Bump the all-dependencies group with 34 updates

[dependabot]

Bumps the all-dependencies group with 34 updates:

Package	From	To
shakapacker	10.2.0	10.3.0
pg	1.5.6	1.6.3
bootsnap	1.23.0	1.24.6
puma	6.4.2	8.0.2
thruster	0.1.16	0.1.23
uglifier	4.2.0	4.2.1
jbuilder	2.12.0	2.15.1
redis	5.3.0	5.4.1
sdoc	2.6.1	2.6.5
rails-html-sanitizer	1.7.0	1.7.1
autoprefixer-rails	10.4.16.0	10.4.21.0
redcarpet	3.6.0	3.6.1
web-console	4.2.1	4.3.0
spring	4.2.1	4.7.0
factory_bot_rails	6.4.3	6.5.1
foreman	0.88.1	0.90.0
rubocop	1.69.0	1.88.2
rubocop-performance	1.23.1	1.26.1
rubocop-rails	2.29.1	2.36.0
rubocop-rspec	3.4.0	3.10.2
debug	1.9.2	1.11.1
pry	0.14.2	0.16.0
pry-byebug	3.10.1	3.12.0
pry-doc	1.5.0	1.7.0
pry-stack_explorer	0.6.1	0.6.3
capybara-screenshot	1.0.26	1.0.27
coveralls_reborn	0.25.0	1.0.0
database_cleaner	2.0.2	2.1.0
launchy	3.0.1	3.1.1
rails_best_practices	1.23.2	1.23.4
rspec-rails	6.0.4	8.0.4
selenium-webdriver	4.22.0	4.46.0
stimulus-rails	1.3.3	1.3.4
turbo-rails	2.0.11	2.0.23

Updates shakapacker from 10.2.0 to 10.3.0

Release notes

Sourced from shakapacker's releases.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Changelog

Sourced from shakapacker's changelog.

[v10.3.0] - July 5, 2026

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

Commits

• 73ba063 Release 10.3.0
• e8cb3c8 Bump version to v10.3.0 in CHANGELOG.md
• 7ae6b33 Update changelog for v10.2.1 (#1210)
• 564cc4e Add v10 upgrade guide (#1208)
• bef38d6 Fallback to Babel for implicit SWC webpack configs (#1206)
• fc16549 fix: allow webpack-dev-server v6 (#1102)
• 29f855a Fix Claude OAuth token env for Actions (#1202)
• 9b56482 [codex] Document and harden helper binstub PATH fix (#1201)
• aa94c79 [codex] Delegate helper binstub Node resolution to exec (#1200)
• See full diff in compare view

Updates pg from 1.5.6 to 1.6.3

Changelog

Sourced from pg's changelog.

v1.6.3 [2025-12-29] Lars Kanis lars@greiz-reinsdorf.de

Added:

• Add binary gems for ruby-4.0, now providing ruby-3.0 to 4.0. #682
• Update fat binary gem to OpenSSL-3.6.0 and PostgreSQL-18.1.
• Improve documentation of PG::Result and README. #676
• Update errorcodes to PostgreSQL-18.
• Use rb_hash_new_capa on Ruby-3.2+ . #674
• Deny any server communication on a frozen PG::Connection . #677
• Fix possible race condition in PG::Result in Ractor context. #674

Removed:

• Drop binary gem support for platform x86-mingw32. #682
• Drop binary gems for ruby-2.7.

v1.6.2 [2025-09-02] Lars Kanis lars@greiz-reinsdorf.de

• Remove several absolute paths from native binaries which pointed to build directories. #668
• Fix bad fallback path to pg_service.conf. #666
• Use rbpg_ prefix for base64_* functions to avoid name clashes with functions provided by other libraries like Heimdal on Macos. #667
• Raise a more descriptive error message in case of pg_ext LoadError. #664
• Freeze some constants to make them available in a Ractor context. #660
• Several documentation improvements.
• Update native binary gems to OpenSSL-3.5.2, krb5-1.22.1 and PostgreSQL-17.6.

v1.6.1 [2025-08-03] Lars Kanis lars@greiz-reinsdorf.de

• Add binary gems for platforms aarch64-linux-musl and x86_64-linux-musl without the need to install package gcompat. #657.
• Serialize CompositeCoder#dimensions only when set. #652 This fixes the compatibility to pg-1.5.9, when deserializing Marshal data from pg-1.6, as long as the new attribute isn't used.
• Remove dependency to MSYS2 package "postgresql" from binary Windows gem #654

v1.6.0 [2025-07-27] Lars Kanis lars@greiz-reinsdorf.de

Added:

• Add binary gems for Ruby 3.4.
• Add fat binary gem for platform aarch64-mingw-ucrt aka Windows on ARM #626, for platform Macos on Intel and ARM #643, for platform aarch64-linux #646 and for platform x86_64-linux #551.
• Update fat binary gem to OpenSSL-3.5.1 and PostgreSQL-17.5.
• Add a patch to libpq to avoid starvation on bigger SSL records, which some database engines other than vanilla PostgreSQL use. This patch applies to platform specific binary gems only. #616
• Add support for new query cancel functions of PostgreSQL-17. This adds the new class PG::CancelConnection which provides the ability to cancel a query per blocking or per non-blocking functions. If the new functions are available they are used and the older are no longer compiled in.

... (truncated)

Commits

• d4539c2 Bump VERSION to pg-1.6.3 and add release notes
• 720900d Merge pull request #682 from larskanis/ruby-4.0
• f605b59 Remove x86-mingw32 from binary builds
• 5c69000 Update to ruby-4.0
• 2acaf3d CI: workaround missing ruby-4.0 on Window
• b500ded fix comment
• bc3f2f8 CI: Macos-13 on Intel is deprecated
• 77667eb Merge pull request #678 from larskanis/ci-update
• 6e52ce5 CI: Update PostgreSQL on Macos
• 6d40f50 CI: Print mkmf.log on failure on Macos
• Additional commits viewable in compare view

Updates bootsnap from 1.23.0 to 1.24.6

Release notes

Sourced from bootsnap's releases.

v1.24.4

What's Changed

• Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
• Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
• Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
• Avoid leaking a private method in Object when testing for Parse.y bugs.

Full Changelog: rails/bootsnap@v1.24.3...v1.24.4

v1.24.3

• Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

Full Changelog: rails/bootsnap@v1.24.2...v1.24.3

v1.24.2

What's Changed

• Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

Full Changelog: rails/bootsnap@v1.24.1...v1.24.2

v1.24.1

What's Changed

• Fix encoding of Ruby source files loaded when BOOTSNAP_READONLY is set. Files would incorectly be loaded in ASCII-8BIT causing literal strings outside the pure ASCII range to have ASCII-8BIT encoding instead of UTF-8. This bug was introduced in 1.24.0.

Full Changelog: rails/bootsnap@v1.24.0...v1.24.1

v1.24.0

What's Changed

• Added a hook API to customize Ruby compilation.

Full Changelog: rails/bootsnap@v1.23.0...v1.24.0

Changelog

Sourced from bootsnap's changelog.

1.24.6

• Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

1.24.5

• No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

1.24.4

• Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
• Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
• Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
• Avoid leaking a private method in Object when testing for Parse.y bugs.

1.24.3

• Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

1.24.2

• Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

1.24.1

• Fix encoding of Ruby source files loaded when BOOTSNAP_READONLY is set. Files would incorectly be loaded in ASCII-8BIT causing literal strings outside the pure ASCII range to have ASCII-8BIT encoding instead of UTF-8. This bug was introduced in 1.24.0.

1.24.0

• Added a hook API to customize Ruby compilation.

Commits

• 026e183 Release 1.24.6
• 263e346 Merge pull request #556 from byroot/remove-canary
• 7c31cd8 Check for [Bug #22023] by checking Ruby version rather than a canary
• 54eba76 Merge pull request #554 from byroot/namespace-overflow
• fe963d5 bs_cache_path: account for namespace length
• 7b42db6 Merge pull request #553 from arpitjain099/chore/declare-workflow-perms
• 113b184 ci: add permissions: contents: read to ci
• d6ca050 Release 1.24.5
• 579aa0e Merge pull request #552 from byroot/fix-bootsnap-config
• 2884e89 Only load config file is directed to by .setup
• Additional commits viewable in compare view

Updates puma from 6.4.2 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

• CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
• CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

v8.0.1

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

• Breaking changes

  • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

7.2.1 / 2026-05-27

• Bugfixes

... (truncated)

Commits

• 8085b75 Release v8.0.2 (#3945)
• 439c613 8.0.2 backport (#3944)
• cee7e61 Release v8.0.1 (#3932)
• f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
• 97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
• 03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
• 053efae Reword v8 upgrade guide ipv6 bullet (#3928)
• b19f35a Fix incorrect hook names in gRPC docs (#3923)
• eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
• 08f63d4 Release v8.0.0 (#3914)
• Additional commits viewable in compare view

Updates thruster from 0.1.16 to 0.1.23

Changelog

Sourced from thruster's changelog.

v0.1.22 / 2026-06-29

• Build with Go 1.26.4
• Exclude image types from compression (#137)

v0.1.21 / 2026-05-17

• Build with Go 1.26.3

v0.1.20 / 2026-03-25

• Only redirect HTTP->HTTPS for policy-allowed hosts

v0.1.19 / 2026-03-06

• Build with Go 1.26.1

v0.1.18 / 2026-02-02

• Return correct exit code when terminated with signal (#110)
• Build with Go 1.25.6

v0.1.17 / 2025-12-16

• Mitigate BREACH attacks with random jitter and optional compression guard (#102)

Commits

• 168dc1f Update version & changelog
• 900411c Merge pull request #140 from rafafloresta/bump-go-1.26.5-security
• 2eb7870 Bump Go to 1.26.5 to fix crypto/tls ECH de-anonymization (CVE-2026-42505)
• 3acd601 Merge pull request #138 from basecamp/version-0.1.22
• 43dfae9 Version 0.1.22
• 6c45e38 Merge pull request #137 from basecamp/compression-exclude-image-types
• 33ea926 Exclude image types from compression
• 043a28e Merge pull request #136 from basecamp/check-fmt-in-ci
• 22e7ee8 Check formatting during CI
• c64f358 Merge pull request #135 from basecamp/go-1-26-4
• Additional commits viewable in compare view

Updates uglifier from 4.2.0 to 4.2.1

Changelog

Sourced from uglifier's changelog.

4.2.1 (22 September 2024)

• fix Ruby 3.4 compatiblity, drop Ruby 2.3 and older support (#195)
• fix typos (#194)

Commits

• 959b740 Bump version to 4.2.1
• 5a6a6f4 Update changelog
• f7ee1a2 Merge branch 'drop-base64'
• b808f14 Merge pull request #194 from kianmeng/fix-typos
• 46b75e4 Bump required ruby version to 2.4
• 81fbc31 Merge pull request #196 from lautis/ci-ruby-versions
• 030a33e Use released version of alaska runtime to run tests
• 15d317d Update build matrix
• 89c6136 Drop base64 gem from dependency
• 0947f7c Merge pull request #191 from SimenB/master-1
• Additional commits viewable in compare view

Updates jbuilder from 2.12.0 to 2.15.1

Release notes

Sourced from jbuilder's releases.

v2.15.1

What's Changed

• Fix partial for Active Model when extra locals are passed in by @​rafaelfranca in rails/jbuilder#617

New Contributors

• @​rafaelfranca made their first contribution in rails/jbuilder#617

Full Changelog: rails/jbuilder@v2.15.0...v2.15.1

v2.15.0

What's Changed

• Optimize KeyFormatter on cache hits by @​moberegger in rails/jbuilder#607
• Make method_missing private by @​alexceder in rails/jbuilder#614
• Optimize array! and set! by @​moberegger in rails/jbuilder#604
• Use :unprocessable_content for scaffolds with Rack 3.1 or higher by @​taketo1113 in rails/jbuilder#603
• Optimize _map_collection by @​moberegger in rails/jbuilder#612
• fix: Preserve locals when rendering inline partial for object by @​moberegger in rails/jbuilder#613

New Contributors

• @​mayur-kambariya made their first contribution in rails/jbuilder#609
• @​alexceder made their first contribution in rails/jbuilder#614
• @​taketo1113 made their first contribution in rails/jbuilder#603

Full Changelog: rails/jbuilder@v2.14.1...v2.15.0

v2.14.1

What's Changed

• Ensure that Jbuilder.encode properly forwards arguments to .new by @​flavorjones in rails/jbuilder#601

New Contributors

• @​flavorjones made their first contribution in rails/jbuilder#601

Full Changelog: rails/jbuilder@v2.14.0...v2.14.1

v2.14.0

What's Changed

• Drop support to Ruby < 3.0 and Rails < 7.0
• Test against Rails 8 and fix Rails 7 logger dependency by @​excid3 in rails/jbuilder#582
• Add status: :see_other to update action by @​excid3 in rails/jbuilder#583
• Force close final statement in templates by @​ienders in rails/jbuilder#578
• Optimize _is_collection? method by @​moberegger in rails/jbuilder#590
• Add #frozen_string_literal: true to all files by @​moberegger in rails/jbuilder#599
• Optimize _key to prevent string allocation when formatting Symbols by @​moberegger in rails/jbuilder#593
• Optimize key formatter by @​moberegger in rails/jbuilder#597
• Optimize internal extract! calls to save on memory allocation by @​moberegger in rails/jbuilder#598
• Fix regression in API controllers with view_cache_dependencies helper by @​excid3 in rails/jbuilder#575
• Optimize method_missing via alias_method by @​moberegger in rails/jbuilder#600
• Cleanup project for Rails 7+ support by @​moberegger in rails/jbuilder#594
• Fix warnings and prevent Jbuilder::VERSION constant from being obliterated by @​pixeltrix in rails/jbuilder#574
• Optimize memory allocation when rendering partials by @​moberegger in rails/jbuilder#591

... (truncated)

Commits

• 31eb6e9 Prepare for 2.15.1
• 154b0fe Merge pull request #617 from rails/rm-fix-616
• d3e763b Fix partial for Active Model when extra locals are passed in
• 018083d Prepare for 2.15.0
• 72cf067 Update devcontainer image to Ruby 4.0.4 and add devcontainer-lock.json
• d35a962 Merge pull request #615 from taketo1113/ci-rails8.1-ruby4.0
• cc42e7e CI: Add Rails 8.1 & Ruby 4.0 to CI Matrix
• cd7482e Merge pull request #613 from affinity/moberegger/fix-inline-partial-locals-be
• 58283a0 Merge pull request #612 from affinity/moberegger/optimize-_map_collection
• 09ca3e1 Merge pull request #603 from taketo1113/update-rack-unprocessable_content
• Additional commits viewable in compare view

Updates redis from 5.3.0 to 5.4.1

Changelog

Sourced from redis's changelog.

5.4.1

• Properly handle NOSCRIPT errors.

5.4.0

• Fix blmpop method to actually use BLMPOP, it was mistakenly issuing LMPOP commands.
• xadd now accepts a minid: argument.
• zrank and zrevrank now accepts with_score: argument.
• Redis#call now accept a block, allowing to use Redis instances where RedisClient is expected.

Commits

• 6784a32 Release 5.4.1
• c205a8c Require redis-client earlier
• 16c7855 Merge pull request #1312 from redis/translate-ensure-connected
• 08a3290 Fix without_reconnect to wrap redis-client exceptions
• 8408c03 Update redis release URL
• 317a020 Merge pull request #1311 from redis/specialize-evalsha-noscript-error
• d9f004f Fix a mistake in test_hrandfield
• 57c79c2 Handle RedisClient::NoScriptError
• 082d198 Release 5.4.0
• 00f7a9f Merge pull request #1310 from redis/fix-blmpop
• Additional commits viewable in compare view

Updates sdoc from 2.6.1 to 2.6.5

Changelog

Sourced from sdoc's changelog.

Main (3.0.0.alpha)

• #198 Bump version to 3.0.0.alpha @​zzak
• #197 Remove sdoc-merge and sdoc template @​zzak
• #195 Replace turbolinks with turbo v7.3.0 @​zzak
• #200 Add canonical url link to all pages @​zzak
• #222 Add NameList for building a static file of classes and methods @​zzak
• #206 Move file links to the footer @​p8
• #237 Hide scrollbar for unscrollable code snippets @​jonathanhefner
• #239 Replace highlight.js with Rouge gem @​jonathanhefner
• #242 Use Rouge to highlight method source code @​jonathanhefner
• #243 Enable horizontal scrollbar for method source code @​jonathanhefner
• #251 Move alias listing closer to method name @​jonathanhefner
• #252 Replace source code toggler JavaScript with <details> @​jonathanhefner
• #253 Version links to Rails guides @​jonathanhefner
• #254 Unlink unintentional autolinked code ref links @​jonathanhefner
• #255 Style unstyled code ref links @​jonathanhefner
• #260 Include site title in page titles @​jonathanhefner
• #261 Include project name and version in og:title @​jonathanhefner
• #262 Refine meta description @​jonathanhefner
• #265 Add required Open Graph meta tags @​jonathanhefner
• #266 Add article:modified_time meta tag @​jonathanhefner
• #268 Add initial dark mode support @​p8
• #279 Redesign "Appears in" file list @​jonathanhefner
• #280 Redesign banner and mobile menu bar @​jonathanhefner
• #283, #336 Rework typography @​jonathanhefner
• #286 Render breadcrumb links for module's parents @​jonathanhefner
• #287 Generate uniform <h1> headings for all modules @​jonathanhefner
• #291 Remove keyboard shortcuts that use meta keys @​jonathanhefner
• #294 Remove version badge @​jonathanhefner
• #298 Rewrite search @​jonathanhefner
• #315 Replace navigation tree @​jonathanhefner
• #319 Rework method spotlight effect @​jonathanhefner
• #320 Remove jQuery @​jonathanhefner
• #322 Use type="search" for search input @​jonathanhefner
• #323 Update favicon @​jonathanhefner
• #345 Version explicit links to api.rubyonrails.org @​jonathanhefner
• #356 Redesign "Constants" section @​jonathanhefner
• #357 Support permalinking constants @​jonathanhefner
• #358 Add constants to search index @​jonathanhefner
• #370 Add attributes to search index @​earlopain

Commits

• See full diff in compare view

Updates rails-html-sanitizer from 1.7.0 to 1.7.1

Release notes

Sourced from rails-html-sanitizer's releases.

v1.7.1 / 2026-07-15

• SVG reference elements now restrict both href and xlink:href to local references.

  Previously PermitScrubber restricted only xlink:href on elements in SVG_ALLOW_LOCAL_HREF, so a plain href attribute on those elements could reference an external document. Applications are only affected if the allowed tags are overridden to include an SVG reference element such as use; the default configuration is not affected.

  This change addresses GHSA-cj75-f6xr-r4g7 (CVE requested). The minimum Loofah dependency is now ~> 2.25, >= 2.25.2.

  Mike Dalessio @​flavorjones

Changelog

Sourced from rails-html-sanitizer's cha...

Description has been truncated

[github-actions]

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 447612cb04

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep RSpec config compatible with rspec-rails 8

With rspec-rails 8, the Rails fixture setting is fixture_paths rather than fixture_path; this repo still calls config.fixture_path = Rails.root.join("spec/fixtures") in spec/rails_helper.rb:49. Any bundle exec rspec run that loads rails_helper will fail during boot with NoMethodError before examples run unless the helper is updated to the plural setting or the dependency stays on a compatible 6.x release.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Update the Shakapacker npm package with the gem

This changes only the Ruby gem, but package.json still pins the JS package at shakapacker 10.2.0 and the webpack configs load that package via require('shakapacker') (for example config/webpack/commonWebpackConfig.js:6). Any bin/shakapacker or dev-server build after yarn install will therefore run Ruby Shakapacker 10.3 with JS Shakapacker 10.2, an unsupported mismatch that can cause build failures or skip the JS-side fixes from 10.3. Please update package.json and yarn.lock in the same change.

Useful? React with 👍 / 👎.