Bump the ruby-security-and-maintenance group across 1 directory with 4 updates by dependabot[bot] · Pull Request #47 · Shimizu-Technology/hafa-code

dependabot · 2026-09-19T14:34:16Z

Bumps the ruby-security-and-maintenance group with 4 updates in the /api directory: bootsnap, jwt, resend and solid_queue.

Updates bootsnap from 1.24.1 to 1.26.0

Release notes

Sourced from bootsnap's releases.

v1.26.0

What's Changed

Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.

Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.

Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

v1.25.0

What's Changed

Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

v1.24.6

What's Changed

Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

Full Changelog: rails/bootsnap@v1.24.5...v1.24.6

v1.24.5

What's Changed

No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

Full Changelog: rails/bootsnap@v1.24.4...v1.24.5

v1.24.4

What's Changed

Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.

Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.

Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.

Avoid leaking a private method in Object when testing for Parse.y bugs.

Full Changelog: rails/bootsnap@v1.24.3...v1.24.4

... (truncated)

Changelog

Sourced from bootsnap's changelog.

1.26.0

Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.

Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.

Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

1.25.0

Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

1.24.6

Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

1.24.5

No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

1.24.4

Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.

Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.

Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.

Avoid leaking a private method in Object when testing for Parse.y bugs.

1.24.3

Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

1.24.2

Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

Commits

67a7290 Release 1.26.0
1881b9a Merge pull request #573 from byroot/same-size-miscompilation
605bbeb Fix precompilation when regenerating an existing cache entry of the same size
5fd59da Merge pull request #569 from OskarEichler/codex/accept-tempfile-fd-zero
70550c7 Merge pull request #568 from OskarEichler/codex/remove-umask-debug-output
8aed2ed Accept tempfile descriptor zero
f7457ea Remove umask debug output
9ee62a2 Merge pull request #567 from byroot/rename-mod
7c8178e Handle write(2) being interrupted.
3e755ca atomic_write_cache_file: stop leaking FD on error
Additional commits viewable in compare view

Updates jwt from 3.2.0 to 3.3.0

Changelog

Sourced from jwt's changelog.

v3.3.0 (2026-09-11)

Full Changelog

Features:

Allow a leeway to be given for the iat claim verification #747 - (@denis1011101)

Revamp the error hierarchy under a new JWT::Error base class; signing failures now consistently raise JWT::EncodeError, see https://github.com/jwt/ruby-jwt/blob/main/UPGRADING.md #722 (@anakinj)

Fixes and enhancements:

Refactor JWT::JWK::Set#initialize so each construction path is a named method #758 (@anakinj)

Fix rejection of unknown algorithms from JWKs for RFC compliance and pquip #728

Fix the Style/DirectiveScope RuboCop offense failing the build #752

Fix JWT::JWK::Set sharing its key collection with the set it was copied from #751

Reset the decoded payload and verification state in JWT::EncodedToken#encoded_payload= #749

Fix JWT::Token#detach_payload! not invalidating an already rendered token #748

Commits

ccf2489 Prepare the v3.3.0 release (#762)
6cdacc3 Enforce parentheses on method calls with arguments (#761)
4a576f8 Declutter jwt_spec.rb (#760)
7ddcb0a Fix the RSA-PSS guard skipping the whole jwt_spec file (#759)
7cede0c Refactor JWT::JWK::Set#initialize (#758)
6ab1be7 Revamp error hierarchy (#722)
41fbf31 Invalidate the rendered token when detaching the payload (#757)
d8e231d Reset verification state when replacing the encoded payload (#756)
c25fb5e Fix JWT::JWK::Set sharing its key collection when copied (#751)
bec0ffd Isolate gem builds from release credentials (#755)
Additional commits viewable in compare view

Updates resend from 1.3.0 to 1.16.0

Release notes

Sourced from resend's releases.

v1.16.0

What's Changed

feat(broadcasts): add duplicate endpoint by @gabrielmfern in resend/resend-ruby#241

Full Changelog: resend/resend-ruby@v1.15.0...v1.16.0

v1.15.0

What's Changed

feat(webhooks): add signing secret rotation endpoint by @gabrielmfern in resend/resend-ruby#238

Full Changelog: resend/resend-ruby@v1.14.0...v1.15.0

v1.14.0

What's Changed

feat(contacts): add support for listing contacts by segment by @philnash in resend/resend-ruby#235

Add Action Mailbox ingress for receiving emails in Rails by @excid3 in resend/resend-ruby#234

docs(webhooks): add event listing examples by @gabrielmfern in resend/resend-ruby#233

feat(webhooks): add event replay endpoint by @gabrielmfern in resend/resend-ruby#236

chore: bump version to 1.14.0 by @drish in resend/resend-ruby#237

New Contributors

@philnash made their first contribution in resend/resend-ruby#235

@excid3 made their first contribution in resend/resend-ruby#234

Full Changelog: resend/resend-ruby@v1.13.0...v1.14.0

v1.13.0

What's Changed

feat(webhooks): add event listing endpoints by @gabrielmfern in resend/resend-ruby#229

chore: bump version to 1.13.0 by @gabrielmfern in resend/resend-ruby#232

Full Changelog: resend/resend-ruby@v1.12.0...v1.13.0

v1.12.0

What's Changed

chore(deps): update dependency rubocop to v1.90.0 by @renovate[bot] in resend/resend-ruby#227

feat: add Segments.update method to rename a segment by @dielduarte in resend/resend-ruby#230

chore: bump version to 1.12.0 by @dielduarte in resend/resend-ruby#231

Full Changelog: resend/resend-ruby@v1.11.0...v1.12.0

v1.11.0

What's Changed

feat: add broadcasts.clicked_links() method by @dielduarte in resend/resend-ruby#226

feat: add Broadcasts.recipients method by @dielduarte in resend/resend-ruby#224

feat: add Emails.metrics for account-level email metrics by @dielduarte in resend/resend-ruby#225

... (truncated)

Commits

c7cd1f9 feat(broadcasts): add duplicate endpoint (#241)
ba7b54e feat(webhooks): add signing secret rotation endpoint (#238)
5d02bb9 chore: bump version to 1.14.0 (#237)
57c8f2e feat(webhooks): add event replay endpoint (#236)
f5f9d7d docs(webhooks): add event listing examples (#233)
83b17d5 Add Action Mailbox ingress for receiving emails in Rails (#234)
9011058 feat(contacts): add support for listing contacts by segment (#235)
834b829 chore: bump version to 1.13.0 (#232)
c81cfd3 feat(webhooks): add event listing endpoints (#229)
0a20a87 chore: bump version to 1.12.0 (#231)
Additional commits viewable in compare view

Updates solid_queue from 1.5.0 to 1.7.0

Release notes

Sourced from solid_queue's releases.

v1.7.0 - batches

This is a big one! Solid Queue finally supports job batches thanks to @jpcamara. Check the README for more details about how to use these. This took ages despite being a very requested feature 😅 Big thanks to @jpcamara for his patience, refinements and production-app tests!

What's Changed

Clarify that concurrency + bulk enqueuing is a perf caveat, not unsafe by @Gnirt in rails/solid_queue#785

Wait for polling queries in logging tests instead of sleeping by @wintan1418 in rails/solid_queue#775

Keep semaphore slots held while blocked jobs are enqueued in concurrency test by @wintan1418 in rails/solid_queue#776

Give in-flight jobs enough pause to survive slow shutdowns in tests by @wintan1418 in rails/solid_queue#782

Include the error in fail_many_claimed events and document recovery by @wintan1418 in rails/solid_queue#779

Replace terminated forks even if releasing their claimed jobs fails by @wintan1418 in rails/solid_queue#781

Honour TERM received during supervisor boot before forking workers by @rafael-pissardo in rails/solid_queue#770

Batch Support by @jpcamara in rails/solid_queue#142

New Contributors

@Gnirt made their first contribution in rails/solid_queue#785

Full Changelog: rails/solid_queue@v1.6.0...v1.7.0

v1.6.0 - fiber execution mode (with Async)

A long-awaited feature thanks to @crmne on this release: instead of using a thread pool to run jobs in multiple threads per works, you can now use fibers on a single fiber reactor thread. To use this, you just need to specify the number of fibers instead of the number of threads in your worker configuration, like this:
workers:
  - queues: "api*"
    fibers: 100
    polling_interval: 0.05
It uses Async under the hood, so you need to have that as a dependency for it to work. Also, you need to be using fiber isolation in Rails (config.active_support.isolation_level`` = :fiber).

This can be very useful for I/O-bound workloads, such as those involving LLM calls.

What's Changed

Add fiber worker execution mode by @crmne in rails/solid_queue#728

Roll back transactions leaked by killed job threads in tests by @rosa in rails/solid_queue#773

Document how to update dynamic recurring tasks by @wintan1418 in rails/solid_queue#777

New Contributors

@crmne made their first contribution in rails/solid_queue#728

@wintan1418 made their first contribution in rails/solid_queue#777

Full Changelog: rails/solid_queue@v1.5.1...v1.6.0

v1.5.1

What's Changed

Fix flaky tests caused by leaked job threads and signal timing by @rosa in rails/solid_queue#766

Add an update generator to copy new migrations by @rosa in rails/solid_queue#765

Wait for the continuable job to start before interrupting it by @rosa in rails/solid_queue#767

Add --only-recurring to run just the recurring scheduler by @rafael-pissardo in rails/solid_queue#757

Use with_connection in DistinctValues by @trevorturk in rails/solid_queue#769

Replace forked processes that fail to boot by @sapandiwakar in rails/solid_queue#760

... (truncated)

Commits

e2b5384 Bump solid_queue to 1.7.0
5352228 Reset pooled connections when flipping the batches schema in tests
112bb1c Refine batch support after a full review
1bcac83 Add batch support
fcb5f7a Name the supervisor's stop checkpoint and simplify its lifecycle
124176a Honour TERM received during supervisor boot before forking workers
174cb07 Protect the shutdown reap from release failures too
0526401 Replace terminated forks even if releasing their claimed jobs fails
6816e52 Include the error in fail_many_claimed events and document recovery
fc5fb59 Wait longer for the supervisor to fail the killed worker's job
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…4 updates Bumps the ruby-security-and-maintenance group with 4 updates in the /api directory: [bootsnap](https://github.com/rails/bootsnap), [jwt](https://github.com/jwt/ruby-jwt), [resend](https://github.com/resend/resend-ruby) and [solid_queue](https://github.com/rails/solid_queue). Updates `bootsnap` from 1.24.1 to 1.26.0 - [Release notes](https://github.com/rails/bootsnap/releases) - [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md) - [Commits](rails/bootsnap@v1.24.1...v1.26.0) Updates `jwt` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/jwt/ruby-jwt/releases) - [Changelog](https://github.com/jwt/ruby-jwt/blob/main/CHANGELOG.md) - [Commits](jwt/ruby-jwt@v3.2.0...v3.3.0) Updates `resend` from 1.3.0 to 1.16.0 - [Release notes](https://github.com/resend/resend-ruby/releases) - [Changelog](https://github.com/resend/resend-ruby/blob/main/CHANGELOG.md) - [Commits](resend/resend-ruby@v1.3.0...v1.16.0) Updates `solid_queue` from 1.5.0 to 1.7.0 - [Release notes](https://github.com/rails/solid_queue/releases) - [Commits](rails/solid_queue@v1.5.0...v1.7.0) --- updated-dependencies: - dependency-name: bootsnap dependency-version: 1.26.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-security-and-maintenance - dependency-name: jwt dependency-version: 3.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-security-and-maintenance - dependency-name: resend dependency-version: 1.16.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-security-and-maintenance - dependency-name: solid_queue dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ruby-security-and-maintenance ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-09-19T14:34:21Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ab941193-68c1-4fad-8db8-075ec9b0bb9b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

netlify · 2026-09-19T14:34:22Z

✅ Deploy Preview for hafa-code canceled.

Name	Link
🔨 Latest commit	`65a3018`
🔍 Latest deploy log	https://app.netlify.com/projects/hafa-code/deploys/6aae9d6bafc408000817583b

dependabot · 2026-10-03T14:33:37Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Sep 19, 2026

dependabot Bot closed this Oct 3, 2026

dependabot Bot deleted the dependabot/bundler/api/ruby-security-and-maintenance-8b7067e282 branch October 3, 2026 14:33

Navigation Menu

Bump the ruby-security-and-maintenance group across 1 directory with 4 updates - #47

Bump the ruby-security-and-maintenance group across 1 directory with 4 updates#47
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/api/ruby-security-and-maintenance-8b7067e282

dependabot Bot commented on behalf of github Sep 19, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Sep 19, 2026

Review skipped

Uh oh!

netlify Bot commented Sep 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.26.0

What's Changed

v1.25.0

What's Changed

v1.24.6

What's Changed

v1.24.5

What's Changed

v1.24.4

What's Changed

1.26.0

1.25.0

1.24.6

1.24.5

1.24.4

1.24.3

1.24.2

v3.3.0 (2026-09-11)

v1.16.0

What's Changed

v1.15.0

What's Changed

v1.14.0

What's Changed

New Contributors

v1.13.0

What's Changed

v1.12.0

What's Changed

v1.11.0

What's Changed

v1.7.0 - batches

What's Changed

New Contributors

v1.6.0 - fiber execution mode (with Async)

What's Changed

New Contributors

v1.5.1

What's Changed

Uh oh!

coderabbitai Bot commented Sep 19, 2026

Review skipped

Uh oh!

netlify Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for hafa-code canceled.

Uh oh!

dependabot Bot commented on behalf of github Oct 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 19, 2026 •

edited

Loading

netlify Bot commented Sep 19, 2026 •

edited

Loading