What's Changed
- SSRF: take the address policy from surfguard instead of keeping our own copy by @jeremy in #3026
- Guard Gemfile against bundling under the wrong Ruby by @jeremy in #3041
- dep: bump image_processing, ruby-vips, mini_magick by @flavorjones in #3051
- Bump bootsnap to 1.24.6 (security) by @jeremy in #3022
- Remove the dead User::Transferable concern by @jeremy in #3030
- Bump the github-actions group across 1 directory with 5 updates by @dependabot[bot] in #3035
- Serve static public pages with a locked-down CSP by @jeremy in #3031
- Bump aws-sdk-s3 from 1.219.0 to 1.229.0 by @dependabot[bot] in #2916
- Bump jbuilder from 2.14.1 to 2.15.1 by @dependabot[bot] in #2920
- Update lexxy to 0.9.31 by @jorgemanrubia in #3052
Full Changelog: https://github.com/basecamp/fizzy/compare/fizzy@36fb8ee...fizzy@493706c