11-24T20:32:18, 2020-11-24 or 20:32:18 are not treated as strings but as new the classes Tomlrb::LocalDateTime, Tomlrb::LocalDate and Tomlrb::LocalTime respectively. You can get the string values by calling #to_s method on any of those classes. Additionally, You can also get Time objects with the #to_time method. See API documentation for the methods' details.

1.3.0 - 2020-03-19

• Fix error with falsy table values

1.2.9 - 2019-11-22

• Fixes and cleanups for ruby 2.7

1.2.8 - 2018-12-18

• Reduce gem size by excluding tests (tas50)
• Make integer and float parsing closer to the spec (sgarciac)

... (truncated)

Commits

• 8d67126 Merge pull request #59 from fbernier/gemspec-racc
• bedcc9d Declare the racc runtime dependency and trim the gem
• f6795c6 Merge pull request #58 from fbernier/fix-redos
• 41cafa9 Add SECURITY.md and credit the 2.0.5 advisories
• 882e1fc Bump version to 2.0.5
• c5fe629 fix: remove catastrophic backtracking and per-char recursion from scanner
• 263d97f Merge pull request #54 from fbernier/toml-test
• ebe44cd Add v2.0.4 changelogs
• e258318 Bump version to v2.0.4
• bb66e4d Update TOML test
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)