[dependabot]

Bumps the ruby-dependencies group with 6 updates in the / directory:

Package	From	To
dalli	5.1.1	5.2.2
kaminari	1.2.2	1.3.0
sqlite3	2.9.6	2.10.1
brakeman	8.0.6	8.1.0
selenium-webdriver	4.50.0	4.51.0
pg	1.6.3	1.7.0

Updates dalli from 5.1.1 to 5.2.2

Release notes

Sourced from dalli's releases.

v5.2.2

Security release. Released together with 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13: with a namespace, a retried request could read or write a different key (GHSA-m252-9cgf-vx2w); completes the fixes for GHSA-wr87-m4jw-29x5 and GHSA-w39f-xq2m-4g8x from 5.2.1, and fixes regressions from that release. Upgrading is strongly recommended.

Security:

• Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)
  • With a namespace, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key
  • Affects single-key operations since 5.0.3, single-server get_multi since 5.1.0, and get_with_metadata and fetch_with_lock since 4.1.0; fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected
• Complete the fix for per-request raw: true on reads (GHSA-wr87-m4jw-29x5)
  • A read made with raw: true doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Raw reads now ignore flags in the reply
  • Affects 5.2.1 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13

Bug fixes:

• get_with_metadata and fetch_with_lock retried the final error raised when a server is marked down, so with down_retry_delay: 0 they retried an unresponsive server forever. They now retry only retryable errors, like other operations
• Fix a regression in 5.2.1: a get_multi that didn't finish within socket_timeout counted toward socket_max_failures, so two slow get_multi calls in a row marked a healthy server down. It now just closes the connection
• Fix a regression in 5.2.1: over TLS, every request buffered in a quiet block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again
• Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no s flag could leave the connection out of step or raise a non-Dalli error
• With decompressed_max_bytes in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit
• With a digest_class whose digests aren't short hex strings, shortening a long key could loop forever. It now raises ArgumentError

Notes:

• Document how long keys are shortened, and that a short key written in the same form names the same item, in the README's security note (#1200)

Development:

• Run the Tests, RuboCop and Profiles workflows on pushes to main and the *-stable branches only, so a pull request's branch isn't tested twice (once for the push and once for the pull request) (#1198)

v5.2.1

Security release. Fixes five vulnerabilities, released together in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12: a pipelined get_multi returning another key's value (GHSA-p6pm-ch9v-44vx); unbounded retries and routing tokens that add meta flags (GHSA-4qp6-2jcr-596v); unbounded decompression and reply sizes (GHSA-3553-vcg5-72jw); per-request raw: true ignored on reads (GHSA-wr87-m4jw-29x5); and a forked child resending the parent's requests or ending its TLS session (GHSA-w39f-xq2m-4g8x). Upgrading is strongly recommended.

Security:

• Fix pipelined get_multi returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)
  • The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (CLIENT_ERROR, SERVER_ERROR, or EN from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a get could return another key's value
  • Keys are now measured in bytes as sent, after base64 encoding when the key needs it. A key under 250 characters but over 250 bytes on the wire (for example, one with many non-ASCII characters) was the easiest way to cause that error reply. Such keys are now truncated like other long keys; keys that worked before are unchanged
  • Affects the meta protocol since 3.2.0 (the default since 5.0.0); fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Reject routing tokens that add meta flags, and stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)
  • p_token and l_token now reject whitespace and control characters, not just CR, LF and NUL. A space let a token add meta flags to the request it was sent with: changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or reading a different key
  • Affects 5.1.0 and later; fixed in 5.2.1 and 5.1.3
  • A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after socket_max_failures attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after down_retry_delay
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)
  • Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's compress or serializer settings. The new decompressed_max_bytes option (default 128 MiB; nil disables it) makes a read that would pass it raise Dalli::UnmarshalError. Custom compressors whose decompress takes only the data keep working, without the limit
  • The value size in a reply was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise Dalli::DalliError before reading
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Honor per-request raw: true on reads, and add Dalli::JSONSerializer (GHSA-wr87-m4jw-29x5)
  • get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata ignored a per-request raw: true and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have Marshal.load run on data someone else wrote to memcached. They now return the stored bytes
  • The raw part affects get_with_metadata since 4.2.0, and the other methods since they gained per-request options in 5.1.0

... (truncated)

Changelog

Sourced from dalli's changelog.

5.2.2

Security:

• Keep the caller's key when retrying a request (GHSA-m252-9cgf-vx2w)
  • With a namespace, a request retried after a transient network error (a timeout, or a connection closed by memcached or a proxy) applied the namespace a second time, so a retried read could return a different key's value and a retried write could overwrite a different key
  • Affects single-key operations since 5.0.3, single-server get_multi since 5.1.0, and get_with_metadata and fetch_with_lock since 4.1.0; fixed in 5.2.2, 5.1.4, 5.0.10 and 4.3.7. Clients without a namespace aren't affected
• Complete the fix for per-request raw: true on reads (GHSA-wr87-m4jw-29x5)
  • A read made with raw: true doesn't ask for flags, but a reply carrying them anyway (from a proxy or a hostile server) still had its value deserialized. Raw reads now ignore flags in the reply
  • Affects 5.2.1 and earlier; fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7 and 3.2.13

Bug fixes:

• get_with_metadata and fetch_with_lock retried the final error raised when a server is marked down, so with down_retry_delay: 0 they retried an unresponsive server forever. They now retry only retryable errors, like other operations
• Fix a regression in 5.2.1: a get_multi that didn't finish within socket_timeout counted toward socket_max_failures, so two slow get_multi calls in a row marked a healthy server down. It now just closes the connection
• Fix a regression in 5.2.1: over TLS, every request buffered in a quiet block was sent as its own TLS record and system call (2.5 times slower for a block of 2000 deletes). Each flush is one write again
• Handle malformed replies from a broken or hostile server or proxy: a negative value size, a hit with no key, or a hit with no s flag could leave the connection out of step or raise a non-Dalli error
• With decompressed_max_bytes in effect, data after the end of a compressed value's stream was returned as part of the value. It's now ignored, as without the limit
• With a digest_class whose digests aren't short hex strings, shortening a long key could loop forever. It now raises ArgumentError

Notes:

• Document how long keys are shortened, and that a short key written in the same form names the same item, in the README's security note (#1200)

Development:

• Run the Tests, RuboCop and Profiles workflows on pushes to main and the *-stable branches only, so a pull request's branch isn't tested twice (once for the push and once for the pull request) (#1198)

5.2.1

Security:

• Fix pipelined get_multi returning one key's value for another after an error reply (GHSA-p6pm-ch9v-44vx)
  • The pipelined reply parser took any reply without a body for the end of the batch. An error reply for one key (CLIENT_ERROR, SERVER_ERROR, or EN from a proxy) ended it early, and the replies still on the connection were read as the replies to later commands, so a get could return another key's value
  • Keys are now measured in bytes as sent, after base64 encoding when the key needs it. A key under 250 characters but over 250 bytes on the wire (for example, one with many non-ASCII characters) was the easiest way to cause that error reply. Such keys are now truncated like other long keys; keys that worked before are unchanged
  • Affects the meta protocol since 3.2.0 (the default since 5.0.0); fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Reject routing tokens that add meta flags, and stop retrying an unresponsive server forever (GHSA-4qp6-2jcr-596v)
  • p_token and l_token now reject whitespace and control characters, not just CR, LF and NUL. A space let a token add meta flags to the request it was sent with: changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or reading a different key
  • Affects 5.1.0 and later; fixed in 5.2.1 and 5.1.3
  • A server that accepted connections but never answered (or dropped the connection on a request) was retried forever, hanging the caller, because each successful reconnect reset the failure count. Requests now fail after socket_max_failures attempts and the server is marked down, as when it can't be reached at all; it gets a full set of attempts again after down_retry_delay
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Limit decompressed and reply value sizes (GHSA-3553-vcg5-72jw)
  • Values flagged as compressed were inflated without limit, so a small stored value could expand to gigabytes on read, whatever the client's compress or serializer settings. The new decompressed_max_bytes option (default 128 MiB; nil disables it) makes a read that would pass it raise Dalli::UnmarshalError. Custom compressors whose decompress takes only the data keep working, without the limit
  • The value size in a reply was used to read or buffer that many bytes, so a malicious server could make the client allocate gigabytes. Sizes over 1 GiB, memcached's largest item, now raise Dalli::DalliError before reading
  • Affects all versions; fixed in 5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12
• Honor per-request raw: true on reads, and add Dalli::JSONSerializer (GHSA-wr87-m4jw-29x5)
  • get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata ignored a per-request raw: true and deserialized the value according to its stored flags, so a caller who asked for raw bytes could still have Marshal.load run on data someone else wrote to memcached. They now return the stored bytes
  • The raw part affects get_with_metadata since 4.2.0, and the other methods since they gained per-request options in 5.1.0

... (truncated)

Commits

• a27cfd3 Merge pull request #1205 from petergoldstein/release/5.2.2
• 1455750 Prepare 5.2.2 release
• 2be6cc3 Put the test server's extra flags after the key, and fix a misplaced comment
• dca2533 Raise instead of looping when a digest is too long for a truncated key
• 2c9b12d Ignore data after the end of the stream in the capped inflate
• 1cf990d Handle malformed hits in the reply parsers
• 7175f23 Send each write-buffer flush as one write
• 8e41599 Don't count a get_multi that runs out of time as a socket failure
• 15a71c2 Ignore flags in replies to raw reads (GHSA-wr87-m4jw-29x5)
• 3fad213 Retry only retryable errors in get_with_metadata and fetch_with_lock
• Additional commits viewable in compare view

Updates kaminari from 1.2.2 to 1.3.0

Release notes

Sourced from kaminari's releases.

v1.3.0

1.3.0

Security Fixes:

• page ignores a Hash or an Array page number (e.g. ?page[]=1) instead of raising #1087 [@​xiaohui-zhangxh]
• page_entries_info escapes the entry_name, which could contain user input, while keeping an html_safe entry_name as is: d599c37

Incompatible Changes:

• Dropped Ruby 2.0 support: 2f1f84b
• The default English page_entries_info message now separates the range with an en dash (e.g. "1–25") instead of  -  #1105 [@​jdufresne]
• page_entries_info displays "No entries found" on out of range pages, instead of an inverted range like "Displaying users 81–80 of 50 in total": b712562

Enhancements:

• Rails 7.1, 7.2, 8.0, and 8.1 support
• Ruby 3.1, 3.2, 3.3, 3.4, and 4.0 support
• Added paginated? to models, relations, and paginatable arrays #1118 [@​jarenas9539]
• Added the data: option to paginate for the links' data attributes #1095 [@​theforestvn88]
• Registered Kaminari's deprecator to Rails.application.deprecators #1103 [@​etiennebarrie]
• require 'kaminari' also loads Kaminari::VERSION #1079 [@​d-otis]
• The views generator warns when it falls back to erb for an unsupported template engine: 4c2991e
• Improved performance of total_count for grouped relations by counting the groups in the database with a subquery #1157 (based on #1022 and #1023 [@​bendilley])
• Improved performance of total_count by removing irrelevant eager_load and preload that ran unwanted joins in the count query #1043 [@​Viktor-Ivliev]
• Improved performance of paginate by calling url_for only a few times per paginator: 7b5f079
• Improved performance of paginate by looking up each partial template only once per paginator: c5cc1a1
• Improved performance of paginate by reducing object allocations: 1cc6f98, ff07a28, b951069, 2e80453, 794724e, and 7f08863
• Improved performance of page and per on Active Record by copying the Relation only once: 0cb494d, c35e5a1, and ae23bc6
• Improved performance of page_entries_info #1109 [@​jdufresne]

Bug Fixes:

• Fixed ActionController::UrlGenerationError on Rails 8+ when the request params include route options such as subdomain or host #1147 [@​hpanwar09]
• Fixed view helpers called with keyword arguments inside the paginator templates on Ruby 3 #1114 [@​diasjorge]
• Fixed an error with a Symbol param_name other than :page #1121 [@​magnum]
• Fixed NameError when including Kaminari::Helpers::UrlHelper outside of the views #1100 [@​hikonori07]
• Fixed page_entries_info for a paginated empty array with total_count #1088 [@​monfresh]
• Fixed total_count on the last page of a loaded Relation with padding: c7a46f1
• Fixed ZeroDivisionError from per after per(0) #1138 [@​dpep]
• Fixed per and max_paginates_per dropping the padding: c149803
• Fixed per, max_paginates_per, and padding changing the receiver's values instead of the returned scope's: a9cbb2c
• Fixed max_paginates_per returning no records after an ignored per value such as per('abc'): 0f2816a
• Fixed per treating a value like "abc\n10" as per(0) instead of ignoring it: 8298351
• Fixed Kaminari::ZeroPerPageOperation from total_count on a loaded per(0) Relation #1155 [@​andreyruby]
• Fixed total_count returning 0 with max_pages after per(0): 06e90d9
• Fixed TypeError from total_count after unscope(:limit): 4fd263b
• Fixed the Haml and Slim paginators rendering the next and last links on out of range pages, as the erb paginator doesn't: a44950d
• Fixed the views generator generating nothing for an unsupported template engine, such as one set via config.generators.template_engine #1108 [@​Xavier-IV]
• Fixed the views generator crashing on network errors other than SocketError: 6d91911

Changelog

Sourced from kaminari's changelog.

1.3.0

Security Fixes:

• page ignores a Hash or an Array page number (e.g. ?page[]=1) instead of raising #1087 [@​xiaohui-zhangxh]
• page_entries_info escapes the entry_name, which could contain user input, while keeping an html_safe entry_name as is: d599c37

Incompatible Changes:

• Dropped Ruby 2.0 support: 2f1f84b
• The default English page_entries_info message now separates the range with an en dash (e.g. "1–25") instead of  -  #1105 [@​jdufresne]
• page_entries_info displays "No entries found" on out of range pages, instead of an inverted range like "Displaying users 81–80 of 50 in total": b712562

Enhancements:

• Rails 7.1, 7.2, 8.0, and 8.1 support
• Ruby 3.1, 3.2, 3.3, 3.4, and 4.0 support
• Added paginated? to models, relations, and paginatable arrays #1118 [@​jarenas9539]
• Added the data: option to paginate for the links' data attributes #1095 [@​theforestvn88]
• Registered Kaminari's deprecator to Rails.application.deprecators #1103 [@​etiennebarrie]
• require 'kaminari' also loads Kaminari::VERSION #1079 [@​d-otis]
• The views generator warns when it falls back to erb for an unsupported template engine: 4c2991e
• Improved performance of total_count for grouped relations by counting the groups in the database with a subquery #1157 (based on #1022 and #1023 [@​bendilley])
• Improved performance of total_count by removing irrelevant eager_load and preload that ran unwanted joins in the count query #1043 [@​Viktor-Ivliev]
• Improved performance of paginate by calling url_for only a few times per paginator: 7b5f079
• Improved performance of paginate by looking up each partial template only once per paginator: c5cc1a1
• Improved performance of paginate by reducing object allocations: 1cc6f98, ff07a28, b951069, 2e80453, 794724e, and 7f08863
• Improved performance of page and per on Active Record by copying the Relation only once: 0cb494d, c35e5a1, and ae23bc6
• Improved performance of page_entries_info #1109 [@​jdufresne]

Bug Fixes:

• Fixed ActionController::UrlGenerationError on Rails 8+ when the request params include route options such as subdomain or host #1147 [@​hpanwar09]
• Fixed view helpers called with keyword arguments inside the paginator templates on Ruby 3 #1114 [@​diasjorge]
• Fixed an error with a Symbol param_name other than :page #1121 [@​magnum]
• Fixed NameError when including Kaminari::Helpers::UrlHelper outside of the views #1100 [@​hikonori07]
• Fixed page_entries_info for a paginated empty array with total_count #1088 [@​monfresh]
• Fixed total_count on the last page of a loaded Relation with padding: c7a46f1
• Fixed ZeroDivisionError from per after per(0) #1138 [@​dpep]
• Fixed per and max_paginates_per dropping the padding: c149803
• Fixed per, max_paginates_per, and padding changing the receiver's values instead of the returned scope's: a9cbb2c
• Fixed max_paginates_per returning no records after an ignored per value such as per('abc'): 0f2816a
• Fixed per treating a value like "abc\n10" as per(0) instead of ignoring it: 8298351
• Fixed Kaminari::ZeroPerPageOperation from total_count on a loaded per(0) Relation #1155 [@​andreyruby]
• Fixed total_count returning 0 with max_pages after per(0): 06e90d9
• Fixed TypeError from total_count after unscope(:limit): 4fd263b
• Fixed the Haml and Slim paginators rendering the next and last links on out of range pages, as the erb paginator doesn't: a44950d
• Fixed the views generator generating nothing for an unsupported template engine, such as one set via config.generators.template_engine #1108 [@​Xavier-IV]
• Fixed the views generator crashing on network errors other than SocketError: 6d91911

Commits

• d957f0c Version 1.3.0
• b0794cd Version 1.3.0
• c5cc1a1 Look up each partial template only once in a paginator
• ae23bc6 Copy the Relation only once in per
• c35e5a1 Copy the Relation only once in Model.page
• 7b5f079 Generate the page URLs in a paginator with url_for only a few times
• 0cb494d Extend paginated relations with a named module rather than a block
• 8298351 Check that the per value starts with a digit at the beginning of the string
• 4fd263b Don't raise in total_count after unscoping limit
• 6d91911 Handle more network errors in the views generator
• Additional commits viewable in compare view

Updates sqlite3 from 2.9.6 to 2.10.1

Release notes

Sourced from sqlite3's releases.

2.10.1 / 2026-10-19

Dependencies

• Vendored sqlite is updated to v3.54.1 (from v3.54.0). This release contains a fix for a possible heap buffer overflow on 32-bit builds, including the precompiled x86-linux-gnu and x86-linux-musl gems. #756 @​flavorjones

Improved

• Database#define_aggregator no longer creates an anonymous class for each aggregate function it defines. Each invocation of the function still runs on a clone of the template object. #752 @​jhawthorn

48390cc2b809acd1280f5c9daaf3c2013833adb8a5ece9b0634f708651080ccd  gems/sqlite3-2.10.1-aarch64-linux-gnu.gem
db1bcddf98e4eeea80ca896f56aa3f9468364fa1ee8e042ddc6b628b5092fabb  gems/sqlite3-2.10.1-aarch64-linux-musl.gem
34a67a3fe84f705a0fad6f7aa4541579300644b9acdf414797e59929a6e3528b  gems/sqlite3-2.10.1-arm-linux-gnu.gem
e317adb8979b57dafd999b54410b4050296aa5d00caa664e3f75d876e2ae90e8  gems/sqlite3-2.10.1-arm-linux-musl.gem
45f74dad0a8ee57ae5fadfac39bf160d1f09fb0484a442223310d869cd957d92  gems/sqlite3-2.10.1-arm64-darwin.gem
bf5c7d7e8ce0253456777432c826a6f8f2c06e891686f1157f44548a53416a87  gems/sqlite3-2.10.1-x64-mingw-ucrt.gem
7b3f9eff7c5c26551800649312796203ded8a505bcdaf30cd915dd9ae5e9575c  gems/sqlite3-2.10.1-x86-linux-gnu.gem
8f193eb1b4a66156baaaedafac0de091533cf840f4b78cf3fa2019cde0388f10  gems/sqlite3-2.10.1-x86-linux-musl.gem
00d1cd2e8ecff5ad9fffa0c97de59d4f85c5fc54eada2587d53ca0bd933b7a5d  gems/sqlite3-2.10.1-x86_64-darwin.gem
661ecede31e23a412059cd8c684ed84e332f64f167e4a90902cf99e8ea2c8718  gems/sqlite3-2.10.1-x86_64-linux-gnu.gem
67c7c5443a930157b4e148f0f4cb9ab998ee7ecfa8ce56879a6b56d1d742b2be  gems/sqlite3-2.10.1-x86_64-linux-musl.gem
7ae52c91f5b766882cf44d2dbd26d2dbbb841606f0ec78df3be019bd07b13ff4  gems/sqlite3-2.10.1.gem

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.
  • SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

• ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @​kch
• Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @​Maaarcocr

Fixed

... (truncated)

Changelog

Sourced from sqlite3's changelog.

2.10.1 / 2026-10-19

Dependencies

• Vendored sqlite is updated to v3.54.1 (from v3.54.0). This release contains a fix for a possible heap buffer overflow on 32-bit builds, including the precompiled x86-linux-gnu and x86-linux-musl gems. #756 @​flavorjones

Improved

• Database#define_aggregator no longer creates an anonymous class for each aggregate function it defines. Each invocation of the function still runs on a clone of the template object. #752 @​jhawthorn

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.
  • SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

• ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @​kch
• Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @​Maaarcocr

Fixed

• Fix Database#statement_timeout= interrupting statements almost immediately instead of after the timeout elapsed, including re-executed prepared statements and calls to Database#execute_batch2. #737 @​palkan @​flavorjones

Improved

• On CRuby, Statement#types allocates fewer strings. Each declared type is downcased and interned in C, instead of allocating two strings per column. #743 @​jhawthorn

Changed

• ResultSet#each and #each_hash return the result set when called with a block. As a consequence, Database#execute and #execute2 called with a block return the closed ResultSet instead of nil. #656 @​kch
• Statement#columns and Statement#types return frozen arrays, and the strings in Statement#types are frozen. Code that mutates them now raises FrozenError. #743 @​jhawthorn
• Statement#column_decltype and Statement#types return UTF-8 strings. Previously they returned ASCII-8BIT strings. #743 @​jhawthorn

Commits

• f465056 version bump to v2.10.1
• 3fdb2d0 build(deps): bump ruby/setup-ruby (#755)
• eac117b build(deps-dev): update rubocop-minitest requirement (#754)
• 1102a6f build(deps-dev): update rake-compiler requirement from 1.3.1 to 1.3.2 (#753)
• 90d52d5 dep: update vendored sqlite to 3.54.1 (#756)
• 03af202 Merge pull request #752 from jhawthorn/aggregator-factories
• 5e65275 Replace define_aggregator's generated proxy class with a factory object
• 07186c3 version bump to v2.10.0
• 7ad6fc0 feat: Add Database#serialize and Database#deserialize methods (#685)
• c35ae35 Fix statement_timeout interrupting most queries (#737)
• Additional commits viewable in compare view

Updates brakeman from 8.0.6 to 8.1.0

Release notes

Sourced from brakeman's releases.

8.1.0

• Update SonarQube report to use generic issue format (@​fffx)
• Include regex code in validation warnings (@​eliotsykes)
• Check validation regexes in non-activerecord models (@​eliotsykes)
• Skip top-level vendor directory before recursive globbing (@​ronocod)
• Support Rails 7.1+ positional enum syntax in SQL injection check (@​cubasepp / @​Eljees)
• Recognize Haml::AttributeBuilder.build_class as an escaped output (@​Eljees)
• Fix frozen string error (@​shaicoleman)
• Better help and error message for --ensure-latest (#2036)

Changelog

Sourced from brakeman's changelog.

8.1.0 - 2026-09-30

• Better help and error message for --ensure-latest
• Fix frozen string error (Shai Coleman)
• Update Sonar report format (fangxing)
• Fix frozen src string error
• Recognize Haml::AttributeBuilder.build_class as an escaped output (Yuriy Tumanov)
• Include regex code in validation warnings (Eliot Sykes)
• Check validation regexes in non-activerecord models (Eliot Sykes)
• Skip top-level vendor directory before recursive globbing (Conor O'Donnell)
• Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)

Commits

• c778164 Bump to 8.1.0
• 4621407 Update CHANGES
• 26ba01f Support Rails 7.1+ positional enum syntax in SQL injection check (#2051)
• 8f04922 Skip top-level vendor directory before recursive globbing (#2039)
• f921f01 Check validation regexes in non-activerecord models (#2053)
• d62e919 Fix CheckValidationRegex overly broad ignores (#2050)
• 73bbc99 Recognize Haml::AttributeBuilder.build_class as an escaped output (#2052)
• 71f8f69 Fix typo in test_format_validation_with_multiline (#2049)
• 0fd4dbc Add bundle install step to contributing doc (#2047)
• 5de415c Fix ERB frozen src error (#2048)
• Additional commits viewable in compare view

Updates selenium-webdriver from 4.50.0 to 4.51.0

Release notes

Sourced from selenium-webdriver's releases.

Selenium 4.51.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

• [py] Validate WebSocket response interval correctly by @​cuishuang in SeleniumHQ/selenium#17984
• [py][bidi] Send setClientWindowState rect members as sibling params by @​AutomatedTester in SeleniumHQ/selenium#18100
• [rust] Degrade to empty metadata when the cache cannot be read by @​AutomatedTester in SeleniumHQ/selenium#18101
• [dotnet] [test] Separate project for NUnit infrastructure by @​nvborisenko in SeleniumHQ/selenium#18104
• [java] Do not leak the HttpClient on startup failure by @​joerg1985 in SeleniumHQ/selenium#18047
• [java] Add RemoteWebDriver.getClientFactory() and move HttpCommandExecutor field removal to 4.53 by @​diemol in SeleniumHQ/selenium#18111
• [dotnet] [test] Parallelize internal testing by @​nvborisenko in SeleniumHQ/selenium#18110
• [build] pin Firefox BiDi vendor CDDL from the Firefox repository by @​titusfortner in SeleniumHQ/selenium#18094
• [build] remove obsolete third_party dependencies and dead build references by @​titusfortner in SeleniumHQ/selenium#18072
• [build] generate release docs at approval and commit them after the packages publish by @​titusfortner in SeleniumHQ/selenium#18113
• [dotnet] [test] Upgrade NUnit library to v5 by @​nvborisenko in SeleniumHQ/selenium#18114
• [build] recover from incomplete Java release by dropping staged repositories when found by @​titusfortner in SeleniumHQ/selenium#18112
• [dotnet] [build] Escape macOS Edge browser path by @​nvborisenko in SeleniumHQ/selenium#18126
• [js][bidi] Add vendor specific class generation by @​pujagani in SeleniumHQ/selenium#18125
• [java] assert setFiles uploads reach the server in SetFilesCommandTest by @​yashp676 in SeleniumHQ/selenium#18058
• [java][bidi] Decode nested RemoteValues from the parsed tree instead of re-serializing each subtree by @​yashp676 in SeleniumHQ/selenium#18095
• [rb] type a field-less synthetic map record as a validated map by @​aguspe in SeleniumHQ/selenium#18121
• [java] remove guava from client bindings #12737 by @​joerg1985 in SeleniumHQ/selenium#13739
• [build] clean up IntelliJ project files and align .editorconfig with formatters by @​titusfortner in SeleniumHQ/selenium#18119
• [javascript] Create @​seleniumhq/atoms npm package from TypeScript atoms by @​AutomatedTester in SeleniumHQ/selenium#17459
• [java][bidi] Add BiDi code generator by @​pujagani in SeleniumHQ/selenium#17777
• [java][bidi] Type field-less synthetic map records as Map<String, V> by @​yashp676 in SeleniumHQ/selenium#18122
• [javascript] Publish atoms under the @​selenium npm scope by @​AutomatedTester in SeleniumHQ/selenium#18132
• [build] sign Java artifacts in-process with in-memory PGP keys instead of gpg-agent by @​titusfortner in SeleniumHQ/selenium#18130
• [py] Support Python 3.15 by @​cgoldberg in SeleniumHQ/selenium#18065
• [javascript] Publish @​seleniumhq/atoms as part of the npm release by @​AutomatedTester in SeleniumHQ/selenium#18133
• [js] Remove the WebSQL and AppCache atoms by @​AutomatedTester in SeleniumHQ/selenium#18137
• [build] remove bazel patches that now have upstream fixes by @​titusfortner in SeleniumHQ/selenium#18140
• [rust] configure the Chrome sandbox after unpacking a Chrome for Testing build on Windows by @​titusfortner in SeleniumHQ/selenium#18139
• [dotnet] [test] Entry point to mutate driver options per fixture by @​nvborisenko in SeleniumHQ/selenium#18141
• [js] Add webextension methods on the driver with BiDi and fallback by @​pujagani in SeleniumHQ/sele...

  Description has been truncated

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.