bundle: bump the ruby-dependencies group across 1 directory with 5 updates by dependabot[bot] · Pull Request #193 · HopHubProject/HopHub

dependabot · 2026-10-17T20:43:14Z

Bumps the ruby-dependencies group with 5 updates in the / directory:

Package	From	To
dalli	`5.1.1`	`5.2.2`
sqlite3	`2.9.6`	`2.10.0`
brakeman	`8.0.6`	`8.1.0`
selenium-webdriver	`4.50.0`	`4.51.0`
pg	`1.6.3`	`1.7.0`

Updates dalli from 5.1.1 to 5.2.2

Release notes

Sourced from dalli's releases.

v5.2.2

Security release. Released together with 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13: with a namespace, a retried request could read or write a different key (GHSA-m252-9cgf-vx2w); completes the fixes for GHSA-wr87-m4jw-29x5 and GHSA-w39f-xq2m-4g8x from 5.2.1, and fixes regressions from that release. Upgrading is strongly recommended.

Security:

Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)

With a namespace, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key

Affects single-key operations since 5.0.3, single-server get_multi since 5.1.0, and get_with_metadata and fetch_with_lock since 4.1.0; fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected

Complete the fix for per-request raw: true on reads (GHSA-wr87-m4jw-29x5)

A read made with raw: true doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Raw reads now ignore flags in the reply

Affects 5.2.1 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13

Bug fixes:

get_with_metadata and fetch_with_lock retried the final error raised when a server is marked down, so with down_retry_delay: 0 they retried an unresponsive server forever. They now retry only retryable errors, like other operations

Fix a regression in 5.2.1: a get_multi that didn't finish within socket_timeout counted toward socket_max_failures, so two slow get_multi calls in a row marked a healthy server down. It now just closes the connection

Fix a regression in 5.2.1: over TLS, every request buffered in a quiet block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again

Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no s flag could leave the connection out of step or raise a non-Dalli error

With decompressed_max_bytes in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit

With a digest_class whose digests aren't short hex strings, shortening a long key could loop forever. It now raises ArgumentError

Notes:

Document how long keys are shortened, and that a short key written in the same form names the same item, in the README's security note (#1200)

Development:

Run the Tests, RuboCop and Profiles workflows on pushes to main and the *-stable branches only, so a pull request's branch isn't tested twice (once for the push and once for the pull request) (#1198)

v5.2.1

Security release. Fixes five vulnerabilities, released together in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12: a pipelined get_multi returning another key's value (GHSA-p6pm-ch9v-44vx); unbounded retries and routing tokens that add meta flags (GHSA-4qp6-2jcr-596v); unbounded decompression and reply sizes (GHSA-3553-vcg5-72jw); per-request raw: true ignored on reads (GHSA-wr87-m4jw-29x5); and a forked child resending the parent's requests or ending its TLS session (GHSA-w39f-xq2m-4g8x). Upgrading is strongly recommended.

Security:

Fix pipelined get_multi returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)

The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (CLIENT_ERROR, SERVER_ERROR, or EN from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a get could return another key's value

Keys are now measured in bytes as sent, after base64 encoding when the key needs it. A key under 250 characters but over 250 bytes on the wire (for example, one with many non-ASCII characters) was the easiest way to cause that error reply. Such keys are now truncated like other long keys; keys that worked before are unchanged

Affects the meta protocol since 3.2.0 (the default since 5.0.0); fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12

Reject routing tokens that add meta flags, and stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)

p_token and l_token now reject whitespace and control characters, not just CR, LF and NUL. A space let a token add meta flags to the request it was sent with: changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or reading a different key

Affects 5.1.0 and later; fixed in 5.2.1 and 5.1.3

A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after socket_max_failures attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after down_retry_delay

Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12

Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)

Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's compress or serializer settings. The new decompressed_max_bytes option (default 128 MiB; nil disables it) makes a read that would pass it raise Dalli::UnmarshalError. Custom compressors whose decompress takes only the data keep working, without the limit

The value size in a reply was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise Dalli::DalliError before reading

Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12

Honor per-request raw: true on reads, and add Dalli::JSONSerializer (GHSA-wr87-m4jw-29x5)

get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata ignored a per-request raw: true and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have Marshal.load run on data someone else wrote to memcached. They now return the stored bytes

The raw part affects get_with_metadata since 4.2.0, and the other methods since they gained per-request options in 5.1.0

... (truncated)

Changelog

Sourced from dalli's changelog.

5.2.2

Security:

Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)

With a namespace, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key

Affects single-key operations since 5.0.3, single-server get_multi since 5.1.0, and get_with_metadata and fetch_with_lock since 4.1.0; fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected

Complete the fix for per-request raw: true on reads (GHSA-wr87-m4jw-29x5)

A read made with raw: true doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Raw reads now ignore flags in the reply

Affects 5.2.1 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13

Bug fixes:

get_with_metadata and fetch_with_lock retried the final error raised when a server is marked down, so with down_retry_delay: 0 they retried an unresponsive server forever. They now retry only retryable errors, like other operations

Fix a regression in 5.2.1: a get_multi that didn't finish within socket_timeout counted toward socket_max_failures, so two slow get_multi calls in a row marked a healthy server down. It now just closes the connection

Fix a regression in 5.2.1: over TLS, every request buffered in a quiet block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again

Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no s flag could leave the connection out of step or raise a non-Dalli error

With decompressed_max_bytes in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit

With a digest_class whose digests aren't short hex strings, shortening a long key could loop forever. It now raises ArgumentError

Notes:

Document how long keys are shortened, and that a short key written in the same form names the same item, in the README's security note (#1200)

Development:

Run the Tests, RuboCop and Profiles workflows on pushes to main and the *-stable branches only, so a pull request's branch isn't tested twice (once for the push and once for the pull request) (#1198)

5.2.1

Security:

Fix pipelined get_multi returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)

The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (CLIENT_ERROR, SERVER_ERROR, or EN from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a get could return another key's value

Keys are now measured in bytes as sent, after base64 encoding when the key needs it. A key under 250 characters but over 250 bytes on the wire (for example, one with many non-ASCII characters) was the easiest way to cause that error reply. Such keys are now truncated like other long keys; keys that worked before are unchanged

Affects the meta protocol since 3.2.0 (the default since 5.0.0); fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12

Reject routing tokens that add meta flags, and stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)

p_token and l_token now reject whitespace and control characters, not just CR, LF and NUL. A space let a token add meta flags to the request it was sent with: changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or reading a different key

Affects 5.1.0 and later; fixed in 5.2.1 and 5.1.3

A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after socket_max_failures attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after down_retry_delay

Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12

Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)

Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's compress or serializer settings. The new decompressed_max_bytes option (default 128 MiB; nil disables it) makes a read that would pass it raise Dalli::UnmarshalError. Custom compressors whose decompress takes only the data keep working, without the limit

The value size in a reply was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise Dalli::DalliError before reading

Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12

Honor per-request raw: true on reads, and add Dalli::JSONSerializer (GHSA-wr87-m4jw-29x5)

get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata ignored a per-request raw: true and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have Marshal.load run on data someone else wrote to memcached. They now return the stored bytes

The raw part affects get_with_metadata since 4.2.0, and the other methods since they gained per-request options in 5.1.0

... (truncated)

Commits

a27cfd3 Merge pull request #1205 from petergoldstein/release/5.2.2
1455750 Prepare 5.2.2 release
2be6cc3 Put the test server's extra flags after the key, and fix a misplaced comment
dca2533 Raise instead of looping when a digest is too long for a truncated key
2c9b12d Ignore data after the end of the stream in the capped inflate
1cf990d Handle malformed hits in the reply parsers
7175f23 Send each write-buffer flush as one write
8e41599 Don't count a get_multi that runs out of time as a socket failure
15a71c2 Ignore flags in replies to raw reads (GHSA-wr87-m4jw-29x5)
3fad213 Retry only retryable errors in get_with_metadata and fetch_with_lock
Additional commits viewable in compare view

Updates sqlite3 from 2.9.6 to 2.10.0

Release notes

Sourced from sqlite3's releases.

2.10.0 / 2026-10-13

Dependencies

Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @flavorjones

Notable changes in this version include:

ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.

The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.

SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @kch

Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @Maaarcocr

Fixed

Fix Database#statement_timeout= interrupting statements almost immediately instead of after the timeout elapsed, including re-executed prepared statements and calls to Database#execute_batch2. #737 @palkan @flavorjones

Improved

On CRuby, Statement#types allocates fewer strings. Each declared type is downcased and interned in C, instead of allocating two strings per column. #743 @jhawthorn

Changed

ResultSet#each and #each_hash return the result set when called with a block. As a consequence, Database#execute and #execute2 called with a block return the closed ResultSet instead of nil. #656 @kch

Statement#columns and Statement#types return frozen arrays, and the strings in Statement#types are frozen. Code that mutates them now raises FrozenError. #743 @jhawthorn

Statement#column_decltype and Statement#types return UTF-8 strings. Previously they returned ASCII-8BIT strings. #743 @jhawthorn
dafeea94182af2eb53a10797be359fa6ec4270532bd45255d1c2beb69f2eb743  gems/sqlite3-2.10.0-aarch64-linux-gnu.gem
ec4ffedded0bd8579629e14d0647cfee9092c0af0009c05d6404d90857b1cb8b  gems/sqlite3-2.10.0-aarch64-linux-musl.gem
bcf2e165f27fd28f46ba34eeba3503d557ea7f76f9dd40434ce719f2ba0d5cda  gems/sqlite3-2.10.0-arm-linux-gnu.gem
338510e64876c7d02d91733eeaee384806c58b3835d8a688d1bfdbf7e468c497  gems/sqlite3-2.10.0-arm-linux-musl.gem
f619f33adfd01a1827e8764a3da92b289c1a99d93707d021a242dccba6909c4e  gems/sqlite3-2.10.0-arm64-darwin.gem
ec284ace2bca873737d0e8818f8eb31e5b84936b694f95933514872929b945d0  gems/sqlite3-2.10.0-x64-mingw-ucrt.gem
a3ac204853c8c6b3f2f6f94ebaa52cba26cfd48df82537b1b154a28fc687f057  gems/sqlite3-2.10.0-x86-linux-gnu.gem
96508597fc5e54bfc1a12f94eb2d9f8e0517a8a377bdbfd6cc824215c4530adb  gems/sqlite3-2.10.0-x86-linux-musl.gem
67306588548e62095855a511285daf33389d7f4311c1c33a1addd23e2b90cec5  gems/sqlite3-2.10.0-x86_64-darwin.gem
295f48b240ba663efa2e3b6f38cbc0f19f5c8a2823a71fda3bf15531be5dd0e8  gems/sqlite3-2.10.0-x86_64-linux-gnu.gem
876dd86a15c7828075ff7612e3d0ab0eb2eba0d8485b13fd4000e8a335f86bc5  gems/sqlite3-2.10.0-x86_64-linux-musl.gem
3fc6c4ac2249b1c54099e7b80e57afdd678e648c1f54de8ad3b4c775195c661a  gems/sqlite3-2.10.0.gem

Changelog

Sourced from sqlite3's changelog.

2.10.0 / 2026-10-13

Dependencies

Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @flavorjones

Notable changes in this version include:

ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.

The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.

SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @kch

Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @Maaarcocr

Fixed

Fix Database#statement_timeout= interrupting statements almost immediately instead of after the timeout elapsed, including re-executed prepared statements and calls to Database#execute_batch2. #737 @palkan @flavorjones

Improved

On CRuby, Statement#types allocates fewer strings. Each declared type is downcased and interned in C, instead of allocating two strings per column. #743 @jhawthorn

Changed

ResultSet#each and #each_hash return the result set when called with a block. As a consequence, Database#execute and #execute2 called with a block return the closed ResultSet instead of nil. #656 @kch

Statement#columns and Statement#types return frozen arrays, and the strings in Statement#types are frozen. Code that mutates them now raises FrozenError. #743 @jhawthorn

Statement#column_decltype and Statement#types return UTF-8 strings. Previously they returned ASCII-8BIT strings. #743 @jhawthorn

Commits

07186c3 version bump to v2.10.0
7ad6fc0 feat: Add Database#serialize and Database#deserialize methods (#685)
c35ae35 Fix statement_timeout interrupting most queries (#737)
ac1b9d9 Avoid string allocation of types on statement (and freeze arrays) (#743)
6067955 Allow calling each, each_hash without block (#656)
f231517 build(deps): bump the actions group with 3 updates (#748)
64aa362 build(deps-dev): update standard requirement from 1.56.0 to 1.57.0 (#747)
197861a dep: update vendored sqlite to 3.54.0 (#750)
b79f314 build(deps-dev): update rdoc requirement from 8.0.0 to 8.1.0 (#745)
b265a20 build(deps): bump the actions group with 2 updates (#746)
Additional commits viewable in compare view

Updates brakeman from 8.0.6 to 8.1.0

Release notes

Sourced from brakeman's releases.

8.1.0

Update SonarQube report to use generic issue format (@fffx)

Include regex code in validation warnings (@eliotsykes)

Check validation regexes in non-activerecord models (@eliotsykes)

Skip top-level vendor directory before recursive globbing (@ronocod)

Support Rails 7.1+ positional enum syntax in SQL injection check (@cubasepp / @Eljees)

Recognize Haml::AttributeBuilder.build_class as an escaped output (@Eljees)

Fix frozen string error (@shaicoleman)

Better help and error message for --ensure-latest (#2036)

Changelog

Sourced from brakeman's changelog.

8.1.0 - 2026-09-30

Better help and error message for --ensure-latest

Fix frozen string error (Shai Coleman)

Update Sonar report format (fangxing)

Fix frozen src string error

Recognize Haml::AttributeBuilder.build_class as an escaped output (Yuriy Tumanov)

Include regex code in validation warnings (Eliot Sykes)

Check validation regexes in non-activerecord models (Eliot Sykes)

Skip top-level vendor directory before recursive globbing (Conor O'Donnell)

Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)

Commits

c778164 Bump to 8.1.0
4621407 Update CHANGES
26ba01f Support Rails 7.1+ positional enum syntax in SQL injection check (#2051)
8f04922 Skip top-level vendor directory before recursive globbing (#2039)
f921f01 Check validation regexes in non-activerecord models (#2053)
d62e919 Fix CheckValidationRegex overly broad ignores (#2050)
73bbc99 Recognize Haml::AttributeBuilder.build_class as an escaped output (#2052)
71f8f69 Fix typo in test_format_validation_with_multiline (#2049)
0fd4dbc Add bundle install step to contributing doc (#2047)
5de415c Fix ERB frozen src error (#2048)
Additional commits viewable in compare view

Updates selenium-webdriver from 4.50.0 to 4.51.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.51.0

Detailed Changelogs by Component

Java | Python | DotNet | Ruby | JavaScript

What's Changed

[py] Validate WebSocket response interval correctly by @cuishuang in SeleniumHQ/selenium#17984

[py][bidi] Send setClientWindowState rect members as sibling params by @AutomatedTester in SeleniumHQ/selenium#18100

[rust] Degrade to empty metadata when the cache cannot be read by @AutomatedTester in SeleniumHQ/selenium#18101

[dotnet] [test] Separate project for NUnit infrastructure by @nvborisenko in SeleniumHQ/selenium#18104

[java] Do not leak the HttpClient on startup failure by @joerg1985 in SeleniumHQ/selenium#18047

[java] Add RemoteWebDriver.getClientFactory() and move HttpCommandExecutor field removal to 4.53 by @diemol in SeleniumHQ/selenium#18111

[dotnet] [test] Parallelize internal testing by @nvborisenko in SeleniumHQ/selenium#18110

[build] pin Firefox BiDi vendor CDDL from the Firefox repository by @titusfortner in SeleniumHQ/selenium#18094

[build] remove obsolete third_party dependencies and dead build references by @titusfortner in SeleniumHQ/selenium#18072

[build] generate release docs at approval and commit them after the packages publish by @titusfortner in SeleniumHQ/selenium#18113

[dotnet] [test] Upgrade NUnit library to v5 by @nvborisenko in SeleniumHQ/selenium#18114

[build] recover from incomplete Java release by dropping staged repositories when found by @titusfortner in SeleniumHQ/selenium#18112

[dotnet] [build] Escape macOS Edge browser path by @nvborisenko in SeleniumHQ/selenium#18126

[js][bidi] Add vendor specific class generation by @pujagani in SeleniumHQ/selenium#18125

[java] assert setFiles uploads reach the server in SetFilesCommandTest by @yashp676 in SeleniumHQ/selenium#18058

[java][bidi] Decode nested RemoteValues from the parsed tree instead of re-serializing each subtree by @yashp676 in SeleniumHQ/selenium#18095

[rb] type a field-less synthetic map record as a validated map by @aguspe in SeleniumHQ/selenium#18121

[java] remove guava from client bindings #12737 by @joerg1985 in SeleniumHQ/selenium#13739

[build] clean up IntelliJ project files and align .editorconfig with formatters by @titusfortner in SeleniumHQ/selenium#18119

[javascript] Create @seleniumhq/atoms npm package from TypeScript atoms by @AutomatedTester in SeleniumHQ/selenium#17459

[java][bidi] Add BiDi code generator by @pujagani in SeleniumHQ/selenium#17777

[java][bidi] Type field-less synthetic map records as Map<String, V> by @yashp676 in SeleniumHQ/selenium#18122

[javascript] Publish atoms under the @selenium npm scope by @AutomatedTester in SeleniumHQ/selenium#18132

[build] sign Java artifacts in-process with in-memory PGP keys instead of gpg-agent by @titusfortner in SeleniumHQ/selenium#18130

[py] Support Python 3.15 by @cgoldberg in SeleniumHQ/selenium#18065

[javascript] Publish @seleniumhq/atoms as part of the npm release by @AutomatedTester in SeleniumHQ/selenium#18133

[js] Remove the WebSQL and AppCache atoms by @AutomatedTester in SeleniumHQ/selenium#18137

[build] remove bazel patches that now have upstream fixes by @titusfortner in SeleniumHQ/selenium#18140

[rust] configure the Chrome sandbox after unpacking a Chrome for Testing build on Windows by @titusfortner in SeleniumHQ/selenium#18139

[dotnet] [test] Entry point to mutate driver options per fixture by @nvborisenko in SeleniumHQ/selenium#18141

[js] Add webextension methods on the driver with BiDi and fallback by @pujagani in SeleniumHQ/selenium#18127

[build] source the Java and .NET versions from a root version.bzl that tests do not read by @titusfortner in SeleniumHQ/selenium#18138

[build] pin the driver location once per test process so services built in tests skip Selenium Manager by @titusfortner in SeleniumHQ/selenium#18143

[java] Do not pass a bare --proxy to Selenium Manager by @Mochxd in SeleniumHQ/selenium#18089

[java][bidi] Update tests to use converter functions by @pujagani in SeleniumHQ/selenium#18146

[java] manage state in tests not in global hooks by @titusfortner in SeleniumHQ/selenium#18142

[build] add stub mode option for using selenium manager with bazel by @titusfortner in SeleniumHQ/selenium#18135

New Contributors

@cuishuang made their first contribution in SeleniumHQ/selenium#17984

... (truncated)

Changelog

Sourced from selenium-webdriver's changelog.

4.51.0 (2026-10-09)

Support CDP versions: v153, v154, v155

[build] Automated CDDL Spec Update (#18118)

type a field-less synthetic map record as a validated map (#18121)

[build] Automated Browser Version Update (major) with CDP (#18131)

Commits

35c5fab [build] Prepare for release of selenium-4.51.0 (#18149)
8f7503a [build] Automated Browser Version Update (major) with CDP (#18131)
f3a43a5 [build] remove the Windows session settle sleeps now that Selenium Manager co...
953b27b [rb] drop Safari captureScreenshot guard now that Safari Technology Preview 2...
92807c9 [build] pin the driver location once per test process so services built in te...
e0c56c9 [rb] update test guard for different bidi error in Chrome beta
788fcf3 [rb] type a field-less synthetic map record as a validated map (#18121)
8ba36d4 [build] Automated Dependency Update (#18124)
6d04770 [build] Automated CDDL Spec Update (#18118)
e1af1a7 [rb] update tests to guard BiDi browsing context on Safari and Windows Firefo...
Additional commits viewable in compare view

Updates pg from 1.6.3 to 1.7.0

Changelog

Sourced from pg's changelog.

v1.7.0 [2026-10-02] Lars Kanis lars@greiz-reinsdorf.de

Added:

Add PG::Connection#embed_params and keyword :typename for its parameter casting. #726 This allows to generate SQL strings with embedded parameters for easier debugging.

Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #695

Add PG::Result#each_tuple #675

Add PG::TypeMap#query_param_encoders to retrieve encoders. #726

Deduplicate result field name strings for better performance. #750

Removed:

Remove compatibility to ruby < 3.1 and drops support of ruby-2.7 and ruby-3.0. #749

Remove GLV unlocking at all functions which process data modifiable in a second thread. #721 This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.

Remove :static_symbol result field names. #691

Remove enforced rpath addition when no rpath is configured in rbconfig. #699

Fixes:

Limit memory allocation on invalid input into PG::BinaryDecoder::Array. #743

Free COPY buffers when decoders raise to avoid possible memory leak in get_copy_data. #742

Prevent SQL injection in set_client_encoding. #741

Add GC_GUARD to temporary ruby objects for conninfo string to avoid it's GC'ed prematurely. #739

Remove option "quirks_mode" from JSON en/decoder to fix compat with json-3.0 gem. #737

Respect calendar type of Ruby and PostgreSQL. #725

Fix broken set_notice_(receiver|processor) callback after GC.compact. #734

Disable DNS resolution in ruby when a service file is used, so that the priority of parameters is equal to libpq. #635

Use RARRAY_LENINT to avoid possible overflow. #728

Fix possible integer overflow at PG::BinaryEncoder::CopyRow and PG::TextEncoder::CopyRow. #714, #715

Avoid possible integer overflow in query parameter encoding. #719

Ensure conninfo is a valid C string before closing the connection to avoid a double free of PGconn. #709

Raise on a too large input string to PG::TextEncoder::Bytea. #717

Check PG::BinaryEncoder::CopyRow array input size instead of producing an invalid output.

Remove accidentally copied "static" keyword from Copy and Record encoder. #711

Avoid possibility to replace typemap while being used in Copy and Record encoders and decoders. #707

Add GC_GUARD's for encoding converted strings sent to the server. #705

Fix incomplete transaction commit when thread is shutdown ungracefully. #704

Assign VALUE after registration per rb_gc_register_address() #703

Update dependencies for binary gems to PostgreSQL-18.6, OpenSSL-3.6.5, krb5-1.22.2 #752

Commits

fcf40c5 Add new gem signing certificate
d41e07a Merge pull request #753 from larskanis/rm-pgsql-10
8e1ee8f Remove some conditions for PostgreSQL-10
050c56d Fix typo in CHANGELOG and add version note
2c4934e Bump VERSION to 1.7.0
f644ba2 Update release notes once more
b16542d Merge pull request #752 from larskanis/upd-binaries
66b27c6 Update dependencies for binary gems to
6a07394 Add CHANGELOG entry for pg-1.7.0
5390356 Merge pull request #749 from larskanis/minruby-3.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates Bumps the ruby-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [dalli](https://github.com/petergoldstein/dalli) | `5.1.1` | `5.2.2` | | [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) | `2.9.6` | `2.10.0` | | [brakeman](https://github.com/presidentbeef/brakeman) | `8.0.6` | `8.1.0` | | [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.50.0` | `4.51.0` | | [pg](https://github.com/ged/ruby-pg) | `1.6.3` | `1.7.0` | Updates `dalli` from 5.1.1 to 5.2.2 - [Release notes](https://github.com/petergoldstein/dalli/releases) - [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md) - [Commits](petergoldstein/dalli@v5.1.1...v5.2.2) Updates `sqlite3` from 2.9.6 to 2.10.0 - [Release notes](https://github.com/sparklemotion/sqlite3-ruby/releases) - [Changelog](https://github.com/sparklemotion/sqlite3-ruby/blob/main/CHANGELOG.md) - [Commits](sparklemotion/sqlite3-ruby@v2.9.6...v2.10.0) Updates `brakeman` from 8.0.6 to 8.1.0 - [Release notes](https://github.com/presidentbeef/brakeman/releases) - [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md) - [Commits](presidentbeef/brakeman@v8.0.6...v8.1.0) Updates `selenium-webdriver` from 4.50.0 to 4.51.0 - [Release notes](https://github.com/SeleniumHQ/selenium/releases) - [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES) - [Commits](SeleniumHQ/selenium@selenium-4.50.0...selenium-4.51.0) Updates `pg` from 1.6.3 to 1.7.0 - [Changelog](https://github.com/ged/ruby-pg/blob/master/CHANGELOG.md) - [Commits](ged/ruby-pg@v1.6.3...v1.7.0) --- updated-dependencies: - dependency-name: dalli dependency-version: 5.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: sqlite3 dependency-version: 2.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: brakeman dependency-version: 8.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: selenium-webdriver dependency-version: 4.51.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: ruby-dependencies - dependency-name: pg dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-24T20:43:31Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Oct 17, 2026

dependabot Bot closed this Oct 24, 2026

dependabot Bot deleted the dependabot/bundler/ruby-dependencies-f966b70e53 branch October 24, 2026 20:43

Navigation Menu

Repository navigation

bundle: bump the ruby-dependencies group across 1 directory with 5 updates - #193

bundle: bump the ruby-dependencies group across 1 directory with 5 updates#193
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-dependencies-f966b70e53

dependabot Bot commented on behalf of github Oct 17, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v5.2.2

v5.2.1

5.2.2

5.2.1

2.10.0 / 2026-10-13

Dependencies

Added

Fixed

Improved

Changed

2.10.0 / 2026-10-13

Dependencies

Added

Fixed

Improved

Changed

8.1.0

8.1.0 - 2026-09-30

Selenium 4.51.0

Detailed Changelogs by Component

What's Changed

New Contributors

4.51.0 (2026-10-09)

v1.7.0 [2026-10-02] Lars Kanis lars@greiz-reinsdorf.de

Uh oh!

dependabot Bot commented on behalf of github Oct 24, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 17, 2026 •

edited

Loading