[dependabot]

Bumps the production-dependencies-major group with 23 updates in the / directory:

Package	From	To
rack	2.2.24	2.2.25
stripe	5.55.0	13.5.2
puma	7.2.1	8.0.2
aws-sdk-rails	2.1.0	5.2.0
json	2.19.9	3.1.0
dalli	3.2.3	5.2.5
colorize	0.8.1	1.1.0
rails-i18n	7.0.10	8.1.0
rails	7.1.6	8.1.4.1
kaminari	1.2.2	1.3.2
carrierwave	3.1.3	3.1.4
i18n-js	3.9.2	4.2.4
countries	2.1.2	8.1.0
config	2.2.3	5.6.1
redis	4.2.5	6.0.0
hashie	4.0.0	5.2.0
connection_pool	2.5.3	3.0.2
barnes	0.0.8	1.0.1
rack-cors	2.0.2	3.0.0
rack	2.2.25	3.2.8
sprockets	3.7.5	4.4.1
rack-attack	6.5.0	6.8.0
actionpack	7.1.6	8.1.4.1
activerecord	7.1.6	8.1.4.1

Updates rack from 2.2.24 to 2.2.25

Changelog

Sourced from rack's changelog.

[2.2.25] - 2026-10-30

Security

• GHSA-5v64-555j-wjxm Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
• GHSA-wvg4-6p58-3gh3 Rack::Static header rules were matched against an unnormalized path, allowing dot segments to bypass them.
• GHSA-p8x9-v4hv-2w4g Multipart requests with more than one boundary parameter were accepted when the first value was empty or began with a quote, semicolon, or comma, bypassing the guard added for CVE-2026-26961.

Fixed

• Multipart parser: scan boundary lines with a literal newline search instead of a backtracking regexp, which allocated tens of megabytes per scan for long lines and made the scan buffer fix above ineffective on this series.

Commits

• 40904de Bump patch version.
• c435449 Update changelog.
• 71b39f0 Scan multipart boundary lines without regexp backtracking.
• c9b4698 Remove parsed bytes from the multipart buffer while reading parts.
• d5e928b Reject multipart content types with a boundary parameter before the parsed one.
• e88097c Normalize static header rule paths before matching.
• See full diff in compare view

Updates stripe from 5.55.0 to 13.5.2

Release notes

Sourced from stripe's releases.

v13.5.2

See the changelog for the full release notes.

v12.6.1

See the changelog for the full release notes.

v11.7.1

See the changelog for the full release notes.

v10.15.1

See the changelog for the full release notes.

v9.4.1

See the changelog for the full release notes.

v8.7.1

See the changelog for the full release notes.

v7.1.2

See the changelog for the full release notes.

Changelog

Sourced from stripe's changelog.

Changelog

20.1.0 - 2026-10-29

This release changes the pinned API version to 2026-10-28.endive.

• #1990 Reject ASCII-whitespace-only webhook secrets

  • Reject webhook signing secrets made entirely of ASCII whitespace instead of using them as HMAC keys.

• #1992 Add V2 condition to top of SingletonAPIResource self.resource_url

• #1989 Add API v2 Search support

  Adds Stripe::V2::SearchResultObject and support for auto pagination of search results.

• Preserve event context on fetched related objects

• #2010 Update the bundled CA certificates

  Remove compromised, expired, revoked, and distrusted certificates and add the current root certificates trusted by Stripe.

• #2007 Update generated code

  • Add support for new resources V2::Core::Vault::GbBankAccount, V2::Core::Vault::UsBankAccount, V2::MoneyManagement::Adjustment, V2::MoneyManagement::FinancialAccount, V2::MoneyManagement::FinancialAddressCreditSimulation, V2::MoneyManagement::FinancialAddress, V2::MoneyManagement::InboundTransfer, V2::MoneyManagement::OutboundPayment, V2::MoneyManagement::OutboundSetupIntent, V2::MoneyManagement::PayoutIntent, V2::MoneyManagement::PayoutMethod, V2::MoneyManagement::PayoutMethodsBankAccountSpec, V2::MoneyManagement::ReceivedCredit, V2::MoneyManagement::RecipientVerification, V2::MoneyManagement::TransactionEntry, and V2::MoneyManagement::Transaction
  • Add support for acknowledge, create, recipient_verifications, and retrieve methods on resource V2::MoneyManagement::RecipientVerification
  • Add support for list and retrieve methods on resources V2::MoneyManagement::Adjustment, V2::MoneyManagement::ReceivedCredit, and V2::MoneyManagement::TransactionEntry
  • Add support for list, refresh_regulatory_receipt, retrieve, and update methods on resource V2::MoneyManagement::Transaction
  • Add support for credit method on resource V2::MoneyManagement::FinancialAddressCreditSimulation
  • Add support for retrieve method on resource V2::MoneyManagement::PayoutMethodsBankAccountSpec
  • Add support for archive, list, retrieve, and unarchive methods on resource V2::MoneyManagement::PayoutMethod
  • Add support for cancel, confirm, create, list, refresh_fx_quote, refresh_recipient_verification, retrieve, and update methods on resource V2::MoneyManagement::PayoutIntent
  • Add support for cancel, create, list, retrieve, and update methods on resource V2::MoneyManagement::OutboundSetupIntent
  • Add support for cancel, create, list, and retrieve methods on resource V2::MoneyManagement::OutboundPayment
  • Add support for create, list, and retrieve methods on resources V2::MoneyManagement::FinancialAddress and V2::MoneyManagement::InboundTransfer
  • Add support for list, retrieve, and update methods on resource V2::MoneyManagement::FinancialAccount
  • Add support for archive, confirm_microdeposits, create, list, retrieve, send_microdeposits, unarchive, and update methods on resource V2::Core::Vault::UsBankAccount
  • Add support for archive, create, list, retrieve, and unarchive methods on resource V2::Core::Vault::GbBankAccount
  • Add support for reporting_chart, terminal_hardware_orders, and terminal_hardware_shop on AccountSession::Component and AccountSessionCreateParams::Component
  • Add support for wero_payments on Account::Capability, AccountCreateParams::Capability, and AccountUpdateParams::Capability
  • Add support for physical_address on Account::Company, AccountCreateParams::Company, AccountUpdateParams::Company, and TokenCreateParams::Account::Company
  • Add support for proof_of_business_presence on AccountCreateParams::Document and AccountUpdateParams::Document
  • Add support for subscription_pause on BillingPortal::Configuration::Feature, BillingPortal::ConfigurationCreateParams::Feature, BillingPortal::ConfigurationUpdateParams::Feature, BillingPortal::Session::Flow, and BillingPortal::SessionCreateParams::FlowDatum
  • Add support for after_expiration on BillingPortal::SessionCreateParams and BillingPortal::Session
  • Add support for setup_credential_usage on Charge::PaymentMethodDetail::Card, PaymentIntent::PaymentMethodOption::Card, PaymentIntentConfirmParams::PaymentMethodOption::Card, PaymentIntentCreateParams::PaymentMethodOption::Card, PaymentIntentUpdateParams::PaymentMethodOption::Card, SetupIntent::PaymentMethodOption::Card, SetupIntentConfirmParams::PaymentMethodOption::Card, SetupIntentCreateParams::PaymentMethodOption::Card, and SetupIntentUpdateParams::PaymentMethodOption::Card
  • Add support for stored_credential_usage on Charge::PaymentMethodDetail::Card, PaymentAttemptRecord::PaymentMethodDetail::Card, PaymentIntent::PaymentMethodOption::Card, PaymentIntentConfirmParams::PaymentMethodOption::Card, PaymentIntentCreateParams::PaymentMethodOption::Card, PaymentIntentUpdateParams::PaymentMethodOption::Card, and PaymentRecord::PaymentMethodDetail::Card
  • Add support for account_tax_ids, custom_fields, description, and footer on Checkout::SessionCreateParams::SubscriptionDatum::InvoiceSetting, PaymentLink::SubscriptionDatum::InvoiceSetting, PaymentLinkCreateParams::SubscriptionDatum::InvoiceSetting, and PaymentLinkUpdateParams::SubscriptionDatum::InvoiceSetting
  • Add support for payment_intent_data on Checkout::SessionUpdateParams
  • Add support for intended_submission_method on DisputeUpdateParams and Dispute
  • Add support for appeal on Dispute::Evidence and DisputeUpdateParams::Evidence
  • Add support for submission_method on Dispute::EvidenceDetail
  • Add support for pause_schedules on InvoiceCreatePreviewParams::ScheduleDetail
  • Add support for financial_account on Issuing::CardUpdateParams

... (truncated)

Commits

• 898f598 Bump version to 13.5.2
• dfa30a4 Update certs
• cc1fac0 Bump version to 13.5.1
• 9c56aea lock rbi version in jruby (#1549)
• 3aab161 Explicitly pass through custom headers in retrieve (#1576)
• 88f3e69 Bump version to 13.5.0
• 2a81d44 Update generated code (#1534)
• d7e4457 Fix InvoiceLineItem parent class (#1536)
• 43bbf6f add codeowners file (#1533)
• 9d2bacd Bump version to 13.4.1
• Additional commits viewable in compare view

Updates puma from 7.2.1 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

• CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
• CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

v8.0.1

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

• Breaking changes

  • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

Commits

• 8085b75 Release v8.0.2 (#3945)
• 439c613 8.0.2 backport (#3944)
• cee7e61 Release v8.0.1 (#3932)
• f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
• 97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
• 03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
• 053efae Reword v8 upgrade guide ipv6 bullet (#3928)
• b19f35a Fix incorrect hook names in gRPC docs (#3923)
• eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
• 08f63d4 Release v8.0.0 (#3914)
• Additional commits viewable in compare view

Updates aws-sdk-rails from 2.1.0 to 5.2.0

Release notes

Sourced from aws-sdk-rails's releases.

Release v5.2.0 - 2026-08-11

Tag release v5.2.0

References: #169, #171, #172, #173

• Issue - The ElasticBeanstalkSQSD middleware's Docker host check now only consults remote_addr, the raw TCP peer address, instead of also accepting remote_ip. remote_ip is derived from the client-supplied X-Forwarded-For header whenever the peer address is itself private, so a request from any private address could name the Docker gateway and be treated as local. Loopback peer addresses are accepted by the check, so requests proxied over loopback are unaffected.
• Issue - Only classes inheriting from ActiveJob::Base are executed by the ElasticBeanstalkSQSD middleware, preventing arbitrary classes named in an SQS message from being instantiated and run. Job class and periodic task names are validated as constant paths and resolved without searching the namespace's ancestors, so a request cannot name a constant outside the intended namespace.
• Feature - Adds a new configuration object for elastic beanstalk sqsd middleware, with an optional job_class_allowlist configuration to ElasticBeanstalkSQSD middleware to restrict which job classes can be dispatched. When set, the allowlist is checked before the class name is resolved, so an excluded class is never loaded.

Release v5.1.0 - 2024-12-05

Tag release v5.1.0

References: #168

• Feature - Support async job processing in Elastic Beanstalk middleware. (#167)

Release v5.0.0 - 2024-11-21

Tag release v5.0.0

References: #166

• Feature - [Major Version] Remove dependencies on modular feature gems: aws-actiondispatch-dynamodb, aws-actionmailer-ses, aws-actionmailbox-ses, aws-activejob-sqs, and aws-record-rails.

• Issue - Remove Aws::Rails.add_action_mailer_delivery_method in favor of ActionMailer::Base.add_delivery_method or the Railtie and configuration in aws-actionmailer-ses ~> 1.

• Issue - Remove require of aws/rails/action_mailbox/rspec in favor of aws/action_mailbox/ses/rspec.

• Issue - Remove symlinked namespaces from previous major versions.

• Feature - ActiveSupport::Notifications are enabled by default and removes Aws::Rails.instrument_sdk_operations.

• Feature - Moved railtie initializations to their appropriate spots.

• Issue - Do not execute ActiveJob from EB cron without the root path.

Release v4.2.0 - 2024-11-20

Tag release v4.2.0

References: #147, #148, #149, #152, #153, #156, #157, #159, #160, #161, #162, #163, #164

• Feature - DynamoDB Session Storage features now live in the aws-actiondispatch-dynamodb gem. This gem depends on aws-sessionstore-dynamodb ~> 3 which depends on rack ~> 3.

• Feature - Add session store config generation with rails generate dynamo_db:session_store_config. Config generation is no longer tied to the DynamoDB SessionStore ActiveRecord migration generator.

• Issue - ActionDispatch::Session::DynamoDbStore now inherits ActionDispatch::Session::AbstractStore by wrapping Aws::SessionStore::DynamoDB::RackMiddleware.

• Issue - DynamoDbStore is now configured with the :dynamo_db_store configuration instead of :dynamodb_store.

• Feature - Session Store configuration passed into :dynamo_db_store in an initializer will now be considered when using the ActiveRecord migrations or rake tasks that create, delete, or clean session tables.

... (truncated)

Changelog

Sourced from aws-sdk-rails's changelog.

5.2.0 (2026-08-11)

• Issue - The ElasticBeanstalkSQSD middleware's Docker host check now only consults remote_addr, the raw TCP peer address, instead of also accepting remote_ip. remote_ip is derived from the client-supplied X-Forwarded-For header whenever the peer address is itself private, so a request from any private address could name the Docker gateway and be treated as local. Loopback peer addresses are accepted by the check, so requests proxied over loopback are unaffected.
• Issue - Only classes inheriting from ActiveJob::Base are executed by the ElasticBeanstalkSQSD middleware, preventing arbitrary classes named in an SQS message from being instantiated and run. Job class and periodic task names are validated as constant paths and resolved without searching the namespace's ancestors, so a request cannot name a constant outside the intended namespace.
• Feature - Adds a new configuration object for elastic beanstalk sqsd middleware, with an optional job_class_allowlist configuration to ElasticBeanstalkSQSD middleware to restrict which job classes can be dispatched. When set, the allowlist is checked before the class name is resolved, so an excluded class is never loaded.

5.1.0 (2024-12-05)

• Feature - Support async job processing in Elastic Beanstalk middleware. (#167)

5.0.0 (2024-11-21)

• Feature - [Major Version] Remove dependencies on modular feature gems: aws-actiondispatch-dynamodb, aws-actionmailer-ses, aws-actionmailbox-ses, aws-activejob-sqs, and aws-record-rails.

• Issue - Remove Aws::Rails.add_action_mailer_delivery_method in favor of ActionMailer::Base.add_delivery_method or the Railtie and configuration in aws-actionmailer-ses ~> 1.

• Issue - Remove require of aws/rails/action_mailbox/rspec in favor of aws/action_mailbox/ses/rspec.

• Issue - Remove symlinked namespaces from previous major versions.

• Feature - ActiveSupport::Notifications are enabled by default and removes Aws::Rails.instrument_sdk_operations.

• Feature - Moved railtie initializations to their appropriate spots.

• Issue - Do not execute ActiveJob from EB cron without the root path.

4.2.0 (2024-11-20)

• Feature - DynamoDB Session Storage features now live in the aws-actiondispatch-dynamodb gem. This gem depends on aws-sessionstore-dynamodb ~> 3 which depends on rack ~> 3.

• Feature - Add session store config generation with rails generate dynamo_db:session_store_config. Config generation is no longer tied to the DynamoDB SessionStore ActiveRecord migration generator.

• Issue - ActionDispatch::Session::DynamoDbStore now inherits ActionDispatch::Session::AbstractStore by wrapping Aws::SessionStore::DynamoDB::RackMiddleware.

• Issue - DynamoDbStore is now configured with the :dynamo_db_store configuration instead of :dynamodb_store.

• Feature - Session Store configuration passed into :dynamo_db_store in an initializer will now be considered when using the ActiveRecord migrations or rake tasks that create, delete, or clean session tables.

• Feature - AWS_DYNAMO_DB_SESSION_CONFIG_FILE is now searched and with precedence over the default Rails configuration YAML file locations.

• Feature - Prepare modularization of aws-record.

• Issue - Do not skip autoload modules for Aws::Rails.instrument_sdk_operations.

• Feature - ActionMailer SES and SESV2 mailers now live in the aws-actionmailer-ses gem.

... (truncated)

Commits

• c3dd488 Bumped version to v5.2.0
• 47d6012 fix: Address docker origin check vulnerability. (#173)
• 97341bf feat: Restrict which job classes the Elastic Beanstalk SQSD middleware will e...
• fb36ed4 Address review comments.
• 3fe2d3d Address 2nd pass review from Juli
• 47155fb Address review: use .configure block, custom error, changelog wording
• 7e32710 Rubocop
• f8aa6f4 rubocop & pin rdoc
• 668c971 Add job class validation, optional allowlist config option, tests, and update...
• 70b1d27 Update CI (#171)
• Additional commits viewable in compare view

Updates json from 2.19.9 to 3.1.0

Release notes

Sourced from json's releases.

v3.0.0

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.
• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.
• Removed JSON.load_default_options.
• Removed JSON.unsafe_load_default_options.
• Removed JSON.dump_default_options.
• Removed JSON::State#[] and JSON::State#[]=.
• Removed JSON.unparse.
• Removed JSON.fast_generate.
• Removed JSON.fast_unparse.
• Removed JSON.pretty_unparse.
• Removed JSON.restore.
• Removed JSON::PRETTY_STATE_PROTOTYPE.
• Removed the insecure create_additions option.
• Removed JSON::GenericObject.

Full Changelog: ruby/json@v2.21.2...v3.0.0

v3.0.0.rc1

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

... (truncated)

Changelog

Sourced from json's changelog.

2026-10-13 (3.1.0)

• Added rfc8785 generator option to canonicalize the output. Replaces the json-canonicalization with numerous correctness fixes.
• Use the rb_len_t type introduced in Ruby 4.1 to allow for proper 64bit support on LP64 platforms (Windows).
• JRuby: parser errors now include the position (line, column and the message suffix) as well as json_path, matching the C extension.
• Improved the accuracy of parser error's line, column and snipets in presence of multibyte characters.
• Fix JSON.load to work correctly when provided a Zlib::GzipReader as IO source.
• Reject non-ASCII BINARY strings during JSON generation. This was deprecated since a long time and scheduled to be removed for 3.0.

2026-09-09 (3.0.2)

• Fix JSON.load_file and JSON.load_file! to load on Ruby 2.7.0 through 2.7.2, which cannot parse a leading parameter before ....

2026-09-08 (3.0.1)

• Restore the limit positional argument of JSON.dump.

2026-09-07 (3.0.0)

• Add JSON::ParserError#json_path to locate parse errors in the document as a JSONPath-style string (e.g. $.foo[0].bar). For duplicate key errors it points at the duplicated key itself.
• Fix the parser to also reject lone trailing UTF-16 surrogates (\uDCxx with no leading partner), symmetric to the leading-surrogate case. The Java parser already rejected these; this closes the CRuby/JRuby parity gap.

2026-08-11 (3.0.0.rc1)

With the removal of the insecure create_additions option, JSON.load and JSON.dump are now safe to use. Them being unsafe by default caused multiple security vulnerabilites in the past.

If you did depend on create_additions, the recommended migration is to implement a custom serializer using JSON::Coder.

All the mutable default options, such as JSON.load_default_options have been removed. They were preventing Ractor compatiblity, and causing bug in libraries using JSON expecting the default behavior. JSON methods now always behave the same unless monkey patched.

All methods options are now either keyword arguments or checked like keyword arguments, meaning unknown options such as typos raise ArgumentError.

Duplicated keys are now rejected by default.

JavaScript comments in documents are no longer supported by default.

Numerous rarely used aliases have been removed.

• JSON.load defaults are now safe to use.
• All unknown options will now cause an ArgumentError rather than to be ignored.
• The allow_comments parsing option now defaults to false.
• The allow_duplicate_key option now defaults to false, for both parsing and generating JSON.
• Removed the limit positional argument of JSON.dump.
• Removed the escape_slash alias of script_safe.
• Removed Kernel#j and Kernel#jj.

... (truncated)

Commits

• a15b2ba Release 3.1.0
• d09e383 Refactor rfc8785_sort_keys_proc
• e19f7d7 Handle invalid encoding in JSON path keys
• 78d6a83 parser.c: only update the stack once fully spilled
• 6ea6201 Fix parsing of number with out of range negative exponents
• 1b67eb3 Fix parsing of unescaped NULL bytes in strings
• c1a4372 ResumableParser: fix handling of incomplete unicode escape
• 429c109 More hardening against adversarial encode methods
• 8df32ab Index the generated JSON array by rb_len_t
• 21193d0 Match rb_hash_bulk_insert fallback to Ruby's declaration
• Additional commits viewable in compare view

Updates dalli from 3.2.3 to 5.2.5

Release notes

Sourced from dalli's releases.

v5.2.5

Bug fixes:

• set_multi across more than one server stored nil for a Symbol key or a key over 250 bytes, in place of the value given

v5.2.4

Security release. Released together with 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15: a connection shared by several threads or fibers could get out of step during a quiet block or after a get_multi that stopped early, so that reads returned another key's value (GHSA-5xvx-r8rg-5qm2). Upgrading is strongly recommended. It also makes the TLS handshake fix from 5.2.3 work when openssl isn't loaded before Dalli.

Security:

• Keep a connection shared by several threads or fibers in step during a quiet block (GHSA-5xvx-r8rg-5qm2)
  • A quiet (or multi) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an add of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
• Don't let a get_multi that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
  • A pipelined get_multi stopped by a non-network exception (its block raising or breaking, Timeout.timeout, or a value that can't be deserialized) left its unread replies in the response buffer, and a later get_multi large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
  • Affects every supported line (the get_multi issue, 4.3 and later); fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15. On 5.2, clients with defer_drain: true weren't affected by the quiet issue

Bug fixes:

• A failed TLS handshake is now handled as a network error even when openssl wasn't loaded before Dalli
  • The fix in 5.2.3 (#1215) took effect only when the application had already required openssl: otherwise Dalli's list of TLS errors was empty, so a failed handshake still raised OpenSSL::SSL::SSLError and left the socket open

v5.2.3

Security release. Released together with 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14: with the meta protocol, a counter that incr or decr created with an initial value for a key containing spaces, CR/LF or non-ASCII characters could let a crafted key forge the value of another key in a multi-get (GHSA-r47x-6p6r-mvcp). Upgrading is strongly recommended. This release also includes the bug fixes and the new connect_timeout option below.

Security:

• Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
  • memcached stores an item made by auto-create (ma with N/J, or mg with N) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
  • incr and decr with an initial value now create such counters with an add instead. Return values are unchanged
  • The new verify_reply_keys option makes get_multi, get_multi_cas and get_multi_with_metadata ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
  • Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes

Bug fixes:

• get_multi_with_metadata and its CacheResult adapter now retry transient network errors and raise Dalli::NetworkError on terminal failures instead of returning misses or partial results (#1222, @​jaideeppyne)
• A per-request raw: true write no longer compresses the value (#1213)
  • Values at or above the compression threshold (4 KB by default) were compressed and flagged even with raw: true. Raw reads ignore flags, so reading them back with raw: true returned the compressed bytes
  • Raw values are now stored exactly as given. Callers that pass raw: true without compress: false store large values uncompressed; Rails' MemCacheStore passes compress: false and isn't affected
• Fix cas and cas! edge cases, and make flush attempt every server (#1214)
  • cas! on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns false if another client got there first
  • With cache_nils: true, cas treated a stored nil as a miss and didn't call the block
  • The docs now say what cas and cas! return on success: the new CAS value, not true. The return values are unchanged
  • flush stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
• Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
  • A failed or timed-out handshake left the TCP socket open until GC and raised OpenSSL::SSL::SSLError directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and socket_max_failures handling, raising Dalli::NetworkError (or Dalli::RingError once no server is available)
  • Certificate and hostname checks come only from the ssl_context you pass, and a bare OpenSSL::SSL::SSLContext.new checks neither. Dalli now logs a warning once per process when verify_mode doesn't include VERIFY_PEER or verify_hostname is false; see the new TLS section in the README
• Connection and configuration fixes (#1216)
  • memcached:// URIs with a bracketed IPv6 host (memcached://[::1]:11211) now connect
  • A server weight below 1 raises ArgumentError. Before, a ring where every weight was 0 raised FloatDomainError
  • A reply line longer than 8 KiB without a CRLF, or one cut short by the connection closing, is now a network error that closes the connection. Before, the line had no length limit

... (truncated)

Changelog

Sourced from dalli's changelog.

5.2.5

Bug fixes:

• set_multi across more than one server stored nil for a Symbol key or a key over 250 bytes, in place of the value given

5.2.4

Security:

• Keep a connection shared by several threads or fibers in step during a quiet block (GHSA-5xvx-r8rg-5qm2)
  • A quiet (or multi) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an add of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
• Don't let a get_multi that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
  • A pipelined get_multi stopped by a non-network exception (its block raising or breaking, Timeout.timeout, or a value that can't be deserialized) left its unread replies in the response buffer, and a later get_multi large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
  • Affects every supported line (the get_multi issue, 4.3 and later); fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15. On 5.2, clients with defer_drain: true weren't affected by the quiet issue

Bug fixes:

• A failed TLS handshake is now handled as a network error even when openssl wasn't loaded before Dalli
  • The fix in 5.2.3 (#1215) took effect only when the application had already required openssl: otherwise Dalli's list of TLS errors was empty, so a failed handshake still raised OpenSSL::SSL::SSLError and left the socket open

5.2.3

Security:

• Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
  • memcached stores an item made by auto-create (ma with N/J, or mg with N) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
  • incr and decr with an initial value now create such counters with an add instead. Return values are unchanged
  • The new verify_reply_keys option makes get_multi, get_multi_cas and get_multi_with_metadata ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
  • Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes

Bug fixes:

• get_multi_with_metadata and its CacheResult adapter now retry transient network errors and raise Dalli::NetworkError on terminal failures instead of returning misses or partial results (#1222, @​jaideeppyne)
• A per-request raw: true write no longer compresses the value (#1213)
  • Values at or above the compression threshold (4 KB by default) were compressed and flagged even with raw: true. Raw reads ignore flags, so reading them back with raw: true returned the compressed bytes
  • Raw values are now stored exactly as given. Callers that pass raw: true without compress: false store large values uncompressed; Rails' MemCacheStore passes compress: false and isn't affected
• Fix cas and cas! edge cases, and make flush attempt every server (#1214)
  • cas! on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns false if another client got there first
  • With cache_nils: true, cas treated a stored nil as a miss and didn't call the block
  • The docs now say what cas and cas! return on success: the new CAS value, not true. The return values are unchanged
  • flush stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
• Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
  • A failed or timed-out handshake left the TCP socket open until GC and raised OpenSSL::SSL::SSLError directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and socket_max_failures handling, raising Dalli::NetworkError (or Dalli::RingError once no server is available)
  • Certificate and hostname checks come only from the ssl_context you pass, and a bare OpenSSL::SSL::SSLContext.new checks neither. Dalli now logs a warning once per process when verify_mode doesn't include VERIFY_PEER or verify_hostname is false; see the new TLS section in the README
• Connection and configuration fixes (#1216)
  • memcached:// URIs with a bracketed IPv6 host (memcached://[::1]:11211) now...

    Description has been truncated