[dependabot]

Bumps the ruby-dependencies group with 4 updates: bootsnap, dalli, kaminari and sqlite3.

Updates bootsnap from 1.26.0 to 1.26.1

Changelog

Sourced from bootsnap's changelog.

1.26.1

• Fix Bootsnap.enable_frozen_string_literal(app_only: true) raising NameError when the compile cache is disabled. App files are now compiled with frozen string literals on every load, without caching.

• Avoid transcoding Ruby source when the Prism workaround runs with a default internal encoding.

• Better detect support for fast path scanning. Fix compilation on Illumos.

Commits

• 681429d Release 1.26.1
• 9298a58 Merge pull request #582 from byroot/compiler-no-cache
• e340dd0 Support custom compilers even whith caching disabled
• 82b9598 Merge pull request #578 from byroot/windows-binmode
• 8ad8d73 Read and write loadpath cache in binmode
• dd767a4 Merge pull request #581 from czj/ci-old-rubies-on-ubuntu-24.04
• a53f3de CI: run Ruby < 3.2 on ubuntu-24.04 now that ubuntu-latest is 26.04
• db216d1 Merge pull request #576 from pauljccode/fix/source-internal-encoding
• d53eb60 Declare the UTF-8 regression fixture encoding
• d5cdf8a Preserve source encoding in the Prism workaround
• Additional commits viewable in compare view

Updates dalli from 5.2.2 to 5.2.4

Release notes

Sourced from dalli's releases.

v5.2.4

Security release. Released together with 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15: a connection shared by several threads or fibers could get out of step during a quiet block or after a get_multi that stopped early, so that reads returned another key's value (GHSA-5xvx-r8rg-5qm2). Upgrading is strongly recommended. It also makes the TLS handshake fix from 5.2.3 work when openssl isn't loaded before Dalli.

Security:

• Keep a connection shared by several threads or fibers in step during a quiet block (GHSA-5xvx-r8rg-5qm2)
  • A quiet (or multi) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an add of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
• Don't let a get_multi that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
  • A pipelined get_multi stopped by a non-network exception (its block raising or breaking, Timeout.timeout, or a value that can't be deserialized) left its unread replies in the response buffer, and a later get_multi large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
  • Affects every supported line (the get_multi issue, 4.3 and later); fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15. On 5.2, clients with defer_drain: true weren't affected by the quiet issue

Bug fixes:

• A failed TLS handshake is now handled as a network error even when openssl wasn't loaded before Dalli
  • The fix in 5.2.3 (#1215) took effect only when the application had already required openssl: otherwise Dalli's list of TLS errors was empty, so a failed handshake still raised OpenSSL::SSL::SSLError and left the socket open

v5.2.3

Security release. Released together with 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14: with the meta protocol, a counter that incr or decr created with an initial value for a key containing spaces, CR/LF or non-ASCII characters could let a crafted key forge the value of another key in a multi-get (GHSA-r47x-6p6r-mvcp). Upgrading is strongly recommended. This release also includes the bug fixes and the new connect_timeout option below.

Security:

• Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
  • memcached stores an item made by auto-create (ma with N/J, or mg with N) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
  • incr and decr with an initial value now create such counters with an add instead. Return values are unchanged
  • The new verify_reply_keys option makes get_multi, get_multi_cas and get_multi_with_metadata ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
  • Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes

Bug fixes:

• get_multi_with_metadata and its CacheResult adapter now retry transient network errors and raise Dalli::NetworkError on terminal failures instead of returning misses or partial results (#1222, @​jaideeppyne)
• A per-request raw: true write no longer compresses the value (#1213)
  • Values at or above the compression threshold (4 KB by default) were compressed and flagged even with raw: true. Raw reads ignore flags, so reading them back with raw: true returned the compressed bytes
  • Raw values are now stored exactly as given. Callers that pass raw: true without compress: false store large values uncompressed; Rails' MemCacheStore passes compress: false and isn't affected
• Fix cas and cas! edge cases, and make flush attempt every server (#1214)
  • cas! on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns false if another client got there first
  • With cache_nils: true, cas treated a stored nil as a miss and didn't call the block
  • The docs now say what cas and cas! return on success: the new CAS value, not true. The return values are unchanged
  • flush stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
• Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
  • A failed or timed-out handshake left the TCP socket open until GC and raised OpenSSL::SSL::SSLError directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and socket_max_failures handling, raising Dalli::NetworkError (or Dalli::RingError once no server is available)
  • Certificate and hostname checks come only from the ssl_context you pass, and a bare OpenSSL::SSL::SSLContext.new checks neither. Dalli now logs a warning once per process when verify_mode doesn't include VERIFY_PEER or verify_hostname is false; see the new TLS section in the README
• Connection and configuration fixes (#1216)
  • memcached:// URIs with a bracketed IPv6 host (memcached://[::1]:11211) now connect
  • A server weight below 1 raises ArgumentError. Before, a ring where every weight was 0 raised FloatDomainError
  • A reply line longer than 8 KiB without a CRLF, or one cut short by the connection closing, is now a network error that closes the connection. Before, the line had no length limit
  • On CRuby, DNS resolution is now limited by socket_timeout (resolv_timeout:) as well as the connect
• Dalli::Client.new no longer modifies the options hash it's given, and accepts a frozen one (#1217)
• value_max_bytes now counts the key and memcached's per-item overhead (#1217)
  • memcached's -I limit covers the whole item, not only the value. A value of exactly 1 MB passed Dalli's check and then failed in memcached with Dalli::ServerError, which quiet blocks and set_multi silently discarded
  • Dalli now checks value + key + 63 bytes, the overhead measured on memcached 1.6, and raises Dalli::ValueOverMaxSize before sending. A custom value_max_bytes is now that much stricter

... (truncated)

Changelog

Sourced from dalli's changelog.

5.2.4

Security:

• Keep a connection shared by several threads or fibers in step during a quiet block (GHSA-5xvx-r8rg-5qm2)
  • A quiet (or multi) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an add of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
• Don't let a get_multi that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
  • A pipelined get_multi stopped by a non-network exception (its block raising or breaking, Timeout.timeout, or a value that can't be deserialized) left its unread replies in the response buffer, and a later get_multi large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
  • Affects every supported line (the get_multi issue, 4.3 and later); fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15. On 5.2, clients with defer_drain: true weren't affected by the quiet issue

Bug fixes:

• A failed TLS handshake is now handled as a network error even when openssl wasn't loaded before Dalli
  • The fix in 5.2.3 (#1215) took effect only when the application had already required openssl: otherwise Dalli's list of TLS errors was empty, so a failed handshake still raised OpenSSL::SSL::SSLError and left the socket open

5.2.3

Security:

• Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
  • memcached stores an item made by auto-create (ma with N/J, or mg with N) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
  • incr and decr with an initial value now create such counters with an add instead. Return values are unchanged
  • The new verify_reply_keys option makes get_multi, get_multi_cas and get_multi_with_metadata ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
  • Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes

Bug fixes:

• get_multi_with_metadata and its CacheResult adapter now retry transient network errors and raise Dalli::NetworkError on terminal failures instead of returning misses or partial results (#1222, @​jaideeppyne)
• A per-request raw: true write no longer compresses the value (#1213)
  • Values at or above the compression threshold (4 KB by default) were compressed and flagged even with raw: true. Raw reads ignore flags, so reading them back with raw: true returned the compressed bytes
  • Raw values are now stored exactly as given. Callers that pass raw: true without compress: false store large values uncompressed; Rails' MemCacheStore passes compress: false and isn't affected
• Fix cas and cas! edge cases, and make flush attempt every server (#1214)
  • cas! on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns false if another client got there first
  • With cache_nils: true, cas treated a stored nil as a miss and didn't call the block
  • The docs now say what cas and cas! return on success: the new CAS value, not true. The return values are unchanged
  • flush stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
• Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
  • A failed or timed-out handshake left the TCP socket open until GC and raised OpenSSL::SSL::SSLError directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and socket_max_failures handling, raising Dalli::NetworkError (or Dalli::RingError once no server is available)
  • Certificate and hostname checks come only from the ssl_context you pass, and a bare OpenSSL::SSL::SSLContext.new checks neither. Dalli now logs a warning once per process when verify_mode doesn't include VERIFY_PEER or verify_hostname is false; see the new TLS section in the README
• Connection and configuration fixes (#1216)
  • memcached:// URIs with a bracketed IPv6 host (memcached://[::1]:11211) now connect
  • A server weight below 1 raises ArgumentError. Before, a ring where every weight was 0 raised FloatDomainError
  • A reply line longer than 8 KiB without a CRLF, or one cut short by the connection closing, is now a network error that closes the connection. Before, the line had no length limit
  • On CRuby, DNS resolution is now limited by socket_timeout (resolv_timeout:) as well as the connect
• Dalli::Client.new no longer modifies the options hash it's given, and accepts a frozen one (#1217)
• value_max_bytes now counts the key and memcached's per-item overhead (#1217)
  • memcached's -I limit covers the whole item, not only the value. A value of exactly 1 MB passed Dalli's check and then failed in memcached with Dalli::ServerError, which quiet blocks and set_multi silently discarded
  • Dalli now checks value + key + 63 bytes, the overhead measured on memcached 1.6, and raises Dalli::ValueOverMaxSize before sending. A custom value_max_bytes is now that much stricter

... (truncated)

Commits

• 5bf6980 Merge pull request #1245 from petergoldstein/release/5.2.4
• 95c69f8 Merge pull request #1238 from petergoldstein/fix/flaky-delete-cas-test
• 650de92 Merge pull request #1244 from petergoldstein/docs/hardening-plan-r47x
• ac8959b Prepare 5.2.4 release
• 457ad39 Require openssl before defining SSL_ERRORS
• 0a34a51 Don't let a stopped get_multi's replies reach a later request
• 322a496 Drain pending quiet replies before any non-quiet request
• 8e68792 List GHSA-m252-9cgf-vx2w and GHSA-r47x-6p6r-mvcp in the hardening plan
• 67f2d2f Merge pull request #1239 from petergoldstein/release/5.2.3
• 17907cc Fix flaky delete_cas test
• Additional commits viewable in compare view

Updates kaminari from 1.3.0 to 1.3.1

Release notes

Sourced from kaminari's releases.

v1.3.1

1.3.1

Bug Fixes:

• total_count keeps eager_load in the count query again, which the conditions may need when they refer to the eager loaded tables without references (a regression in 1.3.0) #1160 [@​r-uehara0219]
• total_count keeps includes in the count query when they are joined along with eager_load or joins, which the conditions may need: 1462042

Changelog

Sourced from kaminari's changelog.

1.3.1

Bug Fixes:

• total_count keeps eager_load in the count query again, which the conditions may need when they refer to the eager loaded tables without references (a regression in 1.3.0) #1160 [@​r-uehara0219]
• total_count keeps includes in the count query when they are joined along with eager_load or joins, which the conditions may need: 1462042

Commits

• e89681b Version 1.3.1
• 1462042 Keep includes in the total_count query when they are eager loaded
• 28067b0 Keep eager_load in the total_count query
• See full diff in compare view

Updates sqlite3 from 2.10.1 to 2.10.2

Release notes

Sourced from sqlite3's releases.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

e9aea2c2b3476fc875dd8a89313a9a2862818519c0186bfb5b56d6f57bb08d98  gems/sqlite3-2.10.2-aarch64-linux-gnu.gem
4986fc40cdf21342362b72a941df28e95cfe0e644f3ad2532d948b157c39dbee  gems/sqlite3-2.10.2-aarch64-linux-musl.gem
762f609ef891463226b472d3df66aea84d5466ff4376d3ccf4a059718c4ce9c9  gems/sqlite3-2.10.2-arm-linux-gnu.gem
833623eaf1157b1b85d1c0830e3e8f9beb3bb95a9bec3d252f20557a50e9803a  gems/sqlite3-2.10.2-arm-linux-musl.gem
5b0d235ea037e6dcd1b8387a19d73be571917db9f93044d35741cf933a21a37d  gems/sqlite3-2.10.2-arm64-darwin.gem
7fe1bf1adfca4fffeaec27371e0a20c1162d9d985681ec9560971a44fc41d198  gems/sqlite3-2.10.2-x64-mingw-ucrt.gem
46a02a29e9ae452824082388be5c24fd26f133b14bdd268610c6aa9a8d924c44  gems/sqlite3-2.10.2-x86-linux-gnu.gem
38980cf01eb2e4ac1c0755964d60b3d743ccf00686798a626bab852ff4cd3d1e  gems/sqlite3-2.10.2-x86-linux-musl.gem
fd2c67b49d313031af112e172c83ab321681a2b4996bf882eefac50be7bea08f  gems/sqlite3-2.10.2-x86_64-darwin.gem
ca92731ab464df9cae503fa1a439a549e2724f6953c8c05a7769b59366e38f15  gems/sqlite3-2.10.2-x86_64-linux-gnu.gem
b9f8fc62f3e0eb8966b41de251b492b4c8e9d1b23559beb6e150ad7f8d590941  gems/sqlite3-2.10.2-x86_64-linux-musl.gem
f1ea68cd3287f8a49f39a088ac9e4bd0ef4e7f394c3d4a60dd4c7e44b0566964  gems/sqlite3-2.10.2.gem

Changelog

Sourced from sqlite3's changelog.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

Commits

• 1d2aa7a version bump to v2.10.2
• 5329061 Merge pull request #764 from sparklemotion/card-342-callback-lifetime-followups
• 8e81efa test: stop counting the finalizer probes
• 60bf60e doc: list the callback behavior changes in CHANGELOG
• 083d734 Stop a raise inside a callback from deadlocking other threads
• ab14f58 doc: add PR number to CHANGELOG
• e4f3d58 Merge pull request #763 from sparklemotion/card-345-fork-safety-test-flake
• dab7eb2 doc: update CHANGELOG
• 03e5469 test: release aggregate instances on more routes to xFinal
• 621c692 test: skip compaction tests where compaction raises
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.