[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
addressable (changelog)	2.9.0 → 2.9.2
annotate	2.6.5 → 2.7.5
bootsnap (changelog)	1.25.0 → 1.26.1
crawler_detect (changelog)	1.2.15 → 1.2.21
graphql (source, changelog)	2.6.8 → 2.6.15
pg (changelog)	1.6.3 → 1.7.0
puma (source, changelog)	8.0.2 → 8.0.3
rails_cloudflare_turnstile (changelog)	0.5.0 → 0.5.1
rails_semantic_logger (source, changelog)	5.1.0 → 5.2.0
rubocop (source, changelog)	1.89.0 → 1.92.2
rubocop-rails (source, changelog)	2.36.0 → 2.38.0
scout_apm (source, changelog)	6.2.1 → 6.3.3
selenium-webdriver (source, changelog)	4.47.0 → 4.52.0
simplecov (changelog)	1.1.1 → 1.3.2
sqlite3 (changelog)	2.9.6-aarch64-linux-gnu → 2.10.2
vcr (source, changelog)	6.4.0 → 6.4.1
webmock (changelog)	3.26.2 → 3.34.0

---

Release Notes

sporkmonger/addressable (addressable)

v2.9.2

Compare Source

Addressable::URI

• fixes Addressable::URI returning stale values after a component was
  changed: e.g. after host=, #site, #normalized_site,
  #normalized_authority and #normalize could still use the old host, and
  after scheme=, #normalized_port could keep a port that's the new
  scheme's default (#​613)
• fixes Addressable::URI#normalized_query reusing the result of an earlier
  call with different flags: e.g. after normalized_query(:sorted),
  normalized_query and #normalize gave a sorted query, and after
  normalized_query, normalized_query(:sorted) gave an unsorted one (#​608)
• fixes Addressable::URI#clone sharing component strings with the original:
  e.g. appending to the clone's #host also changed the original's host, but
  not its cached normalized values; #dup already made a separate copy (#​617)
• fixes the "instance variable @​validation_deferred not initialized" warning
  that 2.9.1 gave for every new Addressable::URI on Ruby before 3.0 with
  warnings enabled, and a "shadowing outer local variable" warning from
  Addressable::Template on Ruby 2.4 and 2.5 (#​637)

Addressable::Template

• fixes Addressable::Template#expand and #partial_expand changing the
  arrays given as values: e.g. [1, :a] became ["1", "a"]; a frozen array
  raised FrozenError, and an object that responds to to_ary
  raised TypeError (#​605)

Addressable::IDNA

• fixes the pure-Ruby Addressable::IDNA.to_unicode raising ZeroDivisionError
  on some malformed labels, e.g. xn--rp3=, which also made
  Addressable::URI#display_uri raise, because the Punycode decoder
  treated punctuation as digits; such labels are now returned unchanged (#​614)
• speeds up the pure-Ruby Addressable::IDNA.to_unicode, which became up to
  25 times slower in 2.9.1 on long labels with many non-ASCII characters;
  Punycode encoding no longer takes quadratic time (#​645)
• fixes the "character class has duplicated range" warnings that 2.9.1 gave
  when Addressable::IDNA was loaded with warnings enabled (#​636)

v2.9.1

Compare Source

• fixes denial of service in Addressable::URI.normalize_path, which took
  quadratic time on paths with many dot segments; URI#normalize, #join,
  #== and #=== were affected (GHSA-qq38-m9mg-xjj5)
• fixes Addressable::URI.normalize_path keeping segments that a .. should
  have removed after a .. above the root, e.g.
  /../../public/x/../../secret normalized to /public/x/secret instead of
  /secret (GHSA-8gmh-2hhj-2hv9)
• fixes Addressable::URI.normalize_path treating a raw line feed as a
  segment boundary, e.g. joining ..\n/secret onto /public/ gave
  /\n/secret
• deprecates Addressable::URI::RULE_2A, RULE_2B_2C, RULE_2D and
  RULE_PREFIXED_PARENT, which are no longer used; they will be removed in
  2.10.0
• fixes denial of service in Addressable::Template#match and #extract,
  which still backtracked exponentially in 2.9.0 for exploded /, ., ;,
  ? and & expressions (e.g. {/path*}) on regex engines without match
  memoization, such as JRuby, TruffleRuby and MRI before 3.2; match results
  are unchanged (GHSA-j82w-28jv-3pmj)
• fixes denial of service in Addressable::Template#match and #extract,
  which backtracked polynomially or exponentially on the same regex engines
  for expressions with several variables (e.g. {/owner,repo,ref}, or
  {+a,b,c} with many variables), for ; expressions, and for adjacent
  expressions (e.g. {+a}{+b}{+c} or {+a}{b}); match results are unchanged
  (GHSA-9f42-57jx-vpp3)
• fixes denial of service in Addressable::Template#match and #extract,
  which backtracked polynomially for expressions with several exploded
  variables (e.g. {+a*,b*}), including on MRI 3.2; match results are
  unchanged (GHSA-4w5q-wg7v-w6gp)
• fixes Addressable::IDNA.to_unicode in the pure-Ruby backend decoding
  Punycode labels that aren't valid A-labels: labels that decode to only
  ASCII characters (e.g. xn--google- decoded to google) and labels that
  don't convert back to themselves; such a label is now returned unchanged,
  as with libidn, so Addressable::URI#display_uri no longer shows a host
  that differs from #normalized_host (GHSA-9crm-g4mf-wc5j)
• fixes Addressable::IDNA.to_unicode decoding Punycode labels with
  characters that change how a host displays without being visible
  themselves, such as bidi overrides and isolates (e.g. U+202E and U+2066),
  zero width characters and control characters; such a label is now
  returned unchanged, so Addressable::URI#display_uri no longer shows
  them. The pure-Ruby backend also no longer decodes labels with other
  characters that nameprep prohibits, as with libidn (GHSA-539f-xcgw-2gjg)
• fixes Addressable::URI#route_from and #route_to raising
  InvalidURIError when the route's first segment contains a colon
  (e.g. /a:b from /a); the route is now ./a:b (#​625)
• fixes Addressable::IDNA.to_unicode raising in the pure-Ruby backend for
  Punycode labels that are too long, overflow the decoder, or decode past
  U+10FFFF; the label is now returned unchanged, as with libidn, so
  Addressable::URI#display_uri no longer raises for such hosts (#​620)
• fixes Addressable::URI#display_uri raising InvalidURIError for URIs
  without a host, such as abc or mailto:user@example.com; relative URIs
  are also no longer displayed with an empty authority (e.g. /path/to was
  displayed as ///path/to) (#​610)
• fixes Addressable::Template#match and #extract raising
  Addressable::URI::InvalidURIError for a string that isn't a valid URI;
  they now return nil, as for any other URI that doesn't match (#​621)
• fixes Addressable::URI#origin= raising InvalidURIError for an origin
  with an empty port (e.g. http://example.com:), which is the same as no
  port (#​627)

ctran/annotate_models (annotate)

v2.7.5

Compare Source

See https://github.com/ctran/annotate_models/releases/tag/v2.7.5

v2.7.4

Compare Source

• Fix with_comment format in annotate_models_rake #​560

v2.7.3

Compare Source

See https://github.com/ctran/annotate_models/releases/tag/v2.7.3

v2.7.2

Compare Source

See https://github.com/ctran/annotate_models/releases/tag/v2.7.2

v2.7.1

Compare Source

See https://github.com/ctran/annotate_models/releases/tag/v2.7.1

v2.7.0

Compare Source

See https://github.com/ctran/annotate_models/releases/tag/v2.7.0

v2.6.10: Revert incompatible change

Compare Source

Revert "Prefer SQL column type over normalized AR type"

v2.6.9

Compare Source

• Support foreigh key #​241
• Check if model has skip tag in annotate_model_file #​167
• Fix issue where serializer-related flags weren't being honored #​246
• Prefer SQL column type over normalized AR type #​231

v2.6.8

Compare Source

• Nothing annotated unless options[:model_dir] is specified, #​234

v2.6.7

Compare Source

• Nothing annotated unless options[:model_dir] is specified, #​234

v2.6.6

Compare Source

• Makes it possible to wrap annotations, #​225
• Fix single model generation, #​214
• Fix default value for Rails 4.2, #​212
• Don't crash on inherited models in subdirectories, #​232
• Process model_dir in rake task, #​197

rails/bootsnap (bootsnap)

v1.26.1

Compare Source

• Fix Bootsnap.enable_frozen_string_literal(app_only: true) raising NameError when the compile cache is disabled.
  App files are now compiled with frozen string literals on every load, without caching.

• Avoid transcoding Ruby source when the Prism workaround runs with a default internal encoding.

• Better detect support for fast path scanning. Fix compilation on Illumos.

v1.26.0

Compare Source

• Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
• Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified
  without changing its size.
• Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

loadkpi/crawler_detect (crawler_detect)

v1.2.21

Compare Source

v1.2.20

Compare Source

v1.2.19

Compare Source

v1.2.18

Compare Source

v1.2.17

Compare Source

rmosolgo/graphql-ruby (graphql)

v2.6.15

Compare Source

Security

This release includes security patches for the following:

• Analysis: GHSA-8wfw-p943-3jjp
• Parsing, analysis, execution: GHSA-qv9r-jc8m-v7ph
• Complexity: GHSA-wc34-88mf-j95m
• Parser: GHSA-pjx7-wx97-6wf8
• Authorization, Execution::Next: GHSA-rf3p-x6p2-rr4g

New features

• Continue Sorbet adoption #​5867 #​5872
• Analysis: also support GraphQL::ExecutionError #​5870

Bug fixes

• Directives: don't drop repeated instances of repeatable directives on interfaces or on subclasses with inherited directives #​5823
• Parser: improve stack overflow error message #​5857
• Parser: reject variables in default values #​5864
• Parser: improve handling of CR line endings #​5848 #​5847
• Generator: improve generated controller for @defer handling #​5855
• Parser: improve numeric lexical boudaries #​5856
• ActionCable: improve memory cleanup #​5860
• Parser: preserve newlines after escaped backslashes #​5858
• Execution::Next: remove duplicate input coercion
• Validation: fix NoMethodError #​5876
• Validation: update callers to types #​5868
• Lexer: speedup #​5880 , documentation #​5883
• Parser: fix column count with BOM #​5886
• Parser: improve token limit handling #​5887
• Execution::Next: improve rescue_from compatibility

v2.6.14

Compare Source

Security

Two patches relating to loopholes in authorization edge cases (legacy and next runtimes):

• GHSA-q3cc-p5hm-55wj
• GHSA-4rw8-495r-pf6j

New Features

• Schema.from_definition: speed up #​5832
• Execution::Next: improve dataloader batching in .authorized?
• Sorbet adoption #​5825 #​5852

Bug Fixes

• Connections: #​5838 #​5840 #​5845 #​5846
• Complexity: use legacy mode when enforcing limits #​5839
• rescue_from: prevent leaking into arguments #​5837
• Parser: Correctly ignore BOM in documents #​5849

v2.6.13

Compare Source

New features

• Move documentation to RDoc #​5689 #​5782
• Begin type-checking the project with Sorbet #​5746 #​5801 #​5800
• Improve CI #​5781 #​5783 #​5785
• Language::Nodes: flatten class definitions and add RBS types #​5790
• rake graphql:pro:validate: harden against misuse #​5795

Bug fixes

• FieldsHaveAppropriateSelections: don't crash on inline fragments without type conditions inside leaf selections #​5791
• Execution::Next: propagate nulls in nested lists #​5779
• Lexer: handle more comments than max_tokens #​5795
• Schema.from_definition: support directive with cyclic argument types #​5802
• Execution::Next: fix field alignment for legacy fields with authorization #​5738
• Connections: paginate duplicate items #​5755
• RelationConnection: peek an extra row to avoid hasNextPage query #​5775
• Complexity: fix __typename with count_introspection_fields: false
• Legacy interpreter: fix TypeError in nested lists #​5777
• Schema.from_definition: correctly handle interface possible types when defined later in the document #​5827
• Validation: improve detection of unused variables with legacy compatibility support #​5796
• Validation: improve detection of conflicting fields with legacy compatibility support #​5797

v2.6.12

Compare Source

Security: This version contains a patch for GHSA-965v-9v76-5hg2

Bug fixes

• Visibility::Profile#preload: preload more type information #​5748 #​5758
• Variables: use defaults for omitted non-null variables #​5754
• Visibility::Profile: freeze hashes when fully loaded #​5750
• Dataloader: give nested dataloader calls their own state #​5760
• RelationConnection: reject invalid cursors #​5752
• Legacy execution: Set current_field and current_arguments for list item dataloader fibers #​5759
• Propagate list errors through non-null items #​5756
• Fix error paths and performance on input objects in lists #​5751
• Execution::Next: Don't call .size on non-Array list results #​5765
• Subscriptions: reject multiple root selections and introspection root selections #​5770
• Parser: fix source locations after multibyte input #​5771
• RelationConnection: fix detection of AsyncDataloader to avoid duplicate queries #​5773

v2.6.11

Compare Source

Bug fixes

• AsyncDataloader: call fiber cleanup hooks after errors #​5718
• RelationConnection: support initialization without context #​5716
• CParser: support exponent-only floats #​5719
• CParser: fix compiler warnings #​5721
• ArrayConnection: reject cursors pointing to malformed, zero, or negative indexes
• AsyncDataloader: prevent duplicate count queries #​5717
• Subscriptions: improve serializer #​5722, #​5723
• Sentry: support data_collection configuration
• Execution::Next: preserve multiplex results after setup errors #​5728
• Execution::Next: use it for Query#result when as_default: true #​5742
• Execution::Next: skip lazy? check when schema doesn't use resolve_lazy for Partials on scalars #​5740
• Execution::Next: treat unimplemented directive hooks as no-ops #​5739
• Schema::Visibility: improve profile preloading #​5743
• Execution::Next: fix Query#result_values when an error is raised #​5744
• loads:: correctly type-check loaded objects when loads: is a loads:-only Object type #​5745

v2.6.10

Compare Source

New features

• Execution::Next: Add dataload: { ..., method: } shorthand #​5706

Bug fixes

• AsyncDataloader: Avoid ClosedError race in old fibers #​5702
• AsyncDataloader: fix nested dataloader runs #​5703
• Validation: speed up FieldsWillMerge #​5704
• AsyncDataloader: Fix ActiveRecord relation loads in connections #​5708
• Execution::Next: handle SystemStackErrors #​5705
• Restore current multiplex after nested execution #​5714
• Parser: handle out-of-range Unicode escapes as parse errors #​5710
• Lexer: re-raise unexpected ArgumentErrors #​5711
• Parser: support short braced unicode escapes #​5712
• Float: reject non-finite values #​5713

v2.6.9

Compare Source

Security

• Parser cache: validate payloads before loading them (GHSA-rmxg-5p3r-j6hh)

ged/ruby-pg (pg)

v1.7.0

Compare Source

Added:

• Add PG::Connection#embed_params and keyword :typename for its parameter casting. #​726
  This allows to generate SQL strings with embedded parameters for easier debugging.
• Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #​695
• Add PG::Result#each_tuple #​675
• Add PG::TypeMap#query_param_encoders to retrieve encoders. #​726
• Deduplicate result field name strings for better performance. #​750

Removed:

• Remove compatibility to ruby < 3.1 and drops support of ruby-2.7 and ruby-3.0. #​749
• Remove GLV unlocking at all functions which process data modifiable in a second thread. #​721
  This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.
• Remove :static_symbol result field names. #​691
• Remove enforced rpath addition when no rpath is configured in rbconfig. #​699

Fixes:

• Limit memory allocation on invalid input into PG::BinaryDecoder::Array. #​743
• Free COPY buffers when decoders raise to avoid possible memory leak in get_copy_data. #​742
• Prevent SQL injection in set_client_encoding. #​741
• Add GC_GUARD to temporary ruby objects for conninfo string to avoid it's GC'ed prematurely. #​739
• Remove option "quirks_mode" from JSON en/decoder to fix compat with json-3.0 gem. #​737
• Respect calendar type of Ruby and PostgreSQL. #​725
• Fix broken set_notice_(receiver|processor) callback after GC.compact. #​734
• Disable DNS resolution in ruby when a service file is used, so that the priority of parameters is equal to libpq. #​635
• Use RARRAY_LENINT to avoid possible overflow. #​728
• Fix possible integer overflow at PG::BinaryEncoder::CopyRow and PG::TextEncoder::CopyRow. #​714, #​715
• Avoid possible integer overflow in query parameter encoding. #​719
• Ensure conninfo is a valid C string before closing the connection to avoid a double free of PGconn. #​709
• Raise on a too large input string to PG::TextEncoder::Bytea. #​717
• Check PG::BinaryEncoder::CopyRow array input size instead of producing an invalid output.
• Remove accidentally copied "static" keyword from Copy and Record encoder. #​711
• Avoid possibility to replace typemap while being used in Copy and Record encoders and decoders. #​707
• Add GC_GUARD's for encoding converted strings sent to the server. #​705
• Fix incomplete transaction commit when thread is shutdown ungracefully. #​704
• Assign VALUE after registration per rb_gc_register_address() #​703
• Update dependencies for binary gems to PostgreSQL-18.6, OpenSSL-3.6.5, krb5-1.22.2 #​752

puma/puma (puma)

v8.0.3

Compare Source

• Security

  • Close connections whose reactor timeout passed even when another client keeps sending data. (GHSA-m5xw-3hrw-qcmf)
  • Don't block the reactor writing a 100 Continue or 408 to a client that stops reading. (GHSA-xw3h-pgr9-3vg7)
  • Apply the write timeout to TLS responses and to file responses larger than 64 KB, and don't let a TLS client that stops reading keep its connection alive by sending TLS records with no request data. (GHSA-x646-wp7c-h9mg)
  • Bound how long a graceful shutdown or restart keeps reading an incomplete request, with the new shutdown_body_timeout option (default 25 seconds). (GHSA-jm4r-w4xx-qxw7)
  • Keep + literal in bind URL query values, and raise on an invalid ssl_cipher_filter. (GHSA-r885-m39c-939g)
  • Verify the TLS certificate and hostname of ssl:// control servers in pumactl, with the new --control-ca-file option for private CAs. (GHSA-86xc-wrr9-xmmq)
  • Back off and rate-limit logging when accept runs out of file descriptors. (GHSA-rf6g-xhmp-gm7v)

  CVE IDs have been requested for these advisories and will be added here once assigned.

• Bugfixes

  • Send the idle notification from a clustered worker only once per idle period, so the master no longer stops an active cluster or delays an idle shutdown ([#​4101])
  • Fix build errors on Windows arm64 with Ruby head ([#​4071])
  • Send TLS close_notify when closing an SSL connection on JRuby ([#​4029])

instrumentl/rails-cloudflare-turnstile (rails_cloudflare_turnstile)

v0.5.1

Compare Source

• Ruby 4.0 support added.
  • Dependencies updates

reidmorrison/rails_semantic_logger (rails_semantic_logger)

v5.2.0

Compare Source

• Deprecations: the gem's deprecator is now registered as
  Rails.application.deprecators[:rails_semantic_logger], so the application's own deprecation
  settings govern it: config.active_support.report_deprecations = false,
  config.active_support.deprecation = :raise, or silencing that one deprecator by name. Rails'
  active_support.deprecation_behavior initializer only reaches deprecators in that collection, and
  this one was never added to it, so nothing an application configured could reach the warnings.
  Note that an application still setting deprecated options will now see them raise under
  config.active_support.deprecation = :raise.
• Deprecations: the warnings for the deprecated appender options (format, ap_options, filter,
  console_logger, add_file_appender) are no longer emitted from the setter. Those options are
  documented to be set in config/application.rb or config/environments/*.rb, which Rails reads in
  load_environment_config, long before active_support.deprecation_behavior applies the settings
  above, so warning from the setter landed in a window that no application configuration could
  reach. The warnings are now recorded and emitted once Rails has applied that configuration. Each
  option is reported once per boot, attributed to the first place it was set; options set later
  (from config/initializers/*, or at runtime) still warn immediately at their call site. Fixes
  #​328.
• ActionCable: resolve the TaggedLoggerProxy class at runtime instead of requiring it by path.
  Rails 8.2 moves it from ActionCable::Connection::TaggedLoggerProxy to
  ActionCable::Server::TaggedLoggerProxy, as part of the ActionCable::Server::Socket refactor,
  and leaves no back-compat alias, so the unconditional
  require "action_cable/connection/tagged_logger_proxy" raised LoadError during
  after_initialize and failed the app's boot on Rails edge. Fixes #​326.
• Documentation: the Semantic Logger documentation site has moved from logger.rocketjob.io to
  logger.reidmorrison.com. The gem's homepage and documentation_uri metadata now point there,
  as do the links in the README.

rubocop/rubocop (rubocop)

v1.92.2

Compare Source

Bug fixes

• #​16147: Fix a false negative for Lint/RedundantCopDisableDirective when autocorrection shifts lines. ([@​koic][])
• #​16104: Fix a false negative for Style/FloatDivision with a trailing comment. ([@​a-lavis][])
• #​16146: Fix a false positive for Lint/RedundantCopDisableDirective with a repeated disable. ([@​koic][])
• #​16176: Fix a false positive for Style/RaiseArgs with EnforcedStyle: compact and constructor arguments. ([@​bbatsov][])
• #​16183: Fix an error for Layout/RescueEnsureAlignment with index or-assignment. ([@​koic][])
• #​16158: Fix an error for Style/NumericPredicate with a predicate nested in the receiver of another. ([@​Starlexxx][])
• #​16125: Fix an error for Style/RedundantCondition with a nested modifier if. ([@​koic][])
• #​16175: Fix an incorrect autocorrect for Layout/HashAlignment with multiple styles and pairs on one line. ([@​bbatsov][])
• #​16139: Fix an incorrect autocorrect for Layout/LineLength with code after a heredoc opener. ([@​koic][])
• #​16160: Fix an incorrect autocorrect for Layout/SingleLineBlockChain with Style/MapToSet. ([@​koic][])
• #​16002: Fix an incorrect autocorrect for Layout/SpaceBeforeBlockBraces with a brace after a line continuation. ([@​Starlexxx][])
• #​16175: Fix an incorrect autocorrect for Layout/SpaceBeforeBlockBraces with a brace after a heredoc body. ([@​bbatsov][])
• #​16180: Fix an incorrect autocorrect for Lint/InterpolationCheck in a split string. ([@​Starlexxx][])
• #​16143: Fix an incorrect autocorrect for Lint/ParenthesesAsGroupedExpression with a command call operand. ([@​koic][])
• #​16170: Fix an incorrect autocorrect for Lint/RedundantSplatExpansion with Array.new as a method argument. ([@​wleeaf][])
• #​16178: Fix an incorrect autocorrect for Style/AndOr with a binary operator method operand. ([@​bbatsov][])
• #​16150: Fix an incorrect autocorrect for Style/AndOr with a command call that takes a do block. ([@​Starlexxx][])
• #​16178: Fix an incorrect autocorrect for `Style/AndOr

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coveralls]

Coverage Report for CI Build 43380505403

Coverage remained the same at 98.423%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	1902
Covered Lines:	1872
Line Coverage:	98.42%
Coverage Strength:	1854.98 hits per line

---

💛 - Coveralls