Skip to content

chore(deps): bump the bundler group with 6 updates - #1408

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-ca052cc97a
Closed

chore(deps): bump the bundler group with 6 updates#1408
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-ca052cc97a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 6 updates:

Package From To
resolv 0.8.0 0.8.1
thruster 0.1.26 0.1.27
bullet 8.2.0 8.3.0
webmock 3.26.4 3.29.0
lefthook 2.1.17 2.2.1
lexxy 1.0.0 1.0.1

Updates resolv from 0.8.0 to 0.8.1

Release notes

Sourced from resolv's releases.

v0.8.1

What's Changed

New Contributors

Full Changelog: ruby/resolv@v0.8.0...v0.8.1

Commits
  • 6a4a1b4 v0.8.1
  • b6e0878 Merge pull request #155 from mame/bound-name-pointer-chain
  • 0415f01 Bound the number of compression pointers per name
  • 0275974 Merge pull request #153 from ruby/claude/ruby-resolv-memory-bug-93457f
  • 292c9a6 Prefer the registry over /etc/resolv.conf on native Windows
  • 12df311 Merge pull request #150 from ruby/claude/friendly-pike-4f8462
  • 8afde76 Remove bccwin from the Resolv::Hosts platform check
  • ce86a83 Merge pull request #149 from ruby/claude/gracious-yonath-553370
  • 971a36e Skip TestWin32Config without the win32/resolv extension
  • 94fa14d Fix the Win32::Resolv guard in test_win32_config.rb
  • Additional commits viewable in compare view

Updates thruster from 0.1.26 to 0.1.27

Changelog

Sourced from thruster's changelog.

v0.1.27 / 2026-09-28

  • Update dependencies (#154)
  • Bump golang.org/x/crypto to v0.56.0 (#152)
  • Build with Go 1.27.1, update dependencies, add make check (#150)
Commits
  • 669643f Merge commit from fork
  • 38d3721 Merge pull request #155 from erikthoreson24/version-0.1.27
  • 0992970 Bump version
  • 72796d7 Merge pull request #154 from basecamp/deps
  • 0864e8a Use http.Transport for h2c test client
  • 80e89ee Update dependencies
  • 22a9978 Merge pull request #152 from erikthoreson24/fix/bump-x-crypto-0.56.0
  • b186518 Bump golang.org/x/crypto to v0.56.0
  • 3ef8516 Merge pull request #150 from basecamp/go-1.27.1
  • fa31b96 Add make check to run go vet and govulncheck
  • Additional commits viewable in compare view

Updates bullet from 8.2.0 to 8.3.0

Changelog

Sourced from bullet's changelog.

8.3.0 (10/10/2026)

  • Add support for ActiveRecord 8.2
Commits

Updates webmock from 3.26.4 to 3.29.0

Release notes

Sourced from webmock's releases.

3.29.0

  • Show a body diff for JSON requests whose content type has a +json suffix, such as application/vnd.api+json, and for the other content types WebMock already matches as JSON (#734)

    Thanks to Olivier Brisse

  • Ignore the case of JSON, XML and url-encoded content types when matching request bodies, and match bodies of any +json or +xml media type, such as image/svg+xml, as JSON or XML

  • Suggest declaring a JSON body as a hash when a request fails to match only because the JSON is formatted differently (#649)

    A body declared as a string must match the request body exactly, including key order and whitespace. When that is the only difference, the error for an unregistered request and the failure message of a request expectation now say so, and suggest with(body: JSON.parse(json_string)). Matching JSON strings regardless of key order by default is planned for the next major version (#485).

3.28.0

  • Fix to_rack apps receiving a rack.session they did not set up (#985)

    WebMock used to add a session hash to the Rack env, shared by every request to the same stub. This confused apps that check whether a session is present, such as Rails API-only apps, and carried session data over between requests. WebMock now leaves rack.session and rack.session.options unset, as a real server does. If your app needs a session, include session middleware in the app you pass to to_rack. RackResponse#session and RackResponse#session_options have been removed.

    Thanks to Jan Graichen

  • Fix crash when matching a hash body pattern against a JSON or XML request that has no body

    Thanks to Chris

  • No longer warn about curb versions newer than the last one tested

  • Document regexp values in hash_including

    Thanks to Christian Bruckmayer

  • Remove unused RequestSignatureSnippet#request_params

    Thanks to Daniel Pepper

3.27.0

  • Fix crash in async-http adapter when a request header has a nil value

    Thanks to hikmetba-bit

  • The async-http adapter now matches stubs against raw request header values instead of values parsed by protocol-http, consistent with the other adapters

  • Add RSpec hash_excluding support to body matching

    Thanks to Chris Gunther

  • Fix hash_excluding ignoring keys given without a value and regexp values, in both query and body matching

  • Fix crash when matching a request that has more than one Content-Type header

Changelog

Sourced from webmock's changelog.

3.29.0

  • Show a body diff for JSON requests whose content type has a +json suffix, such as application/vnd.api+json, and for the other content types WebMock already matches as JSON (#734)

    Thanks to Olivier Brisse

  • Ignore the case of JSON, XML and url-encoded content types when matching request bodies, and match bodies of any +json or +xml media type, such as image/svg+xml, as JSON or XML

  • Suggest declaring a JSON body as a hash when a request fails to match only because the JSON is formatted differently (#649)

    A body declared as a string must match the request body exactly, including key order and whitespace. When that is the only difference, the error for an unregistered request and the failure message of a request expectation now say so, and suggest with(body: JSON.parse(json_string)). Matching JSON strings regardless of key order by default is planned for the next major version (#485).

3.28.0

  • Fix to_rack apps receiving a rack.session they did not set up (#985)

    WebMock used to add a session hash to the Rack env, shared by every request to the same stub. This confused apps that check whether a session is present, such as Rails API-only apps, and carried session data over between requests. WebMock now leaves rack.session and rack.session.options unset, as a real server does. If your app needs a session, include session middleware in the app you pass to to_rack. RackResponse#session and RackResponse#session_options have been removed.

    Thanks to Jan Graichen

  • Fix crash when matching a hash body pattern against a JSON or XML request that has no body

    Thanks to Chris

  • No longer warn about curb versions newer than the last one tested

  • Document regexp values in hash_including

    Thanks to Christian Bruckmayer

  • Remove unused RequestSignatureSnippet#request_params

    Thanks to Daniel Pepper

3.27.0

  • Fix crash in async-http adapter when a request header has a nil value

    Thanks to hikmetba-bit

  • The async-http adapter now matches stubs against raw request header values instead of values parsed by protocol-http, consistent with the other adapters

  • Add RSpec hash_excluding support to body matching

    Thanks to Chris Gunther

  • Fix hash_excluding ignoring keys given without a value and regexp values, in both query and body matching

  • Fix crash when matching a request that has more than one Content-Type header

Commits
  • 664309c Version 3.29.0
  • 5fc01c3 Only check that an oddly encoded JSON body does not raise
  • b8dfa96 Suggest declaring a JSON body as a hash when only its formatting differs
  • d78f3cf Restore the body diff setting after errors_spec turns it off
  • 55d7fec Recognize JSON content types consistently in body diffs
  • 8c1feb6 Version 3.28.0
  • 875e348 Create the GitHub release as part of rake release
  • f7639f4 Stop warning about curb versions newer than the last one checked
  • 31d9526 Test regexp values in hash_including and array body patterns
  • 3316276 Document that to_rack does not provide a session
  • Additional commits viewable in compare view

Updates lefthook from 2.1.17 to 2.2.1

Release notes

Sourced from lefthook's releases.

v2.2.1

Changelog

  • 6dd11f61f54595935746f9e0814c16844fc6d31b feat: support php composer (#1583)
  • c702ccf154bb180107ba5f790518c161d9ce111d fix: generate different patch names when in a worktree (#1582)
  • 486fdd317d29f815821ce2450d42e3a49b066eb0 refactor: cache paths in wrapper (#1570)

v2.2.0

Changelog

  • 46c65b3871dd96c81624f413b24b3d273b41a4e5 deps: October 2026 (#1571)
  • 37f17131b605cf0f64c29252ebfe94610368f769 fix: don't write an install-time lefthook path into AI hook configs (#1544)
  • cc9969c2e2198aafff8accc63ee1aee30e9a2aa4 fix: ignore trailing NUL in --files-from-stdin (#1574)
  • 57fee374b70c18e17ada20e09a336142d6d8899f fix: pass --output path to git diff as a single argument (#1581)
Changelog

Sourced from lefthook's changelog.

2.2.1

2.2.0

2.1.7

2.1.16

2.1.15

2.1.13/2.1.14 (2026-09-14)

2.1.12 (2026-08-28)

... (truncated)

Commits
  • 60c1ddd 2.2.1: support concurrent work in worktrees and release PHP package
  • 6dd11f6 feat: support php composer (#1583)
  • c702ccf fix: generate different patch names when in a worktree (#1582)
  • 486fdd3 refactor: cache paths in wrapper (#1570)
  • 125cd28 2.2.0: new Go version and git worktree fixes
  • 37f1713 fix: don't write an install-time lefthook path into AI hook configs (#1544)
  • 0bd7388 docs: publish JSON schema at lefthook.dev/schema.json (#1579)
  • 57fee37 fix: pass --output path to git diff as a single argument (#1581)
  • cc9969c fix: ignore trailing NUL in --files-from-stdin (#1574)
  • 46c65b3 deps: October 2026 (#1571)
  • See full diff in compare view

Updates lexxy from 1.0.0 to 1.0.1

Release notes

Sourced from lexxy's releases.

v1.0.1

What's Changed

Full Changelog: basecamp/lexxy@v1.0.0...v1.0.1

Commits
  • f0f6c67 Bump version to 1.0.1
  • 82b4baf Only drop the trailing Apple-interchange-newline
  • c5e88d0 Keep bold, italic and line breaks pasted from Google Docs
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the bundler group with 6 updates
c7fc49c 
Bumps the bundler group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [resolv](https://github.com/ruby/resolv) | `0.8.0` | `0.8.1` |
| [thruster](https://github.com/basecamp/thruster) | `0.1.26` | `0.1.27` |
| [bullet](https://github.com/flyerhzm/bullet) | `8.2.0` | `8.3.0` |
| [webmock](https://github.com/bblimke/webmock) | `3.26.4` | `3.29.0` |
| [lefthook](https://github.com/evilmartians/lefthook) | `2.1.17` | `2.2.1` |
| [lexxy](https://github.com/basecamp/lexxy) | `1.0.0` | `1.0.1` |


Updates `resolv` from 0.8.0 to 0.8.1
- [Release notes](https://github.com/ruby/resolv/releases)
- [Commits](ruby/resolv@v0.8.0...v0.8.1)

Updates `thruster` from 0.1.26 to 0.1.27
- [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md)
- [Commits](basecamp/thruster@v0.1.26...v0.1.27)

Updates `bullet` from 8.2.0 to 8.3.0
- [Changelog](https://github.com/flyerhzm/bullet/blob/main/CHANGELOG.md)
- [Commits](flyerhzm/bullet@8.2.0...8.3.0)

Updates `webmock` from 3.26.4 to 3.29.0
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.26.4...v3.29.0)

Updates `lefthook` from 2.1.17 to 2.2.1
- [Release notes](https://github.com/evilmartians/lefthook/releases)
- [Changelog](https://github.com/evilmartians/lefthook/blob/master/CHANGELOG.md)
- [Commits](evilmartians/lefthook@v2.1.17...v2.2.1)

Updates `lexxy` from 1.0.0 to 1.0.1
- [Release notes](https://github.com/basecamp/lexxy/releases)
- [Commits](basecamp/lexxy@v1.0.0...v1.0.1)

---
updated-dependencies:
- dependency-name: resolv
  dependency-version: 0.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: thruster
  dependency-version: 0.1.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: bullet
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: webmock
  dependency-version: 3.29.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: lefthook
  dependency-version: 2.2.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: lexxy
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Oct 15, 2026
This was referenced Oct 15, 2026
Closed
Closed
Closed
This was referenced Oct 15, 2026
Merged
Merged
dschmura added a commit that referenced this pull request Oct 16, 2026
@dschmura
The image scan accepts Thruster 0.1.27's Go and retires the old batch (…
c50ed24 
…#1410)

The image scan has been red on `main` since its weekly run on
2026-10-12, and on every pull request that touches `Gemfile.lock` since
(#1394, #1395, #1399, #1408): four HIGH findings in the Go baked into
Thruster's precompiled binary — Go stdlib v1.27.1 and `golang.org/x/net`
v0.59.0, three denial-of-service CVEs fixed only in Go 1.27.2 and x/net
0.60.0. Thruster 0.1.27 is the newest release, and its published
x86_64-linux binary reports `go1.27.1`, so no version of Thruster
carries the fix yet.

The `.trivyignore` entry for Thruster's Go named its own revisit
trigger: "on the next thruster release (> 0.1.26), or 2026-10-15". Both
fired. This does what that trigger asked. Thruster moves to 0.1.27, the
three new findings go in with the same reasoning the previous batch used
— no fixed release exists, so there is no action to take regardless of
reachability — and a new trigger: the next release after 0.1.27, or
2026-11-15.

The eight go1.26.5-era CVEs the block held, all fixed in Go 1.26.6 and
later, are removed rather than carried forward. The scan cannot print a
finding it ignores, so the only way to learn whether go1.27.1 cleared
them is to stop ignoring them: **this pull request's Image Scan is that
proof**, and a finding that comes back goes back in with its own reason.

Exposure, for the record and not as the rationale: Thruster terminates
TLS only when `TLS_DOMAIN` is set, and no tracked file sets it (`git
grep TLS_DOMAIN` is empty); a fork that enables TLS does so in
kamal-proxy (`proxy: ssl: true`, shipped commented out in
`config/deploy.yml`). That bears on the crypto/tls finding. Whether the
http2 path is reachable through kamal-proxy was not verified.

## Verification

- The three CVEs, versions and fixed versions read from #1408's failed
scan (run 38798151407): stdlib v1.27.1 → 1.27.2 for 78667, 78669, 97031;
x/net v0.59.0 → 0.60.0 for 78669.
- `go1.27.1` read from the binary in the published
`thruster-0.1.27-x86_64-linux` gem.
- `.trivyignore` and image-scan invariants: 6 examples, 0 failures
(rationale and `Revisit:` marker present).
- Image Scan on this pull request (run 38811378629): **green**, and it
did scan the binary — the
`thruster-0.1.27-x86_64-linux/exe/x86_64-linux/` target is listed as
`gobinary`, 0 findings — so none of the eight retired entries is still
present and the three new ones are the only findings.
@dependabot @github

dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 16, 2026
@dependabot
dependabot Bot deleted the dependabot/bundler/bundler-ca052cc97a branch October 16, 2026 00:28
dschmura added a commit that referenced this pull request Oct 16, 2026
@dschmura
Bullet loads on its own now that it knows Active Record 8.2 (#1409)
b30497b 
Bullet 8.2.0 raised at load on Active Record 8.2, so since the move to
Rails main it has loaded through `config/bullet_on_rails_main.rb`, a
shim that hands it its 8.1 patches, with `require: false` on the Gemfile
line so Bundler would not load it first (#1337). A canary spec — "is
still needed: Bullet does not know this Active Record by itself" — was
written to fail the day Bullet supported 8.2 itself, and its failure
message listed the removal steps.

Bullet 8.3.0 does. Dependabot's grouped bundler pull request (#1408)
carried it, and the canary went red there (`test_shard (3)`) exactly as
designed.

This bumps bullet alone and follows the canary's list: the shim and its
require in `config/application.rb` are gone, and the Gemfile line loads
bullet normally. The canary example is deleted; the spec's two behaviour
examples stay, renamed to `spec/config/bullet_spec.rb`, because after
the shim goes they are what proves Bullet still runs and still catches
an N+1 on this Active Record.

Bumping bullet here rather than on #1408's branch keeps Dependabot's
pull request untouched: once this merges, Dependabot rebases the group
and drops bullet from it.

Closes #1337

## Verification

- With bullet 8.3.0 locked and the shim still in place, the canary
failed locally exactly as in #1408's CI ("Bullet now supports Active
Record 8.2: …").
- The removal had its own red: shim deleted, `require: false` still set
→ the suite cannot boot (`NameError: uninitialized constant Bullet`).
Dropping `require: false` → `spec/config/bullet_spec.rb` 2 examples, 0
failures.
- No tracked file outside history still names the shim
(`bullet_on_rails_main`), with a positive control on `bullet_spec`.
- Full suite: 6023 examples, 0 failures, parity 6023/6023, merged
coverage 96.75%.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants