Skip to content

Bump the ruby-security-and-maintenance group across 1 directory with 4 updates - #17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/api/ruby-security-and-maintenance-c245607539
Open

Bump the ruby-security-and-maintenance group across 1 directory with 4 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/api/ruby-security-and-maintenance-c245607539

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 22, 2026 •
edited by greptile-apps Bot
Loading

Copy link
Copy Markdown

Bumps the ruby-security-and-maintenance group with 4 updates in the /api directory: bootsnap, brakeman, resend and solid_queue.

Updates bootsnap from 1.24.1 to 1.25.0

Release notes

Sourced from bootsnap's releases.

v1.25.0

What's Changed

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

v1.24.6

What's Changed

  • Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

Full Changelog: rails/bootsnap@v1.24.5...v1.24.6

v1.24.5

What's Changed

  • No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

Full Changelog: rails/bootsnap@v1.24.4...v1.24.5

v1.24.4

What's Changed

  • Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
  • Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
  • Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
  • Avoid leaking a private method in Object when testing for Parse.y bugs.

Full Changelog: rails/bootsnap@v1.24.3...v1.24.4

v1.24.3

  • Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

Full Changelog: rails/bootsnap@v1.24.2...v1.24.3

v1.24.2

... (truncated)

Changelog

Sourced from bootsnap's changelog.

1.25.0

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

1.24.6

  • Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

1.24.5

  • No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

1.24.4

  • Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
  • Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
  • Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
  • Avoid leaking a private method in Object when testing for Parse.y bugs.

1.24.3

  • Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

1.24.2

  • Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023
Commits
  • e099ec7 Release 1.25.0
  • b694a11 Merge pull request #563 from stanhu/sh-ignore-yjit-in-compile-cache-key
  • 51898f9 Ignore YJIT status in the compile cache key
  • 1ad589b Merge pull request #560 from rails/hm-qnqlnylzkqkltqsz
  • 21fbd65 Merge pull request #561 from jeremy/fix-path-conversion-entry-points
  • 4898853 Convert the path argument in the frame that reads it
  • 8ee47c4 Add MessagePack::Bigint type
  • 49e3eb7 Replace Date Marshalling with recursive msgpack
  • 711fd0b Bump minimum msgpack to 1.5.0
  • 160fc10 Merge pull request #558 from viralpraxis/fix-yaml-cache-kwargs-mutation
  • Additional commits viewable in compare view

Updates brakeman from 8.0.5 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

  • Fix EOL date for Rails 8.0 (yeaseul-kim)
  • Add EOL dates for Rails 8.1 and Ruby 4.0
  • Fix command injection false positives (Jacob Evelyn)
  • Fix unused variable warning (viralpraxis)
Commits
  • fffc483 Bump to 8.0.6
  • b7218fe Update CHANGES
  • c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
  • 4c191dd Fix EOL date for Rails 8.0
  • e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
  • dd4f0b9 Add EOL date for Ruby 4.0
  • 7ca100a Add EOL date for Rails 8.1
  • a53a456 Merge pull request #2022 from JacobEvelyn/main
  • bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
  • 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
  • Additional commits viewable in compare view

Updates resend from 1.3.0 to 1.9.0

Release notes

Sourced from resend's releases.

v1.9.0

What's Changed

Full Changelog: resend/resend-ruby@v1.8.0...v1.9.0

v1.8.0

What's Changed

Full Changelog: resend/resend-ruby@v1.7.0...v1.8.0

v1.7.0

What's Changed

New Contributors

Full Changelog: resend/resend-ruby@v1.6.0...v1.7.0

v1.6.0

What's Changed

... (truncated)

Commits
  • 5430f6f chore: bump (#220)
  • 62003d9 feat(automations): duplicate endpoint (#219)
  • 5ea8bac chore: bump version to 1.8.0 (#218)
  • cd53712 feat: add Broadcasts.cancel method (#216)
  • 34cd6ec chore: use String keys for nested hashes in spec fixtures (#217)
  • b477d67 chore(deps): update dependency rubocop to v1.89.0 (#214)
  • 72be6bd chore: use the API timestamp format in spec fixtures (#215)
  • 0bdf01e chore: bump version to 1.7.0 (#213)
  • 2e17892 chore(deps-dev): bump rails-html-sanitizer from 1.7.0 to 1.7.1 (#207)
  • 958635c chore(deps-dev): bump websocket-driver from 0.8.1 to 0.8.2 (#205)
  • Additional commits viewable in compare view

Updates solid_queue from 1.5.0 to 1.6.0

Release notes

Sourced from solid_queue's releases.

v1.6.0 - fiber execution mode (with Async)

A long-awaited feature thanks to @​crmne on this release: instead of using a thread pool to run jobs in multiple threads per works, you can now use fibers on a single fiber reactor thread. To use this, you just need to specify the number of fibers instead of the number of threads in your worker configuration, like this:

workers:
  - queues: "api*"
    fibers: 100
    polling_interval: 0.05

It uses Async under the hood, so you need to have that as a dependency for it to work. Also, you need to be using fiber isolation in Rails (config.active_support.isolation_level`` = :fiber).

This can be very useful for I/O-bound workloads, such as those involving LLM calls.

What's Changed

New Contributors

Full Changelog: rails/solid_queue@v1.5.1...v1.6.0

v1.5.1

What's Changed

New Contributors

Full Changelog: rails/solid_queue@v1.5.0...v1.5.1

Commits
  • 86f3d92 Bump solid_queue to 1.6.0
  • 2a479f6 Document how to update dynamic recurring tasks
  • 7f59932 Roll back transactions leaked by killed job threads in tests
  • 9c0d5d3 Reorganize the execution pools under SolidQueue::Pool
  • 30b92ca Move the fiber worker checks to Configuration
  • 6e27144 Extract a base class for the execution pools
  • 08e6098 Rescue only the code that runs with capacity reserved when posting
  • 000e8ba Report errors escaping the execution future
  • 5270cc8 Simplify worker initialization
  • 50468fa Start the fiber pool's reactor lazily on first use
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Greptile Summary

Updates the API’s Ruby dependency set, including Bootsnap, Brakeman, Resend, and Solid Queue.

  • Tightens the Resend constraint from ~> 1.0 to ~> 1.9.
  • Refreshes the lockfile and related transitive dependencies.
  • Keeps the existing Solid Queue thread-based configuration unchanged.

Confidence Score: 5/5

The dependency update appears safe to merge, with no concrete changed-code failure identified.

The repository’s Ruby version satisfies the updated dependencies, existing Resend usage remains compatible, and no required Solid Queue migration or configuration change was established.

Important Files Changed
Filename Overview
api/Gemfile Tightens the Resend dependency constraint to the newly resolved 1.9 release line; existing repository call sites remain compatible.
api/Gemfile.lock Updates four targeted gems and their transitive dependency resolution without an established runtime, build, schema, or security regression.

Reviews (1): Last reviewed commit: "Bump the ruby-security-and-maintenance g..." | Re-trigger Greptile

@dependabot
Bump the ruby-security-and-maintenance group across 1 directory with …
db53209 
…4 updates

Bumps the ruby-security-and-maintenance group with 4 updates in the /api directory: [bootsnap](https://github.com/rails/bootsnap), [brakeman](https://github.com/presidentbeef/brakeman), [resend](https://github.com/resend/resend-ruby) and [solid_queue](https://github.com/rails/solid_queue).


Updates `bootsnap` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](rails/bootsnap@v1.24.1...v1.25.0)

Updates `brakeman` from 8.0.5 to 8.0.6
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](presidentbeef/brakeman@v8.0.5...v8.0.6)

Updates `resend` from 1.3.0 to 1.9.0
- [Release notes](https://github.com/resend/resend-ruby/releases)
- [Changelog](https://github.com/resend/resend-ruby/blob/main/CHANGELOG.md)
- [Commits](resend/resend-ruby@v1.3.0...v1.9.0)

Updates `solid_queue` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/rails/solid_queue/releases)
- [Commits](rails/solid_queue@v1.5.0...v1.6.0)

---
updated-dependencies:
- dependency-name: bootsnap
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-security-and-maintenance
- dependency-name: brakeman
  dependency-version: 8.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ruby-security-and-maintenance
- dependency-name: resend
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-security-and-maintenance
- dependency-name: solid_queue
  dependency-version: 1.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-security-and-maintenance
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Aug 22, 2026
@netlify

netlify Bot commented Aug 22, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for hafa-code canceled.

Name Link
🔨 Latest commit db53209
🔍 Latest deploy log https://app.netlify.com/projects/hafa-code/deploys/6a89b335145ad800082b7731

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants