[dependabot]

Bumps the minor-and-patch group with 10 updates in the / directory:

Package	From	To
rubocop-sorbet	0.16.0	0.17.1
json	3.0.2	3.1.0
dalli	5.1.1	5.2.2
graphql	2.6.11	2.6.12
sorbet-static	0.6.13508	0.6.13571
webmock	3.26.4	3.34.0
parallel	2.2.0	2.3.0
sorbet-static-and-runtime	0.6.13508	0.6.13571
rbi	0.4.3	0.5.0
spoom	1.8.9	1.8.12

Updates rubocop-sorbet from 0.16.0 to 0.17.1

Release notes

Sourced from rubocop-sorbet's releases.

v0.17.1

What's Changed

🛠 Other Changes

• Add ForbidTCollectionInstantiation cop with RBS autocorrection by @​Morriar in Shopify/rubocop-sorbet#420
• Add RBS autocorrection to ForbidTTypeAlias by @​Morriar in Shopify/rubocop-sorbet#422
• Fix nested scope leakage in ForbidTStruct autocorrection by @​Morriar in Shopify/rubocop-sorbet#421

Full Changelog: Shopify/rubocop-sorbet@v0.17.0...v0.17.1

v0.17.0

What's Changed

🛠 Other Changes

• Use RBI and RBS gems to parse and generate RBS by @​rafaelfranca in Shopify/rubocop-sorbet#417
• Add Sorbet/ForbidTAssertType cop by @​Morriar in Shopify/rubocop-sorbet#419
• Support RBS comments in AllowIncompatibleOverride by @​Morriar in Shopify/rubocop-sorbet#418
• Preserve tuple element annotations in RedundantTLetForLiteral by @​ipvalverde in Shopify/rubocop-sorbet#424

New Contributors

• @​ipvalverde made their first contribution in Shopify/rubocop-sorbet#424

Full Changelog: Shopify/rubocop-sorbet@v0.16.0...v0.17.0

Commits

• 3b364f4 Release v0.17.1
• 437dd61 Merge pull request #421 from Shopify/fix-forbid-t-struct
• ab9cf0b Stop T::Struct walker at methods
• 3430d3d Merge pull request #422 from Shopify/forbid-t-type-alias-autocorrect
• e825e78 Merge pull request #420 from Shopify/forbid-t-collection-new
• b4a33ae Add cop forbidding Sorbet collection instantiation with RBS autocorrection
• 4abec2e Release v0.17.0
• 289f381 Merge pull request #424 from ipvalverde/ipvalverde/preserve-tuple-array-annot...
• 9bdb10f Preserve tuple element array annotations
• 9384079 Add RBS autocorrection to ForbidTTypeAlias
• Additional commits viewable in compare view

Updates json from 3.0.2 to 3.1.0

Changelog

Sourced from json's changelog.

2026-10-13 (3.1.0)

• Added rfc8785 generator option to canonicalize the output. Replaces the json-canonicalization with numerous correctness fixes.
• Use the rb_len_t type introduced in Ruby 4.1 to allow for proper 64bit support on LP64 platforms (Windows).
• JRuby: parser errors now include the position (line, column and the message suffix) as well as json_path, matching the C extension.
• Improved the accuracy of parser error's line, column and snipets in presence of multibyte characters.
• Fix JSON.load to work correctly when provided a Zlib::GzipReader as IO source.
• Reject non-ASCII BINARY strings during JSON generation. This was deprecated since a long time and scheduled to be removed for 3.0.

Commits

• a15b2ba Release 3.1.0
• d09e383 Refactor rfc8785_sort_keys_proc
• e19f7d7 Handle invalid encoding in JSON path keys
• 78d6a83 parser.c: only update the stack once fully spilled
• 6ea6201 Fix parsing of number with out of range negative exponents
• 1b67eb3 Fix parsing of unescaped NULL bytes in strings
• c1a4372 ResumableParser: fix handling of incomplete unicode escape
• 429c109 More hardening against adversarial encode methods
• 8df32ab Index the generated JSON array by rb_len_t
• 21193d0 Match rb_hash_bulk_insert fallback to Ruby's declaration
• Additional commits viewable in compare view

Updates dalli from 5.1.1 to 5.2.2

Release notes

Sourced from dalli's releases.

v5.2.2

Security release. Released together with 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13: with a namespace, a retried request could read or write a different key (GHSA-m252-9cgf-vx2w); completes the fixes for GHSA-wr87-m4jw-29x5 and GHSA-w39f-xq2m-4g8x from 5.2.1, and fixes regressions from that release. Upgrading is strongly recommended.

Security:

• Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)
  • With a namespace, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key
  • Affects single-key operations since 5.0.3, single-server get_multi since 5.1.0, and get_with_metadata and fetch_with_lock since 4.1.0; fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected
• Complete the fix for per-request raw: true on reads (GHSA-wr87-m4jw-29x5)
  • A read made with raw: true doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Raw reads now ignore flags in the reply
  • Affects 5.2.1 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13

Bug fixes:

• get_with_metadata and fetch_with_lock retried the final error raised when a server is marked down, so with down_retry_delay: 0 they retried an unresponsive server forever. They now retry only retryable errors, like other operations
• Fix a regression in 5.2.1: a get_multi that didn't finish within socket_timeout counted toward socket_max_failures, so two slow get_multi calls in a row marked a healthy server down. It now just closes the connection
• Fix a regression in 5.2.1: over TLS, every request buffered in a quiet block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again
• Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no s flag could leave the connection out of step or raise a non-Dalli error
• With decompressed_max_bytes in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit
• With a digest_class whose digests aren't short hex strings, shortening a long key could loop forever. It now raises ArgumentError

Notes:

• Document how long keys are shortened, and that a short key written in the same form names the same item, in the README's security note (#1200)

Development:

• Run the Tests, RuboCop and Profiles workflows on pushes to main and the *-stable branches only, so a pull request's branch isn't tested twice (once for the push and once for the pull request) (#1198)

v5.2.1

Security release. Fixes five vulnerabilities, released together in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12: a pipelined get_multi returning another key's value (GHSA-p6pm-ch9v-44vx); unbounded retries and routing tokens that add meta flags (GHSA-4qp6-2jcr-596v); unbounded decompression and reply sizes (GHSA-3553-vcg5-72jw); per-request raw: true ignored on reads (GHSA-wr87-m4jw-29x5); and a forked child resending the parent's requests or ending its TLS session (GHSA-w39f-xq2m-4g8x). Upgrading is strongly recommended.

Security:

• Fix pipelined get_multi returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)
  • The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (CLIENT_ERROR, SERVER_ERROR, or EN from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a get could return another key's value
  • Keys are now measured in bytes as sent, after base64 encoding when the key needs it. A key under 250 characters but over 250 bytes on the wire (for example, one with many non-ASCII characters) was the easiest way to cause that error reply. Such keys are now truncated like other long keys; keys that worked before are unchanged
  • Affects the meta protocol since 3.2.0 (the default since 5.0.0); fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Reject routing tokens that add meta flags, and stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)
  • p_token and l_token now reject whitespace and control characters, not just CR, LF and NUL. A space let a token add meta flags to the request it was sent with: changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or reading a different key
  • Affects 5.1.0 and later; fixed in 5.2.1 and 5.1.3
  • A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after socket_max_failures attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after down_retry_delay
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)
  • Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's compress or serializer settings. The new decompressed_max_bytes option (default 128 MiB; nil disables it) makes a read that would pass it raise Dalli::UnmarshalError. Custom compressors whose decompress takes only the data keep working, without the limit
  • The value size in a reply was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise Dalli::DalliError before reading
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Honor per-request raw: true on reads, and add Dalli::JSONSerializer (GHSA-wr87-m4jw-29x5)
  • get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata ignored a per-request raw: true and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have Marshal.load run on data someone else wrote to memcached. They now return the stored bytes
  • The raw part affects get_with_metadata since 4.2.0, and the other methods since they gained per-request options in 5.1.0

... (truncated)

Changelog

Sourced from dalli's changelog.

5.2.2

Security:

• Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)
  • With a namespace, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key
  • Affects single-key operations since 5.0.3, single-server get_multi since 5.1.0, and get_with_metadata and fetch_with_lock since 4.1.0; fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected
• Complete the fix for per-request raw: true on reads (GHSA-wr87-m4jw-29x5)
  • A read made with raw: true doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Raw reads now ignore flags in the reply
  • Affects 5.2.1 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13

Bug fixes:

• get_with_metadata and fetch_with_lock retried the final error raised when a server is marked down, so with down_retry_delay: 0 they retried an unresponsive server forever. They now retry only retryable errors, like other operations
• Fix a regression in 5.2.1: a get_multi that didn't finish within socket_timeout counted toward socket_max_failures, so two slow get_multi calls in a row marked a healthy server down. It now just closes the connection
• Fix a regression in 5.2.1: over TLS, every request buffered in a quiet block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again
• Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no s flag could leave the connection out of step or raise a non-Dalli error
• With decompressed_max_bytes in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit
• With a digest_class whose digests aren't short hex strings, shortening a long key could loop forever. It now raises ArgumentError

Notes:

• Document how long keys are shortened, and that a short key written in the same form names the same item, in the README's security note (#1200)

Development:

• Run the Tests, RuboCop and Profiles workflows on pushes to main and the *-stable branches only, so a pull request's branch isn't tested twice (once for the push and once for the pull request) (#1198)

5.2.1

Security:

• Fix pipelined get_multi returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)
  • The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (CLIENT_ERROR, SERVER_ERROR, or EN from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a get could return another key's value
  • Keys are now measured in bytes as sent, after base64 encoding when the key needs it. A key under 250 characters but over 250 bytes on the wire (for example, one with many non-ASCII characters) was the easiest way to cause that error reply. Such keys are now truncated like other long keys; keys that worked before are unchanged
  • Affects the meta protocol since 3.2.0 (the default since 5.0.0); fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Reject routing tokens that add meta flags, and stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)
  • p_token and l_token now reject whitespace and control characters, not just CR, LF and NUL. A space let a token add meta flags to the request it was sent with: changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or reading a different key
  • Affects 5.1.0 and later; fixed in 5.2.1 and 5.1.3
  • A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after socket_max_failures attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after down_retry_delay
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)
  • Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's compress or serializer settings. The new decompressed_max_bytes option (default 128 MiB; nil disables it) makes a read that would pass it raise Dalli::UnmarshalError. Custom compressors whose decompress takes only the data keep working, without the limit
  • The value size in a reply was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise Dalli::DalliError before reading
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Honor per-request raw: true on reads, and add Dalli::JSONSerializer (GHSA-wr87-m4jw-29x5)
  • get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata ignored a per-request raw: true and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have Marshal.load run on data someone else wrote to memcached. They now return the stored bytes
  • The raw part affects get_with_metadata since 4.2.0, and the other methods since they gained per-request options in 5.1.0

... (truncated)

Commits

• a27cfd3 Merge pull request #1205 from petergoldstein/release/5.2.2
• 1455750 Prepare 5.2.2 release
• 2be6cc3 Put the test server's extra flags after the key, and fix a misplaced comment
• dca2533 Raise instead of looping when a digest is too long for a truncated key
• 2c9b12d Ignore data after the end of the stream in the capped inflate
• 1cf990d Handle malformed hits in the reply parsers
• 7175f23 Send each write-buffer flush as one write
• 8e41599 Don't count a get_multi that runs out of time as a socket failure
• 15a71c2 Ignore flags in replies to raw reads (GHSA-wr87-m4jw-29x5)
• 3fad213 Retry only retryable errors in get_with_metadata and fetch_with_lock
• Additional commits viewable in compare view

Updates graphql from 2.6.11 to 2.6.12

Changelog

Sourced from graphql's changelog.

2.6.12 (14 Oct 2026)

Security: This version contains a patch for GHSA-965v-9v76-5hg2

Bug fixes

• Visibility::Profile#preload: preload more type information #5748 #5758
• Variables: use defaults for omitted non-null variables #5754
• Visibility::Profile: freeze hashes when fully loaded #5750
• Dataloader: give nested dataloader calls their own state #5760
• RelationConnection: reject invalid cursors #5752
• Legacy execution: Set current_field and current_arguments for list item dataloader fibers #5759
• Propagate list errors through non-null items #5756
• Fix error paths and performance on input objects in lists #5751
• Execution::Next: Don't call .size on non-Array list results #5765
• Subscriptions: reject multiple root selections and introspection root selections #5770
• Parser: fix source locations after multibyte input #5771
• RelationConnection: fix detection of AsyncDataloader to avoid duplicate queries #5773

Commits

• 842ab4f v2.6.12
• b49ee49 Merge commit from fork
• c0d6048 Only skip auth for built-in node/nodes/edges fields in Execution::Next
• 075a44e Add failing test for Execution::Next skipping auth on custom edge/connection ...
• 536364a Merge pull request #5773 from drhops/fix-relation-connection-async-dataloader...
• beba07b Fix RelationConnection's AsyncDataloader check so its single-flight lock engages
• 61759ed Merge pull request #5771 from ydah/fix-parser-multibyte-locations
• fe9974a Merge pull request #5770 from ydah/fix-subscription-root-validation
• 0547b67 Merge pull request #5769 from rmosolgo/dependabot/github_actions/shogo82148/a...
• c64bdfe Fix parser source locations after multibyte input
• Additional commits viewable in compare view

Updates sorbet-static from 0.6.13508 to 0.6.13571

Release notes

Sourced from sorbet-static's releases.

sorbet 0.6.13570.20261015153047-2d369a813

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13570', :group => :development
gem 'sorbet-runtime', '0.6.13570'

sorbet 0.6.13569.20261015150910-e9154e054

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13569', :group => :development
gem 'sorbet-runtime', '0.6.13569'

sorbet 0.6.13568.20261015143457-3e19ac70a

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13568', :group => :development
gem 'sorbet-runtime', '0.6.13568'

sorbet 0.6.13567.20261015132013-f00b82da1

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13567', :group => :development
gem 'sorbet-runtime', '0.6.13567'

sorbet 0.6.13566.20261015130532-21c94086b

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13566', :group => :development
gem 'sorbet-runtime', '0.6.13566'

sorbet 0.6.13565.20261015110443-7c41365a5

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13565', :group => :development
gem 'sorbet-runtime', '0.6.13565'

sorbet 0.6.13564.20261015103512-d42a5d3fe

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13564', :group => :development
gem 'sorbet-runtime', '0.6.13564'

sorbet 0.6.13563.20261015102048-894233795

... (truncated)

Commits

• See full diff in compare view

Updates webmock from 3.26.4 to 3.34.0

Release notes

Sourced from webmock's releases.

3.34.0

• Allow with(query: :any) to match any query string (#1099)

  stub_request(:get, "www.example.com").with(query: :any) matches requests with any query string, or none. RSpec's anything works the same way. Previously, this raised NoMethodError, and you had to write with(query: hash_including({})).

  Use a URL without query parameters when passing query: :any. Otherwise, WebMock raises ArgumentError.

  Thanks to nightpool

• Raise a clear ArgumentError for an unsupported query option

  Previously, a value such as with(query: :all) raised NoMethodError (undefined method split). The new error lists the supported values.

• Show anything for keys given without a value to hash_including or hash_excluding outside RSpec

  Previously, with Minitest or Test::Unit, messages showed #<WebMock::Matchers::AnyArgMatcher:0x...>, for example for with(query: hash_including(:a)). RSpec's own matchers already showed anything.

• Provide HTTP_HOST to to_rack apps when the client has not supplied a Host header (#1084)

  Previously, requests from some HTTP clients reached the Rack app without HTTP_HOST. This caused host checks such as Sinatra's HostAuthorization to see an empty host.

  WebMock now fills in the host from the request URL, including the port when it is not the default. An explicit Host header is preserved.

  Thanks to Benoit Tigeot

• Fix Rack compatibility for to_rack apps

  The request environment now passes Rack::Lint.

  SERVER_PORT and CONTENT_LENGTH are now strings. If your app or tests read them directly, use string comparisons, such as env['SERVER_PORT'] == "80". The environment also includes SERVER_PROTOCOL.

  CONTENT_TYPE is omitted when the request has no content type. The Content-Length header is passed only as CONTENT_LENGTH, without an extra HTTP_CONTENT_LENGTH entry. Transfer-Encoding is removed because the body has already been decoded.

  Repeated header values are joined into one string. Header values and the body read from rack.input now use binary (ASCII-8BIT) strings.

3.33.0

• Return effective_url as a String for stubbed Typhoeus responses (#869)

  Previously, this was an Addressable::URI. If your code calls methods such as effective_url.host, parse the returned string into a URI first.

  The URL keeps the request's port, query order and encoding. It follows curl's formatting: for example, http://example.com:80 becomes http://example.com:80/. Stubbed timeouts now provide an effective_url too.

  Thanks to Tom Brammar

• Fix incorrect removal of default ports from displayed URLs

  WebMock could accidentally remove :80 or :443 from a URL's path or query. For example, an error message could show /foo/bar instead of /foo:80/bar.

  Only the host's default port is now removed. This also works when the port is immediately followed by a query string, as in http://example.com:80?a=b.

... (truncated)

Changelog

Sourced from webmock's changelog.

3.34.0

• Allow with(query: :any) to match any query string (#1099)

  stub_request(:get, "www.example.com").with(query: :any) matches requests with any query string, or none. RSpec's anything works the same way. Previously, this raised NoMethodError, and you had to write with(query: hash_including({})).

  Use a URL without query parameters when passing query: :any. Otherwise, WebMock raises ArgumentError.

  Thanks to nightpool

• Raise a clear ArgumentError for an unsupported query option

  Previously, a value such as with(query: :all) raised NoMethodError (undefined method split). The new error lists the supported values.

• Show anything for keys given without a value to hash_including or hash_excluding outside RSpec

  Previously, with Minitest or Test::Unit, messages showed #<WebMock::Matchers::AnyArgMatcher:0x...>, for example for with(query: hash_including(:a)). RSpec's own matchers already showed anything.

• Provide HTTP_HOST to to_rack apps when the client has not supplied a Host header (#1084)

  Previously, requests from some HTTP clients reached the Rack app without HTTP_HOST. This caused host checks such as Sinatra's HostAuthorization to see an empty host.

  WebMock now fills in the host from the request URL, including the port when it is not the default. An explicit Host header is preserved.

  Thanks to Benoit Tigeot

• Fix Rack compatibility for to_rack apps

  The request environment now passes Rack::Lint.

  SERVER_PORT and CONTENT_LENGTH are now strings. If your app or tests read them directly, use string comparisons, such as env['SERVER_PORT'] == "80". The environment also includes SERVER_PROTOCOL.

  CONTENT_TYPE is omitted when the request has no content type. The Content-Length header is passed only as CONTENT_LENGTH, without an extra HTTP_CONTENT_LENGTH entry. Transfer-Encoding is removed because the body has already been decoded.

  Repeated header values are joined into one string. Header values and the body read from rack.input now use binary (ASCII-8BIT) strings.

3.33.0

• Return effective_url as a String for stubbed Typhoeus responses (#869)

  Previously, this was an Addressable::URI. If your code calls methods such as effective_url.host, parse the returned string into a URI first.

  The URL keeps the request's port, query order and encoding. It follows curl's formatting: for example, http://example.com:80 becomes http://example.com:80/. Stubbed timeouts now provide an effective_url too.

  Thanks to Tom Brammar

• Fix incorrect removal of default ports from displayed URLs

  WebMock could accidentally remove :80 or :443 from a URL's path or query. For example, an error message could show /foo/bar instead of /foo:80/bar.

... (truncated)

Commits

• 11392e4 Version 3.34.0
• eabc151 Close the gaps a review found in the Rack env
• 38f08be Make the Rack env for to_rack apps follow the Rack spec
• 732328b Tidy the Rack host fallback and its specs
• 3d831ce Set HTTP_HOST in the Rack env instead of the Net::HTTP signature
• aa71fc1 Merge pull request #1084 from benoittgt/prevent-empty-host
• 5fbb394 Reject query :any with a URI query and accept anything matchers
• d94e918 Reject unsupported query options and describe :any as anything
• 0b56b62 Merge pull request #1099 from nightpool/add-any-query-option
• 78d1078 Version 3.33.0
• Additional commits viewable in compare view

Updates parallel from 2.2.0 to 2.3.0

Changelog

Sourced from parallel's changelog.

2.3.0

Added

• exit!: true option to skip at_exit hooks and VM teardown in worker processes

Commits

• c504087 v2.3.0
• 02aec79 fix random error from invalid utf8
• 38c256e Merge pull request #393 from grosser/grosser/exit
• 42796dd add exit! option
• See full diff in compare view

Updates sorbet-static-and-runtime from 0.6.13508 to 0.6.13571

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.6.13570.20261015153047-2d369a813

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13570', :group => :development
gem 'sorbet-runtime', '0.6.13570'

sorbet 0.6.13569.20261015150910-e9154e054

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13569', :group => :development
gem 'sorbet-runtime', '0.6.13569'

sorbet 0.6.13568.20261015143457-3e19ac70a

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13568', :group => :development
gem 'sorbet-runtime', '0.6.13568'

sorbet 0.6.13567.20261015132013-f00b82da1

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13567', :group => :development
gem 'sorbet-runtime', '0.6.13567'

sorbet 0.6.13566.20261015130532-21c94086b

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13566', :group => :development
gem 'sorbet-runtime', '0.6.13566'

sorbet 0.6.13565.20261015110443-7c41365a5

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13565', :group => :development
gem 'sorbet-runtime', '0.6.13565'

sorbet 0.6.13564.20261015103512-d42a5d3fe

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13564', :group => :development
gem 'sorbet-runtime', '0.6.13564'

sorbet 0.6.13563.20261015102048-894233795

... (truncated)

Commits

• See full diff in compare view

Updates rbi from 0.4.3 to 0.5.0

Release notes

Sourced from rbi's releases.

v0.5.0

What's Changed

🛠 Other Changes

• Introduce ForwardingParam for argument forwarding by @​Morriar in Shopify/rbi#625
• Test Method#add_forwarding_param builder by @​KaanOzkan in Shopify/rbi#657
• Remove useless benchmarks by @​Morriar in Shopify/rbi#659
• Fix superlinear work in collect_dangling_comments for nested scopes by @​jesse-shopify in Shopify/rbi#672
• Fix quadratic duplicate checks when merging comments by @​jesse-shopify in Shopify/rbi#673

Full Changelog: Shopify/rbi@v0.4.3...v0.5.0

Commits

• 6704519 Bump version to v0.5.0
• 31b87a8 Merge pull request #673 from Shopify/fix-quadratic-merge-comment-checks
• 9be813d Merge pull request #672 from Shopify/fix-superlinear-dangling-comments
• aeda7c9 Test deduplication of repeated new comments
• a3d9008 Merge pull request #675 from Shopify/dependabot/bundler/minor-and-patch-fec0c...
• 26121ec Merge pull request #674 from Shopify/dependabot/github_actions/ruby/setup-rub...
• 7551dee Bump the minor-and-patch group with 3 updates
• 0107310 Bump ruby/setup-ruby from 1.328.0 to 1.329.0
• be780aa Update exported RBI
• 1a3c96a Remove explanatory comments
• Additional commits viewable in compare view

Updates spoom from 1.8.9 to 1.8.12

Release notes

Sourced from spoom's releases.

v1.8.12

What's Changed

🐛 Bug Fixes

• Escape project data in the HTML coverage report by @​egiurleo in GHSA-8rx6-f9cr-23q6

🛠 Other Changes

• Warn before loading custom deadcode plugins by @​egiurleo in Shopify/spoom#1034

Full Changelog: Shopify/spoom@v1.8.11...v1.8.12

v1.8.11

What's Changed

✨ Enhancements

• Expose RBS_REWRITE_PATTERN for rbs_rewriter by @​st0012 in Shopify/spoom#1030

🛠 Other Changes

• Expose RBS syntax and strictness helpers for rbs_rewriter by @​st0012 in Shopify/spoom#1031

Full Changelog: Shopify/spoom@v1.8.10...v1.8.11

v1.8.10

What's Changed

🛠 Other Changes

• Collect metrics for T::InexactStruct and T::ImmutableStruct by @​Morriar in Shopify/spoom#1026

Full Changelog: Shopify/spoom@v1.8.9...v1.8.10

Commits

• df9bdfa Bump version to v1.8.12
• 833a6c4 Merge commit from fork
• 01cfb83 Merge pull request #1034 from Shopify/deadcode-custom-plugins-warning
• 94b59dc Warn before loading custom deadcode plugins
• d6ea003 Simplify Snapshot.integer_field
• 031adac Validate snapshot counts and escape every tooltip value
• 7369829 Escape project data in the HTML coverage report
• 20e5fb3 Bump version to v1.8.11
• 3ea933d Merge pull request #1031 from Shopify/codex/rbs-minimum-strictness
• 4ed6db9 Merge pull request #1033 from Shopify/dependabot/github_actions/ruby/setup-ru...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[KaanOzkan]

These aren't supposed to be overrides, but I'm reluctant to rename a nice name