Update bundler non-major dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence	Update
dalli (changelog)	5.0.5 → 5.0.6			patch
http	6.0.3 → 6.0.4			patch
lograge (changelog)	0.14.0 → 0.15.0			minor
mitlibraries-theme	v1.4 → v1.5			minor
net-imap (changelog)	0.6.4.1 → 0.6.6			patch
rubocop (source, changelog)	1.88.1 → 1.88.2			patch
rubocop-rails (source, changelog)	2.35.5 → 2.36.0			minor
terser (changelog)	1.2.7 → 1.2.8			patch
web-console	4.2.1 → 4.3.0			minor

---

Release Notes

petergoldstein/dalli (dalli)

v5.0.6

Compare Source

==========

Performance:

• Skip the cas-return flag on quiet meta_set requests (#​1131)

  • In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request
  • Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter
  • Extracted from #​1130; thanks to Jianbin Chen for this contribution

• Reduce allocations in KeyRegularizer and multi-key request paths (#​1120)

  • Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value
  • Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers
  • Thanks to Jean Boussier for this contribution

• Reduce allocations in ResponseBuffer pipelined getk parsing (#​1117)

  • process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response
  • Also skips trailing nils in the token array
  • Thanks to Jean Boussier for this contribution

• Enable frozen string literals in RequestFormatter (#​1118)

  • Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)
  • Thanks to Jean Boussier for this contribution

• Reduce allocations in ResponseProcessor#value_from_tokens (#​1113)

  • token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons
  • Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)
  • Thanks to Jean Boussier for this contribution

• Reduce allocations in common operation paths (#​1111)

  • Use Symbol#name over Symbol#to_s to return a frozen string without allocation
  • Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled
  • Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation
  • Use match? in KeyRegularizer#encode to avoid MatchData object allocation
  • Reduces objects allocated by ~26% and memory by ~6% for a simple get workload
  • Thanks to Jean Boussier for this contribution

• Fix pathological memory behavior in ResponseBuffer (#​1114)

  • compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@​offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original
  • Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read
  • Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations
  • Accompanied by new unit tests for ResponseBuffer (#​1115)
  • Thanks to Jean Boussier for this contribution

Features:

• delete_multi now returns the number of keys found and deleted (#​1126)
  • Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed
  • The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted
  • The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted
  • Thanks to Iliana Hadzhiatanasova for this contribution

Bug Fixes:

• Raise instead of returning a truncated value when the peer closes mid-response (#​1135)

  • IO#read(count) on a blocking socket accumulates across TCP chunks and hands back a shorter buffer (or nil) in only one case: the stream hit EOF. That short buffer was passed through as the response body, so a memcached restart, proxy drop, or load balancer timeout partway through a response could surface a truncated but still decodable value to the caller, indistinguishable from a real one
  • A short read is now treated as the premature EOF it is, raising and closing the dirty socket so the request is retried on a fresh connection
  • CRuby only; the JRuby path already used Socket#readfull, which enforces the same contract
  • Extracted from #​1130; thanks to Ian Ker-Seymer for the original fix and Jianbin Chen for the port

• Tear down the connection when a non-StandardError aborts a request (#​1136)

  • Async::Stop and Thread#kill descend from Exception rather than StandardError, so the rescue clauses in Protocol::Base#request never saw them; a scheduler cancelling a fiber parked on a response read skipped close entirely, leaving the connection marked as having a request in progress with partial response bytes still unread on the wire, and returning that half-used client to the pool under connection_pool
  • Protocol::Base#request now closes in an ensure unless the request ran to completion, and ConnectionManager#close performs its state cleanup in an ensure so a second cancellation landing inside @sock.close cannot leave the socket non-nil with the request still marked in progress
  • Dalli::DalliError and Dalli::MarshalError now close the connection at the point of failure rather than at the start of the next request; those paths already left the request in progress and ConnectionManager#confirm_ready! closed on the next call, so this changes when the close happens rather than adding one
  • Extracted from #​1130; thanks to Dan Mayer for the original fix and Jianbin Chen for the port

• Fix ResponseBuffer compaction logic (#​1119)

  • COMPACT_THRESHOLD was removed in #​1116 as apparently unused, but the constant was referenced by the compaction guard; its absence silently disabled buffer compaction
  • Restored the constant, corrected the compaction condition, and improved the buffer-shrinking implementation to use String#bytesplice (backed by memmove) for true in-place compaction
  • Adds targeted tests covering the compaction threshold and shrink behavior
  • Thanks to Jean Boussier for this contribution

Maintenance:

• Scope StrictWarnings to Dalli's own source (#​1134)

  • The test suite runs under -w and prepends a hook to Warning.singleton_class that turns warnings into failures, but that hook is global: a warning emitted while loading any third-party gem aborted the whole suite before a single test ran
  • json 2.21.2's pure-Ruby generator (used on JRuby, where the C extension is unavailable) warns method redefined; discarding old to_hash at require time, which took the jruby-10 CI job red with no change to Dalli
  • Warnings are now attributed to a source file and only raise for lib/ and test/; attribution prefers the location Ruby embeds in the message, since the stack at that point describes the require chain rather than the offending code
  • Portable attribution of Kernel#warn callers also required walking the stack rather than indexing it (Ruby 3.3/3.4 push an <internal:warning> frame that 4.0 does not), skipping RubyGems' Kernel#warn shim (active on JRuby but not CRuby), and resolving relative backtrace paths

• Make raw and namespace fast path tests actually use those options (#​1129)

  • Followup to #​1127: the raw and namespace variants passed those options to the helper that starts memcached, which configures the client the tests then discarded, so neither option was ever exercised
  • Passes the options to the client under test and adds assertions that fail if they are absent
  • Thanks to Iliana Hadzhiatanasova for this contribution

• Benchmark set_multi and add a delete_multi target (#​1132)

  • Enables the two set_multi reports that were commented out pending the arrival of set_multi, resolving the accompanying TODO
  • Adds a delete_multi target comparing the pipelined path against N single deletes
  • Extracted from #​1130; thanks to Jianbin Chen for this contribution

• Bump CI memcached to 1.6.41 and run benchmarks on pull requests (#​1133)

  • The tests workflow moves from 1.6.40 to 1.6.41; the benchmarks and profile workflows had drifted back on 1.6.23
  • Extracted from #​1130; thanks to Jianbin Chen for this contribution

• Disable RuboCop metrics cops (#​1128)

  • Thanks to Jean Boussier for this contribution

• Remove PIDCache module (#​1125)

  • Process.pid is cached natively by Ruby 3.3+ (via https://bugs.ruby-lang.org/issues/19443), making the manual cache unnecessary now that Dalli requires Ruby 3.3+
  • Thanks to Jean Boussier for this contribution

• Remove unused COMPACT_THRESHOLD constant from ResponseBuffer (#​1116)

  • Followup cleanup after the buffer management redesign in #​1114
  • Note: subsequently found to be in use; restored and corrected in #​1119
  • Thanks to Jean Boussier for this contribution

• Use String#byteindex instead of String#index when searching for the response terminator in getk_response_from_buffer (#​1112)

  • The result feeds directly into byteslice; byteindex makes the intent explicit, though both return the same value since the buffer encoding is always BINARY
  • Thanks to Jean Boussier for this contribution

• Make single-server fast path tests actually exercise the fast path (#​1127)

  • The batch-operation tests built clients through a helper that registers two address aliases for the same memcached process, so every client had a 2-server ring and the tests always ran through the pipelined path instead of the single-server fast path
  • Adds a single_server_client test helper that builds a client with a single address, and uses it in the affected get_multi, set_multi, and delete_multi tests
  • Thanks to Iliana Hadzhiatanasova for this contribution

roidrage/lograge (lograge)

v0.15.0

Compare Source

• Test and support Rails 7.2, 8.0, and 8.1 #​399, #​400
• Test and support Ruby 3.4 and 4.0, JRuby 10.0, and TruffleRuby 34 #​399, #​400
• Explicitly require 'logger' to fix loading on Ruby 3.4+ where it is no longer autoloaded #​399
• Replace deprecated add_runtime_dependency with add_dependency in the gemspec #​399

mitlibraries/mitlibraries-theme (mitlibraries-theme)

v1.5: Rails 8.x

Compare Source

What's Changed

• Add integrity hashes for remote scripts and stylesheets by @​jazairi in MITLibraries#61
• Configure Renovate by @​renovate[bot] in MITLibraries#62
• Allow Rails 8.x by @​JPrevost in MITLibraries#67

New Contributors

• @​renovate[bot] made their first contribution in MITLibraries#62

Full Changelog: MITLibraries/mitlibraries-theme@v1.4...v1.5

ruby/net-imap (net-imap)

v0.6.6

Compare Source

What's Changed

Fixed

• 🐛 Fix incorrect regexp for testing if string is quotable by @​nevans in #​723
  This bug was introduced by v0.6.5 as part of #​712.
  It causes some valid string arguments (which should be sent as IMAP literal values) to raise a DataFormatError exception (without sending).

Full Changelog: ruby/net-imap@v0.6.5...v0.6.6

v0.6.5

Compare Source

What's Changed

Added

• 🧵 Add thread join timeout to #disconnect by @​nevans in #​689
• ✨ Add #utf8_enabled? by @​nevans in #​715
• ✨ Remember set of enabled server capabilities by @​nevans in #​716
  Adds #enabled and #enabled? methods.

Fixed

• 🥅 Fix premature tagged response guard for IDLE by @​nevans in #​688
• 🥅 Test for NULL bytes before sending string args by @​nevans in #​712
• 🐛 Use literal syntax for invalid UTF8 or non-UTF8 strings by @​nevans in #​713

Other Changes

• 🧵🥅 Reraise receiver thread errors with caller's backtrace by @​nevans in #​691
• 🧵🥅 Reraise #starttls receiver thread errors with caller's backtrace by @​nevans in #​711
• ♻️ Extract InvalidTaggedResponseError error by @​nevans in #​687
• 🧵 Refactor thread synchronization for sending commands by @​nevans in #​692
• 🧵Refactor receive responses thread sync by @​nevans in #​694
• ♻️ Extract handle_response from receive_responses by @​nevans in #​695

Miscellaneous

• 🔀 Merge v0.6.4.1 patches by @​nevans in #​702
• Fix flaky test_starttls_stripping_ok_sent_before_response by @​hsbt in #​709
• ⬆️ Bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​708
• ✅⚡ Faster tests by @​nevans in #​714
• Pin simplecov version by @​nobu in #​717
• simplecov-{html,json} have been incorporated in SimpleCov 1.0.0 by @​nobu in #​718
• ⬆️ Bump step-security/harden-runner from 2.19.4 to 2.20.0 by @​dependabot[bot] in #​719
• ✅ Fix issues with simplecov v1.0 upgrade by @​nevans in #​721

Full Changelog: ruby/net-imap@v0.6.4.1...v0.6.5

rubocop/rubocop (rubocop)

v1.88.2

Compare Source

Bug fixes

• #​15417: Fix a false negative for Lint/ToJSON, which did not flag singleton def self.to_json definitions. ([@​bbatsov][])
• #​15418: Fix a false negative for Lint/UnreachableCode, which only flagged the first statement after a flow-of-control statement instead of every unreachable statement that followed it. ([@​bbatsov][])
• #​15416: Fix a false negative for Lint/UselessNumericOperation, which only flagged bare method-call receivers and ignored local variables, instance/class/global variables, and constants (e.g. @x + 0, CONST * 1). ([@​bbatsov][])
• #​15419: Fix a false negative for Lint/Void where safe-navigation calls to nonmutating methods (e.g. x&.sort) were not flagged when CheckForMethodsWithNoSideEffects is enabled. ([@​bbatsov][])
• #​15421: Fix a false negative for Style/ArrayIntersect with the block form using include? (e.g. array1.any? { |e| array2.include?(e) }), which was only detected for member?. ([@​bbatsov][])
• #​15420: Fix a false negative for Style/CollectionCompact, which did not flag grep_v(nil)/grep_v(NilClass) on a safe-navigation call (e.g. array&.grep_v(nil)). ([@​bbatsov][])
• #​15422: Fix a false negative for Style/DefWithParentheses with a single-line definition whose body follows a semicolon (e.g. def foo(); end), where the parentheses can be safely omitted. ([@​bbatsov][])
• #​15388: Fix a false negative for Style/MixinUsage when including multiple modules in one statement. ([@​bbatsov][])
• #​15388: Fix a false negative for Style/ModuleFunction when the module body is a single statement. ([@​bbatsov][])
• #​15388: Fix a false negative for Style/RedundantCurrentDirectoryInPath with double-quoted strings containing interpolation. ([@​bbatsov][])
• #​15395: Fix a false negative for Style/RedundantHeredocDelimiterQuotes with double-quoted delimiters whose body contains interpolation or escapes. ([@​bbatsov][])
• #​15409: Fix a false positive for Gemspec/DuplicatedAssignment with multiple specifications. ([@​bbatsov][])
• #​15403: Fix a false positive for Layout/CommentIndentation with a comment above an inline access modifier (e.g. private def foo) when Layout/AccessModifierIndentation is configured with EnforcedStyle: outdent. ([@​grk][])
• #​15372: Fix a false positive for Style/InvertibleUnlessCondition with a multi-statement begin condition. ([@​bbatsov][])
• #​15360: Fix an incorrect autocorrect for Style/ArgumentsForwarding and Style/MethodDefParentheses when autocorrection conflicts while adding parentheses to method definition arguments. ([@​koic][])
• #​15417: Fix an incorrect autocorrect for Lint/ToJSON that produced invalid Ruby (def to_json(*_args)()) when the method had explicit empty parentheses. ([@​bbatsov][])
• #​15426: Fix an incorrect autocorrect for Style/MethodCallWithoutArgsParentheses when empty parentheses span multiple lines and the method call has a block. ([@​koic][])
• #​15328: Fix a false positive for Style/HashConversion with a splat argument, which previously produced an invalid hash literal. ([@​bbatsov][])
• #​15338: Fix a false positive for Style/HashLookupMethod with safe navigation, where the suggested bracket form would be the unreadable hash&.[](key). ([@​bbatsov][])
• #​15397: Fix an incorrect autocorrect for Style/IdenticalConditionalBranches that hoisted the moved expression to column zero instead of matching the surrounding indentation. ([@​bbatsov][])
• #​15372: Fix an incorrect autocorrect for Style/InvertibleUnlessCondition with mixed &&/|| conditions, which lost the required parentheses when inverting. ([@​bbatsov][])
• #​15428: Fix an incorrect autocorrect for Style/TrivialAccessors when AllowPredicates: false is set and a trivial reader is defined as a predicate class method. ([@​koic][])
• #​15402: Fix an infinite loop and file corruption for Layout/LineLength with SplitStrings when an over-long string is indented under a multi-line parent. ([@​bbatsov][])
• #​15384: Fix a false positive and a false negative for Style/MissingRespondToMissing when method_missing is defined at the top level or alongside sibling classes. ([@​bbatsov][])
• #​15432: Fix false positives in Layout/ElseAlignment when using else within a block that is part of a larger expression. ([@​koic][])
• #​15423: Fix false positives in Layout/MultilineMethodCallIndentation when a method chain is nested inside a parenthesized argument list or a grouped expression within a hash pair value. ([@​koic][])
• #​15424: Fix Style/StructInheritance autocorrect dropping leading indentation when class is inside a module or namespace. ([@​amckinnie][])
• #​15325: Fix Style/DocumentationMethod ignoring AllowedMethods for inline modifier defs. ([@​bbatsov][])
• #​15369: Fix a false positive for Style/LambdaCall when the argument list contains a comment, which the autocorrect would have dropped. ([@​bbatsov][])

Changes

• #​15430: Improve performance of offense reporting by not allocating a new source range per offense outside of embedded sources. ([@​bbatsov][])
• #​15430: Improve investigation performance by dispatching on_new_investigation, on_investigation_end, and on_other_file only to cops that refine them, and by skipping after_* dispatch when no cop needs it. ([@​bbatsov][])
• #​15430: Improve performance of the per-file cop relevancy check by skipping gem requirement evaluation for cops without gem requirements. ([@​bbatsov][])
• #​15430: Improve Lint/Debugger performance on code without debugger calls. ([@​bbatsov][])
• #​15430: Improve autocorrection performance by keeping corrections in memory across inspection iterations and writing each corrected file only once. ([@​bbatsov][])
• #​15415: Mark Lint/NumericOperationWithConstantResult autocorrect as unsafe because it drops the operands, discarding their side effects and silencing cases where the result is not actually constant (e.g. x / x raises when x is 0). ([@​bbatsov][])
• #​15430: Improve performance of cops using AllowedPatterns, ForbiddenPatterns, and AllowedMethods by compiling the configured patterns only once. ([@​bbatsov][])
• #​15430: Improve performance of Style/IfUnlessModifier and other modifier cops on files with many comments or conditionals. ([@​bbatsov][])

rubocop/rubocop-rails (rubocop-rails)

v2.36.0

Compare Source

Bug fixes

• #​1647: Fix a false negative for Rails/EagerEvaluationLogMessage when the interpolated string is passed to Rails.logger.debug as the sole body of an enclosing block such as each or tap. ([@​conwayje][])
• #​1646: Fix a false negative for Rails/ReversibleMigration when using remove_index without a column inside a change_table block. ([@​ilianah][])
• #​1642: Fix a false negative for Rails/SafeNavigation when using try/try! with a symbol to proc such as foo.try(&:bar). ([@​koic][])
• #​1599: Fix an incorrect autocorrect for Rails/LinkToBlank when Style/TrailingCommaInArguments with EnforcedStyleForMultiline: consistent_comma adds a trailing comma, which produced a duplicate comma. ([@​koic][])
• #​1619: Fix MigratedSchemaVersion setting so it works for all cops. ([@​lovro-bikic][])

Changes

• #​1641: Fix false negatives in Rails/SafeNavigation when using try/try! with operator methods such as [], []=, and ==. ([@​koic][])

ahorek/terser-ruby (terser)

v1.2.8

Compare Source

• update TerserJS to [5.49.0]

rails/web-console (web-console)

v4.3.0

Compare Source

• #​342 Always permit IPv4-mapped IPv6 loopback addresses ([@​zunda]).
• Fixed Rails 8.2.0.alpha support
• Drop Rails 7.2 support
• Drop Ruby 3.1 support

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coveralls]

coverage: 99.072%. remained the same — renovate/bundler-minor-patch into main