Bump the production-dependencies-major group across 1 directory with 21 updates by dependabot[bot] · Pull Request #1387 · CommitChange/houdini

dependabot · 2026-07-20T14:27:41Z

Bumps the production-dependencies-major group with 19 updates in the / directory:

Package	From	To
rack	`2.2.23`	`3.2.6`
sprockets	`3.7.5`	`4.2.2`
rack-attack	`6.5.0`	`6.8.0`
stripe	`5.55.0`	`13.5.1`
puma	`7.2.1`	`8.0.2`
aws-sdk-rails	`2.1.0`	`5.1.0`
dalli	`3.2.3`	`5.0.5`
colorize	`0.8.1`	`1.1.0`
rails-i18n	`7.0.10`	`8.1.0`
rails	`7.1.5.2`	`8.1.3`
devise-two-factor	`6.1.0`	`6.4.0`
i18n-js	`3.9.2`	`4.2.4`
countries	`2.1.2`	`8.1.0`
config	`2.2.3`	`5.6.1`
redis	`4.2.5`	`5.4.1`
hashie	`4.0.0`	`5.1.0`
connection_pool	`2.5.3`	`3.0.2`
barnes	`0.0.8`	`1.0.1`
rack-cors	`2.0.2`	`3.0.0`

Updates rack from 2.2.23 to 3.2.6

Release notes

Sourced from rack's releases.

v3.2.6

Full Changelog: rack/rack@v3.2.5...v3.2.6

v3.2.4

No release notes provided.

v3.0.9.1

What's Changed

Fixed ReDoS in Accept header parsing [CVE-2024-26146]

Fixed ReDoS in Content Type header parsing [CVE-2024-25126]

Reject Range headers which are too large [CVE-2024-26141]

Full Changelog: rack/rack@v3.0.9...v3.0.9.1

v3.0.9

What's Changed

Fix content-length calcuation in Rack:Response#write #2150

Full Changelog: rack/rack@v3.0.8...v3.0.9

v3.0.8

What's Changed

Backport "Fix some unused variable verbose warnings" by @skipkayhil in rack/rack#2084

New Contributors

@skipkayhil made their first contribution in rack/rack#2084

Full Changelog: rack/rack@v3.0.7...v3.0.8

v3.0.7

What's Changed

Backport "Make query parameters without = have nil values". by @jeremyevans in rack/rack#2060

Full Changelog: rack/rack@v3.0.6.1...v3.0.7

v3.0.6.1

No release notes provided.

v3.0.4.1

Full Changelog: rack/rack@v3.0.4...v3.0.4.1

v3.0.4

Full Changelog: rack/rack@v3.0.3...v3.0.4

v3.0.3

What's Changed

Release v3.0.3 by @ioquatix in rack/rack#2000

... (truncated)

Changelog

Sourced from rack's changelog.

[3.2.6] - 2026-04-01

Security

CVE-2026-34763 Root directory disclosure via unescaped regex interpolation in Rack::Directory.

CVE-2026-34230 Avoid O(n^2) algorithm in Rack::Utils.select_best_encoding which could lead to denial of service.

CVE-2026-32762 Forwarded header semicolon injection enables Host and Scheme spoofing.

CVE-2026-26961 Raise error for multipart requests with multiple boundary parameters.

CVE-2026-34786 Rack::Static header_rules bypass via URL-encoded path mismatch.

CVE-2026-34831 Content-Length mismatch in Rack::Files error responses.

CVE-2026-34826 Multipart byte range processing allows denial of service via excessive overlapping ranges.

CVE-2026-34835 Rack::Request accepts invalid Host characters, enabling host allowlist bypass.

CVE-2026-34830 Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect.

CVE-2026-34785 Rack::Static prefix matching can expose unintended files under the static root.

CVE-2026-34829 Multipart parsing without Content-Length header allows unbounded chunked file uploads.

CVE-2026-34827 Multipart header parsing allows denial of service via escape-heavy quoted parameters.

CVE-2026-26962 Improper unfolding of folded multipart headers preserves CRLF in parsed parameter values.

[3.2.5] - 2026-02-16

Security

CVE-2026-25500 XSS injection via malicious filename in Rack::Directory.

CVE-2026-22860 Directory traversal via root prefix bypass in Rack::Directory.

Fixed

Fix Rack::MockResponse#body when the body is a Proc. (#2420, #2423, @tavianator, [@ioquatix])

[3.2.4] - 2025-11-03

Fixed

Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @alpaca-tc, @willnet, @krororo)

[3.2.3] - 2025-10-10

Security

CVE-2025-61780 Improper handling of headers in Rack::Sendfile may allow proxy bypass.

CVE-2025-61919 Unbounded read in Rack::Request form parsing can lead to memory exhaustion.

[3.2.2] - 2025-10-07

Security

CVE-2025-61772 Multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

CVE-2025-61771 Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

CVE-2025-61770 Unbounded multipart preamble buffering enables DoS (memory exhaustion)

... (truncated)

Commits

e1f22fd Bump patch version.
31989fd Fix typo in test.
d268165 Fix test expectation.
8f425de Add Ruby v4.0 to the test matrix.
bf83042 Drop EOL Rubies from external tests.
d50c4d3 Implement OBS unfolding for multipart requests per RFC 5322 2.2.3
bfb6914 Limit the number of quoted escapes during multipart parsing
b3e5945 Add Content-Length size check in Rack::Multipart::Parser
7a8f326 Fix root prefix bug in Rack::Static
a57bc14 Only do a simple substitution on the x-accel-mapping paths
Additional commits viewable in compare view

Updates sprockets from 3.7.5 to 4.2.2

Release notes

Sourced from sprockets's releases.

v4.2.2

What's Changed

document how to chain ERB for custom processors by @ashkulz in rails/sprockets#807

Drop base64 gem from dependency by @tricknotes in rails/sprockets#810

Add Ruby 3.3 to CI matrix by @m-nakamura145 in rails/sprockets#799

Bump rake version 13.2 or higher to suppress ostruct warnings by @yahonda in rails/sprockets#811

Add logger as dependency to address warnings against Ruby 3.4.0dev by @yahonda in rails/sprockets#813

Address warning: URI::RFC3986_PARSER warnings against ruby 3.4.0dev by @yahonda in rails/sprockets#812

Full Changelog: rails/sprockets@v4.2.1...v4.2.2

4.2.1

What's Changed

Fix .jpeg precompile issue by @ghiculescu in rails/sprockets#781

CI against Ruby 3.2 [changelog skip] by @amatsuda in rails/sprockets#777

Fix header casing compatibility with Rails 7 by @skipkayhil in rails/sprockets#790

fix: set application/css-sourcemap+json default charset to unicode by @chadlwilson in rails/sprockets#764

New Contributors

@ghiculescu made their first contribution in rails/sprockets#781

@skipkayhil made their first contribution in rails/sprockets#791

@jpbalarini made their first contribution in rails/sprockets#768

@chadlwilson made their first contribution in rails/sprockets#764

Full Changelog: rails/sprockets@v4.2.0...v4.2.1

4.2.0

What's Changed

Fix class name in sample code by @ursm in rails/sprockets#751

fix: grammar by @benkoshy in rails/sprockets#756

fix typo by @benkoshy in rails/sprockets#757

Update Link by @benkoshy in rails/sprockets#754

Rack 3 support by @lsylvester in rails/sprockets#758

Make Sprockets::Utils.module_include thread safe on JRuby by @ntkme in rails/sprockets#759

Fix thread safety of Sprockets::CachedEnvironment and Sprockets::Cache::MemoryStore by @eregon in rails/sprockets#771

New Contributors

@ursm made their first contribution in rails/sprockets#751

@benkoshy made their first contribution in rails/sprockets#756

@ntkme made their first contribution in rails/sprockets#759

Full Changelog: rails/sprockets@v4.1.1...v4.2.0

v4.1.1

Fix Sprockets::Server to return response headers to compatible with with Rack::Lint 2.0.

Full Changelog: rails/sprockets@v4.1.0...v4.1.1

v4.1.0

... (truncated)

Changelog

Sourced from sprockets's changelog.

4.2.2

Added missing dependency on logger. #813

Fix URI::RFC3986_PARSER warnings. #812

Removed dependency on base64. #810

4.2.1

Fix for precompile issues when multiple extensions map to the same MIME type (eg. .jpeg / .jpg). #781

Fix application/css-sourcemap+json charset #764

Fix compatibility with Rack 2 applications. #790

4.2.0

Rack 3 compatibility. #758

Fix thread safety of Sprockets::CachedEnvironment and Sprockets::Cache::MemoryStore. #771

Add support for Rack 3.0. Headers set by sprockets will now be lower case. #758

Make Sprockets::Utils.module_include thread safe on JRuby. #759

Fix typo in asset.rb file. #768

4.1.1

Fix Sprockets::Server to return response headers to be compatible with Rack::Lint 2.0.

4.1.0

Allow age to be altered in asset:clean rake task.

Fix Sprockets::Server to return lower-cased response headers to comply with Rack::Lint 3.0. #744

Adding new directive depend_on_directory #668

Fix application/js-sourcemap+json charset #669

Fix CachedEnvironment caching nil values #723

Process *.jst.ejs.erb files with ERBProcessor #674

Fix cache key for coffee script processor to be dependent on the filename #670

4.0.3

Fix Manifest#find yielding from a Promise causing issue on Ruby 3.1.0-dev. #720

Better detect the ERB version to avoid deprecation warnings. #719

Allow assets already fingerprinted to be served through Sprockets::Server

Do not fingerprint files that already contain a valid digest in their name

Remove remaining support for Ruby < 2.4.#672

4.0.2

Fix etag and digest path compilation that were generating string with invalid digest since 4.0.1.

4.0.1

Fix for Ruby 2.7 keyword arguments warning in base.rb. #660

Fix for when x_sprockets_linecount is missing from a source map.

... (truncated)

Commits

4dff018 Release 4.2.2
2fe13f2 Merge pull request #812 from yahonda/uri_rfc3986_parser_escape_and_unescape_a...
19b056c Merge pull request #813 from yahonda/add_logger
ceac1ce Merge pull request #811 from yahonda/bump_rake
e87e7c6 Add logger as dependency to address warnings against Ruby 3.4.0dev
9386ae4 Address warning: URI::RFC3986_PARSER warnings against ruby 3.4.0dev
8b47cd5 Bump rake version 13 or higher to suppress ostruct warnings
37b8468 Merge pull request #799 from m-nakamura145/update-ci-matrix
e4686d5 Merge pull request #810 from tricknotes/drop-base64
b8eaeef Drop base64 gem from dependency
Additional commits viewable in compare view

Updates rack-attack from 6.5.0 to 6.8.0

Release notes

Sourced from rack-attack's releases.

v6.8.0

What's Changed

Changed

Avoid RedisCacheStore#increment on Rails 6+ (which might improve performance) by @jdelStrother (#597)

Fixed

Fix #588 don't fail if request.ip is missing, by @santib (#630)

Fix reset! when using namespaced cache store by @santib (#673)

Deprecated

Soft deprecate integration with rack 1.x, may or may not work with it.

Soft deprecate integration with rails 5.2 or less, may or may not work with it.

Removed

Remove support for unmaintained ActiveSupport::Cache::RedisStore, by @mitchellhenke (#625)

New Contributors

@floehopper made their first contribution in rack/rack-attack#618

@mttkay made their first contribution in rack/rack-attack#622

@mitchellhenke made their first contribution in rack/rack-attack#625

@santib made their first contribution in rack/rack-attack#629

@tisba made their first contribution in rack/rack-attack#654

@fynsta made their first contribution in rack/rack-attack#658

@alexsmartens made their first contribution in rack/rack-attack#664

Full Changelog: rack/rack-attack@v6.7.0...v6.8.0

v6.7.0

What's Changed

Replace git.io URL by @kyoshidajp in rack/rack-attack#579

test: update rack-test to v2 from v1 by @grzuy in rack/rack-attack#587

Update example description to not suggest using a deprecated method by @MaksimAbramchuk in rack/rack-attack#589

Add note about cache stores and in-memory caches. by @nateberkopec in rack/rack-attack#604

ci: tests against redis gem v5 by @grzuy in rack/rack-attack#612

Support rack 3 by @ioquatix in rack/rack-attack#586

Gem release management. by @ioquatix in rack/rack-attack#614

New Contributors

@kyoshidajp made their first contribution in rack/rack-attack#579

@MaksimAbramchuk made their first contribution in rack/rack-attack#589

@nateberkopec made their first contribution in rack/rack-attack#604

Full Changelog: rack/rack-attack@v6.6.1...v6.7.0

... (truncated)

Changelog

Sourced from rack-attack's changelog.

[6.8.0] - 2025-10-14

Changed

Avoid RedisCacheStore#increment on Rails 6+ (which might improve performance) by @jdelStrother (#597)

Fixed

Fix #588 don't fail if request.ip is missing, by @santib (#630)

Fix reset! when using namespaced cache store by @santib (#673)

Deprecated

Soft deprecate integration with rack 1.x, may or may not work with it.

Soft deprecate integration with rails 5.2 or less, may or may not work with it.

Removed

Remove support for unmaintained ActiveSupport::Cache::RedisStore, by @mitchellhenke (#625)

[6.7.0] - 2023-07-26

Replace git.io URL by @kyoshidajp in #579

test: update rack-test to v2 from v1 by @grzuy in #587

Update example description to not suggest using a deprecated method by @MaksimAbramchuk in #589

Add note about cache stores and in-memory caches. by @nateberkopec in #604

ci: tests against redis gem v5 by @grzuy in #612

Support rack 3 by @ioquatix in #586

Gem release management. by @ioquatix in #614

[6.6.1] - 2022-04-14

Fixed

Fixes deprecation warning in redis 4.6+ ([@ixti])

[6.6.0] - 2022-01-29

Added

Ability to have access to the request object instead of only env (still can access env with request.env) when customizing throttle and blocklist responses with new methods Rack::Attack.blocklisted_responder= and Rack::Attack.throttled_responder= which yield the request to your lambda. ([@NikolayRys])

Deprecated

Rack::Attack.blocklisted_response=

Rack::Attack.throttled_response=

Commits

65f1ead Bumps gem version to v6.8.0
e84eaf5 Upgrade GHA Runners (#694)
4606efb build(deps): bump actions/checkout from 4 to 5 (#690)
40d83d1 Fix GHA Runner (#692)
1dba6ec Remove CodeClimate (#693)
4677708 Add Ruby 3.4 to the CI (#681)
8710876 Fix CI (#683)
86650c4 Fix reset! when using namespaced cache store (#673)
8d5b210 Fix wrong merge resolution (#680)
6db4a73 Drop Dalli 2 support (#679)
Additional commits viewable in compare view

Updates stripe from 5.55.0 to 13.5.1

Release notes

Sourced from stripe's releases.

v13.5.1

#1576 Explicitly pass through custom headers in retrieve

See the changelog for more details.

Changelog

Sourced from stripe's changelog.

Changelog

19.3.1 - 2026-07-15

#1902 Replace source hash with Telemetry UUID

#1901 Make Error fields generated

19.3.0 - 2026-06-24

This release changes the pinned API version to 2026-06-24.dahlia.

#1896 Update generated code

Add support for release_details on Reserve::Hold

Change Billing::CreditGrant.priority to be required

Add support for buyer_id on Charge::PaymentMethodDetail::Bizum, ConfirmationToken::PaymentMethodPreview::Bizum, ConfirmationToken::PaymentMethodPreview::Blik, PaymentAttemptRecord::PaymentMethodDetail::Bizum, PaymentMethod::Bizum, PaymentMethod::Blik, and PaymentRecord::PaymentMethodDetail::Bizum

Add support for transaction_link_id on Charge::PaymentMethodDetail::Card

Add support for fingerprint on Charge::PaymentMethodDetail::Pix, ConfirmationToken::PaymentMethodPreview::Pix, PaymentMethod::Pix, and SetupAttempt::PaymentMethodDetail::Pix

Add support for sunbit on Checkout::Session::PaymentMethodOption, Checkout::SessionCreateParams::PaymentMethodOption, PaymentIntent::PaymentMethodOption, PaymentIntentConfirmParams::PaymentMethodOption, PaymentIntentCreateParams::PaymentMethodOption, and PaymentIntentUpdateParams::PaymentMethodOption

Add support for billing_cycle_anchor_config on Checkout::SessionCreateParams::SubscriptionDatum

Add support for wechat_pay on Checkout::Session::PaymentMethodOption

Add support for mastercard_compliance on Dispute::Evidence::EnhancedEvidence, Dispute::EvidenceDetail::EnhancedEligibility, and DisputeUpdateParams::Evidence::EnhancedEvidence

Add support for status_details on FinancialConnections::Account

⚠️ Remove support for stored_credential_usage on PaymentAttemptRecord::PaymentMethodDetail::Card and PaymentRecord::PaymentMethodDetail::Card

⚠️ Change PaymentAttemptRecord::PaymentMethodDetail::Card.description and PaymentRecord::PaymentMethodDetail::Card.description to be optional

⚠️ Change PaymentAttemptRecord::PaymentMethodDetail::Card.iin and PaymentRecord::PaymentMethodDetail::Card.iin to be optional

⚠️ Change PaymentAttemptRecord::PaymentMethodDetail::Card.issuer and PaymentRecord::PaymentMethodDetail::Card.issuer to be optional

Add support for setup_future_usage on PaymentIntent::PaymentMethodOption::Satispay, PaymentIntentConfirmParams::PaymentMethodOption::Satispay, PaymentIntentCreateParams::PaymentMethodOption::Satispay, and PaymentIntentUpdateParams::PaymentMethodOption::Satispay

Change PaymentRecordReportRefundParams.refunded to be optional

Add support for satispay on SetupAttempt::PaymentMethodDetail

Add support for custom_fields, description, and footer on Subscription::InvoiceSetting, SubscriptionCreateParams::InvoiceSetting, and SubscriptionUpdateParams::InvoiceSetting

Add support for payment_method_options and payment_method on TopupCreateParams

Add support for mode on V2::Commerce::ProductCatalogImport

Add support for sunbit_payments on V2::Core::Account::Configuration::Merchant::Capability, V2::Core::AccountCreateParams::Configuration::Merchant::Capability, and V2::Core::AccountUpdateParams::Configuration::Merchant::Capability

Add support for crypto_money_manager and money_manager on V2::Core::AccountUpdateParams::Identity::Attestation::TermsOfService

⚠️ Remove support for crypto_storer and storer on V2::Core::AccountUpdateParams::Identity::Attestation::TermsOfService

19.2.1 - 2026-06-12

#1874 Add "source" field to user-agent header

19.2.0 - 2026-05-27

This release changes the pinned API version to 2026-05-27.dahlia.

#1864 Update generated code

Add support for new resource V2::Commerce::ProductCatalogImport

Add support for create and retrieve methods on resource V2::Commerce::ProductCatalogImport

Add support for bizum_payments and scalapay_payments on Account::Capability, AccountCreateParams::Capability, and AccountUpdateParams::Capability

Add support for automatic_transfer_rules_by_currency on BalanceSettings::Payment::Payout and BalanceSettingsUpdateParams::Payment::Payout

Add support for start_of_day on BalanceSettings::Payment::SettlementTiming and BalanceSettingsUpdateParams::Payment::SettlementTiming

Add support for description on ChargeCreateParams::TransferDatum, PaymentIntent::TransferDatum, PaymentIntentCreateParams::TransferDatum, and PaymentIntentUpdateParams::TransferDatum

Add support for bizum on Charge::PaymentMethodDetail, ConfirmationToken::PaymentMethodPreview, ConfirmationTokenCreateParams::PaymentMethodDatum, PaymentAttemptRecord::PaymentMethodDetail, PaymentIntent::PaymentMethodOption, PaymentIntentConfirmParams::PaymentMethodDatum, PaymentIntentConfirmParams::PaymentMethodOption, PaymentIntentCreateParams::PaymentMethodDatum, PaymentIntentCreateParams::PaymentMethodOption, PaymentIntentUpdateParams::PaymentMethodDatum, PaymentIntentUpdateParams::PaymentMethodOption, PaymentMethodConfigurationCreateParams, PaymentMethodConfigurationUpdateParams, PaymentMethodConfiguration, PaymentMethodCreateParams, PaymentMethod, PaymentRecord::PaymentMethodDetail, SetupIntent::PaymentMethodOption, SetupIntentConfirmParams::PaymentMethodDatum, SetupIntentConfirmParams::PaymentMethodOption, SetupIntentCreateParams::PaymentMethodDatum, SetupIntentCreateParams::PaymentMethodOption, SetupIntentUpdateParams::PaymentMethodDatum, and SetupIntentUpdateParams::PaymentMethodOption

Add support for scalapay on Charge::PaymentMethodDetail, Checkout::Session::PaymentMethodOption, Checkout::SessionCreateParams::PaymentMethodOption, ConfirmationToken::PaymentMethodPreview, ConfirmationTokenCreateParams::PaymentMethodDatum, PaymentAttemptRecord::PaymentMethodDetail, PaymentIntent::PaymentMethodOption, PaymentIntentConfirmParams::PaymentMethodDatum, PaymentIntentConfirmParams::PaymentMethodOption, PaymentIntentCreateParams::PaymentMethodDatum, PaymentIntentCreateParams::PaymentMethodOption, PaymentIntentUpdateParams::PaymentMethodDatum, PaymentIntentUpdateParams::PaymentMethodOption, PaymentMethodConfigurationCreateParams, PaymentMethodConfigurationUpdateParams, PaymentMethodConfiguration, PaymentMethodCreateParams, PaymentMethod, PaymentRecord::PaymentMethodDetail, Refund::DestinationDetail, SetupIntentConfirmParams::PaymentMethodDatum, SetupIntentCreateParams::PaymentMethodDatum, and SetupIntentUpdateParams::PaymentMethodDatum

Add support for mandate on Charge::PaymentMethodDetail::Twint, PaymentAttemptRecord::PaymentMethodDetail::Twint, and PaymentRecord::PaymentMethodDetail::Twint

... (truncated)

Commits

cc1fac0 Bump version to 13.5.1
9c56aea lock rbi version in jruby (#1549)
3aab161 Explicitly pass through custom headers in retrieve (#1576)
88f3e69 Bump version to 13.5.0
2a81d44 Update generated code (#1534)
d7e4457 Fix InvoiceLineItem parent class (#1536)
43bbf6f add codeowners file (#1533)
9d2bacd Bump version to 13.4.1
f2b4c22 Update generated code for v1463 (#1528)
d146769 Bump version to 13.4.0
Additional commits viewable in compare view

Updates puma from 7.2.1 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

Bugfixes

Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)

Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

v8.0.1

Bugfixes

Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

Performance

Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

Docs

Fix incorrect hook names in gRPC docs (#3923)

Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

Features

Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)

Add single and cluster DSL hooks for mode-specific configuration (#3621)

Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)

Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)

Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

Bugfixes

Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

Performance

JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)

Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

Refactor

Collect env processing into dedicated client_env.rb module (#3582)

Move event to default configuration (#3872)

Docs

Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)

Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)

Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)

Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

Bugfixes

Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)

Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

Bugfixes

Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

Performance

Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

Docs

Fix incorrect hook names in gRPC docs (#3923)

Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

Features

Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)

Add single and cluster DSL hooks for mode-specific configuration (#3621)

Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)

Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)

Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

Bugfixes

Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

Performance

JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)

Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

Refactor

Collect env processing into dedicated client_env.rb module (#3582)

Move event to default configuration (#3872)

Docs

Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)

Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)

Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)

Add file descriptor limit warning in test helper for contributors (#3893)

Breaking changes

Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

Commits

8085b75 Release v8.0.2 (#3945)
439c613 8.0.2 backport (#3944)
cee7e61 Release v8.0.1 (#3932)
f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
053efae Reword v8 upgrade guide ipv6 bullet (#3928)
b19f35a Fix incorrect hook names in gRPC docs (#3923)
eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
08f63d4 Release v8.0.0 (#3914)
Additional commits viewable in compare view

Updates aws-sdk-rails from 2.1.0 to 5.1.0

Release notes

Sourced from aws-sdk-rails's releases.

Release v5.1.0 - 2024-12-05

Tag release v5.1.0

References: #168

Feature - Support async job processing in Elastic Beanstalk middleware. (#167)

Release v5.0.0 - 2024-11-21

Tag release v5.0.0

References: #166

Feature - [Major Version] Remove dependencies on modular feature gems: aws-actiondispatch-dynamodb, aws-actionmailer-ses, aws-actionmailbox-ses, aws-activejob-sqs, and aws-record-rails.

Issue - Remove Aws::Rails.add_action_mailer_delivery_method in favor of ActionMailer::Base.add_delivery_method or the Railtie and configuration in aws-actionmailer-ses ~> 1.

Issue - Remove require of aws/rails/action_mailbox/rspec in favor of aws/action_mailbox/ses/rspec.

Issue - Remove symlinked namespaces from previous major versions.

Feature - ActiveSupport::Notifications are enabled by default and removes Aws::Rails.instrument_sdk_operations.

Feature - Moved railtie initializations to their appropriate spots.

Issue - Do not execute ActiveJob from EB cron without the root path.

Release v4.2.0 - 2024-11-20

Tag release v4.2.0

References: #147, #148, #149, #152, #153, #156, #157, #159, #160, #161, #162, #163, #164

Feature - DynamoDB Session Storage features now live in the aws-actiondispatch-dynamodb gem. This gem depends on aws-sessionstore-dynamodb ~> 3 which depends on rack ~> 3.

Feature - Add session store config generation with rails generate dynamo_db:session_store_config. Config generation is no longer tied to the DynamoDB SessionStore ActiveRecord migration generator.

Issue - ActionDispatch::Session::DynamoDbStore now inherits ActionDispatch::Session::AbstractStore by wrapping Aws::SessionStore::DynamoDB::RackMiddleware.

Issue - DynamoDbStore is now configured with the :dynamo_db_store configuration instead of :dynamodb_store.

Feature - Session Store configuration passed into :dynamo_db_store in an initializer will now be considered when using the ActiveRecord migrations or rake tasks that create, delete, or clean session tables.

Feature - AWS_DYNAMO_DB_SESSION_CONFIG_FILE is now searched and with precedence over the default Rails configuration YAML file locations.

Feature - Prepare modularization of aws-record.

Issue - Do not skip autoload modules for Aws::Rails.instrument_sdk_operations.

Feature - ActionMailer SES and SESV2 mailers now live in the aws-actionmailer-ses gem.

Feature - New namespace and class names for SES and SESV2 mailers. Aws::Rails::SesMailer has been moved to Aws::ActionMailer::SES::Mailer and Aws::Rails::Sesv2Mailer has been moved to Aws::ActionMailer::SESV2::Mailer. The classes have been symlinked for backwards compatibility in this major version.

... (truncated)

Changelog

Sourced from aws-sdk-rails's changelog.

5.1.0 (2024-12-05)

Feature - Support async job processing in Elastic Beanstalk middleware. (#167)

5.0.0 (2024-11-21)

Feature - [Major Version] Remove dependencies on modular feature gems: aws-actiondispatch-dynamodb, aws-actionmailer-ses, aws-actionmailbox-ses, aws-activejob-sqs, and aws-record-rails.

Issue - Remove Aws::Rails.add_action_mailer_delivery_method in favor of ActionMailer::Base.add_delivery_method or the Railtie and configuration in aws...
Description has been truncated

…21 updates Bumps the production-dependencies-major group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [rack](https://github.com/rack/rack) | `2.2.23` | `3.2.6` | | [sprockets](https://github.com/rails/sprockets) | `3.7.5` | `4.2.2` | | [rack-attack](https://github.com/rack/rack-attack) | `6.5.0` | `6.8.0` | | [stripe](https://github.com/stripe/stripe-ruby) | `5.55.0` | `13.5.1` | | [puma](https://github.com/puma/puma) | `7.2.1` | `8.0.2` | | [aws-sdk-rails](https://github.com/aws/aws-sdk-rails) | `2.1.0` | `5.1.0` | | [dalli](https://github.com/petergoldstein/dalli) | `3.2.3` | `5.0.5` | | [colorize](https://github.com/fazibear/colorize) | `0.8.1` | `1.1.0` | | [rails-i18n](https://github.com/svenfuchs/rails-i18n) | `7.0.10` | `8.1.0` | | [rails](https://github.com/rails/rails) | `7.1.5.2` | `8.1.3` | | [devise-two-factor](https://github.com/tinfoil/devise-two-factor) | `6.1.0` | `6.4.0` | | [i18n-js](https://github.com/fnando/i18n-js) | `3.9.2` | `4.2.4` | | [countries](https://github.com/countries/countries) | `2.1.2` | `8.1.0` | | [config](https://github.com/rubyconfig/config) | `2.2.3` | `5.6.1` | | [redis](https://github.com/redis/redis-rb) | `4.2.5` | `5.4.1` | | [hashie](https://github.com/hashie/hashie) | `4.0.0` | `5.1.0` | | [connection_pool](https://github.com/mperham/connection_pool) | `2.5.3` | `3.0.2` | | [barnes](https://github.com/heroku/barnes) | `0.0.8` | `1.0.1` | | [rack-cors](https://github.com/cyu/rack-cors) | `2.0.2` | `3.0.0` | Updates `rack` from 2.2.23 to 3.2.6 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.23...v3.2.6) Updates `sprockets` from 3.7.5 to 4.2.2 - [Release notes](https://github.com/rails/sprockets/releases) - [Changelog](https://github.com/rails/sprockets/blob/main/CHANGELOG.md) - [Commits](rails/sprockets@v3.7.5...v4.2.2) Updates `rack-attack` from 6.5.0 to 6.8.0 - [Release notes](https://github.com/rack/rack-attack/releases) - [Changelog](https://github.com/rack/rack-attack/blob/main/CHANGELOG.md) - [Commits](rack/rack-attack@v6.5.0...v6.8.0) Updates `stripe` from 5.55.0 to 13.5.1 - [Release notes](https://github.com/stripe/stripe-ruby/releases) - [Changelog](https://github.com/stripe/stripe-ruby/blob/master/CHANGELOG.md) - [Commits](stripe/stripe-ruby@v5.55.0...v13.5.1) Updates `puma` from 7.2.1 to 8.0.2 - [Release notes](https://github.com/puma/puma/releases) - [Changelog](https://github.com/puma/puma/blob/main/History.md) - [Commits](puma/puma@v7.2.1...v8.0.2) Updates `aws-sdk-rails` from 2.1.0 to 5.1.0 - [Release notes](https://github.com/aws/aws-sdk-rails/releases) - [Changelog](https://github.com/aws/aws-sdk-rails/blob/main/CHANGELOG.md) - [Commits](aws/aws-sdk-rails@v2.1.0...v5.1.0) Updates `rack-attack` from 6.5.0 to 6.8.0 - [Release notes](https://github.com/rack/rack-attack/releases) - [Changelog](https://github.com/rack/rack-attack/blob/main/CHANGELOG.md) - [Commits](rack/rack-attack@v6.5.0...v6.8.0) Updates `dalli` from 3.2.3 to 5.0.5 - [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md) - [Commits](petergoldstein/dalli@v3.2.3...v5.0.5) Updates `colorize` from 0.8.1 to 1.1.0 - [Changelog](https://github.com/fazibear/colorize/blob/master/CHANGELOG.md) - [Commits](https://github.com/fazibear/colorize/commits) Updates `rails-i18n` from 7.0.10 to 8.1.0 - [Changelog](https://github.com/svenfuchs/rails-i18n/blob/master/CHANGELOG.md) - [Commits](svenfuchs/rails-i18n@v7.0.10...v8.1.0) Updates `rails` from 7.1.5.2 to 8.1.3 - [Release notes](https://github.com/rails/rails/releases) - [Commits](rails/rails@v7.1.5.2...v8.1.3) Updates `devise-two-factor` from 6.1.0 to 6.4.0 - [Release notes](https://github.com/tinfoil/devise-two-factor/releases) - [Changelog](https://github.com/devise-two-factor/devise-two-factor/blob/main/CHANGELOG.md) - [Commits](devise-two-factor/devise-two-factor@v6.1.0...v6.4.0) Updates `i18n-js` from 3.9.2 to 4.2.4 - [Changelog](https://github.com/fnando/i18n-js/blob/main/CHANGELOG.md) - [Commits](fnando/i18n-js@v3.9.2...v4.2.4) Updates `countries` from 2.1.2 to 8.1.0 - [Release notes](https://github.com/countries/countries/releases) - [Changelog](https://github.com/countries/countries/blob/master/CHANGELOG.md) - [Upgrade guide](https://github.com/countries/countries/blob/master/UPGRADE.md) - [Commits](countries/countries@v2.1.2...v8.1.0) Updates `config` from 2.2.3 to 5.6.1 - [Release notes](https://github.com/rubyconfig/config/releases) - [Changelog](https://github.com/rubyconfig/config/blob/master/CHANGELOG.md) - [Commits](rubyconfig/config@2.2.3...5.6.1) Updates `redis` from 4.2.5 to 5.4.1 - [Changelog](https://github.com/redis/redis-rb/blob/master/CHANGELOG.md) - [Commits](redis/redis-rb@v4.2.5...v5.4.1) Updates `hashie` from 4.0.0 to 5.1.0 - [Release notes](https://github.com/hashie/hashie/releases) - [Changelog](https://github.com/hashie/hashie/blob/master/CHANGELOG.md) - [Commits](hashie/hashie@v4.0.0...v5.1.0) Updates `connection_pool` from 2.5.3 to 3.0.2 - [Changelog](https://github.com/mperham/connection_pool/blob/main/Changes.md) - [Commits](mperham/connection_pool@v2.5.3...v3.0.2) Updates `barnes` from 0.0.8 to 1.0.1 - [Changelog](https://github.com/heroku/barnes/blob/main/CHANGELOG.md) - [Commits](heroku/barnes@v0.0.8...v1.0.1) Updates `rack-cors` from 2.0.2 to 3.0.0 - [Changelog](https://github.com/cyu/rack-cors/blob/master/CHANGELOG.md) - [Commits](cyu/rack-cors@v2.0.2...v3.0.0) Updates `activerecord` from 7.1.5.2 to 8.1.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v8.1.3/activerecord/CHANGELOG.md) - [Commits](rails/rails@v7.1.5.2...v8.1.3) Updates `actionpack` from 7.1.5.2 to 8.1.3 - [Release notes](https://github.com/rails/rails/releases) - [Changelog](https://github.com/rails/rails/blob/v8.1.3/actionpack/CHANGELOG.md) - [Commits](rails/rails@v7.1.5.2...v8.1.3) --- updated-dependencies: - dependency-name: actionpack dependency-version: 8.1.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: activerecord dependency-version: 8.1.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: aws-sdk-rails dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: barnes dependency-version: 1.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: colorize dependency-version: 1.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: config dependency-version: 5.6.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: connection_pool dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: countries dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: dalli dependency-version: 5.0.5 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: devise-two-factor dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies-major - dependency-name: hashie dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: i18n-js dependency-version: 4.2.4 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: puma dependency-version: 8.0.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: rack dependency-version: 3.2.6 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: rack-attack dependency-version: 6.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies-major - dependency-name: rack-attack dependency-version: 6.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies-major - dependency-name: rack-cors dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: rails dependency-version: 8.1.3 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: rails-i18n dependency-version: 8.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: redis dependency-version: 5.4.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: sprockets dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major - dependency-name: stripe dependency-version: 13.5.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Jul 20, 2026

dependabot Bot requested a review from wwahammy as a code owner July 20, 2026 14:27

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Jul 20, 2026

dependabot Bot force-pushed the dependabot/bundler/production-dependencies-major-6dde0885dd branch from 5f4ef40 to fa3d8ba Compare July 20, 2026 17:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the production-dependencies-major group across 1 directory with 21 updates#1387

Bump the production-dependencies-major group across 1 directory with 21 updates#1387
dependabot[bot] wants to merge 1 commit into
supporter_level_goalfrom
dependabot/bundler/production-dependencies-major-6dde0885dd

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.2.6

v3.2.4

v3.0.9.1

What's Changed

v3.0.9

What's Changed

v3.0.8

What's Changed

New Contributors

v3.0.7

What's Changed

v3.0.6.1

v3.0.4.1

v3.0.4

v3.0.3

What's Changed

[3.2.6] - 2026-04-01

Security

[3.2.5] - 2026-02-16

Security

Fixed

[3.2.4] - 2025-11-03

Fixed

[3.2.3] - 2025-10-10

Security

[3.2.2] - 2025-10-07

Security

v4.2.2

What's Changed

4.2.1

What's Changed

New Contributors

4.2.0

What's Changed

New Contributors

v4.1.1

v4.1.0

4.2.2

4.2.1

4.2.0

4.1.1

4.1.0

4.0.3

4.0.2

4.0.1

v6.8.0

What's Changed

Changed

Fixed

Deprecated

Removed

New Contributors

v6.7.0

What's Changed

New Contributors

[6.8.0] - 2025-10-14

Changed

Fixed

Deprecated

Removed

[6.7.0] - 2023-07-26

[6.6.1] - 2022-04-14

Fixed

[6.6.0] - 2022-01-29

Added

Deprecated

v13.5.1

Changelog

19.3.1 - 2026-07-15

19.3.0 - 2026-06-24

19.2.1 - 2026-06-12

19.2.0 - 2026-05-27

v8.0.2

Security advisories

v8.0.1

v8.0.0 - Into the Arena

dependabot Bot commented on behalf of github Jul 20, 2026 •

edited

Loading