Skip to content

Bump the production-dependencies-major group across 1 directory with 21 updates - #1395

Open
dependabot[bot] wants to merge 1 commit into
supporter_level_goalfrom
dependabot/bundler/production-dependencies-major-92d177b113
Open

Bump the production-dependencies-major group across 1 directory with 21 updates#1395
dependabot[bot] wants to merge 1 commit into
supporter_level_goalfrom
dependabot/bundler/production-dependencies-major-92d177b113

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 19, 2026

Copy link
Copy Markdown

Bumps the production-dependencies-major group with 19 updates in the / directory:

Package From To
rack 2.2.23 2.2.24
stripe 5.55.0 13.5.1
puma 7.2.1 8.0.2
aws-sdk-rails 2.1.0 5.2.0
dalli 3.2.3 5.0.6
colorize 0.8.1 1.1.0
rails-i18n 7.0.10 8.1.0
rails 7.1.5.2 8.1.3.1
devise-two-factor 6.1.0 6.4.0
i18n-js 3.9.2 4.2.4
countries 2.1.2 8.1.0
config 2.2.3 5.6.1
redis 4.2.5 6.0.0
hashie 4.0.0 5.1.0
connection_pool 2.5.3 3.0.2
barnes 0.0.8 1.0.1
rack-cors 2.0.2 3.0.0
rack 2.2.24 3.2.7
sprockets 3.7.5 4.4.0
rack-attack 6.5.0 6.8.0

Updates rack from 2.2.23 to 2.2.24

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

SPEC Changes

Added

  • Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @​codergeek121)
  • Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @​skipkayhil)
  • Add support for streaming bodies when using Rack::Events. (#2375, @​unflxw)
  • Add deflaters option to Rack::Deflater to enable custom compression algorithms like zstd. (#2168, @​alexanderadam)
  • Add Rack::Request#prefetch? for identifying requests with Sec-Purpose: prefetch header set. (#2405, @​glaszig)
  • Add rack.request.config environment key to configure Rack::Request behavior.
  • Add Rack::Request#headers for simpler access to request headers by header name. (#1881, @​jeremyevans)
  • Allow disabling the Rack::QueryParser bytesize and params limits by passing nil for the bytesize_limit/params_limit keyword arguments, or a negative value for RACK_QUERY_PARSER_BYTESIZE_LIMIT/RACK_QUERY_PARSER_PARAMS_LIMIT. (#2492, @​alpaca-tc)

Changed

  • Require Ruby 2.7.3 or newer and replace ruby2_keywords with argument forwarding.
  • Raise before exceeding a part limit, not after. (#2362, @​matthew-puku)
  • Rack::Deflater now uses a fixed GZip mtime value. (#2372, @​bensheldon)
  • Multipart parser drops support for RFC 2231 filename* parameter (prohibited by RFC 7578) and now properly handles UTF-8 encoded filenames via percent-encoding and direct UTF-8 bytes. (#2398, @​wtn)
  • The query parser now raises Rack::QueryParser::IncompatibleEncodingError if we try to parse params that are not ASCII compatible. (#2416, @​bquorning)
  • The mime type for .pem files has been changed from application/x-x509-ca-cert to application/x-pem-file. (#2435, @​jeremyevans)
  • Freeze Rack::Auth::AbstractRequest::AUTHORIZATION_KEYS, Rack::Utils::STATUS_WITH_NO_ENTITY_BODY, Rack::Multipart::Parser::EMPTY, Rack::Utils.default_query_parser, and internal constants in Rack::Lint. (#2428, @​jhawthorn)

Fixed

  • Rack::Multipart::UploadedFile now delegates keyword arguments to the wrapped tempfile. Calls such as uploaded_file.readlines(chomp: true) raised TypeError on Ruby 3.0+. (#2481, #2499, @​SeanLF)
  • Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)
  • Multipart parser: add nil guards to prevent NoMethodError crashes when handling Content-Disposition without parameters and Content-Type parameters without '='. (@​haruki0409)

[3.2.6] - 2026-04-01

Security

  • CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.
  • CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.
  • CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.
  • CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.
  • CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.
  • CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.
  • CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.
  • CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.
  • CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.

... (truncated)

Commits

Updates stripe from 5.55.0 to 13.5.1

Changelog

Sourced from stripe's changelog.

Changelog

19.5.0 - 2026-08-10

  • #1932 Handle break in auto-paging blocks

    • Rescues LocalJumpError to prevent crash when calling break inside an auto_paging_each

  • #1927 Surface object property on EventNotification

  • #1918 add/adjust event parsing helpers

    • Added methods that return their respective Event/EventNotification class instances without verifying authenticity. Use them when you've previously verified an event (e.g. you verified, put the event in a queue, and are now processing). Supports events from AWS EventBridge and Azure Event Grid natively.
      • Webhook#construct_event_without_verification(payload)
      • StripeClient#parse_event_notification_without_verification(payload)

  • #1924 Discard the connection when a request is interrupted

    • Fix connection reuse after a request is interrupted by a non-StandardError exception (e.g. from rack-timeout), which could cause subsequent requests to receive a previous request's response

19.4.0 - 2026-07-29

This release changes the pinned API version to 2026-07-29.dahlia.

  • #1913 Update generated code
    • Add support for new resource FinancialConnections::Authorization
    • Add support for unreject method on resource Account
    • Add support for list method on resource PaymentRecord
    • Add support for smart_disputes_management on AccountSession::Component::DisputesList::Feature, AccountSession::Component::Payment::Feature, AccountSession::Component::PaymentDetail::Feature, AccountSession::Component::PaymentDispute::Feature, AccountSessionCreateParams::Component::DisputesList::Feature, AccountSessionCreateParams::Component::Payment::Feature, AccountSessionCreateParams::Component::PaymentDetail::Feature, and AccountSessionCreateParams::Component::PaymentDispute::Feature
    • Add support for administrative_address and principal_place_of_business on Account::Company, AccountCreateParams::Company, AccountUpdateParams::Company, and TokenCreateParams::Account::Company
    • Add support for sepa_debit_payments on AccountUpdateParams::Setting
    • Remove support for proof_of_registration on AccountCreateParams::Document. This field was limited-use and is being deprecated.
    • Add support for payouts_action on AccountRejectParams
    • Remove support for dynamic_tax_rates on Checkout::SessionCreateParams::LineItem. This field was limited-use and is being deprecated.
    • Add support for setup_future_usage on Checkout::Session::PaymentMethodOption::Payco, Checkout::Session::PaymentMethodOption::SamsungPay, Checkout::SessionCreateParams::PaymentMethodOption::Payco, Checkout::SessionCreateParams::PaymentMethodOption::SamsungPay, PaymentIntent::PaymentMethodOption::Payco, PaymentIntent::PaymentMethodOption::SamsungPay, PaymentIntentConfirmParams::PaymentMethodOption::Payco, PaymentIntentConfirmParams::PaymentMethodOption::SamsungPay, PaymentIntentCreateParams::PaymentMethodOption::Payco, PaymentIntentCreateParams::PaymentMethodOption::SamsungPay, PaymentIntentUpdateParams::PaymentMethodOption::Payco, PaymentIntentUpdateParams::PaymentMethodOption::SamsungPay, and PaymentLinkUpdateParams::PaymentIntentDatum
    • Add support for network on Dispute::PaymentMethodDetail::Card
    • Add support for limits and manual_entry on FinancialConnections::SessionCreateParams and FinancialConnections::Session
    • Add support for require_payment_method_support on FinancialConnections::Session::Filter and FinancialConnections::SessionCreateParams::Filter
    • Add support for bank_account_token on FinancialConnections::Session
    • Add support for metadata on InvoiceCreatePreviewParams::SubscriptionDetail
    • Add support for business_name on Issuing::Card::Shipping, Issuing::CardCreateParams::Shipping, and Issuing::CardUpdateParams::Shipping
    • Add support for allowed_payment_method_types on PaymentIntentConfirmParams, PaymentIntentCreateParams, PaymentIntentUpdateParams, PaymentIntent, SetupIntentConfirmParams, SetupIntentCreateParams, SetupIntentUpdateParams, and SetupIntent
    • Add support for referrer on PaymentIntentConfirmParams::RadarOption and PaymentIntentCreateParams::RadarOption
    • Add support for consent_collection and shipping_options on PaymentLinkUpdateParams
    • Add support for custom_fields, description, and footer on Quote::InvoiceSetting, QuoteCreateParams::InvoiceSetting, QuoteUpdateParams::InvoiceSetting, SubscriptionSchedule::DefaultSetting::InvoiceSetting, SubscriptionSchedule::Phase::InvoiceSetting, SubscriptionScheduleCreateParams::DefaultSetting::InvoiceSetting, SubscriptionScheduleCreateParams::Phase::InvoiceSetting, SubscriptionScheduleUpdateParams::DefaultSetting::InvoiceSetting, and SubscriptionScheduleUpdateParams::Phase::InvoiceSetting
    • Add support for customer_account and customer on Refund
    • Add support for payment_method on Refund and Topup
    • Add support for trial on SubscriptionSchedule::Phase
    • Add support for mass_transit_parking_tax and parking_tax on Tax::Registration::CountryOption::Me and Tax::RegistrationCreateParams::CountryOption::Me
    • Add support for initiated_by and payment_method_options on Topup
    • Add support for additional_addresses on V2::Core::Account::Identity::BusinessDetail, V2::Core::AccountCreateParams::Identity::BusinessDetail, V2::Core::AccountTokenCreateParams::Identity::BusinessDetail, and V2::Core::AccountUpdateParams::Identity::BusinessDetail
  • #1906 Adds error_object.rbi file, allowing users to get full typing for API Error Objects

19.3.1 - 2026-07-15

  • #1902 Replace source hash with Telemetry UUID
  • #1901 Make Error fields generated

... (truncated)

Commits

Updates puma from 7.2.1 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

v8.0.1

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

  • Breaking changes

    • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)
Commits

Updates aws-sdk-rails from 2.1.0 to 5.2.0

Release notes

Sourced from aws-sdk-rails's releases.

Release v5.2.0 - 2026-08-11

Tag release v5.2.0

References: #169, #171, #172, #173

  • Issue - The ElasticBeanstalkSQSD middleware's Docker host check now only consults remote_addr, the raw TCP peer address, instead of also accepting remote_ip. remote_ip is derived from the client-supplied X-Forwarded-For header whenever the peer address is itself private, so a request from any private address could name the Docker gateway and be treated as local. Loopback peer addresses are accepted by the check, so requests proxied over loopback are unaffected.
  • Issue - Only classes inheriting from ActiveJob::Base are executed by the ElasticBeanstalkSQSD middleware, preventing arbitrary classes named in an SQS message from being instantiated and run. Job class and periodic task names are validated as constant paths and resolved without searching the namespace's ancestors, so a request cannot name a constant outside the intended namespace.
  • Feature - Adds a new configuration object for elastic beanstalk sqsd middleware, with an optional job_class_allowlist configuration to ElasticBeanstalkSQSD middleware to restrict which job classes can be dispatched. When set, the allowlist is checked before the class name is resolved, so an excluded class is never loaded.

Release v5.1.0 - 2024-12-05

Tag release v5.1.0

References: #168

  • Feature - Support async job processing in Elastic Beanstalk middleware. (#167)

Release v5.0.0 - 2024-11-21

Tag release v5.0.0

References: #166

  • Feature - [Major Version] Remove dependencies on modular feature gems: aws-actiondispatch-dynamodb, aws-actionmailer-ses, aws-actionmailbox-ses, aws-activejob-sqs, and aws-record-rails.

  • Issue - Remove Aws::Rails.add_action_mailer_delivery_method in favor of ActionMailer::Base.add_delivery_method or the Railtie and configuration in aws-actionmailer-ses ~> 1.

  • Issue - Remove require of aws/rails/action_mailbox/rspec in favor of aws/action_mailbox/ses/rspec.

  • Issue - Remove symlinked namespaces from previous major versions.

  • Feature - ActiveSupport::Notifications are enabled by default and removes Aws::Rails.instrument_sdk_operations.

  • Feature - Moved railtie initializations to their appropriate spots.

  • Issue - Do not execute ActiveJob from EB cron without the root path.

Release v4.2.0 - 2024-11-20

Tag release v4.2.0

References: #147, #148, #149, #152, #153, #156, #157, #159, #160, #161, #162, #163, #164

  • Feature - DynamoDB Session Storage features now live in the aws-actiondispatch-dynamodb gem. This gem depends on aws-sessionstore-dynamodb ~> 3 which depends on rack ~> 3.

  • Feature - Add session store config generation with rails generate dynamo_db:session_store_config. Config generation is no longer tied to the DynamoDB SessionStore ActiveRecord migration generator.

  • Issue - ActionDispatch::Session::DynamoDbStore now inherits ActionDispatch::Session::AbstractStore by wrapping Aws::SessionStore::DynamoDB::RackMiddleware.

  • Issue - DynamoDbStore is now configured with the :dynamo_db_store configuration instead of :dynamodb_store.

  • Feature - Session Store configuration passed into :dynamo_db_store in an initializer will now be considered when using the ActiveRecord migrations or rake tasks that create, delete, or clean session tables.

... (truncated)

Changelog

Sourced from aws-sdk-rails's changelog.

5.2.0 (2026-08-11)

  • Issue - The ElasticBeanstalkSQSD middleware's Docker host check now only consults remote_addr, the raw TCP peer address, instead of also accepting remote_ip. remote_ip is derived from the client-supplied X-Forwarded-For header whenever the peer address is itself private, so a request from any private address could name the Docker gateway and be treated as local. Loopback peer addresses are accepted by the check, so requests proxied over loopback are unaffected.
  • Issue - Only classes inheriting from ActiveJob::Base are executed by the ElasticBeanstalkSQSD middleware, preventing arbitrary classes named in an SQS message from being instantiated and run. Job class and periodic task names are validated as constant paths and resolved without searching the namespace's ancestors, so a request cannot name a constant outside the intended namespace.
  • Feature - Adds a new configuration object for elastic beanstalk sqsd middleware, with an optional job_class_allowlist configuration to ElasticBeanstalkSQSD middleware to restrict which job classes can be dispatched. When set, the allowlist is checked before the class name is resolved, so an excluded class is never loaded.

5.1.0 (2024-12-05)

  • Feature - Support async job processing in Elastic Beanstalk middleware. (#167)

5.0.0 (2024-11-21)

  • Feature - [Major Version] Remove dependencies on modular feature gems: aws-actiondispatch-dynamodb, aws-actionmailer-ses, aws-actionmailbox-ses, aws-activejob-sqs, and aws-record-rails.

  • Issue - Remove Aws::Rails.add_action_mailer_delivery_method in favor of ActionMailer::Base.add_delivery_method or the Railtie and configuration in aws-actionmailer-ses ~> 1.

  • Issue - Remove require of aws/rails/action_mailbox/rspec in favor of aws/action_mailbox/ses/rspec.

  • Issue - Remove symlinked namespaces from previous major versions.

  • Feature - ActiveSupport::Notifications are enabled by default and removes Aws::Rails.instrument_sdk_operations.

  • Feature - Moved railtie initializations to their appropriate spots.

  • Issue - Do not execute ActiveJob from EB cron without the root path.

4.2.0 (2024-11-20)

  • Feature - DynamoDB Session Storage features now live in the aws-actiondispatch-dynamodb gem. This gem depends on aws-sessionstore-dynamodb ~> 3 which depends on rack ~> 3.

  • Feature - Add session store config generation with rails generate dynamo_db:session_store_config. Config generation is no longer tied to the DynamoDB SessionStore ActiveRecord migration generator.

  • Issue - ActionDispatch::Session::DynamoDbStore now inherits ActionDispatch::Session::AbstractStore by wrapping Aws::SessionStore::DynamoDB::RackMiddleware.

  • Issue - DynamoDbStore is now configured with the :dynamo_db_store configuration instead of :dynamodb_store.

  • Feature - Session Store configuration passed into :dynamo_db_store in an initializer will now be considered when using the ActiveRecord migrations or rake tasks that create, delete, or clean session tables.

  • Feature - AWS_DYNAMO_DB_SESSION_CONFIG_FILE is now searched and with precedence over the default Rails configuration YAML file locations.

  • Feature - Prepare modularization of aws-record.

  • Issue - Do not skip autoload modules for Aws::Rails.instrument_sdk_operations.

  • Feature - ActionMailer SES and SESV2 mailers now live in the aws-actionmailer-ses gem.

... (truncated)

Commits
  • c3dd488 Bumped version to v5.2.0
  • 47d6012 fix: Address docker origin check vulnerability. (#173)
  • 97341bf feat: Restrict which job classes the Elastic Beanstalk SQSD middleware will e...
  • fb36ed4 Address review comments.
  • 3fe2d3d Address 2nd pass review from Juli
  • 47155fb Address review: use .configure block, custom error, changelog wording
  • 7e32710 Rubocop
  • f8aa6f4 rubocop & pin rdoc
  • 668c971 Add job class validation, optional allowlist config option, tests, and update...
  • 70b1d27 Update CI (#171)
  • Additional commits viewable in compare view

Updates dalli from 3.2.3 to 5.0.6

Release notes

Sourced from dalli's releases.

v5.0.6

Performance:

  • Skip the cas-return flag on quiet meta_set requests (#1131)

    • In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request
    • Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Reduce allocations in KeyRegularizer and multi-key request paths (#1120)

    • Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value
    • Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseBuffer pipelined getk parsing (#1117)

    • process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response
    • Also skips trailing nils in the token array
    • Thanks to Jean Boussier for this contribution

  • Enable frozen string literals in RequestFormatter (#1118)

    • Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseProcessor#value_from_tokens (#1113)

    • token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons
    • Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in common operation paths (#1111)

    • Use Symbol#name over Symbol#to_s to return a frozen string without allocation
    • Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled
    • Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation
    • Use match? in KeyRegularizer#encode to avoid MatchData object allocation
    • Reduces objects allocated by ~26% and memory by ~6% for a simple get workload
    • Thanks to Jean Boussier for this contribution

  • Fix pathological memory behavior in ResponseBuffer (#1114)

    • compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original
    • Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read
    • Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations
    • Accompanied by new unit tests for ResponseBuffer (#1115)
    • Thanks to Jean Boussier for this contribution

Features:

  • delete_multi now returns the number of keys found and deleted (#1126)
    • Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed
    • The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted
    • The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted
    • Thanks to Iliana Hadzhiatanasova for this contribution

... (truncated)

Changelog

Sourced from dalli's changelog.

5.0.6

Performance:

  • Skip the cas-return flag on quiet meta_set requests (#1131)

    • In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request
    • Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Reduce allocations in KeyRegularizer and multi-key request paths (#1120)

    • Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value
    • Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseBuffer pipelined getk parsing (#1117)

    • process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response
    • Also skips trailing nils in the token array
    • Thanks to Jean Boussier for this contribution

  • Enable frozen string literals in RequestFormatter (#1118)

    • Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseProcessor#value_from_tokens (#1113)

    • token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons
    • Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in common operation paths (#1111)

    • Use Symbol#name over Symbol#to_s to return a frozen string without allocation
    • Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled
    • Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation
    • Use match? in KeyRegularizer#encode to avoid MatchData object allocation
    • Reduces objects allocated by ~26% and memory by ~6% for a simple get workload
    • Thanks to Jean Boussier for this contribution

  • Fix pathological memory behavior in ResponseBuffer (#1114)

    • compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original
    • Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read
    • Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations
    • Accompanied by new unit tests for ResponseBuffer (#1115)
    • Thanks to Jean Boussier for this contribution

Features:

  • delete_multi now returns the number of keys found and deleted (#1126)
    • Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed
    • The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted
    • The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted

... (truncated)

Commits

Updates colorize from 0.8.1 to 1.1.0

Changelog

Sourced from colorize's changelog.

1.1.0 / 2023-06-22

  • make readline support optional

1.0.5 / 2023-06-22

  • (backwards compatibility) purple -> magenta

1.0.3 / 2023-06-21

  • fix ? ommit

1.0.2 / 2023-06-21

  • check if color exists when extending class

1.0.1 / 2023-06-19

  • fix maching of colorized strings without readline characters

1.0.0 / 2023-06-19

  • add more modes
  • add aliases
  • grey and gray default aliases
  • update dependencies
  • add non-visible text delimiters
  • add prevent_color switch
  • cleanup and refactor
Commits

Updates rails-i18n from 7.0.10 to 8.1.0

Changelog

Sourced from rails-i18n's changelog.

8.1.0 (2025-11-24)

  • Update following locales:
    • Korean (ko): Remove %{attribute} placeholder from error messages
    • German (de): Add missing key (errors.messages.in)
    • Italian (it): Add missing key (errors.messages, errors.messages.password_too_long, number.currency.format.negative_format, number.format.round_mode, number.human.storage_units.units.zb)
    • Ukrainian (uk): Add missing key (errors.messages.in)
  • Update to Rails 8.1.x

8.0.2 (2025-08-16)

  • Update following locales:
    • Japanese (ja): Add missing key (errors.messages.password_too_long, currency.format.negative_format, storage_units.units.zb)
    • German (de, de-DE, de-AT, de-CH): Add missing key (password_too_long)
    • Malayalam (ml): Add missing key (datetime.distance_in_words.x_years.one, datetime.distance_in_words.x_years.other, errors.messages.in, errors.messages.password_too_long, currency.format.negative_format, number.format.round_mode, storage_units.units.eb, storage_units.units.pb, storage_units.units.zb). Fix translation (activerecord.errors.messages.record_invalid, errors.messages.other_than, number.currency.format.unit)
    • Serbian Cyrillic (sr): Fix date format, February typo, and RSD unit
    • Basque (eu): Fixed week day abbreviations, fix percentage symbol position (number.percentage.format)
    • Croatian (hr), Serbian Cyrillic (sr) and Serbian Latin (scr): Add proper plural forms to decimal units
    • Add following locales:
      • Montenegrin (cnr)
      • Armenian (hy)

8.0.1 (2024-11-10)

  • Update following locales:
    • English (en): Add missing key (password_too_long)
    • Portuguese (pt): Add missing keys (password_too_long, negative_format, and zb)
  • Update Gemfile

8.0.0 (2024-11-10)

  • Update to Rails 8.0.x
  • Drop support for Ruby 3.0 and 3.1
Commits
  • 32a4583 8.1.0 release
  • 2cb420d Merge pull request #1155 from pcreux/fix-ko
  • 2714995 Merge branch 'master' into fix-ko
  • 0beeb2c Merge pull request #1157 from rakvium/patch-2
  • 8b84e43 Merge pull request #1156 from rakvium/patch-1
  • b9089de Update CHANGELOG.md: add uk.errors.messages.in
  • 863d59a Update CHANGELOG.md: add de.errors.messages.in
  • 64ecb5a Add uk.errors.messages.in
  • 8dfce30 Add de.errors.messages.in

@dependabot
Bump the production-dependencies-major group across 1 directory with …
c4776b5 
…21 updates

Bumps the production-dependencies-major group with 19 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [rack](https://github.com/rack/rack) | `2.2.23` | `2.2.24` |
| [stripe](https://github.com/stripe/stripe-ruby) | `5.55.0` | `13.5.1` |
| [puma](https://github.com/puma/puma) | `7.2.1` | `8.0.2` |
| [aws-sdk-rails](https://github.com/aws/aws-sdk-rails) | `2.1.0` | `5.2.0` |
| [dalli](https://github.com/petergoldstein/dalli) | `3.2.3` | `5.0.6` |
| [colorize](https://github.com/fazibear/colorize) | `0.8.1` | `1.1.0` |
| [rails-i18n](https://github.com/svenfuchs/rails-i18n) | `7.0.10` | `8.1.0` |
| [rails](https://github.com/rails/rails) | `7.1.5.2` | `8.1.3.1` |
| [devise-two-factor](https://github.com/tinfoil/devise-two-factor) | `6.1.0` | `6.4.0` |
| [i18n-js](https://github.com/fnando/i18n-js) | `3.9.2` | `4.2.4` |
| [countries](https://github.com/countries/countries) | `2.1.2` | `8.1.0` |
| [config](https://github.com/rubyconfig/config) | `2.2.3` | `5.6.1` |
| [redis](https://github.com/redis/redis-rb) | `4.2.5` | `6.0.0` |
| [hashie](https://github.com/hashie/hashie) | `4.0.0` | `5.1.0` |
| [connection_pool](https://github.com/mperham/connection_pool) | `2.5.3` | `3.0.2` |
| [barnes](https://github.com/heroku/barnes) | `0.0.8` | `1.0.1` |
| [rack-cors](https://github.com/cyu/rack-cors) | `2.0.2` | `3.0.0` |
| [rack](https://github.com/rack/rack) | `2.2.24` | `3.2.7` |
| [sprockets](https://github.com/rails/sprockets) | `3.7.5` | `4.4.0` |
| [rack-attack](https://github.com/rack/rack-attack) | `6.5.0` | `6.8.0` |



Updates `rack` from 2.2.23 to 2.2.24
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v2.2.23...v2.2.24)

Updates `stripe` from 5.55.0 to 13.5.1
- [Release notes](https://github.com/stripe/stripe-ruby/releases)
- [Changelog](https://github.com/stripe/stripe-ruby/blob/master/CHANGELOG.md)
- [Commits](stripe/stripe-ruby@v5.55.0...v13.5.1)

Updates `puma` from 7.2.1 to 8.0.2
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v7.2.1...v8.0.2)

Updates `aws-sdk-rails` from 2.1.0 to 5.2.0
- [Release notes](https://github.com/aws/aws-sdk-rails/releases)
- [Changelog](https://github.com/aws/aws-sdk-rails/blob/main/CHANGELOG.md)
- [Commits](aws/aws-sdk-rails@v2.1.0...v5.2.0)

Updates `dalli` from 3.2.3 to 5.0.6
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](petergoldstein/dalli@v3.2.3...v5.0.6)

Updates `colorize` from 0.8.1 to 1.1.0
- [Changelog](https://github.com/fazibear/colorize/blob/master/CHANGELOG.md)
- [Commits](https://github.com/fazibear/colorize/commits)

Updates `rails-i18n` from 7.0.10 to 8.1.0
- [Changelog](https://github.com/svenfuchs/rails-i18n/blob/master/CHANGELOG.md)
- [Commits](svenfuchs/rails-i18n@v7.0.10...v8.1.0)

Updates `rails` from 7.1.5.2 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v7.1.5.2...v8.1.3.1)

Updates `devise-two-factor` from 6.1.0 to 6.4.0
- [Release notes](https://github.com/tinfoil/devise-two-factor/releases)
- [Changelog](https://github.com/devise-two-factor/devise-two-factor/blob/main/CHANGELOG.md)
- [Commits](devise-two-factor/devise-two-factor@v6.1.0...v6.4.0)

Updates `i18n-js` from 3.9.2 to 4.2.4
- [Changelog](https://github.com/fnando/i18n-js/blob/main/CHANGELOG.md)
- [Commits](fnando/i18n-js@v3.9.2...v4.2.4)

Updates `countries` from 2.1.2 to 8.1.0
- [Release notes](https://github.com/countries/countries/releases)
- [Changelog](https://github.com/countries/countries/blob/master/CHANGELOG.md)
- [Upgrade guide](https://github.com/countries/countries/blob/master/UPGRADE.md)
- [Commits](countries/countries@v2.1.2...v8.1.0)

Updates `config` from 2.2.3 to 5.6.1
- [Release notes](https://github.com/rubyconfig/config/releases)
- [Changelog](https://github.com/rubyconfig/config/blob/master/CHANGELOG.md)
- [Commits](rubyconfig/config@2.2.3...5.6.1)

Updates `redis` from 4.2.5 to 6.0.0
- [Release notes](https://github.com/redis/redis-rb/releases)
- [Changelog](https://github.com/redis/redis-rb/blob/master/CHANGELOG.md)
- [Commits](redis/redis-rb@v4.2.5...v6.0.0)

Updates `hashie` from 4.0.0 to 5.1.0
- [Release notes](https://github.com/hashie/hashie/releases)
- [Changelog](https://github.com/hashie/hashie/blob/master/CHANGELOG.md)
- [Commits](hashie/hashie@v4.0.0...v5.1.0)

Updates `connection_pool` from 2.5.3 to 3.0.2
- [Changelog](https://github.com/mperham/connection_pool/blob/main/Changes.md)
- [Commits](mperham/connection_pool@v2.5.3...v3.0.2)

Updates `barnes` from 0.0.8 to 1.0.1
- [Changelog](https://github.com/heroku/barnes/blob/main/CHANGELOG.md)
- [Commits](heroku/barnes@v0.0.8...v1.0.1)

Updates `rack-cors` from 2.0.2 to 3.0.0
- [Changelog](https://github.com/cyu/rack-cors/blob/master/CHANGELOG.md)
- [Commits](cyu/rack-cors@v2.0.2...v3.0.0)

Updates `rack` from 2.2.24 to 3.2.7
- [Release notes](https://github.com/rack/rack/releases)
- [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md)
- [Commits](rack/rack@v2.2.23...v2.2.24)

Updates `sprockets` from 3.7.5 to 4.4.0
- [Release notes](https://github.com/rails/sprockets/releases)
- [Changelog](https://github.com/rails/sprockets/blob/main/CHANGELOG.md)
- [Commits](rails/sprockets@v3.7.5...v4.4.0)

Updates `rack-attack` from 6.5.0 to 6.8.0
- [Release notes](https://github.com/rack/rack-attack/releases)
- [Changelog](https://github.com/rack/rack-attack/blob/main/CHANGELOG.md)
- [Commits](rack/rack-attack@v6.5.0...v6.8.0)

Updates `activerecord` from 7.1.5.2 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/activerecord/CHANGELOG.md)
- [Commits](rails/rails@v7.1.5.2...v8.1.3.1)

Updates `actionpack` from 7.1.5.2 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v8.1.3.1/actionpack/CHANGELOG.md)
- [Commits](rails/rails@v7.1.5.2...v8.1.3.1)

---
updated-dependencies:
- dependency-name: rack
  dependency-version: 2.2.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies-major
- dependency-name: stripe
  dependency-version: 13.5.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: puma
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: aws-sdk-rails
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: dalli
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: colorize
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: rails-i18n
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: rails
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: devise-two-factor
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies-major
- dependency-name: i18n-js
  dependency-version: 4.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: countries
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: config
  dependency-version: 5.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: redis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: hashie
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: connection_pool
  dependency-version: 3.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: barnes
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: rack-cors
  dependency-version: 3.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: rack
  dependency-version: 3.2.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: sprockets
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: rack-attack
  dependency-version: 6.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies-major
- dependency-name: activerecord
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
- dependency-name: actionpack
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 19, 2026
@dependabot
dependabot Bot requested a review from wwahammy as a code owner August 19, 2026 03:00
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 19, 2026
@dependabot dependabot Bot mentioned this pull request Aug 19, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wwahammy wwahammy Awaiting requested review from wwahammy wwahammy is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants