[dependabot]

Bumps the ruby-starters group with 7 updates in the /languages/ruby/rails directory:

Package	From	To
rails	8.1.3.1	8.1.4.1
sqlite3	2.9.6	2.10.2
solid_queue	1.7.0	1.7.2
solid_cable	4.0.2	4.1.0
thruster	0.1.26	0.1.27
image_processing	2.1.0	2.2.0
brakeman	8.0.6	8.1.0

Updates rails from 8.1.3.1 to 8.1.4.1

Release notes

Sourced from rails's releases.

8.1.4.1

Active Support

• ActiveSupport::MessagePack no longer deserializes an unsafe ActiveSupport::SafeBuffer as html_safe.

  A SafeBuffer that was no longer html_safe?, for example after an in-place gsub!, was deserialized as an html_safe SafeBuffer. It is now serialized with an unsafe marker and deserialized as a String. Earlier versions of Rails cannot read an unsafe buffer serialized this way.

  [GHSA-2w9f-fxwj-w2qf]

  Jean Boussier

• ActiveSupport::Inflector#safe_constantize matches the constant name in a LoadError message as a literal string instead of building a Regexp from it.

  The name's segments were interpolated unescaped into the pattern, so input that reaches safe_constantize, such as the channel identifier in an Action Cable subscribe command, chose the source passed to the regexp compiler.

  [GHSA-8474-xrp6-wh69]

  Jeremy Daer

Active Model

• No changes.

Active Record

• No changes.

Action View

• Skip attribute names in tag helpers that are blank once converted to a string.

  A Symbol such as :" " is not blank, because Symbol#blank? is Symbol#empty?, so it reached the escaping step and produced an attribute with no name. The asset helpers symbolize their keys, so an ordinary String key reached the same place.

  [GHSA-68p9-83h6-5wpj]

  Mike Dalessio

... (truncated)

Commits

• 3f290b7 Preparing for 8.1.4.1 release
• 2d9f502 Apply cookies_same_site_protection to every session store
• c3a295c Reject Mailgun timestamps from the future
• 9190210 Skip tag attribute names that are blank once converted to a string
• 568b19c Fix strip_tags to encode " and ' in its output
• 3c67a69 Preserve committed Active Storage streams after errors
• ccbfc09 Avoid blocking Live buffer termination
• 7a955ca Vary rendered responses by negotiation headers
• 60f22af Sanitize Active Storage filename parts
• 4ca0906 ActiveSupport::MessagePack preserve SafeBuffer html_safe status
• Additional commits viewable in compare view

Updates sqlite3 from 2.9.6 to 2.10.2

Release notes

Sourced from sqlite3's releases.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

e9aea2c2b3476fc875dd8a89313a9a2862818519c0186bfb5b56d6f57bb08d98  gems/sqlite3-2.10.2-aarch64-linux-gnu.gem
4986fc40cdf21342362b72a941df28e95cfe0e644f3ad2532d948b157c39dbee  gems/sqlite3-2.10.2-aarch64-linux-musl.gem
762f609ef891463226b472d3df66aea84d5466ff4376d3ccf4a059718c4ce9c9  gems/sqlite3-2.10.2-arm-linux-gnu.gem
833623eaf1157b1b85d1c0830e3e8f9beb3bb95a9bec3d252f20557a50e9803a  gems/sqlite3-2.10.2-arm-linux-musl.gem
5b0d235ea037e6dcd1b8387a19d73be571917db9f93044d35741cf933a21a37d  gems/sqlite3-2.10.2-arm64-darwin.gem
7fe1bf1adfca4fffeaec27371e0a20c1162d9d985681ec9560971a44fc41d198  gems/sqlite3-2.10.2-x64-mingw-ucrt.gem
46a02a29e9ae452824082388be5c24fd26f133b14bdd268610c6aa9a8d924c44  gems/sqlite3-2.10.2-x86-linux-gnu.gem
38980cf01eb2e4ac1c0755964d60b3d743ccf00686798a626bab852ff4cd3d1e  gems/sqlite3-2.10.2-x86-linux-musl.gem
fd2c67b49d313031af112e172c83ab321681a2b4996bf882eefac50be7bea08f  gems/sqlite3-2.10.2-x86_64-darwin.gem
ca92731ab464df9cae503fa1a439a549e2724f6953c8c05a7769b59366e38f15  gems/sqlite3-2.10.2-x86_64-linux-gnu.gem
b9f8fc62f3e0eb8966b41de251b492b4c8e9d1b23559beb6e150ad7f8d590941  gems/sqlite3-2.10.2-x86_64-linux-musl.gem
f1ea68cd3287f8a49f39a088ac9e4bd0ef4e7f394c3d4a60dd4c7e44b0566964  gems/sqlite3-2.10.2.gem

... (truncated)

Changelog

Sourced from sqlite3's changelog.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

2.10.1 / 2026-10-19

Dependencies

• Vendored sqlite is updated to v3.54.1 (from v3.54.0). This release contains a fix for a possible heap buffer overflow on 32-bit builds, including the precompiled x86-linux-gnu and x86-linux-musl gems. #756 @​flavorjones

Improved

• Database#define_aggregator no longer creates an anonymous class for each aggregate function it defines. Each invocation of the function still runs on a clone of the template object. #752 @​jhawthorn

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.

... (truncated)

Commits

• 1d2aa7a version bump to v2.10.2
• 5329061 Merge pull request #764 from sparklemotion/card-342-callback-lifetime-followups
• 8e81efa test: stop counting the finalizer probes
• 60bf60e doc: list the callback behavior changes in CHANGELOG
• 083d734 Stop a raise inside a callback from deadlocking other threads
• ab14f58 doc: add PR number to CHANGELOG
• e4f3d58 Merge pull request #763 from sparklemotion/card-345-fork-safety-test-flake
• dab7eb2 doc: update CHANGELOG
• 03e5469 test: release aggregate instances on more routes to xFinal
• 621c692 test: skip compaction tests where compaction raises
• Additional commits viewable in compare view

Updates solid_queue from 1.7.0 to 1.7.2

Release notes

Sourced from solid_queue's releases.

v1.7.2

Summary

Concurrency-limited jobs now give their slot back only to the semaphore they got it from. That fixes a job that ran past its duration letting an extra job run alongside the next holder (#827). It also fixes jobs whose class goes missing during a deploy giving back a slot they never took, or keeping one they did take. Nothing needs migrating; see "Upgrading to version 1.7.2" for what to do before 2.0.

What's Changed

• Give concurrency slots back only to the semaphore they came from by @​rosa in rails/solid_queue#831

Full Changelog: rails/solid_queue@v1.7.1...v1.7.2

v1.7.1

Summary of changes

Process resilience

• Processes stop and get replaced when their heartbeats keep failing past the alive threshold (#778).
• The async supervisor replaces dead threads even if releasing their jobs fails during a database outage (#791, fixes #823).
• Workers stop when finishing a job fails (#768).
• Forked processes exit immediately, which avoids the exit hang on SQLite (#801).
• The Puma plugin keeps shutting down when its output pipe is gone (#800, #737).
• In async mode, in-flight jobs go back to the queue when shutdown times out (#815).

Jobs and concurrency

• Jobs whose class no longer loads are failed with ClassMissingError instead of being dropped (#783).
• Discarding ready jobs in bulk unblocks the jobs waiting behind them (#818).
• Retrying failed jobs in bulk resets their retry counters (#817).
• Concurrency locks are taken in key order when dispatching several jobs, which avoids deadlocks (#812).
• One less query per enqueue (#819).
• On MySQL, failed jobs with very large error messages no longer crash workers (#822).
• Bulk-discarding claimed executions raises UndiscardableError instead of NameError (#828).
• Batch completion errors no longer block the next job (#816).

Queues and recurring tasks

• Queue prefixes escape _ and %, and each queue is selected only once (#811).
• Dynamic tasks recreated with the same key are rescheduled (#793).

Other

• The CLI is no longer eager loaded (#826).
• CI pins json below 3 for Rails 7.1 and 8.0 (#813). That's test-only, but it explains the Gemfile change.
• README additions: READ COMMITTED for MySQL, sql_notifications, the Puma plugin's behavior, retry_on and process death, async mode with TERM and QUIT, and removing leftover recurring tasks.

What's Changed

• Replace terminated threads even if releasing their claimed jobs fails by @​rosa in rails/solid_queue#791
• Stop processes whose heartbeats keep failing past the alive threshold by @​wintan1418 in rails/solid_queue#778
• Stop workers when job finalization fails by @​rafael-pissardo in rails/solid_queue#768
• Add README notes on READ COMMITTED, sql_notifications, and the Puma plugin's failure behaviour by @​rosa in rails/solid_queue#795
• Assert the successful job's output regardless of execution order by @​rosa in rails/solid_queue#796
• Document that retry_on can't intercept process-death errors by @​wintan1418 in rails/solid_queue#789
• Harden the lifecycle and pool-size worker tests against slow databases by @​rosa in rails/solid_queue#798
• Exit forked processes immediately to avoid a SQLite mutex deadlock at exit by @​rosa in rails/solid_queue#801

... (truncated)

Commits

• b9c646a Bump solid_queue to 1.7.2
• 8b2a87b Let the job answer for the concurrency slot it holds
• 310496a Test that a job records the semaphore it created on MySQL, and correct the up...
• 6af5101 Place the semaphore note under 1.7.2 in UPGRADING
• 50ca656 Read the acquired semaphore with a lock, and record the limit used
• 62c2927 Give concurrency slots back only to the semaphore they came from
• 24d936a Bump solid_queue to 1.7.1
• 3d7c5d0 Keep batch completion errors from blocking subsequent jobs
• 7323f03 Move the concurrent dispatching test next to the other semaphore lock tests
• a034856 Acquire concurrency locks by key when dispatching several jobs
• Additional commits viewable in compare view

Updates solid_cable from 4.0.2 to 4.1.0

Release notes

Sourced from solid_cable's releases.

v4.1.0

Rails World Edition

• Use the channel hash directly instead of rehashing every poll by @​npezza93 in rails/solid_cable#85
• Memoize cable configuration by @​npezza93 in rails/solid_cable#86
• Batch writes together by @​npezza93 in rails/solid_cable#87
• Add encryption support by @​npezza93 in rails/solid_cable#88
• Update bench app and loadtest script by @​npezza93 in rails/solid_cable#90
• Bring autotrimming inline with solid cache by @​npezza93 in rails/solid_cable#89

Full Changelog: rails/solid_cable@v4.0.2...v4.1.0

Commits

• 1e4217e disable autotrimming
• 6bb0bd4 bump version
• 7e97e8c pass around the actual message
• 79b9839 Pass the actual messages to broadcast_batch
• 41b1059 better naming
• 56f41fe skip duping the current_channels
• 0585967 actually compress encrypted messages
• a1d8b27 Remove channel index since we use channel_hash now
• c75d007 Bring autotrimming inline with solid cache (#89)
• 2dea601 Update bench app and loadtest script (#90)
• Additional commits viewable in compare view

Updates thruster from 0.1.26 to 0.1.27

Changelog

Sourced from thruster's changelog.

v0.1.27 / 2026-09-28

• Update dependencies (#154)
• Bump golang.org/x/crypto to v0.56.0 (#152)
• Build with Go 1.27.1, update dependencies, add make check (#150)

Commits

• 669643f Merge commit from fork
• 38d3721 Merge pull request #155 from erikthoreson24/version-0.1.27
• 0992970 Bump version
• 72796d7 Merge pull request #154 from basecamp/deps
• 0864e8a Use http.Transport for h2c test client
• 80e89ee Update dependencies
• 22a9978 Merge pull request #152 from erikthoreson24/fix/bump-x-crypto-0.56.0
• b186518 Bump golang.org/x/crypto to v0.56.0
• 3ef8516 Merge pull request #150 from basecamp/go-1.27.1
• fa31b96 Add make check to run go vet and govulncheck
• Additional commits viewable in compare view

Updates image_processing from 2.1.0 to 2.2.0

Changelog

Sourced from image_processing's changelog.

2.2.0 (2026-09-29)

• Save in the #convert format when the destination path has no extension, such as a /dev/fd/N path (thanks to @​flavorjones)

Commits

• d9737fb Set version to 2.2.0
• 8f7b538 Handle missing AVIF encoder in tests
• 92086c5 Handle AVIF format on extensionless destinations
• 5827e83 Save in the #convert format to an extensionless destination (#150)
• See full diff in compare view

Updates brakeman from 8.0.6 to 8.1.0

Release notes

Sourced from brakeman's releases.

8.1.0

• Update SonarQube report to use generic issue format (@​fffx)
• Include regex code in validation warnings (@​eliotsykes)
• Check validation regexes in non-activerecord models (@​eliotsykes)
• Skip top-level vendor directory before recursive globbing (@​ronocod)
• Support Rails 7.1+ positional enum syntax in SQL injection check (@​cubasepp / @​Eljees)
• Recognize Haml::AttributeBuilder.build_class as an escaped output (@​Eljees)
• Fix frozen string error (@​shaicoleman)
• Better help and error message for --ensure-latest (#2036)

Changelog

Sourced from brakeman's changelog.

8.1.0 - 2026-09-30

• Better help and error message for --ensure-latest
• Fix frozen string error (Shai Coleman)
• Update Sonar report format (fangxing)
• Fix frozen src string error
• Recognize Haml::AttributeBuilder.build_class as an escaped output (Yuriy Tumanov)
• Include regex code in validation warnings (Eliot Sykes)
• Check validation regexes in non-activerecord models (Eliot Sykes)
• Skip top-level vendor directory before recursive globbing (Conor O'Donnell)
• Support Rails 7.1+ positional enum syntax in SQL injection check (Michael Vogl/Yuriy Tumanov)

Commits

• c778164 Bump to 8.1.0
• 4621407 Update CHANGES
• 26ba01f Support Rails 7.1+ positional enum syntax in SQL injection check (#2051)
• 8f04922 Skip top-level vendor directory before recursive globbing (#2039)
• f921f01 Check validation regexes in non-activerecord models (#2053)
• d62e919 Fix CheckValidationRegex overly broad ignores (#2050)
• 73bbc99 Recognize Haml::AttributeBuilder.build_class as an escaped output (#2052)
• 71f8f69 Fix typo in test_format_validation_with_multiline (#2049)
• 0fd4dbc Add bundle install step to contributing doc (#2047)
• 5de415c Fix ERB frozen src error (#2048)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions