chore(deps): bump the bundler group across 1 directory with 5 updates

[dependabot]

Bumps the bundler group with 5 updates in the / directory:

Package	From	To
resolv	0.8.0	0.8.1
bullet	8.2.0	8.3.0
webmock	3.26.4	3.30.0
lefthook	2.1.17	2.2.1
lexxy	1.0.0	1.0.1

Updates resolv from 0.8.0 to 0.8.1

Release notes

Sourced from resolv's releases.

v0.8.1

What's Changed

• Forward-port win32/resolv fixes from ruby/ruby#19030 by @​hsbt in ruby/resolv#149
• Forward-port bccwin removal from ruby/ruby#19010 by @​hsbt in ruby/resolv#150
• Prefer the registry over /etc/resolv.conf on native Windows by @​hsbt in ruby/resolv#153
• Bound the number of compression pointers per name by @​mame in ruby/resolv#155

New Contributors

• @​mame made their first contribution in ruby/resolv#155

Full Changelog: ruby/resolv@v0.8.0...v0.8.1

Commits

• 6a4a1b4 v0.8.1
• b6e0878 Merge pull request #155 from mame/bound-name-pointer-chain
• 0415f01 Bound the number of compression pointers per name
• 0275974 Merge pull request #153 from ruby/claude/ruby-resolv-memory-bug-93457f
• 292c9a6 Prefer the registry over /etc/resolv.conf on native Windows
• 12df311 Merge pull request #150 from ruby/claude/friendly-pike-4f8462
• 8afde76 Remove bccwin from the Resolv::Hosts platform check
• ce86a83 Merge pull request #149 from ruby/claude/gracious-yonath-553370
• 971a36e Skip TestWin32Config without the win32/resolv extension
• 94fa14d Fix the Win32::Resolv guard in test_win32_config.rb
• Additional commits viewable in compare view

Updates bullet from 8.2.0 to 8.3.0

Changelog

Sourced from bullet's changelog.

8.3.0 (10/10/2026)

• Add support for ActiveRecord 8.2

Commits

• fb5f796 Bump version to 8.3.0
• 16aafba Merge pull request #782 from GoThassos/rails-8.2-compat
• c0cc937 Add support for ActiveRecord 8.2
• See full diff in compare view

Updates webmock from 3.26.4 to 3.30.0

Release notes

Sourced from webmock's releases.

3.30.0

• Allow narrowing an RSpec expectation on a stub with with, as in expect(stub).to have_been_requested.once.with(body: "abc") (#1128)

  The expectation counts only the requests that match both the stub and the conditions given to with. The stub itself does not change.

  Thanks to Sébastien S.

• Show the JSON body hint for expectations narrowed with with too, and no longer show it when a block is given to the stub or expectation, since checking would mean calling the block

• Allow a full URL with a path in disable_net_connect!(allow: ...), as in allow: "https://github.com/mozilla/geckodriver/releases/latest" (#977)

  URLs are compared the same way as in stubs, so the default port, letter case in the host, and the order and encoding of query parameters don't matter. A URL without a path or query allows every path on that scheme, host and port; a trailing slash restricts requests to / with no query string. Credentials in either URL are ignored.

  Thanks to Henry Blyth

3.29.0

• Show a body diff for JSON requests whose content type has a +json suffix, such as application/vnd.api+json, and for the other content types WebMock already matches as JSON (#734)

  Thanks to Olivier Brisse

• Ignore the case of JSON, XML and url-encoded content types when matching request bodies, and match bodies of any +json or +xml media type, such as image/svg+xml, as JSON or XML

• Suggest declaring a JSON body as a hash when a request fails to match only because the JSON is formatted differently (#649)

  A body declared as a string must match the request body exactly, including key order and whitespace. When that is the only difference, the error for an unregistered request and the failure message of a request expectation now say so, and suggest with(body: JSON.parse(json_string)). Matching JSON strings regardless of key order by default is planned for the next major version (#485).

3.28.0

• Fix to_rack apps receiving a rack.session they did not set up (#985)

  WebMock used to add a session hash to the Rack env, shared by every request to the same stub. This confused apps that check whether a session is present, such as Rails API-only apps, and carried session data over between requests. WebMock now leaves rack.session and rack.session.options unset, as a real server does. If your app needs a session, include session middleware in the app you pass to to_rack. RackResponse#session and RackResponse#session_options have been removed.

  Thanks to Jan Graichen

• Fix crash when matching a hash body pattern against a JSON or XML request that has no body

  Thanks to Chris

• No longer warn about curb versions newer than the last one tested

• Document regexp values in hash_including

  Thanks to Christian Bruckmayer

• Remove unused RequestSignatureSnippet#request_params

  Thanks to Daniel Pepper

3.27.0

• Fix crash in async-http adapter when a request header has a nil value

... (truncated)

Changelog

Sourced from webmock's changelog.

3.30.0

• Allow narrowing an RSpec expectation on a stub with with, as in expect(stub).to have_been_requested.once.with(body: "abc") (#1128)

  The expectation counts only the requests that match both the stub and the conditions given to with. The stub itself does not change.

  Thanks to Sébastien S.

• Show the JSON body hint for expectations narrowed with with too, and no longer show it when a block is given to the stub or expectation, since checking would mean calling the block

• Allow a full URL with a path in disable_net_connect!(allow: ...), as in allow: "https://github.com/mozilla/geckodriver/releases/latest" (#977)

  URLs are compared the same way as in stubs, so the default port, letter case in the host, and the order and encoding of query parameters don't matter. A URL without a path or query allows every path on that scheme, host and port; a trailing slash restricts requests to / with no query string. Credentials in either URL are ignored.

  Thanks to Henry Blyth

3.29.0

• Show a body diff for JSON requests whose content type has a +json suffix, such as application/vnd.api+json, and for the other content types WebMock already matches as JSON (#734)

  Thanks to Olivier Brisse

• Ignore the case of JSON, XML and url-encoded content types when matching request bodies, and match bodies of any +json or +xml media type, such as image/svg+xml, as JSON or XML

• Suggest declaring a JSON body as a hash when a request fails to match only because the JSON is formatted differently (#649)

  A body declared as a string must match the request body exactly, including key order and whitespace. When that is the only difference, the error for an unregistered request and the failure message of a request expectation now say so, and suggest with(body: JSON.parse(json_string)). Matching JSON strings regardless of key order by default is planned for the next major version (#485).

3.28.0

• Fix to_rack apps receiving a rack.session they did not set up (#985)

  WebMock used to add a session hash to the Rack env, shared by every request to the same stub. This confused apps that check whether a session is present, such as Rails API-only apps, and carried session data over between requests. WebMock now leaves rack.session and rack.session.options unset, as a real server does. If your app needs a session, include session middleware in the app you pass to to_rack. RackResponse#session and RackResponse#session_options have been removed.

  Thanks to Jan Graichen

• Fix crash when matching a hash body pattern against a JSON or XML request that has no body

  Thanks to Chris

• No longer warn about curb versions newer than the last one tested

• Document regexp values in hash_including

  Thanks to Christian Bruckmayer

• Remove unused RequestSignatureSnippet#request_params

  Thanks to Daniel Pepper

... (truncated)

Commits

• d57be75 Version 3.30.0
• 37ab875 Compare allowed URLs in the net connect allow list the same way as stub URLs
• 686f411 Keep allowing every path for scheme://host in the net connect allow list
• 76b020c Merge pull request #978 from henrahmagix/patch-1
• 0a6b7f4 Show the JSON body hint for expectations narrowed with with
• 71acb1b Stop with on stub expectations from changing the stub
• 8369a56 Merge pull request #1128 from inkstak/feature-have_been_requested_with_body
• 664309c Version 3.29.0
• 5fc01c3 Only check that an oddly encoded JSON body does not raise
• b8dfa96 Suggest declaring a JSON body as a hash when only its formatting differs
• Additional commits viewable in compare view

Updates lefthook from 2.1.17 to 2.2.1

Release notes

Sourced from lefthook's releases.

v2.2.1

Changelog

• 6dd11f61f54595935746f9e0814c16844fc6d31b feat: support php composer (#1583)
• c702ccf154bb180107ba5f790518c161d9ce111d fix: generate different patch names when in a worktree (#1582)
• 486fdd317d29f815821ce2450d42e3a49b066eb0 refactor: cache paths in wrapper (#1570)

v2.2.0

Changelog

• 46c65b3871dd96c81624f413b24b3d273b41a4e5 deps: October 2026 (#1571)
• 37f17131b605cf0f64c29252ebfe94610368f769 fix: don't write an install-time lefthook path into AI hook configs (#1544)
• cc9969c2e2198aafff8accc63ee1aee30e9a2aa4 fix: ignore trailing NUL in --files-from-stdin (#1574)
• 57fee374b70c18e17ada20e09a336142d6d8899f fix: pass --output path to git diff as a single argument (#1581)

Changelog

Sourced from lefthook's changelog.

2.2.1

• feat: support php composer (#1583) by @​mrexox
• fix: generate different patch names when in a worktree (#1582) by @​mrexox
• refactor: cache paths in wrapper (#1570) by @​mrexox

2.2.0

• fix: don't write an install-time lefthook path into AI hook configs (#1544) by @​anandghegde
• docs: publish JSON schema at lefthook.dev/schema.json (#1579) by @​BUTTERFINGERS7498
• fix: pass --output path to git diff as a single argument (#1581) by @​cpruijsen
• fix: ignore trailing NUL in --files-from-stdin (#1574) by @​jasonwbarnett
• deps: October 2026 (#1571) by @​mrexox

2.1.7

• fix: don't hash submodules when checking fail_on_changes (#1566) by @​tiagovilasboas
• refactor: naming of helpers (#1568) by @​mrexox
• fix: diff push files against the merge base with the default branch (#1565) by @​mrexox
• refactor: working with git (#1564) by @​mrexox
• docs: add protect-branch example to docs (#1563) by @​vim89

2.1.16

• fix: test staging fixed files with partially staged by @​mrexox
• fix: preserve unrelated unstaged changes on conflict (#1483) by @​Sakshamm-Goyal
• deps: bump mod and text deps to resolve CVEs (#1560) by @​devindavies
• ci: refactor publishing scripts (#1559) by @​mrexox

2.1.15

• fix: do not pipe stdin into post-checkout git-lfs hook (#1523) by @​rwinkelman
• fix: remove color blending (#1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#1485) by @​hamodywe
• test: regression for valid fish shell completion output (#1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#1547) by @​Yash121l

2.1.13/2.1.14 (2026-09-14)

• fix: error when --job/--command matches nothing (#1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#1510) by @​hamodywe
• docs: quote template run examples (#1472) by @​Guflly

2.1.12 (2026-08-28)

... (truncated)

Commits

• 60c1ddd 2.2.1: support concurrent work in worktrees and release PHP package
• 6dd11f6 feat: support php composer (#1583)
• c702ccf fix: generate different patch names when in a worktree (#1582)
• 486fdd3 refactor: cache paths in wrapper (#1570)
• 125cd28 2.2.0: new Go version and git worktree fixes
• 37f1713 fix: don't write an install-time lefthook path into AI hook configs (#1544)
• 0bd7388 docs: publish JSON schema at lefthook.dev/schema.json (#1579)
• 57fee37 fix: pass --output path to git diff as a single argument (#1581)
• cc9969c fix: ignore trailing NUL in --files-from-stdin (#1574)
• 46c65b3 deps: October 2026 (#1571)
• See full diff in compare view

Updates lexxy from 1.0.0 to 1.0.1

Release notes

Sourced from lexxy's releases.

v1.0.1

What's Changed

• Keep bold, italic and line breaks pasted from Google Docs by @​rosa in basecamp/lexxy#1288

Full Changelog: basecamp/lexxy@v1.0.0...v1.0.1

Commits

• f0f6c67 Bump version to 1.0.1
• 82b4baf Only drop the trailing Apple-interchange-newline
• c5e88d0 Keep bold, italic and line breaks pasted from Google Docs
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions