Skip to content

Bump the bundler group across 1 directory with 22 updates - #1453

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-6060d76a75
Closed

Bump the bundler group across 1 directory with 22 updates#1453
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-6060d76a75

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 22 updates in the / directory:

Package From To
rails 8.1.3.1 8.1.4
aws-sdk-s3 1.228.1 1.233.1
bootsnap 1.24.6 1.26.0
devise 4.9.4 5.0.4
devise_token_auth 1.2.6 1.3.0
good_job 4.19.2 4.20.0
lograge 0.15.0 0.15.1
newrelic_rpm 10.6.0 10.9.0
pagy 43.6.1 43.7.0
pg 1.6.3 1.7.0
annotaterb 4.24.0 4.25.0
brakeman 8.0.5 8.1.0
listen 3.10.0 3.10.1
reek 6.5.0 6.6.0
rubocop 1.88.2 1.91.0
rubocop-performance 1.26.1 1.27.0
rubocop-rails 2.36.0 2.38.0
parallel_tests 5.7.0 5.8.0
pg_query 6.2.2 6.2.5
rspec-openapi 0.31.0 0.34.0
selenium-webdriver 4.46.0 4.50.0
webmock 3.26.2 3.26.4

Updates rails from 8.1.3.1 to 8.1.4

Release notes

Sourced from rails's releases.

8.1.4

Active Support

  • Fix the debug error page rendering for SyntaxErrors with multi-line messages.

    Marco Roth

  • Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

    Earlopain

  • Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

    Kenta Ishizaki

  • Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

    Kenta Ishizaki

  • Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

    Kenta Ishizaki

  • Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

    Kenta Ishizaki

  • Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

    Kenta Ishizaki

  • Fix number_to_human and number_to_human_size crashing when :precision is nil.

    Kenta Ishizaki

  • Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

    Andrew Novoselac

  • Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

    Kenta Ishizaki

... (truncated)

Commits
  • c3466ea Preparing for 8.1.4 release
  • 334dc3e Merge pull request #58854 from carlosdanielpohlod/strict-locals-ascii-only-body
  • 8df6693 Merge pull request #58827 from rails/backport-alias-fallback-8-1-stable
  • 2ed2c88 Define read_attribute_for_validation instead of aliasing send
  • 2616145 Merge pull request #56705 from p8/activemodel/fix-read-attr-for-serialization...
  • 20abac3 Merge pull request #58817 from yahonda/fix-alias-fallback-to-object-in-attrib...
  • 2670772 Merge pull request #58733 from kwestein/create-or-find-by-deadlock
  • 8236300 Merge pull request #58806 from Shopify/hm-wnqzpryypymkrxtn
  • e6288a8 Update CHANGELOGs for 8-1-stable backports
  • 44a7fd4 Merge pull request #58799 from e-akashsaini/fix-tuple-where-key-corrupting-at...
  • Additional commits viewable in compare view

Updates aws-sdk-s3 from 1.228.1 to 1.233.1

Changelog

Sourced from aws-sdk-s3's changelog.

1.233.1 (2026-10-01)

  • Issue - Fix unbounded memory growth in upload_stream on TransferManager and Aws::S3::Object when the data source outpaces the upload (#3407).

  • Issue - Prevent upload_file, upload_stream and download_file on TransferManager and Aws::S3::Object from hanging when a worker thread is terminated by a non-StandardError.

1.233.0 (2026-09-30)

  • Feature - Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others.

1.232.3 (2026-09-28)

  • Issue - Remove :thread_count from transfer options even when a custom :executor is configured on TransferManager, fixing an ArgumentError raised on single-part upload_file calls.

  • Issue - Fix :thread_count being ignored by the deprecated Object#download_file, which always used the default thread count.

1.232.2 (2026-09-25)

  • Issue - Ensure the internally-created executor is shutdown on error in TransferManager and Aws::S3::Object resource methods, preventing leaked worker threads on multipart transfer failures (#3419).

1.232.1 (2026-09-16)

  • Issue - Return the copy response from multipart copy_to/copy_from instead of nil on success.

1.232.0 (2026-09-11)

  • Feature - Updated S3 Object Lock Default Retention documentation.

1.231.0 (2026-09-09)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.230.0 (2026-09-08)

  • Feature - Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level.

1.229.0 (2026-08-06)

  • Feature - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.

1.228.2 (2026-07-30)

... (truncated)

Commits

Updates bootsnap from 1.24.6 to 1.26.0

Release notes

Sourced from bootsnap's releases.

v1.26.0

What's Changed

  • Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
  • Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
  • Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

v1.25.0

What's Changed

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.26.0

  • Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
  • Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
  • Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

1.25.0

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits
  • 67a7290 Release 1.26.0
  • 1881b9a Merge pull request #573 from byroot/same-size-miscompilation
  • 605bbeb Fix precompilation when regenerating an existing cache entry of the same size
  • 5fd59da Merge pull request #569 from OskarEichler/codex/accept-tempfile-fd-zero
  • 70550c7 Merge pull request #568 from OskarEichler/codex/remove-umask-debug-output
  • 8aed2ed Accept tempfile descriptor zero
  • f7457ea Remove umask debug output
  • 9ee62a2 Merge pull request #567 from byroot/rename-mod
  • 7c8178e Handle write(2) being interrupted.
  • 3e755ca atomic_write_cache_file: stop leaking FD on error
  • Additional commits viewable in compare view

Updates devise from 4.9.4 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

5.0.3 - 2026-03-16

5.0.2 - 2026-02-18

  • enhancements
    • Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825
      • Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.
    • Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

  • bug fixes
    • Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31

  • breaking changes

    • Drop support to Ruby < 2.7

    • Drop support to Rails < 7.0

    • Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

    • Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

    • Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

    • Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

    • Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

    • Remove deprecated Devise.activerecord51? method.

    • Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

      This is potentially a breaking change because Devise previously used the following order to find a secret key:

      app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base

      Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645

    • Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

    • Change <br> tags separating form elements to wrapping them in <p> tags #5494

    • Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

... (truncated)

Commits
  • 9ea459d Release v5.0.4 with sec fix for timeoutable
  • 025fe21 Merge commit from fork
  • 7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
  • 605de86 Update links to https [ci skip]
  • 5e3a8bf Bundle update
  • 5d20277 Cleanup old Rails.version check for db migration path
  • 4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
  • 2f80920 Release v5.0.3
  • 5334707 Add CVE to changelog [ci skip]
  • 0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
  • Additional commits viewable in compare view

Updates devise_token_auth from 1.2.6 to 1.3.0

Commits

Updates good_job from 4.19.2 to 4.20.0

Release notes

Sourced from good_job's releases.

v4.20.0

Review the Changelog for more details.

New features

What's Changed

Quite a number of bugfixes in this release 🎉

New Contributors

Full Changelog: bensheldon/good_job@v4.19.4...v4.20.0

v4.19.4

Review the Changelog for more details.

What's Changed

Full Changelog: bensheldon/good_job@v4.19.3...v4.19.4

v4.19.3

Review the Changelog for more details.

What's Changed

... (truncated)

Changelog

Sourced from good_job's changelog.

v4.20.0 (2026-10-03)

Full Changelog

Implemented enhancements:

Fixed bugs:

  • [dashboard] Mismatch between page header vs graph headers #1601
  • Add dashboard and batch indexes, remove redundant indexes, and reorder the cron index #1840 (bensheldon)
  • Detect Puma worker boot hooks and Puma 8 requests in in_webserver? #1836 (amanfredi)
  • Keep both SharedExecutor threads available on JRuby #1835 (amanfredi)
  • Pass cron_graceful_restart_period to the CronManager so it takes effect #1833 (amanfredi)
  • Wrap Notifier's NOTIFY recipient dispatch in the Rails executor #1830 (shiaho777)
  • Preserve active backtrace tabs across live poll refreshes #1824 (shiaho777)
  • Refetch async navbar values after a live poll refresh #1823 (shiaho777)
  • Truncate long strings when displaying job params on the dashboard #1822 (shiaho777)
  • Bound all search_text documents under the tsvector size limit #1820 (shiaho777)
  • Finish a job's unfinished executions when it is discarded #1819 (shiaho777)

Closed issues:

  • Dequeue candidate indexes don't cover queue-filtered workers — one queue's backlog degrades every other queue's claim query #1790
  • PG: ProgramLimitExceeded during search when a job has a huge error message #1785
  • Very large serialized_params caused dashboard timeout on Heroku #1629
  • [dashboard] Viewing a job & live poll resets the Full Trace vs Application Trace #1606
  • [GoodJob] Notifier errored: NameError: uninitialized constant GoodJob::Job in develpment #1571
  • Bug: calling GoodJob.restart in Puma on_worker_boot still starts GoodJob regardless of it being in async mode or not #1531
  • Discarding a job via the dashboard should also update the discrete_execution #1093
  • A copy of GoodJob::Execution has been removed from the module tree but is still active! #954

Merged pull requests:

v4.19.4 (2026-10-02)

Full Changelog

Merged pull requests:

v4.19.3 (2026-09-21)

... (truncated)

Commits
  • 5171ce3 Release good_job v4.20.0
  • d0843b5 Match identifier-like strings in dashboard search (#1831)
  • deaae2a Preserve active backtrace tabs across live poll refreshes (#1824)
  • 60b3273 Truncate long strings when displaying job params on the dashboard (#1822)
  • 65c2fda Wrap Notifier's NOTIFY recipient dispatch in the Rails executor (#1830)
  • e4ea7f7 Detect Puma worker boot hooks and Puma 8 requests in in_webserver? (#1836)
  • 2a19264 Refetch async navbar values after a live poll refresh (#1823)
  • 4fd029e Pass cron_graceful_restart_period to the CronManager so it takes effect (#1...
  • 3723d8d Finish a job's unfinished executions when it is discarded (#1819)
  • 8186963 Bound all search_text documents under the tsvector size limit (#1820)
  • Additional commits viewable in compare view

Updates lograge from 0.15.0 to 0.15.1

Changelog

Sourced from lograge's changelog.

0.15.1

  • Fully suppress Rails' default Action View logs on Rails 7.1+ by also removing ActionView::LogSubscriber::Start #386
  • Declare logger as a runtime dependency in the gemspec, since it is no longer a default gem in newer Rubies #401
Commits
  • 106e833 Release 0.15.1 (#406)
  • f12d78c Release 0.15.1
  • a66e9bf Unsubscribe all Rails built-in subscribers (#386)
  • 82a899d Match Rails log subscribers explicitly instead of by namespace
  • f3b0e21 Merge branch 'master' into unsubscribe_all_action_view_subscribers_in_rails_71
  • d0b1df5 Merge pull request #401 from leoarnold/leoarnold/gemspec
  • dd847eb Add 'logger' as dependency in gemspec
  • d5b43c6 Merge pull request #405 from roidrage/ci/fix-json3-and-rubocop
  • 4939216 ci: run RuboCop once instead of across the whole matrix
  • f3b821d ci: fix pre-existing failures from json 3.x and RuboCop 1.91
  • Additional commits viewable in compare view

Updates newrelic_rpm from 10.6.0 to 10.9.0

Changelog

Sourced from newrelic_rpm's changelog.

v10.9.0

  • Feature: Continuous Profiling (preview)

    Continuous Profiling is a new feature which is not yet generally available for use. The agent-side component code is now present in the agent but to actually use it ahead of the General Availability release, you will need to contact your New Relic sales representative to join the preview early.

    Continuous Profiling repeatedly samples the Ruby call stacks of your running application and reports them to New Relic, so you can see which methods are consuming the most CPU time (or allocating the most objects) in production, without adding code to your app.

    To turn it on, add the stackprof and google-protobuf gems to your application's Gemfile, then set profiling.enabled to true:

      profiling.enabled: true

    With only profiling.enabled set, the agent samples CPU time every 10 milliseconds for the life of the process. These options let you tune that behavior:

    Configuration name Default Behavior
    profiling.enabled false If true, the agent collects and reports continuous profiling data.
    profiling.include cpu What to sample: cpu for CPU time, or object for object allocations.
    profiling.sample_period 0.01 Seconds between stack samples. Only used when profiling.include is cpu. Must be between 0.000001 and 0.999999.
    profiling.object_allocation_interval 10000 Object allocations between stack samples. Only used when profiling.include is object. Must be between 1000 and 999999.
    profiling.delay 0 Milliseconds to wait before profiling starts. 0 starts immediately.
    profiling.duration 0 Milliseconds to profile before stopping automatically. 0 profiles until the process exits.

    PR#3617

  • Feature: Add support for Dalli 5.1.1

    Dalli 5.1.1 added arguments to some of the methods the agent instruments, which could raise an ArgumentError on multi-key operations or cause request options to be silently dropped. Now, the agent accepts and forwards a variable number of positional and keyword arguments for these methods. PR#3683

v10.8.0

  • Feature: Report a unique hostname for Google Cloud Run Worker Pools and Jobs

    The Cloud Run hostname support added in PR#3609 detected Cloud Run by looking for K_REVISION, which Cloud Run Services set. The agent now also recognizes CLOUD_RUN_REVISION (Worker Pools) and CLOUD_RUN_EXECUTION (Jobs), so utilization.gcp_cloud_run.use_instance_as_host applies to all three resource types. When utilization.gcp_cloud_run.include_revision_in_host is true, the hostname uses whichever of those variables is set, for example {CLOUD_RUN_EXECUTION}-{instance id} on a Job. Issue#3651 Thanks to @​choznerol for contributing this enhancement! PR#3652

  • Feature: Add browser_monitoring.version configuration option

    Customers can now pin the exact browser agent loader version New Relic injects by setting the new browser_monitoring.version configuration option. See the browser agent EOL policy for which versions are currently available and supported.

  • Feature: Add span.kind to background job libraries

    Now, the span.kind attribute will be added to produce and consume operations from background job libraries. This includes ActiveJob, Sidekiq, Resque and DelayedJob. PR#3636

  • Bugfix: DelayedJob instrumentation no longer reinstalls itself on every worker under prepend mode

    When DelayedJob instrumentation is installed via prepend (the default), creating more than one Delayed::Worker in the same process caused the agent to log "Installing DelayedJob instrumentation" and reinitialize the plugin again for each additional worker. This was harmless but noisy; it's now only done once per process, matching the existing chain-instrumentation behavior. PR#3654

  • Bugfix: Allowlisted configuration values are no longer case sensitive

... (truncated)

Commits
  • 694cbe6 Merge pull request #3684 from newrelic/prerelease_updates_10.9.0-pre
  • 91cbbe0 bump version
  • 2738c1a Merge pull request #3617 from newrelic/add_cont_profiling
  • c002128 Update CHANGELOG.md
  • 2e45276 Update test/perfverse/newrelic.yml
  • ab80c6d Merge branch 'dev' into add_cont_profiling
  • 2cbc5a2 Merge pull request #3683 from newrelic/update_support_dalli_511
  • 6da9852 add changelog entry
  • 05de4aa update for other 5.1.1. change, also add test that would have broken before
  • 2fcc321 add support for dalli 5.1.1
  • Additional commits viewable in compare view

Updates pagy from 43.6.1 to 43.7.0

Release notes

Sourced from pagy's releases.

Version 43.7.0

Changes in 43.7.0

  • Refactor the Search::Arguments and Searcher classes to allow more flexibility in chaining queres.
  • Fix the non-standard "previous" link relation in headers_hash and JSON:API urls_hash
    • headers_hash emits the conventional rel="prev" in the link header
    • urls_hash returns the :prev key with jsonapi: true, as the JSON:API specification requires
    • urls_hash keeps the :previous key otherwise
  • Fix series_nav_js ignoring the :slots and :compact helper options
    • The :slots and :compact options passed to the series_nav_js helpers were silently ignored
    • The :steps option overrides the :slots option, while the :compact option applies to all the steps
  • Fix the playground doc URLs and make the playground apps consistent
  • Add :rails_active_search paginator, test and docs

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

  • New :countish Paginator
    • Faster than OFFSET and supporting the full UI
  • New Keynav Pagination
    • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
  • New interactive dev-tools
    • New PagyWand to integrate the pagy CSS with your app themes.
    • New Pagy AI available right inside your own app.
  • Intelligent automation
  • Simpler API
    • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
    • Methods are autoloaded only if used, and consume no memory otherwise.
    • Methods have narrower scopes and can be overridden without deep knowledge.
  • New documentation
    • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.7.0

  • Refactor the Search::Arguments and Searcher classes to allow more flexibility in chaining queres.
  • Fix the non-standard "previous" link relation in headers_hash and JSON:API urls_hash
    • headers_hash emits the conventional rel="prev" in the link header
    • urls_hash returns the :prev key with jsonapi: true, as the JSON:API specification requires
    • urls_hash keeps the :previous key otherwise
  • Fix series_nav_js ignoring the :slots and :compact helper options
    • The :slots and :compact options passed to the series_nav_js helpers were silently ignored
    • The :steps option overrides the :slots option, while the :compact option applies to all the steps
  • Fix the playground doc URLs and make the playground apps consistent
  • Add :rails_active_search paginator, test and docs

Version 43.6.3

  • Deprecate the :max_limit in favor of the more descriptive :client_limit option.

Version 43.6.2

  • Fix nil records returned for Array collections on page overflow (#920) (Fix #919)
Commits
  • 16e2a25 Merge branch 'dev'
  • 6a5a8fc Version 43.7.0
  • 3fbd015 Update gems and packages
  • fecc1d6 Skip console output failure due to different formatting of ruby < 3.4
  • 5ac4cfb 💎 Refactor the Search::Arguments and Searcher classes to allow more flexibili...
  • ac44f13 💎 Fix the non-standard "previous" link relation in headers_hash and JSON:API ...
  • 553a95b 💎 Fix series_nav_js ignoring the :slots and :compact helper options
  • 682a120 Add the script to update the docs console examples, and its test
  • d09d8bb Review the docs for style, consistency and formatting
  • 6471967 💎 Fix the playground doc URLs and make the playground apps consistent
  • Additional commits viewable in compare view

Updates pg from 1.6.3 to 1.7.0

Changelog

Sourced from pg's changelog.

v1.7.0 [2026-10-02] Lars Kanis lars@greiz-reinsdorf.de

Added:

  • Add PG::Connection#embed_params and keyword :typename for its parameter casting. #726 This allows to generate SQL strings with embedded parameters for easier debugging.
  • Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #695
  • Add PG::Result#each_tuple #675
  • Add PG::TypeMap#query_param_encoders to retrieve encoders. #726
  • Deduplicate result field name strings for better performance. #750

Removed:

  • Remove compatibility to ruby < 3.1 and drops support of ruby-2.7 and ruby-3.0. #749
  • Remove GLV unlocking at all functions which process data modifiable in a second thread. #721 This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.
  • Remove :static_symbol result field names. #691
  • Remove enforced rpath addition when no rpath is configured in rbconfig. #699

Fixes:

  • Limit memory allocation on invalid input into PG::BinaryDecoder::Array. #743
  • Free COPY buffers when decoders raise to avoid possible memory leak in get_copy_data. #742
  • Prevent SQL injection in set_client_encoding. #741
  • Add GC_GUARD to temporary ruby objects for conninfo string to avoid it's GC'ed prematurely. #739
  • Remove option "quirks_mode" from JSON en/decoder to fix compat with json-3.0 gem. #737
  • Respect calendar type of Ruby and PostgreSQL. #725
  • Fix broken set_notice_(receiver|processor) callback after GC.compact. #734
  • Disable DNS resolution in ruby when a service file is used, so that the priority of parameters is equal to libpq. #635
  • Use RARRAY_LENINT to avoid possible overflow. #728
  • Fix possible integer overflow at PG::BinaryEncoder::CopyRow and PG::TextEncoder::CopyRow. #714, #715
  • Avoid possible integer overflow in query parameter encoding. #719
  • Ensure conninfo is a valid C string before closing the connection to avoid a double free of PGconn. #709
  • Raise on a too large input string to PG::TextEncoder::Bytea. #717
  • Check PG::BinaryEncoder::CopyRow array input size instead of producing an invalid output.
  • Remove accidentally copied "static" keyword from Copy and Record encoder. #711
  • Avoid possibility to replace typemap while being used in Copy and Record encoders and decoders. #707
  • Add GC_GUARD's for encoding converted strings sent to the server. #705
  • Fix incomplete transaction commit when thread is shutdown ungracefully. #704
  • Assign VALUE after registration per rb_gc_register_address() #703
  • Update dependencies for binary gems to PostgreSQL-18.6, OpenSSL-3.6.5, krb5-1.22.2 #752
Commits
  • fcf40c5 Add new gem signing certificate
  • d41e07a Merge pull request #753 from larskanis/rm-pgsql-10
  • 8e1ee8f Remove some conditions for PostgreSQL-10

@dependabot
Bump the bundler group across 1 directory with 22 updates
8ee0727 
Bumps the bundler group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [rails](https://github.com/rails/rails) | `8.1.3.1` | `8.1.4` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.228.1` | `1.233.1` |
| [bootsnap](https://github.com/rails/bootsnap) | `1.24.6` | `1.26.0` |
| [devise](https://github.com/heartcombo/devise) | `4.9.4` | `5.0.4` |
| [devise_token_auth](https://github.com/lynndylanhurley/devise_token_auth) | `1.2.6` | `1.3.0` |
| [good_job](https://github.com/bensheldon/good_job) | `4.19.2` | `4.20.0` |
| [lograge](https://github.com/roidrage/lograge) | `0.15.0` | `0.15.1` |
| [newrelic_rpm](https://github.com/newrelic/newrelic-ruby-agent) | `10.6.0` | `10.9.0` |
| [pagy](https://github.com/ddnexus/pagy) | `43.6.1` | `43.7.0` |
| [pg](https://github.com/ged/ruby-pg) | `1.6.3` | `1.7.0` |
| [annotaterb](https://github.com/drwl/annotaterb) | `4.24.0` | `4.25.0` |
| [brakeman](https://github.com/presidentbeef/brakeman) | `8.0.5` | `8.1.0` |
| [listen](https://github.com/guard/listen) | `3.10.0` | `3.10.1` |
| [reek](https://github.com/troessner/reek) | `6.5.0` | `6.6.0` |
| [rubocop](https://github.com/rubocop/rubocop) | `1.88.2` | `1.91.0` |
| [rubocop-performance](https://github.com/rubocop/rubocop-performance) | `1.26.1` | `1.27.0` |
| [rubocop-rails](https://github.com/rubocop/rubocop-rails) | `2.36.0` | `2.38.0` |
| [parallel_tests](https://github.com/grosser/parallel_tests) | `5.7.0` | `5.8.0` |
| [pg_query](https://github.com/pganalyze/pg_query) | `6.2.2` | `6.2.5` |
| [rspec-openapi](https://github.com/exoego/rspec-openapi) | `0.31.0` | `0.34.0` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.46.0` | `4.50.0` |
| [webmock](https://github.com/bblimke/webmock) | `3.26.2` | `3.26.4` |



Updates `rails` from 8.1.3.1 to 8.1.4
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v8.1.3.1...v8.1.4)

Updates `aws-sdk-s3` from 1.228.1 to 1.233.1
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `bootsnap` from 1.24.6 to 1.26.0
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](rails/bootsnap@v1.24.6...v1.26.0)

Updates `devise` from 4.9.4 to 5.0.4
- [Release notes](https://github.com/heartcombo/devise/releases)
- [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md)
- [Commits](heartcombo/devise@v4.9.4...v5.0.4)

Updates `devise_token_auth` from 1.2.6 to 1.3.0
- [Changelog](https://github.com/lynndylanhurley/devise_token_auth/blob/master/CHANGELOG.md)
- [Commits](lynndylanhurley/devise_token_auth@v1.2.6...v1.3.0)

Updates `good_job` from 4.19.2 to 4.20.0
- [Release notes](https://github.com/bensheldon/good_job/releases)
- [Changelog](https://github.com/bensheldon/good_job/blob/main/CHANGELOG.md)
- [Commits](bensheldon/good_job@v4.19.2...v4.20.0)

Updates `lograge` from 0.15.0 to 0.15.1
- [Changelog](https://github.com/roidrage/lograge/blob/master/CHANGELOG.md)
- [Commits](roidrage/lograge@v0.15.0...v0.15.1)

Updates `newrelic_rpm` from 10.6.0 to 10.9.0
- [Release notes](https://github.com/newrelic/newrelic-ruby-agent/releases)
- [Changelog](https://github.com/newrelic/newrelic-ruby-agent/blob/dev/CHANGELOG.md)
- [Commits](newrelic/newrelic-ruby-agent@10.6.0...10.9.0)

Updates `pagy` from 43.6.1 to 43.7.0
- [Release notes](https://github.com/ddnexus/pagy/releases)
- [Changelog](https://github.com/ddnexus/pagy/blob/master/docs/CHANGELOG.md)
- [Commits](ddnexus/pagy@43.6.1...43.7.0)

Updates `pg` from 1.6.3 to 1.7.0
- [Changelog](https://github.com/ged/ruby-pg/blob/master/CHANGELOG.md)
- [Commits](ged/ruby-pg@v1.6.3...v1.7.0)

Updates `annotaterb` from 4.24.0 to 4.25.0
- [Changelog](https://github.com/drwl/annotaterb/blob/main/CHANGELOG.md)
- [Commits](drwl/annotaterb@v4.24.0...v4.25.0)

Updates `brakeman` from 8.0.5 to 8.1.0
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](presidentbeef/brakeman@v8.0.5...v8.1.0)

Updates `listen` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/guard/listen/releases)
- [Commits](guard/listen@v3.10.0...v3.10.1)

Updates `reek` from 6.5.0 to 6.6.0
- [Changelog](https://github.com/troessner/reek/blob/master/CHANGELOG.md)
- [Commits](troessner/reek@v6.5.0...v6.6.0)

Updates `rubocop` from 1.88.2 to 1.91.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.88.2...v1.91.0)

Updates `rubocop-performance` from 1.26.1 to 1.27.0
- [Release notes](https://github.com/rubocop/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-performance@v1.26.1...v1.27.0)

Updates `rubocop-rails` from 2.36.0 to 2.38.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rails@v2.36.0...v2.38.0)

Updates `parallel_tests` from 5.7.0 to 5.8.0
- [Changelog](https://github.com/grosser/parallel_tests/blob/master/CHANGELOG.md)
- [Commits](grosser/parallel_tests@v5.7.0...v5.8.0)

Updates `pg_query` from 6.2.2 to 6.2.5
- [Changelog](https://github.com/pganalyze/pg_query/blob/main/CHANGELOG.md)
- [Commits](pganalyze/pg_query@v6.2.2...v6.2.5)

Updates `rspec-openapi` from 0.31.0 to 0.34.0
- [Release notes](https://github.com/exoego/rspec-openapi/releases)
- [Changelog](https://github.com/exoego/rspec-openapi/blob/master/CHANGELOG.md)
- [Commits](exoego/rspec-openapi@v0.31.0...v0.34.0)

Updates `selenium-webdriver` from 4.46.0 to 4.50.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.46.0...selenium-4.50.0)

Updates `webmock` from 3.26.2 to 3.26.4
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.26.2...v3.26.4)

---
updated-dependencies:
- dependency-name: rails
  dependency-version: 8.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: aws-sdk-s3
  dependency-version: 1.233.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: bootsnap
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: devise
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bundler
- dependency-name: devise_token_auth
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: good_job
  dependency-version: 4.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: lograge
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: newrelic_rpm
  dependency-version: 10.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: pagy
  dependency-version: 43.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: pg
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: annotaterb
  dependency-version: 4.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: brakeman
  dependency-version: 8.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: listen
  dependency-version: 3.10.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: reek
  dependency-version: 6.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop
  dependency-version: 1.91.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-performance
  dependency-version: 1.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-rails
  dependency-version: 2.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: parallel_tests
  dependency-version: 5.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: pg_query
  dependency-version: 6.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: rspec-openapi
  dependency-version: 0.34.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: selenium-webdriver
  dependency-version: 4.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: webmock
  dependency-version: 3.26.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Oct 9, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 16, 2026
@dependabot
dependabot Bot deleted the dependabot/bundler/bundler-6060d76a75 branch October 16, 2026 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants