Bump the bundler-dependencies group across 1 directory with 10 updates by dependabot[bot] · Pull Request #88 · tma/balance

dependabot · 2026-09-03T18:29:05Z

Bumps the bundler-dependencies group with 10 updates in the / directory:

Package	From	To
rails	`8.1.3`	`8.1.3.1`
sqlite3	`2.9.5`	`2.9.6`
solid_queue	`1.4.0`	`1.7.0`
solid_cable	`4.0.0`	`4.0.2`
bootsnap	`1.24.6`	`1.25.0`
thruster	`0.1.22`	`0.1.26`
image_processing	`2.0.2`	`2.0.3`
ruby-lsp	`0.26.9`	`0.26.11`
selenium-webdriver	`4.45.0`	`4.48.0`
webmock	`3.26.2`	`3.26.4`

Updates rails from 8.1.3 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

No changes.

Active Model

No changes.

Active Record

No changes.

Action View

No changes.

Action Pack

No changes.

Active Job

No changes.

Action Mailer

No changes.

Action Cable

No changes.

Active Storage

Disable libvips's unfuzzed image loaders and savers.

libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits

3989ebf Preparing for 8.1.3.1 release
349e7a5 Disable libvips's unfuzzed image loaders and savers
See full diff in compare view

Updates sqlite3 from 2.9.5 to 2.9.6

Release notes

Sourced from sqlite3's releases.

2.9.6 / 2026-08-11

Security / Stability

Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @jeremy

Fixed

Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @djmb

Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @djmb

Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @flavorjones

Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @flavorjones

Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @flavorjones

Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @flavorjones

Improved

When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @katafrakt
d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @jeremy

Fixed

Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @djmb

Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @djmb

Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @flavorjones

Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @flavorjones

Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @flavorjones

Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @flavorjones

Improved

When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @katafrakt

Commits

a52dc0d version bump to v2.9.6
cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
abcb0f6 Reject database filenames and VFS names containing NUL (#732)
1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
3de8f6e doc: update CHANGELOG.md
ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
32460e9 Stop sqlite calling into moved Ruby objects (#723)
f600993 build(deps-dev): update rubocop-minitest requirement (#727)
Additional commits viewable in compare view

Updates solid_queue from 1.4.0 to 1.7.0

Release notes

Sourced from solid_queue's releases.

v1.7.0 - batches

This is a big one! Solid Queue finally supports job batches thanks to @jpcamara. Check the README for more details about how to use these. This took ages despite being a very requested feature 😅 Big thanks to @jpcamara for his patience, refinements and production-app tests!

What's Changed

Clarify that concurrency + bulk enqueuing is a perf caveat, not unsafe by @Gnirt in rails/solid_queue#785

Wait for polling queries in logging tests instead of sleeping by @wintan1418 in rails/solid_queue#775

Keep semaphore slots held while blocked jobs are enqueued in concurrency test by @wintan1418 in rails/solid_queue#776

Give in-flight jobs enough pause to survive slow shutdowns in tests by @wintan1418 in rails/solid_queue#782

Include the error in fail_many_claimed events and document recovery by @wintan1418 in rails/solid_queue#779

Replace terminated forks even if releasing their claimed jobs fails by @wintan1418 in rails/solid_queue#781

Honour TERM received during supervisor boot before forking workers by @rafael-pissardo in rails/solid_queue#770

Batch Support by @jpcamara in rails/solid_queue#142

New Contributors

@Gnirt made their first contribution in rails/solid_queue#785

Full Changelog: rails/solid_queue@v1.6.0...v1.7.0

v1.6.0 - fiber execution mode (with Async)

A long-awaited feature thanks to @crmne on this release: instead of using a thread pool to run jobs in multiple threads per works, you can now use fibers on a single fiber reactor thread. To use this, you just need to specify the number of fibers instead of the number of threads in your worker configuration, like this:
workers:
  - queues: "api*"
    fibers: 100
    polling_interval: 0.05
It uses Async under the hood, so you need to have that as a dependency for it to work. Also, you need to be using fiber isolation in Rails (config.active_support.isolation_level`` = :fiber).

This can be very useful for I/O-bound workloads, such as those involving LLM calls.

What's Changed

Add fiber worker execution mode by @crmne in rails/solid_queue#728

Roll back transactions leaked by killed job threads in tests by @rosa in rails/solid_queue#773

Document how to update dynamic recurring tasks by @wintan1418 in rails/solid_queue#777

New Contributors

@crmne made their first contribution in rails/solid_queue#728

@wintan1418 made their first contribution in rails/solid_queue#777

Full Changelog: rails/solid_queue@v1.5.1...v1.6.0

v1.5.1

What's Changed

Fix flaky tests caused by leaked job threads and signal timing by @rosa in rails/solid_queue#766

Add an update generator to copy new migrations by @rosa in rails/solid_queue#765

Wait for the continuable job to start before interrupting it by @rosa in rails/solid_queue#767

Add --only-recurring to run just the recurring scheduler by @rafael-pissardo in rails/solid_queue#757

Use with_connection in DistinctValues by @trevorturk in rails/solid_queue#769

Replace forked processes that fail to boot by @sapandiwakar in rails/solid_queue#760

... (truncated)

Commits

e2b5384 Bump solid_queue to 1.7.0
5352228 Reset pooled connections when flipping the batches schema in tests
112bb1c Refine batch support after a full review
1bcac83 Add batch support
fcb5f7a Name the supervisor's stop checkpoint and simplify its lifecycle
124176a Honour TERM received during supervisor boot before forking workers
174cb07 Protect the shutdown reap from release failures too
0526401 Replace terminated forks even if releasing their claimed jobs fails
6816e52 Include the error in fail_many_claimed events and document recovery
fc5fb59 Wait longer for the supervisor to fail the killed worker's job
Additional commits viewable in compare view

Updates solid_cable from 4.0.0 to 4.0.2

Release notes

Sourced from solid_cable's releases.

v4.0.2

What's Changed

Reset retry counter on each successful poll by @npezza93 in rails/solid_cable#84

Full Changelog: rails/solid_cable@v4.0.1...v4.0.2

v4.0.1

What's Changed

Run ci against different rails versions by @npezza93 in rails/solid_cable#79

Update adapter to handle ActionCable adapterization in 8.2 by @npezza93 in rails/solid_cable#80

Reset reconnect_attempt after successfuly accessing the DB. by @pascalbetz in rails/solid_cable#82

New Contributors

@pascalbetz made their first contribution in rails/solid_cable#82

Full Changelog: rails/solid_cable@v4.0.0...v4.0.1

Commits

4a41ec8 Version bump
f781e4d Reset retry counter on each successful poll (#84)
cf0695c Version bump
c968ba7 Reset reconnect_attempt after successfuly accessing the DB. (#82)
5ea0f55 Update adapter to handle ActionCable adapterization in 8.2 (#80)
89d34d7 Run ci against different rails versions (#79)
See full diff in compare view

Updates bootsnap from 1.24.6 to 1.25.0

Release notes

Sourced from bootsnap's releases.

v1.25.0

What's Changed

Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.25.0

Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits

e099ec7 Release 1.25.0
b694a11 Merge pull request #563 from stanhu/sh-ignore-yjit-in-compile-cache-key
51898f9 Ignore YJIT status in the compile cache key
1ad589b Merge pull request #560 from rails/hm-qnqlnylzkqkltqsz
21fbd65 Merge pull request #561 from jeremy/fix-path-conversion-entry-points
4898853 Convert the path argument in the frame that reads it
8ee47c4 Add MessagePack::Bigint type
49e3eb7 Replace Date Marshalling with recursive msgpack
711fd0b Bump minimum msgpack to 1.5.0
160fc10 Merge pull request #558 from viralpraxis/fix-yaml-cache-kwargs-mutation
Additional commits viewable in compare view

Updates thruster from 0.1.22 to 0.1.26

Changelog

Sourced from thruster's changelog.

v0.1.26 / 2026-08-24

Add X-Request-ID header to requests and logs (#148)

Build with Go 1.27.0 (#147)

Build with Go 1.26.6 (#145)

v0.1.25 / 2026-08-11

Bypass all uncacheable requests (#142)

v0.1.24 / 2026-08-11

Use struct types as cache keys

v0.1.23 / 2026-07-16

Build with Go 1.26.5 (#140)

Commits

cda91ad Bump version
318a0fc Merge pull request #148 from basecamp/request-id
f25e0fb Keep owned headers out of hop-by-hop stripping
e95cad7 Add X-Request-ID to requests, responses and logs
de6ec48 Merge pull request #147 from basecamp/go-1.27
5a33fe7 Update x/crypto, x/net
8e26507 Update klauspost/compress to v1.19.2
06f3e8a Build with Go 1.27.0
e7173c5 Merge pull request #145 from erikthoreson24/bump-go-1.26.6-security
f84d58d bump go to 1.26.6
Additional commits viewable in compare view

Updates image_processing from 2.0.2 to 2.0.3

Changelog

Sourced from image_processing's changelog.

2.0.3 (2026-08-06)

Prevent remote code execution when operation names come from user input, closing bypasses through the #operation meta-builder, #method_missing, and nested #send calls (reported by @szymonsec)

[minimagick] Prevent remote code execution through unsafe public methods (e.g. #instance_eval, #send) passed as loader/saver option names

Commits

1611c00 Bump to 2.0.3
8cd14e9 Test on JRuby 10.1.x
28684e7 Close more RCE security gaps
0360dbd Remove ruby2_keywords usage (#145)
See full diff in compare view

Updates ruby-lsp from 0.26.9 to 0.26.11

Release notes

Sourced from ruby-lsp's releases.

v0.26.11

🐛 Bug Fixes

Handle missing Gemfile in project add-on loading (Shopify/ruby-lsp#4178) by @vinistock

Ensure beta rails add-on is used when beta is enabled (Shopify/ruby-lsp#4194) by @vinistock

v0.26.10

🐛 Bug Fixes

Prevent adding end token on endless methods (Shopify/ruby-lsp#4042) by @vinistock

Return MethodNotFound (-32601) for unrecognized LSP requests (Shopify/ruby-lsp#4040) by @IgorFroehner

Prevent loading old gem installations as project add-ons (Shopify/ruby-lsp#4052) by @vinistock

Fix document link gem paths when to_spec returns nil (Shopify/ruby-lsp#4060) by @vinistock

Use env shebangs for RubyGems installs (Shopify/ruby-lsp#4126) by @joshheinrichs-shopify

Don't crash on document URIs with an invalid scheme (Shopify/ruby-lsp#4127) by @eyupcanakman

Commits

6745c16 Bump version to v0.26.11
3517da1 Ensure beta rails add-on is used when beta is enabled (#4194)
33e50bd Merge pull request #4192 from Shopify/dependabot/submodules/test/fixtures/pri...
929b79f Bump test/fixtures/prism from 115d58f to 9175663
b25bb6d Merge pull request #4190 from Shopify/dependabot/github_actions/pnpm/action-s...
685138b Merge pull request #4189 from Shopify/dependabot/submodules/test/fixtures/pri...
2d9610c Bump pnpm/action-setup from 6.0.9 to 6.0.10
87bd973 Bump test/fixtures/prism from 03bde59 to 115d58f
a9e5a28 Merge pull request #4184 from Shopify/dependabot/submodules/test/fixtures/pri...
b789cd8 Merge pull request #4185 from Shopify/dependabot/github_actions/actions/stale...
Additional commits viewable in compare view

Updates selenium-webdriver from 4.45.0 to 4.48.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.48.0

Detailed Changelogs by Component

Java | Python | DotNet | Ruby | JavaScript

What's Changed

[js] Normalize empty custom locator results by @munawiki in SeleniumHQ/selenium#17851

[py]: fix W3C capabilities built from a list of options (create_matches) by @navin772 in SeleniumHQ/selenium#17897

[rb] add low-level BiDi protocol integration specs by @titusfortner in SeleniumHQ/selenium#17878

Fix badge for CI build on the default branch by @nvborisenko in SeleniumHQ/selenium#17901

[py] Fix broken reStructuredText link in docs by @cgoldberg in SeleniumHQ/selenium#17902

[grid] stop forwarding se:remoteUrl past the Node that consumes it by @titusfortner in SeleniumHQ/selenium#17908

[grid] Forward file upload/download for Kubernetes, Docker and relay sessions by @VietND96 in SeleniumHQ/selenium#17914

[build] reduce github cache churn and aggressively prune CodeQL caches by @titusfortner in SeleniumHQ/selenium#17909

[java] fix two flaky BiDi tests that left timing-dependent state behind by @titusfortner in SeleniumHQ/selenium#17918

[java] Add warn annotation for undeclared field while JSON coercion by @pujagani in SeleniumHQ/selenium#17917

[py] temporarily disable nightly TestPyPI publishing by @titusfortner in SeleniumHQ/selenium#17920

[rb] fix Safari test failures by @titusfortner in SeleniumHQ/selenium#17922

[build] fix the issues that caused the release workflow to fail during last release by @titusfortner in SeleniumHQ/selenium#17921

Revert "[py] temporarily disable nightly TestPyPI publishing (#17920)" by @diemol in SeleniumHQ/selenium#17924

[rb] fix silent hang on oversized WebSocket frames by @aguspe in SeleniumHQ/selenium#17655

[js] Ensure BiDi is not exposed on Driver by @pujagani in SeleniumHQ/selenium#17926

[docs] charter: link the accepted BiDi support boundary record by @AutomatedTester in SeleniumHQ/selenium#17928

Honour the DO_NOT_TRACK env var by @shs96c in SeleniumHQ/selenium#17931

[build] record flaky tests on trunk and report weekly offenders to Slack by @titusfortner in SeleniumHQ/selenium#17930

[build] ignore .bazelbsp/ IDE-generated directory by @diemol in SeleniumHQ/selenium#17932

[adr] Install browser extensions from the driver directly by @titusfortner in SeleniumHQ/selenium#17817

[py] generate the internal BiDi protocol layer from the shared binding-neutral schema by @titusfortner in SeleniumHQ/selenium#17761

[rb] always reject a missing required inbound BiDi field by @titusfortner in SeleniumHQ/selenium#17936

[build] make Java and .NET release reruns pass when already published by @titusfortner in SeleniumHQ/selenium#17935

[build] Move dependency updates into a weekly workflow by @titusfortner in SeleniumHQ/selenium#17934

[rb] accept a whole-valued float for an integer BiDi field by @titusfortner in SeleniumHQ/selenium#17939

[build] unlock trunk once the release finishes writing to it by @titusfortner in SeleniumHQ/selenium#17938

[js] Add serialization and domain layer by @pujagani in SeleniumHQ/selenium#17927

[build] stop updating browsers and CDP during release preparation by @titusfortner in SeleniumHQ/selenium#17940

[py] update new BiDi layer generation to conform to latest proposed ADR by @titusfortner in SeleniumHQ/selenium#17942

[dotnet] [bidi] Throw in case of unknown discriminator by @nvborisenko in SeleniumHQ/selenium#17948

[rb] reject an inbound BiDi scalar outside its union's declared arms by @titusfortner in SeleniumHQ/selenium#17947

[build] alert Slack when a CDP update lands on trunk by @titusfortner in SeleniumHQ/selenium#17950

[js][bidi] Add BiDi connection-level event subscription by @pujagani in SeleniumHQ/selenium#17946

[dotnet] [bidi] SetMediaFeaturesOverride command in Emulation module by @nvborisenko in SeleniumHQ/selenium#17953

New Contributors

@munawiki made their first contribution in SeleniumHQ/selenium#17851

Full Changelog: SeleniumHQ/selenium@selenium-4.47.0...selenium-4.48.0

... (truncated)

Changelog

Sourced from selenium-webdriver's changelog.

4.48.0 (2026-08-27)

Support CDP versions: v150, v151, v152

add low-level BiDi protocol integration specs (#17878)

[build] Automated Browser Version Update (major) with CDP (#17910)

fix silent hang on oversized WebSocket frames (#17655)

always reject a missing required inbound BiDi field (#17936)

accept a whole-valued float for an integer BiDi field (#17939)

reject an inbound BiDi scalar outside its union's declared arms (#17947)

4.47.0 (2026-08-10)

Support CDP versions: v149, v150, v151

support WebDriver BiDi on Safari Preview and move #bidi onto Driver (#17729)

link generated BiDi elements to their spec definitions (#17781)

add objectOnly/preserveExtras/scalar-primitive BiDi schema signals (#17784)

construct the BiDi transport inside the domain from a connection (#17796)

route BiDiBridge navigation through the generated Protocol::BrowsingContext (#17785)

resolve spec runfiles via Bazel::Runfiles (#17810)

[build] standardize generated-file license and not to edit markers across generators (#17816)

validate nullable-constant BiDi params outbound (#17818)

[build] upgrade rules_ruby to 0.28.0 and drop vendored Bazel::Runfiles workaround (#17824)

[build] Merge vendor cddl files into shared BiDi schema and implement custom Firefox webExtension options (#17840)

[grid] honor client-advertised se:remoteUrl for reachable BiDi/CDP/VNC URLs (#17790)

tolerate and warn on missing required inbound BiDi fields, with SE_BIDI_STRICT to escalate (#17844)

remove deprecated FTP proxy support (#17846)

prevent CDP access with Firefox (#17849)

test matchers assert log entries by id and optional messages and match severity (#17848)

[bidi] Correct float/enum type fidelity in the shared schema and validate primitives outbound in Ruby (#17852)

[bidi] mark BiDi types extensible per spec and update Ruby handling (#17853)

raise typed WebDriver errors for BiDi from a generated error-code map (#17855)

allow pending test guards to require matching provided exception (#17859)

pass --enable-chrome-logs unless CHROME_LOG_FILE is set (#17858)

support custom vendor specific capabilities in options classes (#17862)

validate BiDi outbound ref fields against their declared type (#17861)

generate BiDi domain type accessors and union variant factories (#17865)

deprecate invalid Firefox profile code (#17871)

[build] Automated Browser Version Update with CDP (#17873)

4.46.0 (2026-07-10)

Support CDP versions: v148, v149, v150

trim whitespace around NO_PROXY entries (#17565)

add ClientConfig for HTTP client customization (#17699)

generate the BiDi protocol layer from the shared binding-neutral schema (#17731)

Commits

27f5213 [build] Prepare for release of selenium-4.48.0 (#17956)
7bfaedb [rb] reject an inbound BiDi scalar outside its union's declared arms (#17947)
6df5706 [rb] accept a whole-valued float for an integer BiDi field (#17939)
1dd3004 [rb] always reject a missing required inbound BiDi field (#17936)
eb28a14 [rb] fix silent hang on oversized WebSocket frames (#17655)
194545f [rb] fix Safari test failures (#17922)
3e38711 [build] Automated Browser Version Update (major) with CDP (#17910)
0003281 [rb] add low-level BiDi protocol integration specs (#17878)
b4b73af [build] Update lockfiles for nightly versions
1ed71ed [build] Reset versions to nightly after selenium-4.47.0 release
Additional commits viewable in compare view

Updates webmock from 3.26.2 to 3.26.4

Release notes

Sourced from webmock's releases.

3.26.4

Fix race condition in HTTPClient adapter async requests by @koic in #1131

3.26.3

Confirm to work with curb 1.3.7

Thanks to Josch Bockler

Fix NameError in async-http adapter on protocol-http1 >= 0.40

Thanks to Leslie Hoare

Changelog

Sourced from webmock's changelog.

3.26.4

Fix race condition in HTTPClient adapter async requests by @koic in #1131

3.26.3

Confirm to work with curb 1.3.7

Thanks to Josch Bockler

Fix NameError in async-http adapter on protocol-http1 >= 0.40

Thanks to Leslie Hoare

Commits

0fdbad0 Version 3.26.4
b187df8 Merge pull request #1131 from koic/fix_race_condition_in_httpclient_adapter_a...
f275724 Fix race condition in HTTPClient adapter async requests
ee409ac Version 3.26.3
2c976d5 Merge pull request #1127 from jbockler/curb-1.3
5b40155 Confirm to work with curb 1.3.7
f685e7e Merge pull request #1130 from lesleh/fix-async-http-status-description
a50557e Fix NameError in async-http adapter on protocol-http1 >= 0.40
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the bundler-dependencies group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [rails](https://github.com/rails/rails) | `8.1.3` | `8.1.3.1` | | [sqlite3](https://github.com/sparklemotion/sqlite3-ruby) | `2.9.5` | `2.9.6` | | [solid_queue](https://github.com/rails/solid_queue) | `1.4.0` | `1.7.0` | | [solid_cable](https://github.com/rails/solid_cable) | `4.0.0` | `4.0.2` | | [bootsnap](https://github.com/rails/bootsnap) | `1.24.6` | `1.25.0` | | [thruster](https://github.com/basecamp/thruster) | `0.1.22` | `0.1.26` | | [image_processing](https://github.com/janko/image_processing) | `2.0.2` | `2.0.3` | | [ruby-lsp](https://github.com/Shopify/ruby-lsp) | `0.26.9` | `0.26.11` | | [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.45.0` | `4.48.0` | | [webmock](https://github.com/bblimke/webmock) | `3.26.2` | `3.26.4` | Updates `rails` from 8.1.3 to 8.1.3.1 - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v8.1.3...v8.1.3.1) Updates `sqlite3` from 2.9.5 to 2.9.6 - [Release notes](https://github.com/sparklemotion/sqlite3-ruby/releases) - [Changelog](https://github.com/sparklemotion/sqlite3-ruby/blob/main/CHANGELOG.md) - [Commits](sparklemotion/sqlite3-ruby@v2.9.5...v2.9.6) Updates `solid_queue` from 1.4.0 to 1.7.0 - [Release notes](https://github.com/rails/solid_queue/releases) - [Commits](rails/solid_queue@v1.4.0...v1.7.0) Updates `solid_cable` from 4.0.0 to 4.0.2 - [Release notes](https://github.com/rails/solid_cable/releases) - [Commits](rails/solid_cable@v4.0.0...v4.0.2) Updates `bootsnap` from 1.24.6 to 1.25.0 - [Release notes](https://github.com/rails/bootsnap/releases) - [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md) - [Commits](rails/bootsnap@v1.24.6...v1.25.0) Updates `thruster` from 0.1.22 to 0.1.26 - [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md) - [Commits](basecamp/thruster@v0.1.22...v0.1.26) Updates `image_processing` from 2.0.2 to 2.0.3 - [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md) - [Commits](janko/image_processing@v2.0.2...v2.0.3) Updates `ruby-lsp` from 0.26.9 to 0.26.11 - [Release notes](https://github.com/Shopify/ruby-lsp/releases) - [Commits](Shopify/ruby-lsp@v0.26.9...v0.26.11) Updates `selenium-webdriver` from 4.45.0 to 4.48.0 - [Release notes](https://github.com/SeleniumHQ/selenium/releases) - [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES) - [Commits](SeleniumHQ/selenium@selenium-4.45.0...selenium-4.48.0) Updates `webmock` from 3.26.2 to 3.26.4 - [Release notes](https://github.com/bblimke/webmock/releases) - [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md) - [Commits](bblimke/webmock@v3.26.2...v3.26.4) --- updated-dependencies: - dependency-name: rails dependency-version: 8.1.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler-dependencies - dependency-name: sqlite3 dependency-version: 2.9.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler-dependencies - dependency-name: solid_queue dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bundler-dependencies - dependency-name: solid_cable dependency-version: 4.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler-dependencies - dependency-name: bootsnap dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: bundler-dependencies - dependency-name: thruster dependency-version: 0.1.26 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler-dependencies - dependency-name: image_processing dependency-version: 2.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler-dependencies - dependency-name: ruby-lsp dependency-version: 0.26.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bundler-dependencies - dependency-name: selenium-webdriver dependency-version: 4.48.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler-dependencies - dependency-name: webmock dependency-version: 3.26.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bundler-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Declare ruby-vips directly because image_processing 2.0.3 no longer provides the Vips runtime transitively. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5b21263-7574-422a-8875-969453aee340

Install libvips in the jobs that load Rails so ruby-vips can load on GitHub-hosted Ubuntu runners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5b21263-7574-422a-8875-969453aee340

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Sep 3, 2026

tma added 2 commits September 3, 2026 20:34

Let CI boot with the image processing update

950e252

Install libvips in the jobs that load Rails so ruby-vips can load on GitHub-hosted Ubuntu runners. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d5b21263-7574-422a-8875-969453aee340

tma merged commit f249e42 into main Sep 3, 2026
6 checks passed

tma deleted the dependabot/bundler/bundler-dependencies-0f95d21bc0 branch September 3, 2026 18:41

Navigation Menu

Bump the bundler-dependencies group across 1 directory with 10 updates - #88

Bump the bundler-dependencies group across 1 directory with 10 updates#88
tma merged 3 commits into
mainfrom
dependabot/bundler/bundler-dependencies-0f95d21bc0

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 3, 2026

8.1.3.1

Active Support

Active Model

Active Record

Action View

Action Pack

Active Job

Action Mailer

Action Cable

Active Storage

2.9.6 / 2026-08-11

Security / Stability

Fixed

Improved

2.9.6 / 2026-08-11

Security / Stability

Fixed

Improved

v1.7.0 - batches

What's Changed

New Contributors

v1.6.0 - fiber execution mode (with Async)

What's Changed

New Contributors

v1.5.1

What's Changed

v4.0.2

What's Changed

v4.0.1

What's Changed

New Contributors

v1.25.0

What's Changed

1.25.0

v0.1.26 / 2026-08-24

v0.1.25 / 2026-08-11

v0.1.24 / 2026-08-11

v0.1.23 / 2026-07-16

2.0.3 (2026-08-06)

v0.26.11

🐛 Bug Fixes

v0.26.10

🐛 Bug Fixes

Selenium 4.48.0

Detailed Changelogs by Component

What's Changed

New Contributors

4.48.0 (2026-08-27)

4.47.0 (2026-08-10)

4.46.0 (2026-07-10)

3.26.4

3.26.3

3.26.4

3.26.3

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant