Bump the bundler-production-dependencies group across 1 directory with 73 updates

[dependabot]

Bumps the bundler-production-dependencies group with 16 updates in the /src/email directory:

Package	From	To
puma	7.2.0	8.0.2
google-protobuf	4.34.0	4.35.1
opentelemetry-sdk	1.10.0	1.12.0
opentelemetry-common	0.23.0	0.25.0
opentelemetry-logs-sdk	0.4.0	0.6.0
opentelemetry-metrics-sdk	0.12.0	0.15.0
opentelemetry-exporter-otlp	0.31.1	0.34.0
opentelemetry-exporter-otlp-metrics	0.6.1	0.10.0
opentelemetry-exporter-otlp-logs	0.2.2	0.5.1
opentelemetry-instrumentation-all	0.90.1	0.94.0
openfeature-sdk	0.6.4	0.6.5
grpc	1.78.1	1.81.1
mail	2.9.0	2.9.1
mustermann	3.0.4	3.1.1
rack	3.2.5	3.2.6
rack-session	2.1.1	2.1.2

Updates puma from 7.2.0 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

• CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
• CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

v8.0.1

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

• Breaking changes

  • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

7.2.1 / 2026-05-27

• Bugfixes

... (truncated)

Commits

• 8085b75 Release v8.0.2 (#3945)
• 439c613 8.0.2 backport (#3944)
• cee7e61 Release v8.0.1 (#3932)
• f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
• 97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
• 03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
• 053efae Reword v8 upgrade guide ipv6 bullet (#3928)
• b19f35a Fix incorrect hook names in gRPC docs (#3923)
• eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
• 08f63d4 Release v8.0.0 (#3914)
• Additional commits viewable in compare view

Updates google-protobuf from 4.34.0 to 4.35.1

Commits

• See full diff in compare view

Updates opentelemetry-sdk from 1.10.0 to 1.12.0

Release notes

Sourced from opentelemetry-sdk's releases.

opentelemetry-sdk 1.12.0

v1.12.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)
• FIXED: Consistent labels for otel.bsp.dropped_spans metric (#2108)

opentelemetry-sdk 1.11.0

v1.11.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)

Commits

• See full diff in compare view

Updates opentelemetry-common from 0.23.0 to 0.25.0

Release notes

Sourced from opentelemetry-common's releases.

opentelemetry-common 0.25.0

v0.25.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

opentelemetry-common 0.24.0

v0.24.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)

Commits

• See full diff in compare view

Updates opentelemetry-logs-sdk from 0.4.0 to 0.6.0

Release notes

Sourced from opentelemetry-logs-sdk's releases.

opentelemetry-logs-sdk 0.6.0

v0.6.0 / 2026-05-12

• ADDED: Add event_name field to Logs (#2077)
• ADDED: Add git tag to source URI in gemspec (#2101)

opentelemetry-logs-sdk 0.5.1

v0.5.1 / 2026-04-15

• FIXED: Move the logs-sdk requires to support "require 'opentelemetry/sdk/logs'" (#1956)

opentelemetry-logs-sdk 0.5.0

v0.5.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)

Commits

• See full diff in compare view

Updates opentelemetry-metrics-sdk from 0.12.0 to 0.15.0

Release notes

Sourced from opentelemetry-metrics-sdk's releases.

opentelemetry-metrics-sdk 0.15.0

v0.15.0 / 2026-06-16

• BREAKING CHANGE: Metrics cardinality limit (#1909)
• ADDED: Metrics cardinality limit (#1909)

opentelemetry-metrics-sdk 0.14.0

v0.14.0 / 2026-05-12

• BREAKING CHANGE: Use trace_based exemplar filter by default (#2112)
• ADDED: Use trace_based exemplar filter by default (#2112)
• ADDED: Add git tag to source URI in gemspec (#2101)
• FIXED: Return false if it is noop_exemplar_reservoir (#2104)

opentelemetry-metrics-sdk 0.13.1

v0.13.1 / 2026-04-15

• FIXED: Move the metrics-sdk requires to support "require 'opentelemetry/sdk/metrics'" (#1956)

opentelemetry-metrics-sdk 0.13.0

v0.13.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)
• ADDED: Add basic support for metrics exemplar (#1609)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp from 0.31.1 to 0.34.0

Release notes

Sourced from opentelemetry-exporter-otlp's releases.

opentelemetry-exporter-otlp 0.34.0

v0.34.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

opentelemetry-exporter-otlp 0.33.0

v0.33.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)
• ADDED: Handle HTTP 2XX responses as successful in OTLP exporters (#2044)
• FIXED: Issue with sending traces to IPv6 endpoints (#1935)

opentelemetry-exporter-otlp 0.32.0

v0.32.0 / 2026-03-10

• ADDED: Replace cgi with uri for encode and decode (#2028)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-metrics from 0.6.1 to 0.10.0

Release notes

Sourced from opentelemetry-exporter-otlp-metrics's releases.

opentelemetry-exporter-otlp-metrics 0.10.0

v0.10.0 / 2026-06-16

• BREAKING CHANGE: Metrics cardinality limit (#1909)
• ADDED: Metrics cardinality limit (#1909)

opentelemetry-exporter-otlp-metrics 0.9.1

v0.9.1 / 2026-06-02

• FIXED: URI.join dropping path prefix in logs and metrics exporters (#2158)

opentelemetry-exporter-otlp-metrics 0.9.0

v0.9.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

opentelemetry-exporter-otlp-metrics 0.8.0

v0.8.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)
• ADDED: Handle HTTP 2XX responses as successful in OTLP exporters (#2044)
• ADDED: Add basic support for metrics exemplar (#1609)
• FIXED: Issue with sending traces to IPv6 endpoints (#1935)

opentelemetry-exporter-otlp-metrics 0.7.0

v0.7.0 / 2026-03-10

• ADDED: Replace cgi with uri for encode and decode (#2028)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-logs from 0.2.2 to 0.5.1

Release notes

Sourced from opentelemetry-exporter-otlp-logs's releases.

opentelemetry-exporter-otlp-logs 0.5.1

v0.5.1 / 2026-06-02

• FIXED: URI.join dropping path prefix in logs and metrics exporters (#2158)

opentelemetry-exporter-otlp-logs 0.5.0

v0.5.0 / 2026-05-12

• ADDED: Add event_name field to Logs (#2077)
• ADDED: Add git tag to source URI in gemspec (#2101)

opentelemetry-exporter-otlp-logs 0.4.0

v0.4.0 / 2026-04-07

• ADDED: Min Ruby Version 3.3 (#2070)
• ADDED: Handle HTTP 2XX responses as successful in OTLP exporters (#2044)
• FIXED: Issue with sending traces to IPv6 endpoints (#1935)
• DOCS: Fix exporter-otlp-logs gemspec metadata links (#2060)

opentelemetry-exporter-otlp-logs 0.3.0

v0.3.0 / 2026-03-10

• ADDED: Replace cgi with uri for encode and decode (#2028)

Commits

• See full diff in compare view

Updates opentelemetry-instrumentation-all from 0.90.1 to 0.94.0

Release notes

Sourced from opentelemetry-instrumentation-all's releases.

opentelemetry-instrumentation-all 0.94.0

v0.94.0 / 2026-05-21

• ADDED: Upgrade opentelemetry-instrumentation-trilogy to 0.69.0

opentelemetry-instrumentation-all 0.93.0

v0.93.0 / 2026-04-28

• ADDED: Upgrade opentelemetry-instrumentation-rails to 0.42.0

opentelemetry-instrumentation-all 0.92.0

v0.92.0 / 2026-04-14

• BREAKING CHANGE: Min Ruby Version 3.3 (#2125)
• ADDED: Min Ruby Version 3.3 (#2125)
• ADDED: Add release tag into source code url of gem metadata (#1984)
• CHANGED: Update transitive dependencies for all instrumentation gems to new versions

opentelemetry-instrumentation-all 0.91.0

v0.91.0 / 2026-03-17

• ADDED: Upgrade opentelemetry-instrumentation-anthropic to 0.4.0
• ADDED: Upgrade opentelemetry-instrumentation-dalli to 0.29.2
• ADDED: Upgrade opentelemetry-instrumentation-ethon to 0.28.0
• ADDED: Upgrade opentelemetry-instrumentation-excon to 0.28.0
• ADDED: Upgrade opentelemetry-instrumentation-faraday to 0.32.0
• ADDED: Upgrade opentelemetry-instrumentation-grape to 0.6.0
• ADDED: Upgrade opentelemetry-instrumentation-graphql to 0.31.2
• ADDED: Upgrade opentelemetry-instrumentation-http to 0.29.0
• ADDED: Upgrade opentelemetry-instrumentation-http_client to 0.28.0
• ADDED: Upgrade opentelemetry-instrumentation-httpx to 0.7.0
• ADDED: Upgrade opentelemetry-instrumentation-net_http to 0.28.0
• ADDED: Upgrade opentelemetry-instrumentation-racecar to 0.6.1
• ADDED: Upgrade opentelemetry-instrumentation-rack to 0.30.0
• ADDED: Upgrade opentelemetry-instrumentation-rails to 0.40.0
• ADDED: Upgrade opentelemetry-instrumentation-restclient to 0.27.0
• ADDED: Upgrade opentelemetry-instrumentation-sinatra to 0.29.0
• ADDED: Upgrade opentelemetry-instrumentation-trilogy to 0.67.0

Commits

• See full diff in compare view

Updates openfeature-sdk from 0.6.4 to 0.6.5

Release notes

Sourced from openfeature-sdk's releases.

v0.6.5

0.6.5 (2026-03-18)

Features

• add RBS type signatures with Steep type checking (#251) (506e999)

Changelog

Sourced from openfeature-sdk's changelog.

0.6.5 (2026-03-18)

Features

• add RBS type signatures with Steep type checking (#251) (506e999)

Commits

• fa8026f chore(main): release 0.6.5 (#252)
• 602d972 chore(deps): update codecov/codecov-action action to v5.5.3 (#253)
• 506e999 feat: add RBS type signatures with Steep type checking (#251)
• 3f339dc chore(deps): update dependency ruby to v4.0.2 (#250)
• c9472a4 ci: add Claude Code GitHub Action (#249)
• 998c06c chore(deps): update marocchino/sticky-pull-request-comment action to v3 (#248)
• a86856b chore(deps): update dependency ruby to v3.4.9 (#247)
• cfdf478 chore: remove known providers table from README (#246)
• f9d5cfa chore: remove Claude plans and prevent future commits (#245)
• a10e3ba chore(deps): update dependency rspec to "~> 3.13.0" (#244)
• Additional commits viewable in compare view

Updates bigdecimal from 4.0.1 to 4.1.2

Release notes

Sourced from bigdecimal's releases.

v4.1.2

What's Changed

• Optimize BigDecimal#to_s by @​byroot in ruby/bigdecimal#519
• Fix calloc-transposed-args warning by @​nobu in ruby/bigdecimal#520
• Use '0'+n for converting single digit to char by @​tompng in ruby/bigdecimal#521
• Revert "Add a workaround for slow BigDecimal#to_f when it has large N_significant_digits" by @​tompng in ruby/bigdecimal#522
• BigMath.exp overflow/underflow check by @​tompng in ruby/bigdecimal#523
• Fix unary minus on unsigned type warning by @​tompng in ruby/bigdecimal#525
• Update dtoa to version from Ruby 4.0 by @​jhawthorn in ruby/bigdecimal#528
• Bump version to v4.1.2 by @​tompng in ruby/bigdecimal#529

New Contributors

• @​jhawthorn made their first contribution in ruby/bigdecimal#528

Full Changelog: ruby/bigdecimal@v4.1.1...v4.1.2

v4.1.1

What's Changed

• Define test as the default rake task by @​byroot in ruby/bigdecimal#509
• Add changelog for 4.1.0. by @​simi in ruby/bigdecimal#508
• Make BigDecimal object embedded by @​byroot in ruby/bigdecimal#507
• Remove unused minitest from Gemfile by @​byroot in ruby/bigdecimal#510
• Multiplication with 8-decdig batch by @​tompng in ruby/bigdecimal#501
• Increase VpMult batch size by @​tompng in ruby/bigdecimal#511
• Update to cover change in Bundler by @​brandonzylstra in ruby/bigdecimal#512
• tiny grammar fix in README.md by @​brandonzylstra in ruby/bigdecimal#513
• Add a workaround for slow BigDecimal#to_f when it has large N_significant_digits by @​tompng in ruby/bigdecimal#514
• Bump version to v4.1.1 by @​tompng in ruby/bigdecimal#516

New Contributors

• @​byroot made their first contribution in ruby/bigdecimal#509
• @​simi made their first contribution in ruby/bigdecimal#508
• @​brandonzylstra made their first contribution in ruby/bigdecimal#512

Full Changelog: ruby/bigdecimal@v4.1.0...v4.1.1

v4.1.0

What's Changed

• Remove ENABLE_NUMERIC_STRING flag by @​tompng in ruby/bigdecimal#479
• Sample code without deprecated modules by @​tompng in ruby/bigdecimal#480
• Improve performance of add/sub when exponent of two bigdecimals have huge difference by @​tompng in ruby/bigdecimal#478
• Change frozen_string_literal from false to true by @​tompng in ruby/bigdecimal#481
• NTT multiplication and Newton-Raphson division by @​tompng in ruby/bigdecimal#407
• Implement BigMath::PI with Gauss-Legendre algorithm by @​tompng in ruby/bigdecimal#434

... (truncated)

Changelog

Sourced from bigdecimal's changelog.

4.1.2

• Fix dtoa Ractor-safety bug. Update dtoa to version from Ruby 4.0 GH-528

  @​jhawthorn

• Optimize BigDecimal#to_s GH-519

  @​byroot

4.1.1

• Make BigDecimal object embedded GH-507

  @​byroot

• Multiplication with 16-decdig batch GH-501 GH-511

  @​tompng

4.1.0

• Drop Ruby 2.5 support GH-505

  @​tompng

• Performance improvements: NTT multiplication, Newton-Raphson division, bit-burst algorithm for exp/sin, Gauss-Legendre for PI, improved log, and faster add/sub for large exponent differences GH-407 GH-433 GH-434 GH-478 GH-484

  @​tompng

• Remove ENABLE_NUMERIC_STRING flag GH-479

  @​tompng

• Add RBS signature and testing GH-488 GH-492

  @​ksss

• Fix erfc(x,prec) precision when x is huge GH-502

  @​tompng

• Fix error compiling with ruby.wasm GH-504

  @​tompng

Commits

• 9160561 Bump version to v4.1.2 (#529)
• 8050ec7 Update dtoa to version from Ruby 4.0 (#528)
• f8a02b2 Merge pull request #526 from ruby/dependabot/github_actions/step-security/har...
• ac9a5cd Bump step-security/harden-runner from 2.16.1 to 2.17.0
• 6b51b99 Fix unary minus on unsigned type warning (#525)
• 50b80b1 BigMath.exp overflow/underflow check (#523)
• fc54487 Revert "Add a workaround for slow BigDecimal#to_f when it has large N_signifi...
• 72937b7 Use '0'+n for converting single digit to char (#521)
• 8ac1498 Merge pull request #517 from ruby/dependabot/github_actions/rubygems/release-...
• 3c89db5 Merge pull request #518 from ruby/dependabot/github_actions/step-security/har...
• Additional commits viewable in compare view

Updates googleapis-common-protos-types from 1.22.0 to 1.23.0

Release notes

Sourced from googleapis-common-protos-types's releases.

googleapis-common-protos-types: v1.23.0

1.23.0 (2026-05-19)

Features

• Regenerate protos and support Ruby min_version 3.2 (#412)

Commits

• 1bd0442 chore(main): release googleapis-common-protos-types 1.23.0 (#419)
• a869146 chore(main): release google-apps-script-type 1.8.0 (#414)
• 1b1f527 chore(main): release google-geo-type 1.2.0 (#416)
• 83be724 chore(main): release grpc-google-iam-v1 1.12.0 (#397)
• 1766762 chore(main): release google-apps-card-v1 1.2.0 (#413)
• 41762f4 chore(main): release google-cloud-common 1.10.0 (#415)
• 3466c15 chore(main): release google-shopping-type 1.2.0 (#417)
• 8a8561f chore(deps): update actions/checkout action to v6 (#406)
• daa3a55 feat: Regenerate protos and support Ruby min_version 3.2 (#412)
• 24ca7a6 chore: Refactor Github Action per b/485167538 (#409)
• Additional commits viewable in compare view

Updates grpc from 1.78.1 to 1.81.1

Release notes

Sourced from grpc's releases.

Release v1.81.1

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [EventEngine] Fix a potential use-after-free error on Windows. (#42078)
• [ssl] Server side handshaker factory stores a map of key signers. (#42002)
• [Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)
• [EventEngine] Fix a Windows race that causes an assertion error. (#41563)
• [grpc_error] enable error_flatten experiment in OSS. (#41471)

Objective-C

• [ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

• [Python] Add typing_extensions dep to aio Bazel target. (#42001)
• [Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)
• [Python] Drop 3.9. (#42145)
• [Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)
• [Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)
• [Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)
• [Python] Support observability in AsyncIO stack. (#41573)
• [Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Ruby

• [Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)
• [Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

... (truncated)

Commits

• e84a8a2 [Release] Bump version to 1.81.1 (on v1.81.x branch) (#42584)
• 4706d6a [xDS] fix use-after-free in global XdsClient map (#42559)
• 8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
• 0029e06 Move all gRPC Session classes to the experimental namespace (#42462)
• 6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
• 1108777 [Release] Bump core version to 54.0.0 for upcoming release (#42321)
• 74940e8 [fix] Add back the do-while loop that handles the TSI_RESULT correctly.
• 5c6185c [CHTTP2] Assert
• 51bc437 Automated rollback of commit aab1eab78f9fcb3fc6e0aa9c8d7a59de280dbe3f.
• aab1eab [Inproc] Ensure stream is always cancelled under the transport lock.
• Additional commits viewable in compare view

Updates mail from 2.9.0 to 2.9.1

Release notes

Sourced from mail's releases.

2.9.1

What's Changed

• Add Ruby 3.4 to CI matrix in GitHub Actions workflow by @​ydah in mikel/mail#1653

• Improve decoding of Q- and B-encoded strings by @​radar in mikel/mail#1664

• Bump to 2.9.1 by @​radar in mikel/mail#1665

• @​ydah made their first contribution in mikel/mail#1653

Full Changelog: mikel/mail@2.9.0...2.9.1

Commits

• d645d7b Merge pull request #1665 from mikel/tag-291
• 5c863ed Bump to 2.9.1
• 14915fa Merge pull request #1664 from mikel/sec
• 4eab562 Potential fix for pull request finding
• f9d59c2 Improve decoding of Q- and B-encoded strings
• f98fb65 Merge pull request #1653 from ydah/add-ci-matrix
• d908100 Add Ruby 3.4 to CI matrix in GitHub Actions workflow
• See full diff in compare view

Updates mustermann from 3.0.4 to 3.1.1

Changelog

Sourced from mustermann's changelog.

Changelog

Mustermann follows Semantic Versioning 2.0. Anything documented in the README or via YARD and not declared private is part of the public API.

Unreleased changes

Mustermann 4.0.1

Performance improvements

• Reduce memory usage by deduplicating internal data structures. This is especially effective when using large Mustermann::Set objects. #159 #160 @​byroot

Stable Releases

Mustermann 4.0.0 (2026-04-27)

Breaking changes

• Mustermann::Pattern#match will now return Mustermann::Match instead of either MatchData or Mustermann::SimpleMatch. This object behaves similar to the previous return values, but also implements #params and #pattern.
• Moved Mustermann::Mapper and Mustermann::PatternCache from mustermann to mustermann-contrib.
• Removed special code for Sinatra 1.x. If you want to use Mustermann with Sinatra, please upgrade to any of the Sinatra versions released since 2017.

New features

• Mustermann::Rails now supports Rails up to version 8.2 (previously 5.0).
• Added Mustermann::Hybrid, a pattern that's a union of Sinatra, Rails and URI Template syntax. It is designed to be as compatible as possible with all three syntaxes.
• Added Mustermann::Set to mustermann, which is a collection of patterns with associated values, designed for building routing tables that dispatch efficiently as the number of routes grows.
• Reintroduce Mustermann::Router, now based on Mustermann::Set, for demonstration purposes and use in small applications or middleware. Simple and fast.
• The capture option now supports special class and symbol values, that both set an expected capture pattern and define a params converter.
• Mustermann::Pattern#+ and Mustermann::Pattern#| now return single patterns instead of composite patterns in significantly more cases, like having non-overlapping captures.
• Nicer inspect and pretty_print for patterns and other objects.

Here's an example using Mustermann::Hybrid, Mustermann::Set, and the new capture options:

require "mustermann/set"
set = Mustermann::Set.new(type: :hybrid, capture: { id: Integer, user_id: Integer, slug: :slug })
adding values is optional
set.add "/users",                "users.index"
set.add "/users/:id",            "users.show"
set.add "/posts",                "posts.index"
set.add "/users/:user_id/posts", "posts.index"
set.add "/posts/:id(-:slug)",    "posts.show" # slug is optional
match = set.match("/posts/42-awesome-post")
id is automatically converted to an Integer, and slug is available as a string
</tr></table>

... (truncated)

Commits

• 7445f32 remove visualizer injection into inspect and pretty_print, fixes #153
• e7721d8 Fix markup in README
• a33272b Move Rails pattern documentation from mustermann-contrib to mustermann
• 5cfd230 Fix code example
• 656eb61 Fix typo
• 518fb7e Increase version to 3.1.1
• 8fd53a0 Improve Mustermann::Pattern#hash to reduce the chance of collisions on JRuby ...
• 6b1eddc fix load order issue when loading mustermann/expander directly
• c163eaf Merge branch 'main' into reduce-gem-size
• 418233e bump version to 3.1.0
• Additional commits viewable in compare view

Updates net-imap from 0.6.3 to 0.6.4.1

Release notes

Sourced from net-imap's releases.

v0.6.4.1

What's Changed

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.6.4. Please see the linked security advisories for more information.

• (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8) This vulnerability depends how the server interprets non-synchronizing literals. The connection is not vulnerable if the server supports non-synchronizing literals.
  • 🥅 Validate non-synchronizing literals support by @​nevans in ruby/net-imap#701
• (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • 🥅 Validate ID values contain only valid bytes by @​nevans in ruby/net-imap#698
  • 🥅 Validate #enable arguments are all atoms by @​nevans in ruby/net-imap#699 NOTE: #enable should never be called with untrusted input.
• (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66) This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
  • Reported by @​fg0x0
  • 🐛 Prevent trailing {0} in RawData validation by