Skip to content

Bump the bundler group across 1 directory with 23 updates - #1456

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-da0fd35929
Open

Bump the bundler group across 1 directory with 23 updates#1456
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-da0fd35929

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 23 updates in the / directory:

Package From To
rails 8.1.3.1 8.1.4
aws-sdk-s3 1.228.1 1.233.2
bootsnap 1.24.6 1.26.0
devise 4.9.4 5.0.4
devise_token_auth 1.2.6 1.3.0
good_job 4.19.2 4.22.0
lograge 0.15.0 0.15.1
newrelic_rpm 10.6.0 10.9.1
pagy 43.6.1 43.7.1
pg 1.6.3 1.7.0
annotaterb 4.24.0 4.25.0
brakeman 8.0.5 8.1.0
listen 3.10.0 3.10.1
reek 6.5.0 6.6.0
rubocop 1.88.2 1.92.0
rubocop-performance 1.26.1 1.27.0
rubocop-rails 2.36.0 2.38.0
rubocop-rspec_rails 2.32.0 2.33.0
parallel_tests 5.7.0 5.8.0
pg_query 6.2.2 6.2.5
rspec-openapi 0.31.0 0.34.0
selenium-webdriver 4.46.0 4.51.0
webmock 3.26.2 3.30.0

Updates rails from 8.1.3.1 to 8.1.4

Release notes

Sourced from rails's releases.

8.1.4

Active Support

  • Fix the debug error page rendering for SyntaxErrors with multi-line messages.

    Marco Roth

  • Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

    Earlopain

  • Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

    Kenta Ishizaki

  • Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

    Kenta Ishizaki

  • Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

    Kenta Ishizaki

  • Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

    Kenta Ishizaki

  • Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

    Kenta Ishizaki

  • Fix number_to_human and number_to_human_size crashing when :precision is nil.

    Kenta Ishizaki

  • Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

    Andrew Novoselac

  • Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

    Kenta Ishizaki

... (truncated)

Commits
  • c3466ea Preparing for 8.1.4 release
  • 334dc3e Merge pull request #58854 from carlosdanielpohlod/strict-locals-ascii-only-body
  • 8df6693 Merge pull request #58827 from rails/backport-alias-fallback-8-1-stable
  • 2ed2c88 Define read_attribute_for_validation instead of aliasing send
  • 2616145 Merge pull request #56705 from p8/activemodel/fix-read-attr-for-serialization...
  • 20abac3 Merge pull request #58817 from yahonda/fix-alias-fallback-to-object-in-attrib...
  • 2670772 Merge pull request #58733 from kwestein/create-or-find-by-deadlock
  • 8236300 Merge pull request #58806 from Shopify/hm-wnqzpryypymkrxtn
  • e6288a8 Update CHANGELOGs for 8-1-stable backports
  • 44a7fd4 Merge pull request #58799 from e-akashsaini/fix-tuple-where-key-corrupting-at...
  • Additional commits viewable in compare view

Updates aws-sdk-s3 from 1.228.1 to 1.233.2

Changelog

Sourced from aws-sdk-s3's changelog.

1.233.2 (2026-10-06)

  • Issue - Fix download_file on TransferManager and Aws::S3::Object leaving a corrupt file at the destination when a part raises a non-StandardError, and leaving a temp file behind when a caller-provided executor rejects a part.

  • Issue - Prevent upload_directory and download_directory on TransferManager from hanging when listing files or objects raises a non-StandardError, such as from a :filter_callback.

1.233.1 (2026-10-01)

  • Issue - Fix unbounded memory growth in upload_stream on TransferManager and Aws::S3::Object when the data source outpaces the upload (#3407).

  • Issue - Prevent upload_file, upload_stream and download_file on TransferManager and Aws::S3::Object from hanging when a worker thread is terminated by a non-StandardError.

1.233.0 (2026-09-30)

  • Feature - Amazon S3 adds a new optional S3 Inventory field, IntelligentTieringReferenceDate, reporting the reference date S3 Intelligent-Tiering uses to evaluate an object's tier-transition eligibility. The value is populated for objects in the Intelligent-Tiering storage class and left blank for others.

1.232.3 (2026-09-28)

  • Issue - Remove :thread_count from transfer options even when a custom :executor is configured on TransferManager, fixing an ArgumentError raised on single-part upload_file calls.

  • Issue - Fix :thread_count being ignored by the deprecated Object#download_file, which always used the default thread count.

1.232.2 (2026-09-25)

  • Issue - Ensure the internally-created executor is shutdown on error in TransferManager and Aws::S3::Object resource methods, preventing leaked worker threads on multipart transfer failures (#3419).

1.232.1 (2026-09-16)

  • Issue - Return the copy response from multipart copy_to/copy_from instead of nil on success.

1.232.0 (2026-09-11)

  • Feature - Updated S3 Object Lock Default Retention documentation.

1.231.0 (2026-09-09)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.230.0 (2026-09-08)

  • Feature - Adds support for Amazon S3 Object Lock variable retention. Existing S3 APIs that support S3 Object Lock parameters now support two new parameters EventHold and EventHoldDuration at the object level, and DefaultEventHoldDuration at the bucket level.

... (truncated)

Commits

Updates bootsnap from 1.24.6 to 1.26.0

Release notes

Sourced from bootsnap's releases.

v1.26.0

What's Changed

  • Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
  • Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
  • Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

v1.25.0

What's Changed

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.26.0

  • Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
  • Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
  • Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

1.25.0

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits
  • 67a7290 Release 1.26.0
  • 1881b9a Merge pull request #573 from byroot/same-size-miscompilation
  • 605bbeb Fix precompilation when regenerating an existing cache entry of the same size
  • 5fd59da Merge pull request #569 from OskarEichler/codex/accept-tempfile-fd-zero
  • 70550c7 Merge pull request #568 from OskarEichler/codex/remove-umask-debug-output
  • 8aed2ed Accept tempfile descriptor zero
  • f7457ea Remove umask debug output
  • 9ee62a2 Merge pull request #567 from byroot/rename-mod
  • 7c8178e Handle write(2) being interrupted.
  • 3e755ca atomic_write_cache_file: stop leaking FD on error
  • Additional commits viewable in compare view

Updates devise from 4.9.4 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

5.0.3 - 2026-03-16

5.0.2 - 2026-02-18

  • enhancements
    • Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825
      • Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.
    • Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

  • bug fixes
    • Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31

  • breaking changes

    • Drop support to Ruby < 2.7

    • Drop support to Rails < 7.0

    • Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

    • Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

    • Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

    • Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

    • Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

    • Remove deprecated Devise.activerecord51? method.

    • Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

      This is potentially a breaking change because Devise previously used the following order to find a secret key:

      app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base

      Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645

    • Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

    • Change <br> tags separating form elements to wrapping them in <p> tags #5494

    • Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

... (truncated)

Commits
  • 9ea459d Release v5.0.4 with sec fix for timeoutable
  • 025fe21 Merge commit from fork
  • 7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
  • 605de86 Update links to https [ci skip]
  • 5e3a8bf Bundle update
  • 5d20277 Cleanup old Rails.version check for db migration path
  • 4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
  • 2f80920 Release v5.0.3
  • 5334707 Add CVE to changelog [ci skip]
  • 0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
  • Additional commits viewable in compare view

Updates devise_token_auth from 1.2.6 to 1.3.0

Commits

Updates good_job from 4.19.2 to 4.22.0

Release notes

Sourced from good_job's releases.

v4.22.0

Review the Changelog for more details.

What's Changed

Full Changelog: bensheldon/good_job@v4.21.1...v4.22.0

v4.21.1

Review the Changelog for more details.

What's Changed

Full Changelog: bensheldon/good_job@v4.21.0...v4.21.1

v4.21.0

Review the Changelog for more details.

What's Changed

New Contributors

Full Changelog: bensheldon/good_job@v4.20.0...v4.21.0

v4.20.0

Review the Changelog for more details.

New features

... (truncated)

Changelog

Sourced from good_job's changelog.

v4.22.0 (2026-10-09)

Full Changelog

Implemented enhancements:

  • Rename max_threads config to threads and deprecate max_threads #1846 (bensheldon)

Closed issues:

  • CI: json 3.0.2 removed quirks_mode, breaking ActiveSupport's JSON encoder on every test job #1816

Merged pull requests:

  • Restore JRuby gems to Gemfile.lock and add a spec guarding it #1861 (bensheldon)
  • Upgrade vendored frontend libraries (Turbo, Stimulus, es-module-shims, Bootstrap, Chart.js) #1860 (bensheldon)
  • Upgrade dev environment: Ruby 4.0.7, Bundler 4.0.22, and gems #1859 (bensheldon)
  • Don't crash demo when git is unavailable (e.g. Heroku) #1858 (bensheldon)
  • Add apply_label: option to good_job_concurrency_rule #1857 (bensheldon)
  • Deprecate good_job_control_concurrency_with and key-only concurrency rules in favor of labels #1856 (bensheldon)
  • Show concurrency claims on the dashboard #1855 (bensheldon)
  • Allow json 3 for Rails versions that support it; pin json < 3 only for older Rails #1854 (bensheldon)

v4.21.1 (2026-10-07)

Full Changelog

Fixed bugs:

  • Fix crash on natural language cron schedules (v4.21.0 regression) #1853 (bensheldon)

Closed issues:

  • v4.21.0 regression: undefined method 'next_time' for an instance of EtOrbi::EoTime #1852

v4.21.0 (2026-10-06)

Full Changelog

Implemented enhancements:

  • Enqueue jobs with concurrency rules individually in bulk/batch, and support Lambda class-level labels #1851 (bensheldon)

Closed issues:

  • perform_limit: 1 permits two same-label jobs to execute concurrently #1843

Merged pull requests:

  • Fix: Run the enqueue concurrency check always after the job's other enqueue callbacks #1850 (bensheldon)

... (truncated)

Commits
  • 30718bb Release good_job v4.22.0
  • 34c2d19 Restore JRuby platform and gems to Gemfile.lock and add a spec to guard it (#...
  • fe3e163 Deprecate good_job_control_concurrency_with and key-only concurrency rules in...
  • b91699c Upgrade vendored frontend libraries (Turbo, Stimulus, es-module-shims, Bootst...
  • 78b5d56 Rename max_threads config to threads and deprecate max_threads (#1846)
  • a12b095 Upgrade dev environment: Ruby 4.0.7, Bundler 4.0.22, and gems (#1859)
  • ad4be5c Don't crash demo when git is unavailable (e.g. Heroku) (#1858)
  • 2cf58a7 Show concurrency claims on the dashboard (#1855)
  • e8b39dd Add apply_label: option to good_job_concurrency_rule (#1857)
  • 53c87fd Allow json 3 for Rails versions that support it; pin json < 3 only for older ...
  • Additional commits viewable in compare view

Updates lograge from 0.15.0 to 0.15.1

Changelog

Sourced from lograge's changelog.

0.15.1

  • Fully suppress Rails' default Action View logs on Rails 7.1+ by also removing ActionView::LogSubscriber::Start #386
  • Declare logger as a runtime dependency in the gemspec, since it is no longer a default gem in newer Rubies #401
Commits
  • 106e833 Release 0.15.1 (#406)
  • f12d78c Release 0.15.1
  • a66e9bf Unsubscribe all Rails built-in subscribers (#386)
  • 82a899d Match Rails log subscribers explicitly instead of by namespace
  • f3b0e21 Merge branch 'master' into unsubscribe_all_action_view_subscribers_in_rails_71
  • d0b1df5 Merge pull request #401 from leoarnold/leoarnold/gemspec
  • dd847eb Add 'logger' as dependency in gemspec
  • d5b43c6 Merge pull request #405 from roidrage/ci/fix-json3-and-rubocop
  • 4939216 ci: run RuboCop once instead of across the whole matrix
  • f3b821d ci: fix pre-existing failures from json 3.x and RuboCop 1.91
  • Additional commits viewable in compare view

Updates newrelic_rpm from 10.6.0 to 10.9.1

Changelog

Sourced from newrelic_rpm's changelog.

v10.9.1

  • Bugfix: Action Controller instrumentation no longer errors when it can't identify the controller class

    When the agent could not identify a request's controller class, it logged TypeError: no implicit conversion of nil into String and then NoMethodError: undefined method 'finish' for nil, and recorded no data for that request. These transactions are now named Controller/(unknown)/<action> and recorded normally. PR#3691

  • Bugfix: Prevent Parallel workers from hanging when reporting large payloads

    When parallel instrumentation was enabled, Parallel.each/Parallel.map with in_processes: could hang forever. Each worker inherited the pipe write ends the agent registered for its earlier siblings, so those pipes couldn't reach end-of-file, and the agent's pipe listener thread blocked waiting on one of them. Any worker whose data exceeded the operating system pipe buffer then blocked on exit. Now, the agent closes each pipe's write end in the parent right after forking, and the listener no longer blocks on a single pipe while others still have data waiting. Thank you to @​yayamochi for reporting this bug. Issue#3680 PR#3688

  • Bugfix: gRPC calls no longer fail on requests from Synthetics monitors

    When a request from a Synthetics monitor made a gRPC call, the agent added X-NewRelic-Synthetics to the call's metadata. gRPC only allows lowercase metadata keys, so the call raised ArgumentError: 'X-NewRelic-Synthetics' is an invalid header key. The agent now sends the synthetics headers in lowercase. gRPC server transactions also now read the synthetics headers from incoming metadata, so a gRPC service called during a Synthetics check records its trace and Synthetics attributes. PR#3693

v10.9.0

  • Feature: Continuous Profiling (preview)

    Continuous Profiling is a new feature which is not yet generally available for use. The agent-side component code is now present in the agent but to actually use it ahead of the General Availability release, you will need to contact your New Relic sales representative to join the preview early.

    Continuous Profiling repeatedly samples the Ruby call stacks of your running application and reports them to New Relic, so you can see which methods are consuming the most CPU time (or allocating the most objects) in production, without adding code to your app.

    To turn it on, add the stackprof and google-protobuf gems to your application's Gemfile, then set profiling.enabled to true:

      profiling.enabled: true

    With only profiling.enabled set, the agent samples CPU time every 10 milliseconds for the life of the process. These options let you tune that behavior:

    Configuration name Default Behavior
    profiling.enabled false If true, the agent collects and reports continuous profiling data.
    profiling.include cpu What to sample: cpu for CPU time, or object for object allocations.
    profiling.sample_period 0.01 Seconds between stack samples. Only used when profiling.include is cpu. Must be between 0.000001 and 0.999999.
    profiling.object_allocation_interval 10000 Object allocations between stack samples. Only used when profiling.include is object. Must be between 1000 and 999999.
    profiling.delay 0 Milliseconds to wait before profiling starts. 0 starts immediately.
    profiling.duration 0 Milliseconds to profile before stopping automatically. 0 profiles until the process exits.

    PR#3617

  • Feature: Add support for Dalli 5.1.1

    Dalli 5.1.1 added arguments to some of the methods the agent instruments, which could raise an ArgumentError on multi-key operations or cause request options to be silently dropped. Now, the agent accepts and forwards a variable number of positional and keyword arguments for these methods. PR#3683

v10.8.0

  • Feature: Report a unique hostname for Google Cloud Run Worker Pools and Jobs

    The Cloud Run hostname support added in PR#3609 detected Cloud Run by looking for K_REVISION, which Cloud Run Services set. The agent now also recognizes CLOUD_RUN_REVISION (Worker Pools) and CLOUD_RUN_EXECUTION (Jobs), so utilization.gcp_cloud_run.use_instance_as_host applies to all three resource types. When utilization.gcp_cloud_run.include_revision_in_host is true, the hostname uses whichever of those variables is set, for example {CLOUD_RUN_EXECUTION}-{instance id} on a Job. Issue#3651 Thanks to @​choznerol for contributing this enhancement! PR#3652

... (truncated)

Commits
  • 7c08652 Merge pull request #3699 from newrelic/prerelease_updates_10.9.1-pre
  • d7293c6 bump version
  • 2c995af Merge pull request #3693 from newrelic/grpc_synthetics_monitoring
  • 8008f90 Refactor
  • 2fd8687 Add changelog and tests
  • 59d2e68 Merge pull request #3696 from newrelic/make_test_app_rails_edge_able
  • 8c5b53b they changed rails edge, the thing we were doing in our test app is illegal now
  • 0b3b3ef Merge pull request #3695 from newrelic/dependabot/github_actions/actions/chec...
  • 32ec933 Bump actions/checkout from 7.0.0 to 7.0.1
  • cde3efe Merge pull request #3694 from newrelic/dependabot/github_actions/ruby/setup-r...
  • Additional commits viewable in compare view

Updates pagy from 43.6.1 to 43.7.1

Release notes

Sourced from pagy's releases.

Version 43.7.1

Changes in 43.7.1

  • Fix the database error on an out-of-range page with a huge page number (#929)

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

  • New :countish Paginator
    • Faster than OFFSET and supporting the full UI
  • New Keynav Pagination
    • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
  • New interactive dev-tools
    • New PagyWand to integrate the pagy CSS with your app themes.
    • New Pagy AI available right inside your own app.
  • Intelligent automation
  • Simpler API
    • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
    • Methods are autoloaded only if used, and consume no memory otherwise.
    • Methods have narrower scopes and can be overridden without deep knowledge.
  • New documentation
    • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

Version 43.7.0

Changes in 43.7.0

  • Refactor the Search::Arguments and Searcher classes to allow more flexibility in chaining queres.

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.7.1

  • Fix the database error on an out-of-range page with a huge page number (#929)

Version 43.7.0

  • Refactor the Search::Arguments and Searcher classes to allow more flexibility in chaining queres.
  • Fix the non-standard "previous" link relation in headers_hash and JSON:API urls_hash
    • headers_hash emits the conventional rel="prev" in the link header
    • urls_hash returns the :prev key with jsonapi: true, as the JSON:API specification requires
    • urls_hash keeps the :previous key otherwise
  • Fix series_nav_js ignoring the :slots and :compact helper options
    • The :slots and :compact options passed to the series_nav_js helpers were silently ignored
    • The :steps option overrides the :slots option, while the :compact option applies to all the steps
  • Fix the playground doc URLs and make the playground apps consistent
  • Add :rails_active_search paginator, test and docs

Version 43.6.3

  • Deprecate the :max_limit in favor of the more descriptive :client_limit option.

Version 43.6.2

  • Fix nil records returned for Array collections on page overflow (#920) (Fix #919)
Commits
  • ebfa409 Merge branch 'dev'
  • 5a51e89 Version 43.7.1
  • 7ce3e02 Update gems and packages
  • fddac83 💎 Fix the database error on an out-of-range page with a huge page number (#929)
  • 8c49d4c Bump actions/upload-artifact from 4 to 7 (#927)
  • 27fbf69 Bump rubygems/configure-rubygems-credentials from 1.0.0 to 2.1.0 (#926)
  • b7b6a83 Fix the docs url override when Publish Docs is triggered by the Release workflow
  • 16e2a25 Merge branch 'dev'
  • 6a5a8fc Version 43.7.0
  • 3fbd015 Update gems and packages
  • Additional commits viewable in compare view

Updates pg from 1.6.3 to 1.7.0

Changelog

Sourced from pg's changelog.

v1.7.0 [2026-10-02] Lars Kanis lars@greiz-reinsdorf.de

Added:

  • Add PG::Connection#embed_params and keyword :typename for its parameter casting. #726 This allows to generate SQL strings with embedded parameters for easier debugging.
  • Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #695
  • Add PG::Result#each_tuple #675
  • Add PG::TypeMap#query_param_encoders to retrieve encoders. #726
  • Deduplicate result field name strings for better performance. #750

Removed:

  • Remove compatibility to ruby < 3.1 and drops support of ruby-2.7 and ruby-3.0. #749
  • Remove GLV unlocking at all functions which process data modifiable in a second thread. #721 This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.
  • Remove :static_symbol result field names. #691
  • Remove enforced rpath addition when no rpath is configured in rbconfig. #699

Fixes:

  • Limit memory allocation on invalid input into PG::BinaryDecoder::Array. #743
  • Free COPY buffers when decoders raise to avoid possible memory leak in get_copy_data. #742
  • Prevent SQL injection in set_client_encoding. #741
  • Add GC_GUARD to temporary ruby objects for conninfo string to avoid it's GC'ed prematurely. #739
  • Remove option "quirks_mode" from JSON en/decoder to fix compat with json-3.0 gem. #737
  • Respect calendar type of Ruby and PostgreSQL. #725
  • Fix broken set_notice_(receiver|processor) callback after GC.compact. #734
  • Disable DNS resolution in ruby when a service file is used, so that the priority of parameters is equal to libpq. #635
  • Use RARRAY_LENINT to avoid possible overflow. #728
  • Fix possible integer overflow at PG::BinaryEncoder::CopyRow and PG::TextEncoder::CopyRow. #714, #715
  • Avoid possible integer overflow in query parameter encoding. #719
  • Ensure conninfo is a valid C string before closing the connection to avoid a double free of PGconn. #709
  • Raise on a too large input string to PG::TextEncoder::Bytea. #717
  • Check PG::BinaryEncoder::CopyRow array input size instead of producing an invalid output.
  • Remove accidentally copied "static" keyword from Copy and Record encoder. #711
  • Avoid possibility to replace typemap while being used in Copy and Record encoders and decoders. #707
  • Add GC_GUARD's for encoding converted strings sent to the server. #705
  • Fix incomplete transaction commit when thread is shutdown ungracefully. #704
  • Assign VALUE after registration per rb_gc_register_address() #703
  • Update dependencies for binary gems to PostgreSQL-18.6, OpenSSL-3.6.5, krb5-1.22.2 #752
Commits

@dependabot
Bump the bundler group across 1 directory with 23 updates
3cdda7b 
Bumps the bundler group with 23 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [rails](https://github.com/rails/rails) | `8.1.3.1` | `8.1.4` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.228.1` | `1.233.2` |
| [bootsnap](https://github.com/rails/bootsnap) | `1.24.6` | `1.26.0` |
| [devise](https://github.com/heartcombo/devise) | `4.9.4` | `5.0.4` |
| [devise_token_auth](https://github.com/lynndylanhurley/devise_token_auth) | `1.2.6` | `1.3.0` |
| [good_job](https://github.com/bensheldon/good_job) | `4.19.2` | `4.22.0` |
| [lograge](https://github.com/roidrage/lograge) | `0.15.0` | `0.15.1` |
| [newrelic_rpm](https://github.com/newrelic/newrelic-ruby-agent) | `10.6.0` | `10.9.1` |
| [pagy](https://github.com/ddnexus/pagy) | `43.6.1` | `43.7.1` |
| [pg](https://github.com/ged/ruby-pg) | `1.6.3` | `1.7.0` |
| [annotaterb](https://github.com/drwl/annotaterb) | `4.24.0` | `4.25.0` |
| [brakeman](https://github.com/presidentbeef/brakeman) | `8.0.5` | `8.1.0` |
| [listen](https://github.com/guard/listen) | `3.10.0` | `3.10.1` |
| [reek](https://github.com/troessner/reek) | `6.5.0` | `6.6.0` |
| [rubocop](https://github.com/rubocop/rubocop) | `1.88.2` | `1.92.0` |
| [rubocop-performance](https://github.com/rubocop/rubocop-performance) | `1.26.1` | `1.27.0` |
| [rubocop-rails](https://github.com/rubocop/rubocop-rails) | `2.36.0` | `2.38.0` |
| [rubocop-rspec_rails](https://github.com/rubocop/rubocop-rspec_rails) | `2.32.0` | `2.33.0` |
| [parallel_tests](https://github.com/grosser/parallel_tests) | `5.7.0` | `5.8.0` |
| [pg_query](https://github.com/pganalyze/pg_query) | `6.2.2` | `6.2.5` |
| [rspec-openapi](https://github.com/exoego/rspec-openapi) | `0.31.0` | `0.34.0` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.46.0` | `4.51.0` |
| [webmock](https://github.com/bblimke/webmock) | `3.26.2` | `3.30.0` |



Updates `rails` from 8.1.3.1 to 8.1.4
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v8.1.3.1...v8.1.4)

Updates `aws-sdk-s3` from 1.228.1 to 1.233.2
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `bootsnap` from 1.24.6 to 1.26.0
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](rails/bootsnap@v1.24.6...v1.26.0)

Updates `devise` from 4.9.4 to 5.0.4
- [Release notes](https://github.com/heartcombo/devise/releases)
- [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md)
- [Commits](heartcombo/devise@v4.9.4...v5.0.4)

Updates `devise_token_auth` from 1.2.6 to 1.3.0
- [Changelog](https://github.com/lynndylanhurley/devise_token_auth/blob/master/CHANGELOG.md)
- [Commits](lynndylanhurley/devise_token_auth@v1.2.6...v1.3.0)

Updates `good_job` from 4.19.2 to 4.22.0
- [Release notes](https://github.com/bensheldon/good_job/releases)
- [Changelog](https://github.com/bensheldon/good_job/blob/main/CHANGELOG.md)
- [Commits](bensheldon/good_job@v4.19.2...v4.22.0)

Updates `lograge` from 0.15.0 to 0.15.1
- [Changelog](https://github.com/roidrage/lograge/blob/master/CHANGELOG.md)
- [Commits](roidrage/lograge@v0.15.0...v0.15.1)

Updates `newrelic_rpm` from 10.6.0 to 10.9.1
- [Release notes](https://github.com/newrelic/newrelic-ruby-agent/releases)
- [Changelog](https://github.com/newrelic/newrelic-ruby-agent/blob/dev/CHANGELOG.md)
- [Commits](newrelic/newrelic-ruby-agent@10.6.0...10.9.1)

Updates `pagy` from 43.6.1 to 43.7.1
- [Release notes](https://github.com/ddnexus/pagy/releases)
- [Changelog](https://github.com/ddnexus/pagy/blob/master/docs/CHANGELOG.md)
- [Commits](ddnexus/pagy@43.6.1...43.7.1)

Updates `pg` from 1.6.3 to 1.7.0
- [Changelog](https://github.com/ged/ruby-pg/blob/master/CHANGELOG.md)
- [Commits](ged/ruby-pg@v1.6.3...v1.7.0)

Updates `annotaterb` from 4.24.0 to 4.25.0
- [Changelog](https://github.com/drwl/annotaterb/blob/main/CHANGELOG.md)
- [Commits](drwl/annotaterb@v4.24.0...v4.25.0)

Updates `brakeman` from 8.0.5 to 8.1.0
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](presidentbeef/brakeman@v8.0.5...v8.1.0)

Updates `listen` from 3.10.0 to 3.10.1
- [Release notes](https://github.com/guard/listen/releases)
- [Commits](guard/listen@v3.10.0...v3.10.1)

Updates `reek` from 6.5.0 to 6.6.0
- [Changelog](https://github.com/troessner/reek/blob/master/CHANGELOG.md)
- [Commits](troessner/reek@v6.5.0...v6.6.0)

Updates `rubocop` from 1.88.2 to 1.92.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.88.2...v1.92.0)

Updates `rubocop-performance` from 1.26.1 to 1.27.0
- [Release notes](https://github.com/rubocop/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-performance@v1.26.1...v1.27.0)

Updates `rubocop-rails` from 2.36.0 to 2.38.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rails@v2.36.0...v2.38.0)

Updates `rubocop-rspec_rails` from 2.32.0 to 2.33.0
- [Release notes](https://github.com/rubocop/rubocop-rspec_rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rspec_rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rspec_rails@v2.32.0...v2.33.0)

Updates `parallel_tests` from 5.7.0 to 5.8.0
- [Changelog](https://github.com/grosser/parallel_tests/blob/master/CHANGELOG.md)
- [Commits](grosser/parallel_tests@v5.7.0...v5.8.0)

Updates `pg_query` from 6.2.2 to 6.2.5
- [Changelog](https://github.com/pganalyze/pg_query/blob/main/CHANGELOG.md)
- [Commits](pganalyze/pg_query@v6.2.2...v6.2.5)

Updates `rspec-openapi` from 0.31.0 to 0.34.0
- [Release notes](https://github.com/exoego/rspec-openapi/releases)
- [Changelog](https://github.com/exoego/rspec-openapi/blob/master/CHANGELOG.md)
- [Commits](exoego/rspec-openapi@v0.31.0...v0.34.0)

Updates `selenium-webdriver` from 4.46.0 to 4.51.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.46.0...selenium-4.51.0)

Updates `webmock` from 3.26.2 to 3.30.0
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.26.2...v3.30.0)

---
updated-dependencies:
- dependency-name: rails
  dependency-version: 8.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: aws-sdk-s3
  dependency-version: 1.233.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: bootsnap
  dependency-version: 1.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: devise
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bundler
- dependency-name: devise_token_auth
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: good_job
  dependency-version: 4.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: lograge
  dependency-version: 0.15.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: newrelic_rpm
  dependency-version: 10.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: pagy
  dependency-version: 43.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: pg
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: annotaterb
  dependency-version: 4.25.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: brakeman
  dependency-version: 8.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: listen
  dependency-version: 3.10.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: reek
  dependency-version: 6.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop
  dependency-version: 1.92.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-performance
  dependency-version: 1.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-rails
  dependency-version: 2.38.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-rspec_rails
  dependency-version: 2.33.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: parallel_tests
  dependency-version: 5.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: pg_query
  dependency-version: 6.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: rspec-openapi
  dependency-version: 0.34.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: selenium-webdriver
  dependency-version: 4.51.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: webmock
  dependency-version: 3.30.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Oct 16, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants