Skip to content

Bump the prod-ruby-dependencies group across 1 directory with 4 updates - #129

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/prod-ruby-dependencies-a591bc393b
Open

Bump the prod-ruby-dependencies group across 1 directory with 4 updates#129
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/prod-ruby-dependencies-a591bc393b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on redacting-logger, dry-schema, grape and puma to permit the latest version.
Updates redacting-logger from 1.5.1 to 1.5.2

Release notes

Sourced from redacting-logger's releases.

v1.5.2

What's Changed

New Contributors

Full Changelog: github/redacting-logger@v1.5.1...v1.5.2

Commits
  • 2da293a Merge pull request #153 from github/fix/ghs-token-regex-new-format
  • 17f270e Add test coverage for ghs_ token edge cases
  • ac21280 Bump version to 1.5.2
  • 9d91197 Fix ghs_ regex: add dash to character class [A-Za-z0-9._-]
  • 894284d Fix ghs token redaction regex
  • 4fff5a4 Merge pull request #149 from github/dependabot/github_actions/github-actions-...
  • 82337f5 Bump the github-actions group across 1 directory with 2 updates
  • See full diff in compare view

Updates dry-schema from 1.14.1 to 1.16.0

Release notes

Sourced from dry-schema's releases.

v1.16.0

Added

Changed

  • In JSON Schema output, represent values with an eql? constraint as "const" values. (@​adamransom in #514) 
    require "dry/schema"
Dry::Schema.load_extensions(:json_schema)
schema = Dry::Schema.JSON do
required(:version).value(:integer, eql?: 1)
end
schema.json_schema
=> {"$schema": "http://json-schema.org/draft-06/schema#", type: "object", properties: {version: {type: "integer", const: 1}}, required: ["version"]}

Fixed

  • In JSON Schema output, fix representation of arrays that are a combinations of schemas. (@​adamransom in #516)
  • Avoid mutation of arguments given to Dry::Schema::Messages::I18n#get. (@​flash-gordon in 51d48b6)

Compare v1.15.0 ... v1.16.0

v1.15.0

Changed

  • Set mimimum Ruby version to 3.2 (@​timriley)
  • Support UUID v6, v7 and v8 predicates (:uuid_v6?, :uuid_v7? and :uuid_v8?). (@​illiatdesdindes in #509)
  • Support size?, format?, true? and false? predicates when generating JSON schemas. (@​cramt in #499)
  • Allow symbols to be given for top_namespace setting. (@​unused in #491)

Fixed

  • Support intersection types (created with & operator) in schema definitions. (@​baweaver in #496)

    Now works without errors:

    intersection_type =
  Types::Hash.schema(a: Types::String) & 
  (Types::Hash.schema(b: Types::String) | Types::Hash.schema(c: Types::String))
schema = Dry::Schema.Params do
required(:body).value(intersection_type)
end

... (truncated)

Changelog

Sourced from dry-schema's changelog.

1.16.0 - 2026-03-03

Added

Changed

  • In JSON Schema output, represent values with an eql? constraint as "const" values. (@​adamransom in #514) 
    require "dry/schema"
Dry::Schema.load_extensions(:json_schema)
schema = Dry::Schema.JSON do
required(:version).value(:integer, eql?: 1)
end
schema.json_schema
=> {"$schema": "http://json-schema.org/draft-06/schema#", type: "object", properties: {version: {type: "integer", const: 1}}, required: ["version"]}

Fixed

  • In JSON Schema output, fix representation of arrays that are a combinations of schemas. (@​adamransom in #516)
  • Avoid mutation of arguments given to Dry::Schema::Messages::I18n#get. (@​flash-gordon in 51d48b6)

[1.15.0] - 2026-01-09

Changed

  • Set mimimum Ruby version to 3.2 (@​timriley)
  • Support UUID v6, v7 and v8 predicates (:uuid_v6?, :uuid_v7? and :uuid_v8?). (@​illiatdesdindes in #509)
  • Support size?, format?, true? and false? predicates when generating JSON schemas. (@​cramt in #499)
  • Allow symbols to be given for top_namespace setting. (@​unused in #491)

Fixed

  • Support intersection types (created with & operator) in schema definitions. (@​baweaver in #496)

    Now works without errors:

    intersection_type =
  Types::Hash.schema(a: Types::String) & 
  (Types::Hash.schema(b: Types::String) | Types::Hash.schema(c: Types::String))
schema = Dry::Schema.Params do
required(:body).value(intersection_type)
end

... (truncated)

Commits

Updates grape from 3.0.1 to 3.2.1

Changelog

Sourced from grape's changelog.

3.2.1 (2026-04-16)

Fixes

3.2.0 (2026-04-08)

Features

Fixes

  • #2670: Fix UnknownAuthStrategy raised when custom auth strategy class inherits from Grape::Middleware::Auth::Base - @​dblock.
  • #2655: Fix before_each method to handle nil parameter correctly - @​ericproulx.
  • #2660: Fix thread safety: move mutable ParamsScope state (index, params_meeting_dependency) into a per-request ParamScopeTracker stored in Fiber[] - @​ericproulx.
  • #2666: Endpoint cleanup and minor optimizations - @​ericproulx.
  • #2676: Exclude ruby 3.2 for rails_edge - @​ericproulx.
  • #2677: Update actions/checkout to v6 - @​ericproulx.

3.1.0 (2026-01-25)

Features

... (truncated)

Commits
  • b5e0ada Preparing for release, 3.2.1
  • fb3b8f3 Restore attr_reader :schema on contract_scope_validator (#2680)
  • 82fd5da Preparing for release, 3.2.0
  • 198db4d Update actions/checkout to v6. (#2677)
  • 7175dfd Remove ruby 3.2 for rails_edge (#2676)
  • 548baef Add AGENTS.md to please our future A.I. overlords (#2675)
  • d0c0ea4 :with (#2672)
  • 4638481 Fix UnknownAuthStrategy raised when custom auth strategy inherits from Grape:...
  • fe3b4f8 Use Ruby 3.1 shorthand kwargs syntax across the codebase (#2671)
  • 03e6d05 Merge pull request #2670 from ruby-grape/rack_request_error
  • Additional commits viewable in compare view

Updates puma from 7.1.0 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

v8.0.1

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

  • Breaking changes

    • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

7.2.1 / 2026-05-27

  • Bugfixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the prod-ruby-dependencies group across 1 directory with 4 updates
a2eeedc 
Updates the requirements on [redacting-logger](https://github.com/github/redacting-logger), [dry-schema](https://github.com/dry-rb/dry-schema), [grape](https://github.com/ruby-grape/grape) and [puma](https://github.com/puma/puma) to permit the latest version.

Updates `redacting-logger` from 1.5.1 to 1.5.2
- [Release notes](https://github.com/github/redacting-logger/releases)
- [Commits](github/redacting-logger@v1.5.1...v1.5.2)

Updates `dry-schema` from 1.14.1 to 1.16.0
- [Release notes](https://github.com/dry-rb/dry-schema/releases)
- [Changelog](https://github.com/dry-rb/dry-schema/blob/main/CHANGELOG.md)
- [Commits](dry-rb/dry-schema@v1.14.1...v1.16.0)

Updates `grape` from 3.0.1 to 3.2.1
- [Changelog](https://github.com/ruby-grape/grape/blob/master/CHANGELOG.md)
- [Commits](ruby-grape/grape@v3.0.1...v3.2.1)

Updates `puma` from 7.1.0 to 8.0.2
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v7.1.0...v8.0.2)

---
updated-dependencies:
- dependency-name: redacting-logger
  dependency-version: 1.5.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: prod-ruby-dependencies
- dependency-name: dry-schema
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-ruby-dependencies
- dependency-name: grape
  dependency-version: 3.2.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: prod-ruby-dependencies
- dependency-name: puma
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: prod-ruby-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Oct 14, 2026
github-license-compliance[bot]
github-license-compliance Bot found potential problems Oct 14, 2026
View reviewed changes
Comment thread Gemfile.lock Fixed

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@github-license-compliance github-license-compliance[bot] github-license-compliance[bot] left review comments
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants