Bumps pyyaml from 5.2 to 5.4. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/yaml/pyyaml/blob/master/CHANGES">pyyaml's changelog</a>.</em></p> <blockquote> <p>5.4 (2021-01-19)</p> <ul> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/407">yaml/pyyaml#407</a> -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/472">yaml/pyyaml#472</a> -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/441">yaml/pyyaml#441</a> -- Fix memory leak in implicit resolver setup</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/392">yaml/pyyaml#392</a> -- Fix py2 copy support for timezone objects</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/378">yaml/pyyaml#378</a> -- Fix compatibility with Jython</li> </ul> <p>5.3.1 (2020-03-18)</p> <ul> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/386">yaml/pyyaml#386</a> -- Prevents arbitrary code execution during python/object/new constructor</li> </ul> <p>5.3 (2020-01-06)</p> <ul> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/290">yaml/pyyaml#290</a> -- Use <code>is</code> instead of equality for comparing with <code>None</code></li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/270">yaml/pyyaml#270</a> -- Fix typos and stylistic nit</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/309">yaml/pyyaml#309</a> -- Fix up small typo</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/161">yaml/pyyaml#161</a> -- Fix handling of <strong>slots</strong></li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/358">yaml/pyyaml#358</a> -- Allow calling add_multi_constructor with None</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/285">yaml/pyyaml#285</a> -- Add use of safe_load() function in README</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/351">yaml/pyyaml#351</a> -- Fix reader for Unicode code points over 0xFFFF</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/360">yaml/pyyaml#360</a> -- Enable certain unicode tests when maxunicode not > 0xffff</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/359">yaml/pyyaml#359</a> -- Use full_load in yaml-highlight example</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/244">yaml/pyyaml#244</a> -- Document that PyYAML is implemented with Cython</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/329">yaml/pyyaml#329</a> -- Fix for Python 3.10</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/310">yaml/pyyaml#310</a> -- Increase size of index, line, and column fields</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/260">yaml/pyyaml#260</a> -- Remove some unused imports</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/163">yaml/pyyaml#163</a> -- Create timezone-aware datetimes when parsed as such</li> <li><a href="https://github-redirect.dependabot.com/yaml/pyyaml/pull/363">yaml/pyyaml#363</a> -- Add tests for timezone</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/yaml/pyyaml/commit/58d0cb7ee09954c67fabfbd714c5673b03e7a9e1"><code>58d0cb7</code></a> 5.4 release</li> <li><a href="https://github.com/yaml/pyyaml/commit/a60f7a19c0b418fe95fcf2ec0957005ae39e1090"><code>a60f7a1</code></a> Fix compatibility with Jython</li> <li><a href="https://github.com/yaml/pyyaml/commit/ee98abd7d7bd2ca9c7b98aa19164fd0306a3f3d2"><code>ee98abd</code></a> Run CI on PR base branch changes</li> <li><a href="https://github.com/yaml/pyyaml/commit/ddf20330be1fae8813b8ce1789c48f244746d252"><code>ddf2033</code></a> constructor.timezone: _<em>copy</em> & <strong>deepcopy</strong></li> <li><a href="https://github.com/yaml/pyyaml/commit/fc914d52c43f499224f7fb4c2d4c47623adc5b33"><code>fc914d5</code></a> Avoid repeatedly appending to yaml_implicit_resolvers</li> <li><a href="https://github.com/yaml/pyyaml/commit/a001f2782501ad2d24986959f0239a354675f9dc"><code>a001f27</code></a> Fix for CVE-2020-14343</li> <li><a href="https://github.com/yaml/pyyaml/commit/fe150624146ee631bb0f95e45731e8b01281fed6"><code>fe15062</code></a> Add 3.9 to appveyor file for completeness sake</li> <li><a href="https://github.com/yaml/pyyaml/commit/1e1c7fb7c09e9149967c208a6fd07276a6140d57"><code>1e1c7fb</code></a> Add a newline character to end of pyproject.toml</li> <li><a href="https://github.com/yaml/pyyaml/commit/0b6b7d61719fbe0a11f0980489f1bf8ce746c164"><code>0b6b7d6</code></a> Start sentences and phrases for capital letters</li> <li><a href="https://github.com/yaml/pyyaml/commit/c97691596eec279ef9191a9b3bba583a17139d5a"><code>c976915</code></a> Shell code improvements</li> <li>Additional commits viewable in <a href="https://github.com/yaml/pyyaml/compare/5.2...5.4">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps pillow from 6.2.1 to 8.1.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/releases">pillow's releases</a>.</em></p> <blockquote> <h2>8.1.1</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html">https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html</a></p> <h2>8.1.0</h2> <p><a href="https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/8.1.0.html</a></p> <h2>Changes</h2> <ul> <li>Fix TIFF OOB Write error <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5175">#5175</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix for Buffer Read Overrun in PCX Decoding <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5174">#5174</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix for SGI Decode buffer overrun <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5173">#5173</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix OOB Read when saving GIF of xsize=1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5149">#5149</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>Add support for PySide6 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5161">#5161</a> [<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li> <li>Moved QApplication into one test <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5167">#5167</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use disposal settings from previous frame in APNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5126">#5126</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Revert "skip wheels on 3.10-dev due to wheel#354" <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5163">#5163</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Better _binary module use <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5156">#5156</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Added exception explaining that <em>repr_png</em> saves to PNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5139">#5139</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Use previous disposal method in GIF load_end <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5125">#5125</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Do not catch a ValueError only to raise another <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5090">#5090</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Allow putpalette to accept 1024 integers to include alpha values <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5089">#5089</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix OOB Read when writing TIFF with custom Metadata <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5148">#5148</a> [<a href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li> <li>Removed unused variable <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5140">#5140</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix dereferencing of potential null pointers <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5111">#5111</a> [<a href="https://github.com/cgohlke"><code>@​cgohlke</code></a>]</li> <li>Fixed warnings assigning to "unsigned char *" from "char *" <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5127">#5127</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Add append_images support for ICO <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/4568">#4568</a> [<a href="https://github.com/ziplantil"><code>@​ziplantil</code></a>]</li> <li>Fixed comparison warnings <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5122">#5122</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Block TIFFTAG_SUBIFD <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5120">#5120</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Fix dereferencing potential null pointer <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5108">#5108</a> [<a href="https://github.com/cgohlke"><code>@​cgohlke</code></a>]</li> <li>Replaced PyErr_NoMemory with ImagingError_MemoryError <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5113">#5113</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Remove duplicate code <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5109">#5109</a> [<a href="https://github.com/cgohlke"><code>@​cgohlke</code></a>]</li> <li>Moved warning to end of execution <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/4965">#4965</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Removed unused fromstring and tostring C methods <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5026">#5026</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>init() if one of the formats is unrecognised <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5037">#5037</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> </ul> <h2>Dependencies</h2> <ul> <li>Updated libtiff to 4.2.0 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5153">#5153</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated openjpeg to 2.4.0 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5151">#5151</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated harfbuzz to 2.7.4 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5138">#5138</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated harfbuzz to 2.7.3 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5128">#5128</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated libraqm to 0.7.1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5070">#5070</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated libimagequant to 2.13.1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5065">#5065</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Update FriBiDi to 1.0.10 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5064">#5064</a> [<a href="https://github.com/nulano"><code>@​nulano</code></a>]</li> <li>Updated libraqm to 0.7.1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5063">#5063</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> <li>Updated libjpeg-turbo to 2.0.6 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5044">#5044</a> [<a href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li> </ul> <h2>Deprecations</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst">pillow's changelog</a>.</em></p> <blockquote> <h2>8.1.1 (2021-03-01)</h2> <ul> <li> <p>Use more specific regex chars to prevent ReDoS. CVE-2021-25292 [hugovk]</p> </li> <li> <p>Fix OOB Read in TiffDecode.c, and check the tile validity before reading. CVE-2021-25291 [wiredfool]</p> </li> <li> <p>Fix negative size read in TiffDecode.c. CVE-2021-25290 [wiredfool]</p> </li> <li> <p>Fix OOB read in SgiRleDecode.c. CVE-2021-25293 [wiredfool]</p> </li> <li> <p>Incorrect error code checking in TiffDecode.c. CVE-2021-25289 [wiredfool]</p> </li> <li> <p>PyModule_AddObject fix for Python 3.10 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5194">#5194</a> [radarhere]</p> </li> </ul> <h2>8.1.0 (2021-01-02)</h2> <ul> <li> <p>Fix TIFF OOB Write error. CVE-2020-35654 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5175">#5175</a> [wiredfool]</p> </li> <li> <p>Fix for Read Overflow in PCX Decoding. CVE-2020-35653 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5174">#5174</a> [wiredfool, radarhere]</p> </li> <li> <p>Fix for SGI Decode buffer overrun. CVE-2020-35655 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5173">#5173</a> [wiredfool, radarhere]</p> </li> <li> <p>Fix OOB Read when saving GIF of xsize=1 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5149">#5149</a> [wiredfool]</p> </li> <li> <p>Makefile updates <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5159">#5159</a> [wiredfool, radarhere]</p> </li> <li> <p>Add support for PySide6 <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5161">#5161</a> [hugovk]</p> </li> <li> <p>Use disposal settings from previous frame in APNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5126">#5126</a> [radarhere]</p> </li> <li> <p>Added exception explaining that <em>repr_png</em> saves to PNG <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5139">#5139</a> [radarhere]</p> </li> <li> <p>Use previous disposal method in GIF load_end <a href="https://github-redirect.dependabot.com/python-pillow/Pillow/issues/5125">#5125</a> [radarhere]</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python-pillow/Pillow/commit/741d8744a54bedbc49f16922c61a06fcb3681f53"><code>741d874</code></a> 8.1.1 version bump</li> <li><a href="https://github.com/python-pillow/Pillow/commit/179cd1c8f94aabc47e9e522e01683ea9aadbd3a5"><code>179cd1c</code></a> Added 8.1.1 release notes to index</li> <li><a href="https://github.com/python-pillow/Pillow/commit/7d296653da045e18b379c991797f933e054a7476"><code>7d29665</code></a> Update CHANGES.rst [ci skip]</li> <li><a href="https://github.com/python-pillow/Pillow/commit/d25036fca7c8658b698492088361453bb20073e2"><code>d25036f</code></a> Credits</li> <li><a href="https://github.com/python-pillow/Pillow/commit/973a4c333ab6d603e82f6eb2aa6f39d1cfcecccb"><code>973a4c3</code></a> Release notes for 8.1.1</li> <li><a href="https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee"><code>521dab9</code></a> Use more specific regex chars to prevent ReDoS</li> <li><a href="https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61"><code>8b8076b</code></a> Fix for CVE-2021-25291</li> <li><a href="https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9"><code>e25be1e</code></a> Fix negative size read in TiffDecode.c</li> <li><a href="https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5"><code>f891baa</code></a> Fix OOB read in SgiRleDecode.c</li> <li><a href="https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299"><code>cbfdde7</code></a> Incorrect error code checking in TiffDecode.c</li> <li>Additional commits viewable in <a href="https://github.com/python-pillow/Pillow/compare/6.2.1...8.1.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps carrierwave from 1.3.1 to 1.3.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md">carrierwave's changelog</a>.</em></p> <blockquote> <h2>1.3.2 - 2021-02-08</h2> <h3>Fixed</h3> <ul> <li>Fix Ruby 2.7 deprecations(<a href="https://github.com/aubinlrx"><code>@aubinlrx</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2462">#2462</a>)</li> </ul> <h3>Security</h3> <ul> <li>Fix Code Injection vulnerability in CarrierWave::RMagick (<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github.com/carrierwaveuploader/carrierwave/commit/eb9346df598a758a5f8c4a338852982fd7f8f6b8">eb9346df</a>, <a href="https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4">GHSA-cf3w-g86h-35x4</a>)</li> <li>Fix SSRF vulnerability in the remote file download feature (<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github.com/carrierwaveuploader/carrierwave/commit/91714adda998bc9e8decf5b1f5d260d808761304">91714add</a>, <a href="https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5">GHSA-fwcm-636p-68r5</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/56f39b23d16431a79faf8e361d4ee08238db2f66"><code>56f39b2</code></a> Version 1.3.2</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/eb9346df598a758a5f8c4a338852982fd7f8f6b8"><code>eb9346d</code></a> Fix Code Injection vulnerability in CarrierWave::RMagick</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/91714adda998bc9e8decf5b1f5d260d808761304"><code>91714ad</code></a> Fix SSRF vulnerability in the remote file download feature</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/8228e1b981f0a0513c2e61ad763ef63ffe96c195"><code>8228e1b</code></a> URI.open does not exist before Ruby 2.5</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/ac3d0068f65fe3e94a961027d14558baad5e775c"><code>ac3d006</code></a> URI.encode becomes escape, not unescape</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/0712435b22ef5e969b25dffe1f080b0935889557"><code>0712435</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/issues/2462">#2462</a> from aubinlrx/tweak/deprecation_warning_ruby_27</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/c3c652a4d2c877a20fff6a451cffc89321c02a3f"><code>c3c652a</code></a> Cloud not make JRuby build pass on Xenial, reverting back to Trusty</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/0cbea950da56127e5d9263de9bf0193da5490818"><code>0cbea95</code></a> Fix build issues with PostgreSQL and ImageMagick</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/60978361dcd872478f650068804c56f0ed193268"><code>6097836</code></a> use URI.open instead of Kernel.open for Ruby 2.7</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/f10026b8e0eda7709a164b6f8304a6b71993d0f6"><code>f10026b</code></a> Use URI::DEFAULT_PARSER.unescape instead of URI.decode for Ruby 2.7</li> <li>Additional commits viewable in <a href="https://github.com/carrierwaveuploader/carrierwave/compare/v1.3.1...v1.3.2">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>