Skip to content

build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates - #339

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/bundler/development-dependencies-58ec2fce37
Open

build(deps-dev): bump the development-dependencies group across 1 directory with 5 updates#339
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/bundler/development-dependencies-58ec2fce37

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 5 updates in the / directory:

Package From To
msgpack 1.8.3 1.8.4
sqlite3 2.9.4 2.9.6
rubocop-minitest 0.39.1 0.40.0
rubocop-performance 1.26.1 1.27.0
rubocop-rails 2.35.3 2.37.0

Updates msgpack from 1.8.3 to 1.8.4

Changelog

Sourced from msgpack's changelog.

2026-07-28 1.8.4

  • Fix MessagePack::Buffer to stop using already released memory page. This could have caused data to leak across buffers when using the MessagePack::Buffer API directly.
Commits
  • 42378b0 Release 1.8.4
  • 7cb88d4 Merge pull request #399 from Watson1978/fix-rmem-page-ownership
  • ce44d0e Fix rmem page released while a later chunk still points into it
  • 8ab8a5a Merge pull request #398 from hsbt/claude/vigilant-chebyshev-63ce11
  • b136b7f Merge pull request #397 from Watson1978/fix-recursive-ext-stack-overflow
  • cf586e9 Build deep recursive-extension spec payload without deep recursion
  • 752ad7f Skip recursive-extension StackError spec on JRuby
  • 1b0cdf7 Raise StackError instead of crashing on deeply nested recursive extensions
  • d2e1c88 Fix build failure on mswin due to empty UNREACHABLE_RETURN()
  • 3efa8bd Move dev dependencies in the Gemfile
  • Additional commits viewable in compare view

Updates sqlite3 from 2.9.4 to 2.9.6

Release notes

Sourced from sqlite3's releases.

2.9.6 / 2026-08-11

Security / Stability

  • Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

  • Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
  • Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
  • Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
  • Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
  • Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
  • Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

  • When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt
d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

2.9.5 / 2026-06-07

Dependencies

Security / Stability

... (truncated)

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

  • Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

  • Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
  • Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
  • Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
  • Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
  • Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
  • Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

  • When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

2.9.5 / 2026-06-07

Dependencies

Security / Stability

Commits
  • a52dc0d version bump to v2.9.6
  • cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
  • abcb0f6 Reject database filenames and VFS names containing NUL (#732)
  • 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
  • 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
  • 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
  • 3de8f6e doc: update CHANGELOG.md
  • ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
  • 32460e9 Stop sqlite calling into moved Ruby objects (#723)
  • f600993 build(deps-dev): update rubocop-minitest requirement (#727)
  • Additional commits viewable in compare view

Updates rubocop-minitest from 0.39.1 to 0.40.0

Release notes

Sourced from rubocop-minitest's releases.

RuboCop Minitest v0.40.0

New features

  • #355: Add new RuboCop::TestCase as a stable API for testing custom cops with Minitest. The cop under test is derived from the test class name and can be configured with cop_class, cop_config, other_cops, and target_ruby_version. (@​koic)

Changes

  • #345: Fix false positives and negatives in Minitest/NonExecutableTestMethod for nested test classes and for test methods defined before the test class. (@​amckinnie)
  • #278: (Breaking) Remove the cop argument from inspect_source and investigate in the Minitest test support; the cop under test is now resolved automatically. The test configuration now merges the default configuration for the cop under test and sets AllCops: TargetRubyVersion explicitly. (@​koic)
Changelog

Sourced from rubocop-minitest's changelog.

0.40.0 (2026-07-20)

New features

  • #355: Add new RuboCop::TestCase as a stable API for testing custom cops with Minitest. The cop under test is derived from the test class name and can be configured with cop_class, cop_config, other_cops, and target_ruby_version. ([@​koic][])

Changes

  • #345: Fix false positives and negatives in Minitest/NonExecutableTestMethod for nested test classes and for test methods defined before the test class. ([@​amckinnie][])
  • #278: (Breaking) Remove the cop argument from inspect_source and investigate in the Minitest test support; the cop under test is now resolved automatically. The test configuration now merges the default configuration for the cop under test and sets AllCops: TargetRubyVersion explicitly. ([@​koic][])
Commits
  • ee2ffba Cut 0.40.0
  • a647bd0 Update Changelog
  • 8d55114 Merge pull request #359 from koic/fix_multiple_assertions_todo_test_state_leak
  • a7e210d Merge pull request #358 from koic/fix_uninitialized_instance_variable_warnings
  • 113548b Fix Minitest/MultipleAssertions todo test on the oldest supported RuboCop
  • 651e6b1 Suppress uninitialized instance variable warnings in the test support
  • eeff9aa Merge pull request #355 from koic/add_rubocop_test_case_stable_api
  • ef1fc28 Add RuboCop::TestCase as a stable API for testing custom cops
  • ef90ead Merge pull request #354 from koic/fix_jruby_ci_failure_caused_by_rbs_native_e...
  • 8027065 Fix JRuby CI failure caused by rbs native extension build
  • Additional commits viewable in compare view

Updates rubocop-performance from 1.26.1 to 1.27.0

Release notes

Sourced from rubocop-performance's releases.

RuboCop Performance v1.27.0

Bug fixes

  • #532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. (@​koic)

Changes

  • #530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. (@​koic)
Changelog

Sourced from rubocop-performance's changelog.

1.27.0 (2026-08-16)

Bug fixes

  • #532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. ([@​koic][])

Changes

  • #530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])
Commits
  • c07064d Cut 1.27.0
  • 0e7abe8 Update Changelog
  • 0d43a61 Suppress RuboCop offenses
  • 72eb77d Merge pull request #533 from koic/fix_chain_array_allocation_false_negatives
  • 9c60244 Merge pull request #528 from koic/fix_regexp_match_offense_message_for_bang_t...
  • c3515cb [Fix #532] Fix false negatives for Performance/ChainArrayAllocation
  • dba3d75 Merge pull request #530 from koic/lazy_load_cops
  • dd5f992 Load cops lazily
  • f1763dd [Fix #510] Clarify Performance/RegexpMatch message for !~
  • 9c969a6 Fix JRuby CI failure caused by rbs native extension build
  • Additional commits viewable in compare view

Updates rubocop-rails from 2.35.3 to 2.37.0

Release notes

Sourced from rubocop-rails's releases.

RuboCop Rails v2.37.0

Changes

  • #1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. (@​kuboon)
  • #1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. (@​moberegger)
  • #1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. (@​koic)

RuboCop Rails v2.36.0

Bug fixes

  • #1647: Fix a false negative for Rails/EagerEvaluationLogMessage when the interpolated string is passed to Rails.logger.debug as the sole body of an enclosing block such as each or tap. (@​conwayje)
  • #1646: Fix a false negative for Rails/ReversibleMigration when using remove_index without a column inside a change_table block. (@​ilianah)
  • #1642: Fix a false negative for Rails/SafeNavigation when using try/try! with a symbol to proc such as foo.try(&:bar). (@​koic)
  • #1599: Fix an incorrect autocorrect for Rails/LinkToBlank when Style/TrailingCommaInArguments with EnforcedStyleForMultiline: consistent_comma adds a trailing comma, which produced a duplicate comma. (@​koic)
  • #1619: Fix MigratedSchemaVersion setting so it works for all cops. (@​lovro-bikic)

Changes

  • #1641: Fix false negatives in Rails/SafeNavigation when using try/try! with operator methods such as [], []=, and ==. (@​koic)

RuboCop Rails v2.35.5

Bug fixes

  • #1379: Fix an incorrect offense for Rails/SaveBang when a persist method is the last expression in a multiline method or block. (@​aki77)

Changes

RuboCop Rails v2.35.4

Bug fixes

  • #1418: Fix a false positive for Rails/StrongParametersExpect when require is given an array literal, such as params.require([:foo, :bar]).permit(:baz). (@​koic)
  • #1574: Fix an invalid autocorrection for Rails/StrongParametersExpect when permit receives a single dynamic argument, such as params.require(:user).permit(permitted_attributes). (@​koic)
  • #1635: Fix Rails/StrongParametersExpect to allow params[:foo].inspect. (@​jdelStrother)
Changelog

Sourced from rubocop-rails's changelog.

2.37.0 (2026-08-16)

Changes

  • #1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. ([@​kuboon][])
  • #1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. ([@​moberegger][])
  • #1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])

2.36.0 (2026-07-11)

Bug fixes

  • #1647: Fix a false negative for Rails/EagerEvaluationLogMessage when the interpolated string is passed to Rails.logger.debug as the sole body of an enclosing block such as each or tap. ([@​conwayje][])
  • #1646: Fix a false negative for Rails/ReversibleMigration when using remove_index without a column inside a change_table block. ([@​ilianah][])
  • #1642: Fix a false negative for Rails/SafeNavigation when using try/try! with a symbol to proc such as foo.try(&:bar). ([@​koic][])
  • #1599: Fix an incorrect autocorrect for Rails/LinkToBlank when Style/TrailingCommaInArguments with EnforcedStyleForMultiline: consistent_comma adds a trailing comma, which produced a duplicate comma. ([@​koic][])
  • #1619: Fix MigratedSchemaVersion setting so it works for all cops. ([@​lovro-bikic][])

Changes

  • #1641: Fix false negatives in Rails/SafeNavigation when using try/try! with operator methods such as [], []=, and ==. ([@​koic][])

2.35.5 (2026-06-21)

Bug fixes

  • #1379: Fix an incorrect offense for Rails/SaveBang when a persist method is the last expression in a multiline method or block. ([@​aki77][])

Changes

2.35.4 (2026-06-07)

Bug fixes

  • #1418: Fix a false positive for Rails/StrongParametersExpect when require is given an array literal, such as params.require([:foo, :bar]).permit(:baz). ([@​koic][])
  • #1574: Fix an invalid autocorrection for Rails/StrongParametersExpect when permit receives a single dynamic argument, such as params.require(:user).permit(permitted_attributes). ([@​koic][])
  • #1635: Fix Rails/StrongParametersExpect to allow params[:foo].inspect. ([@​jdelStrother][])
Commits
  • 2ccba59 Cut 2.37.0
  • 597f352 Update Changelog
  • a400494 Merge pull request #1652 from moberegger/moberegger/optimize-HttpPositionalAr...
  • cbc6157 Optimize HttpPositionalArguments cop
  • cb023b9 Suppress RuboCop offenses
  • 166cfc6 Merge pull request #1650 from koic/lazy_load_cops
  • 3dd6378 Load cops lazily
  • 0b20dad Merge pull request #1649 from kuboon/copilot/attribute-default-block-value
  • 7c76696 Allow frozen literal defaults in AttributeDefaultBlockValue
  • 84fef55 Reset the docs version
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ectory with 5 updates

Bumps the development-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [msgpack](https://github.com/msgpack/msgpack-ruby) | `1.8.3` | `1.8.4` |
| [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) | `2.9.4` | `2.9.6` |
| [rubocop-minitest](https://github.com/rubocop/rubocop-minitest) | `0.39.1` | `0.40.0` |
| [rubocop-performance](https://github.com/rubocop/rubocop-performance) | `1.26.1` | `1.27.0` |
| [rubocop-rails](https://github.com/rubocop/rubocop-rails) | `2.35.3` | `2.37.0` |



Updates `msgpack` from 1.8.3 to 1.8.4
- [Changelog](https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog)
- [Commits](msgpack/msgpack-ruby@v1.8.3...v1.8.4)

Updates `sqlite3` from 2.9.4 to 2.9.6
- [Release notes](https://github.com/sparklemotion/sqlite3-ruby/releases)
- [Changelog](https://github.com/sparklemotion/sqlite3-ruby/blob/main/CHANGELOG.md)
- [Commits](sparklemotion/sqlite3-ruby@v2.9.4...v2.9.6)

Updates `rubocop-minitest` from 0.39.1 to 0.40.0
- [Release notes](https://github.com/rubocop/rubocop-minitest/releases)
- [Changelog](https://github.com/rubocop/rubocop-minitest/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-minitest@v0.39.1...v0.40.0)

Updates `rubocop-performance` from 1.26.1 to 1.27.0
- [Release notes](https://github.com/rubocop/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-performance@v1.26.1...v1.27.0)

Updates `rubocop-rails` from 2.35.3 to 2.37.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rails@v2.35.3...v2.37.0)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-version: 1.8.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: sqlite3
  dependency-version: 2.9.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: rubocop-minitest
  dependency-version: 0.40.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: rubocop-performance
  dependency-version: 1.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: rubocop-rails
  dependency-version: 2.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 21, 2026
Copilot AI balanced review requested due to automatic review settings August 21, 2026 07:05
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 21, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates development and lint dependencies, including security and stability fixes for SQLite and MessagePack.

Changes:

  • Bumps five direct development dependencies.
  • Refreshes related lockfile versions, checksums, and transitive dependencies.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
Gemfile Updates pinned development and RuboCop plugin versions.
Gemfile.lock Records resolved versions, transitive updates, and checksums.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant