chore(deps): bump the bundler-production-dependencies group across 1 directory with 32 updates

[dependabot]

Bumps the bundler-production-dependencies group with 12 updates in the /src/email directory:

Package	From	To
puma	8.0.0	8.0.2
google-protobuf	4.34.1	4.35.0
opentelemetry-sdk	1.11.0	1.12.0
opentelemetry-common	0.24.0	0.25.0
opentelemetry-logs-sdk	0.5.1	0.6.0
opentelemetry-metrics-sdk	0.13.1	0.14.0
opentelemetry-exporter-otlp	0.33.0	0.34.0
opentelemetry-exporter-otlp-metrics	0.8.0	0.9.1
opentelemetry-exporter-otlp-logs	0.4.0	0.5.1
opentelemetry-instrumentation-all	0.92.0	0.94.0
grpc	1.80.0	1.81.0
net-imap	0.6.3	0.6.4

Updates puma from 8.0.0 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

• CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
• CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

v8.0.1

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

Commits

• 8085b75 Release v8.0.2 (#3945)
• 439c613 8.0.2 backport (#3944)
• cee7e61 Release v8.0.1 (#3932)
• f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
• 97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
• 03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
• 053efae Reword v8 upgrade guide ipv6 bullet (#3928)
• b19f35a Fix incorrect hook names in gRPC docs (#3923)
• eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
• See full diff in compare view

Updates google-protobuf from 4.34.1 to 4.35.0

Commits

• See full diff in compare view

Updates opentelemetry-sdk from 1.11.0 to 1.12.0

Release notes

Sourced from opentelemetry-sdk's releases.

opentelemetry-sdk 1.12.0

v1.12.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)
• FIXED: Consistent labels for otel.bsp.dropped_spans metric (#2108)

Commits

• See full diff in compare view

Updates opentelemetry-common from 0.24.0 to 0.25.0

Release notes

Sourced from opentelemetry-common's releases.

opentelemetry-common 0.25.0

v0.25.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-logs-sdk from 0.5.1 to 0.6.0

Release notes

Sourced from opentelemetry-logs-sdk's releases.

opentelemetry-logs-sdk 0.6.0

v0.6.0 / 2026-05-12

• ADDED: Add event_name field to Logs (#2077)
• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-metrics-sdk from 0.13.1 to 0.14.0

Release notes

Sourced from opentelemetry-metrics-sdk's releases.

opentelemetry-metrics-sdk 0.14.0

v0.14.0 / 2026-05-12

• BREAKING CHANGE: Use trace_based exemplar filter by default (#2112)
• ADDED: Use trace_based exemplar filter by default (#2112)
• ADDED: Add git tag to source URI in gemspec (#2101)
• FIXED: Return false if it is noop_exemplar_reservoir (#2104)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp from 0.33.0 to 0.34.0

Release notes

Sourced from opentelemetry-exporter-otlp's releases.

opentelemetry-exporter-otlp 0.34.0

v0.34.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-metrics from 0.8.0 to 0.9.1

Release notes

Sourced from opentelemetry-exporter-otlp-metrics's releases.

opentelemetry-exporter-otlp-metrics 0.9.1

v0.9.1 / 2026-06-02

• FIXED: URI.join dropping path prefix in logs and metrics exporters (#2158)

opentelemetry-exporter-otlp-metrics 0.9.0

v0.9.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-logs from 0.4.0 to 0.5.1

Release notes

Sourced from opentelemetry-exporter-otlp-logs's releases.

opentelemetry-exporter-otlp-logs 0.5.1

v0.5.1 / 2026-06-02

• FIXED: URI.join dropping path prefix in logs and metrics exporters (#2158)

opentelemetry-exporter-otlp-logs 0.5.0

v0.5.0 / 2026-05-12

• ADDED: Add event_name field to Logs (#2077)
• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-all from 0.92.0 to 0.94.0

Release notes

Sourced from opentelemetry-instrumentation-all's releases.

opentelemetry-instrumentation-all 0.94.0

v0.94.0 / 2026-05-21

• ADDED: Upgrade opentelemetry-instrumentation-trilogy to 0.69.0

opentelemetry-instrumentation-all 0.93.0

v0.93.0 / 2026-04-28

• ADDED: Upgrade opentelemetry-instrumentation-rails to 0.42.0

Commits

• See full diff in compare view

Updates googleapis-common-protos-types from 1.22.0 to 1.23.0

Release notes

Sourced from googleapis-common-protos-types's releases.

googleapis-common-protos-types: v1.23.0

1.23.0 (2026-05-19)

Features

• Regenerate protos and support Ruby min_version 3.2 (#412)

Commits

• 1bd0442 chore(main): release googleapis-common-protos-types 1.23.0 (#419)
• a869146 chore(main): release google-apps-script-type 1.8.0 (#414)
• 1b1f527 chore(main): release google-geo-type 1.2.0 (#416)
• 83be724 chore(main): release grpc-google-iam-v1 1.12.0 (#397)
• 1766762 chore(main): release google-apps-card-v1 1.2.0 (#413)
• 41762f4 chore(main): release google-cloud-common 1.10.0 (#415)
• 3466c15 chore(main): release google-shopping-type 1.2.0 (#417)
• 8a8561f chore(deps): update actions/checkout action to v6 (#406)
• daa3a55 feat: Regenerate protos and support Ruby min_version 3.2 (#412)
• 24ca7a6 chore: Refactor Github Action per b/485167538 (#409)
• Additional commits viewable in compare view

Updates grpc from 1.80.0 to 1.81.0

Release notes

Sourced from grpc's releases.

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [EventEngine] Fix a potential use-after-free error on Windows. (#42078)
• [ssl] Server side handshaker factory stores a map of key signers. (#42002)
• [Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)
• [EventEngine] Fix a Windows race that causes an assertion error. (#41563)
• [grpc_error] enable error_flatten experiment in OSS. (#41471)
• [Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Objective-C

• [ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

• [Python] Add typing_extensions dep to aio Bazel target. (#42001)
• [Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)
• [Python] Drop 3.9. (#42145)
• [Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)
• [Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)
• [Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)
• [Python] Support observability in AsyncIO stack. (#41573)

Ruby

• [Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)
• [Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0-pre1

This is a prerelease of gRPC Core 1.81.0 (graphic).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This prerelease contains refinements, improvements, and bug fixes.

Commits

• 8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
• 0029e06 Move all gRPC Session classes to the experimental namespace (#42462)
• 6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
• 1108777 [Release] Bump core version to 54.0.0 for upcoming release (#42321)
• 74940e8 [fix] Add back the do-while loop that handles the TSI_RESULT correctly.
• 5c6185c [CHTTP2] Assert
• 51bc437 Automated rollback of commit aab1eab78f9fcb3fc6e0aa9c8d7a59de280dbe3f.
• aab1eab [Inproc] Ensure stream is always cancelled under the transport lock.
• 76841c6 [EventEngine] Fix a potential use-after-free error on Windows (#42078)
• 383f8a5 [RBAC] fix config validation edge case (#42284)
• Additional commits viewable in compare view

Updates net-imap from 0.6.3 to 0.6.4

Release notes

Sourced from net-imap's releases.

v0.6.4

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

[!WARNING] ruby/net-imap#664 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp). Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

[!IMPORTANT] Argument validation is significantly improved. Several injection vulnerabilities have been fixed: ruby/net-imap#657 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px). ruby/net-imap#658 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg) ruby/net-imap#659 fixes CRLF/command/argument injection via the storage_limit argument to #setquota (GHSA-hm49-wcqc-g2xg). ruby/net-imap#660 fixes CRLF/command injection via RawData (GHSA-hm49-wcqc-g2xg):

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String. When attr is an Array, its String members are sent as raw data.

[!CAUTION] RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

[!NOTE] Two denial of service vulnerabilities have been addressed. These are generally only relevant when connecting to an untrusted hostile server (or without TLS).

ruby/net-imap#642 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw). ruby/net-imap#654 adds a configurable max_iterations count for SCRAM-* authentication (GHSA-87pf-fpwv-p7m7).

The default ScramAuthenticator#max_iterations is 2**31 - 1 (max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.

Breaking Changes

• ⚡ ResponseReader memoizes Config#max_response_size in ruby/net-imap#642. Changes to #max_response_size now take effect once per response, not on every IO#read. NOTE: It is not expected that this will affect any current usage. See the PR for details.

Added

• ✨ Support BINARY extention to #append (RFC3516) by @​nevans in ruby/net-imap#616
• ✨ Support LITERAL+ and LITERAL- non-synchronizing literals (RFC7888) by @​nevans in ruby/net-imap#649
• 🔒 Add ScramAuthenticator#max_iterations by @​nevans in ruby/net-imap#654
• 🏷️ Add number64 and nz-number64 to NumValidator by @​nevans in ruby/net-imap#625
• ♻️ Add MailboxQuota#quota_root alias by @​nevans in ruby/net-imap#636
• 🔍 Simplify Net::IMAP#inspect with basic state by @​nevans in ruby/net-imap#612
• 🥅 Add ResponseParseError#parser_methods (and override #==) by @​nevans in ruby/net-imap#615

Fixed

... (truncated)

Commits

• 3e49067 🔖 Bump version to 0.6.4
• 0ede4c4 🔀 Merge pull request #664 from ruby/security/STARTTLS-stripping
• 51ae360 ♻️ Add command response handler before command is sent
• 24d5c77 🔒🥅 Handle tagged "OK" to incomplete command
• 62eea6f 🔒🥅 Ensure STARTTLS tagged response was handled
• 46636ca ❌🔒 Add failing test for STARTTLS stripping
• e3b0105 ✅♻️ Inline current STARTLS stripping test
• be32e71 📚 Improve documentation of RawData arguments
• 47c7218 🐛 Validate RawData and wait to continue literals
• 0ec4fd3 🥅 Validate #setquota storage limit argument
• Additional commits viewable in compare view

Updates opentelemetry-api from 1.9.0 to 1.10.0

Release notes

Sourced from opentelemetry-api's releases.

opentelemetry-api 1.10.0

v1.10.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-action_mailer from 0.7.0 to 0.8.1

Release notes

Sourced from opentelemetry-instrumentation-action_mailer's releases.

opentelemetry-instrumentation-action_mailer 0.8.1

v0.8.1 / 2026-06-02

• DOCS: Document payload-key and payload-transform options in action_mailer and active_storage READMEs (#2363)

opentelemetry-instrumentation-action_mailer 0.8.0

v0.8.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-action_pack from 0.17.0 to 0.18.0

Release notes

Sourced from opentelemetry-instrumentation-action_pack's releases.

opentelemetry-instrumentation-action_pack 0.18.0

v0.18.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-action_view from 0.12.0 to 0.13.0

Release notes

Sourced from opentelemetry-instrumentation-action_view's releases.

opentelemetry-instrumentation-action_view 0.13.0

v0.13.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-active_job from 0.11.0 to 0.12.0

Release notes

Sourced from opentelemetry-instrumentation-active_job's releases.

opentelemetry-instrumentation-active_job 0.12.0

v0.12.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-active_record from 0.12.0 to 0.13.0

Release notes

Sourced from opentelemetry-instrumentation-active_record's releases.

opentelemetry-instrumentation-active_record 0.13.0

v0.13.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-active_storage from 0.4.0 to 0.5.1

Release notes

Sourced from opentelemetry-instrumentation-active_storage's releases.

opentelemetry-instrumentation-active_storage 0.5.1

v0.5.1 / 2026-06-02

• DOCS: Document payload-key and payload-transform options in action_mailer and active_storage READMEs (#2363)

opentelemetry-instrumentation-active_storage 0.5.0

v0.5.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-active_support from 0.11.0 to 0.12.0

Release notes

Sourced from opentelemetry-instrumentation-active_support's releases.

opentelemetry-instrumentation-active_support 0.12.0

v0.12.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-base from 0.26.0 to 0.26.1

Release notes

Sourced from opentelemetry-instrumentation-base's releases.

opentelemetry-instrumentation-base 0.26.1

v0.26.1 / 2026-05-21

• FIXED: Handle missing config in middleware when OTEL_SDK_DISABLED=true (#2231)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-excon from 0.29.0 to 0.29.1

Release notes

Sourced from opentelemetry-instrumentation-excon's releases.

opentelemetry-instrumentation-excon 0.29.1

v0.29.1 / 2026-04-28

• FIXED: Enable SimpleCov coverage merging across appraisal runs (#2193)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-grpc from 0.5.0 to 0.5.1

Release notes

Sourced from opentelemetry-instrumentation-grpc's releases.

opentelemetry-instrumentation-grpc 0.5.1

v0.5.1 / 2026-05-21

• FIXED: Handle missing config in middleware when OTEL_SDK_DISABLED=true (#2231)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-gruf from 0.6.0 to 0.6.1

Release notes

Sourced from opentelemetry-instrumentation-gruf's releases.

opentelemetry-instrumentation-gruf 0.6.1

v0.6.1 / 2026-05-21

• FIXED: Handle missing config in middleware when OTEL_SDK_DISABLED=true (#2231)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-rack from 0.31.0 to 0.31.1

Release notes

Sourced from opentelemetry-instrumentation-rack's releases.

opentelemetry-instrumentation-rack 0.31.1

v0.31.1 / 2026-05-21

• FIXED: Handle missing config in middleware when OTEL_SDK_DISABLED=true (#2231)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-rails from 0.41.0 to 0.42.0

Release notes

Sourced from opentelemetry-instrumentation-rails's releases.

opentelemetry-instrumentation-rails 0.42.0

v0.42.0 / 2026-04-28

• BREAKING CHANGE: Min Rails 7.1 (enforced this time) (#2283)
• ADDED: Min Rails 7.1 (enforced this time) (#2283)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-trilogy from 0.68.0 to 0.69.0

Release notes

Sourced from opentelemetry-instrumentation-trilogy's releases.

opentelemetry-instrumentation-trilogy 0.69.0

v0.69.0 / 2026-05-21

• ADDED: Add OTEL_SEMCONV_STABILITY_OPT_IN environment variable support for span attributes (#2095)

Commits

• See full diff in compare view

Updates opentelemetry-logs-api from 0.3.0 to 0.4.0

Release notes

Sourced from opentelemetry-logs-api's releases.

opentelemetry-logs-api 0.4.0

v0.4.0 / 2026-05-12

• ADDED: Add event_name field to Logs (#2077)
• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-metrics-api from 0.5.0 to 0.6.0

Release notes

Sourced from opentelemetry-metrics-api's releases.

opentelemetry-metrics-api 0.6.0

v0.6.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-registry from 0.5.0 to 0.6.0

Release notes

Sourced from opentelemetry-registry's releases.

opentelemetry-registry 0.6.0

v0.6.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-semantic_conventions from 1.37.0 to 1.39.0

Release notes

Sourced from opentelemetry-semantic_conventions's releases.

opentelemetry-semantic_conventions 1.39.0

v1.39.0 / 2026-06-03

• ADDED: Update dependency open-telemetry/semantic-conventions to v1.39.0 (#2137)

opentelemetry-semantic_conventions 1.38.0

v1.38.0 / 2026-05-21

• ADDED: Update semantic conventions to v1.38.0 (#2136)

opentelemetry-semantic_conventions 1.37.1

v1.37.1 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.