Bump the prod-dependencies group across 2 directories with 22 updates

[dependabot]

Bumps the prod-dependencies group with 13 updates in the / directory:

Package	From	To
zeitwerk	2.7.5	2.8.2
aws-sdk-codecommit	1.97.0	1.102.0
aws-sdk-ecr	1.126.0	1.131.0
commonmarker	2.8.2	2.9.0
excon	1.4.2	1.6.0
faraday	2.14.1	2.14.3
nokogiri	1.19.3	1.19.4
opentelemetry-api	1.9.0	1.11.0
opentelemetry-logs-api	0.3.0	0.4.1
opentelemetry-metrics-api	0.5.0	0.6.1
parser	3.3.11.1	3.3.12.0
psych	5.3.1	5.4.0
sorbet-runtime	0.6.13296	0.6.13371

Bumps the prod-dependencies group with 20 updates in the /updater directory:

Package	From	To
zeitwerk	2.7.5	2.8.2
aws-sdk-codecommit	1.97.0	1.102.0
aws-sdk-ecr	1.126.0	1.131.0
commonmarker	2.8.2	2.9.0
excon	1.4.2	1.6.0
faraday	2.14.1	2.14.3
nokogiri	1.19.3	1.19.4
opentelemetry-api	1.9.0	1.11.0
opentelemetry-logs-api	0.3.0	0.4.1
opentelemetry-metrics-api	0.5.0	0.6.1
parser	3.3.11.1	3.3.12.0
psych	5.3.1	5.4.0
sorbet-runtime	0.6.13296	0.6.13371
opentelemetry-exporter-otlp	0.33.0	0.34.1
opentelemetry-exporter-otlp-logs	0.4.0	0.5.1
opentelemetry-exporter-otlp-metrics	0.8.0	0.10.0
opentelemetry-logs-sdk	0.5.1	0.6.1
opentelemetry-metrics-sdk	0.13.1	0.15.0
opentelemetry-sdk	1.11.0	1.13.0
sentry-opentelemetry	6.5.0	6.6.2

Updates zeitwerk from 2.7.5 to 2.8.2

Changelog

Sourced from zeitwerk's changelog.

2.8.2 (23 May 2026)

• on_load and on_unload accept constant paths with leading colons. For example:

  loader.on_load('::User') { ... }

• on_load and on_unload validate that their input is a constant path. For example:

  loader.on_load(':User') { ... }

  raises NameError.

2.8.1 (19 May 2026)

• Replace anonymous block parameters with regular named ones.

  Ruby 3.3.0 has a bug: it does not parse anonymous block parameters, which were introduced in Ruby 3.1.

  While this is a Ruby bug and people could upgrade to 3.3.1, I prefer users just do not hit this. At the end of the day, it is cosmetic.

2.8.0 (18 May 2026)

• Adds support for namespace files, nsfiles for short.

  If a loader has an nsfile configured (nil by default):

  loader.nsfile = 'ns.rb' # must be set before setup

  explicit namespaces can be defined by such special file inside their directories:

  my_component/ns.rb     # MyComponent
  my_component/widget.rb # MyComponent::Widget
  

  This may be handy for self-contained units for which a my_component.rb file in the parent directory would feel unnatural.

  If an nsfile is set, you can still define explicit namespaces as always. Both styles can coexist in the project. However, it is an error condition to try to define the same namespace using both conventions.

... (truncated)

Commits

• 76f0790 Ready for 2.8.2
• 14cff5e Refactor cpath validation for TruffleRuby
• 8c26393 on_load and on_unload validate their input is a constant path
• ea55f02 Add a constant path validator
• 80e925b Let on_load/on_unload use a sentinel for 0 args
• 2a25bce Add RuboCop to CI
• 198fe83 Linting
• 27b9a58 Merge pull request #335 from Shopify/on_load_qualifier
• 14e4143 Ready for 2.8.1
• 94d607d Remove anonymous blocks
• Additional commits viewable in compare view

Updates aws-sdk-codecommit from 1.97.0 to 1.102.0

Changelog

Sourced from aws-sdk-codecommit's changelog.

1.102.0 (2026-07-09)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.101.0 (2026-05-29)

• Feature - Adding new BDD representation of endpoint ruleset

1.100.0 (2026-05-21)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.99.0 (2026-05-19)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.98.0 (2026-05-13)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

Commits

• See full diff in compare view

Updates aws-sdk-ecr from 1.126.0 to 1.131.0

Changelog

Sourced from aws-sdk-ecr's changelog.

1.131.0 (2026-07-09)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.130.0 (2026-06-01)

• Feature - Adding new BDD representation of endpoint ruleset

1.129.0 (2026-05-21)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.128.0 (2026-05-19)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.127.0 (2026-05-13)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

Commits

• See full diff in compare view

Updates commonmarker from 2.8.2 to 2.9.0

Release notes

Sourced from commonmarker's releases.

v2.9.0

What's Changed

• Fix i686 with u32 parsing hack by @​kivikakk in gjtorikian/commonmarker#471
• feat: Upgrade to comrak 0.54 with math_latex + alert_style options, and changed header_ids by @​gjtorikian in gjtorikian/commonmarker#472
• [skip test] Release v2.9.0 by @​github-actions[bot] in gjtorikian/commonmarker#474

Full Changelog: gjtorikian/commonmarker@v2.8.3...v2.9.0

v2.8.3

What's Changed

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in gjtorikian/commonmarker#464
• Bump actions/cache from 5 to 6 by @​dependabot[bot] in gjtorikian/commonmarker#466
• fix: switch Windows builds to a different regex engine by @​gjtorikian in gjtorikian/commonmarker#468
• [skip test] Release v2.8.3 by @​github-actions[bot] in gjtorikian/commonmarker#469

Full Changelog: gjtorikian/commonmarker@v2.8.2...v2.8.3

Changelog

Sourced from commonmarker's changelog.

[v2.9.0] - 13-07-2026

What's Changed

• Fix i686 with u32 parsing hack by @​kivikakk in gjtorikian/commonmarker#471
• feat: Upgrade to comrak 0.54 with math_latex + alert_style options, and changed header_ids by @​gjtorikian in gjtorikian/commonmarker#472

⚠️ The heading anchor markup changed (from upstream). The id now lives on the heading element and the anchor moved to the end with aria-label + data-heading-content, replacing the leading aria-hidden link. CSS/JS targeting the old markup will be affected. See kivikakk/comrak#808 for more information.

Full Changelog: gjtorikian/commonmarker@v2.8.3...v2.9.0

[v2.8.3] - 03-07-2026

What's Changed

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in gjtorikian/commonmarker#464
• Bump actions/cache from 5 to 6 by @​dependabot[bot] in gjtorikian/commonmarker#466
• fix: switch Windows builds to a different regex engine by @​gjtorikian in gjtorikian/commonmarker#468

Full Changelog: gjtorikian/commonmarker@v2.8.2...v2.8.3

Commits

• 2fc7731 Merge pull request #474 from gjtorikian/release/v2.9.0
• 29d0c80 Update CHANGELOG with heading anchor markup changes
• 177d592 Update CHANGELOG.md
• 3ac1e23 [skip test] update changelog
• cc220cb Bump version to 2.9.0
• 027aa7a Merge pull request #472 from gjtorikian/comrak-54
• 729a867 feat: Add math_latex and alert_style options
• cc7c850 build(deps): Bump comrak from 0.53 to 0.54
• aa268bd Merge pull request #471 from gjtorikian/push-wnxmumqvttrt
• 8b63464 fix i686 with u32 parsing hack.
• Additional commits viewable in compare view

Updates excon from 1.4.2 to 1.6.0

Changelog

Sourced from excon's changelog.

1.6.0 2026-07-16

• bump actions/checkout
• fix incorrect e vs error (x2)
• add read_buffer_scratch to optimize memory/GC

1.5.0 2026-05-03

• update bundled certs
• invalid parameter error for nil host
• close security issues around headers and redirect following

1.4.1 2026-03-18

• change cgi require to cgi/escape for ruby 4.0+

1.4.0 2026-03-02

• fixes for ruby4
• add ruby 4.0 and drop 3.2 from ci
• add user-configurable global resolver factory
• add SOCK5 proxy support

1.3.2 2025-12-03

• update bundled certs

1.3.1 2025-11-05

• update bundled certs

1.3.0 2025-08-18

• proxy connect should always include port, regardless of default

1.2.9 2025-08-15

• bump actions/checkout
• update bundled certs

1.2.8 2025-07-16

... (truncated)

Commits

• c81513d v1.6.0
• afe503f Introduce read_buffer_scratch (#903)
• 5356039 fix an erroneous e vs error reference in error handling (#905)
• bbad91b Fix incorrect variable name (#904)
• 30167a4 Bump actions/checkout from 6 to 7 (#902)
• f59b27e v1.5.0
• ea89a35 expand redirect header redaction (#901)
• 74e1754 Raise Excon::Error::InvalidParameter when host is nil instead of crashing wit...
• 4e784d5 update bundled certs
• See full diff in compare view

Updates faraday from 2.14.1 to 2.14.3

Release notes

Sourced from faraday's releases.

v2.14.3

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

• Upgrade CI lint step from Ruby 3 to 4 by @​larouxn in lostisland/faraday#1673
• feat(test): add Stubs#clear to remove all stubs by @​SAY-5 in lostisland/faraday#1675

New Contributors

• @​SAY-5 made their first contribution in lostisland/faraday#1675

Full Changelog: lostisland/faraday@v2.14.2...v2.14.3

v2.14.2

Security Note

This release contains a security fix, we recommend all users to upgrade as soon as possible. A Security Advisory with more details will be posted shortly.

What's Changed

• Add Ruby 4 to CI by @​larouxn in lostisland/faraday#1659
• Modernize RuboCop configuration and fix offenses by @​larouxn in lostisland/faraday#1660
• Lint: Style/OneClassPerFile by @​olleolleolle in lostisland/faraday#1668
• fix(docs): fix incorrect link label by @​JohnnyKei in lostisland/faraday#1667
• chore: Upgrade package.json packages using audit fix by @​olleolleolle in lostisland/faraday#1669

New Contributors

• @​larouxn made their first contribution in lostisland/faraday#1659
• @​JohnnyKei made their first contribution in lostisland/faraday#1667

Full Changelog: lostisland/faraday@v2.14.1...v2.14.2

Commits

• f1ace87 Version bump to 2.14.3
• 36764bf Merge commit from fork
• 59334e0 feat(test): add Stubs#clear to remove all stubs (#1675)
• 469f25c Upgrade CI lint step from Ruby 3 to 4 (#1673)
• 2ecd5e0 Update version.rb
• 3f1280c Merge commit from fork
• 81dc168 Upgrade package.json packages using audit fix (#1669)
• 8b4d1fd Create SECURITY.md
• a01039c fix(docs): fix incorrect link label in request-options and remove dead link i...
• 7df3f24 Lint: Style/OneClassPerFile (#1668)
• Additional commits viewable in compare view

Updates json from 2.19.5 to 2.19.9

Release notes

Sourced from json's releases.

v2.19.9

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: ruby/json@v2.19.8...v2.19.9

v2.19.8

What's Changed

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

Full Changelog: ruby/json@v2.19.7...v2.19.8

v2.19.7

What's Changed

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

Full Changelog: ruby/json@v2.19.6...v2.19.7

v2.19.6

What's Changed

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

Full Changelog: ruby/json@v2.19.5...v2.19.6

Changelog

Sourced from json's changelog.

2026-06-11 (2.19.9)

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

2026-05-28 (2.19.6)

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

Commits

• 2cff267 Release 2.19.9
• fd6a65b generator.c: don't start with a stack buffer in IO case
• 5233dd9 Release 2.19.8
• 3f44b26 Prevent buffer over-read when generating EOF error
• be8d068 Handle invalid types passed as max_nesting option
• 59501c0 Get rid of all_images gem
• c7a7b2b Add a security note in README
• ab6c8f2 Release 2.19.7
• f033b9d Fix some more edge cases with out of range floats
• 5ca8a67 parser.c: Ensure the user provided string can't be mutated
• Additional commits viewable in compare view

Updates nokogiri from 1.19.3 to 1.19.4

Release notes

Sourced from nokogiri's releases.

v1.19.4 / 2026-06-18

Security

• [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
• [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
• [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
• [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
• [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
• [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
• [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f  nokogiri-1.19.4-aarch64-linux-gnu.gem
35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af  nokogiri-1.19.4-aarch64-linux-musl.gem
a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca  nokogiri-1.19.4-arm-linux-gnu.gem
588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb  nokogiri-1.19.4-arm-linux-musl.gem
a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527  nokogiri-1.19.4-arm64-darwin.gem
ce04b9e268c9626852231a48b49128ed52034f1ccb39484a6da3875491cd709e  nokogiri-1.19.4-java.gem
051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e  nokogiri-1.19.4-x64-mingw-ucrt.gem
7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551  nokogiri-1.19.4-x86_64-darwin.gem
379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a  nokogiri-1.19.4-x86_64-linux-gnu.gem
17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b  nokogiri-1.19.4-x86_64-linux-musl.gem
50c951611c92bca05c51411aef45f1cbc50f2821c4802758c5c6d34696533ab5  nokogiri-1.19.4.gem

Changelog

Sourced from nokogiri's changelog.

v1.19.4 / 2026-06-18

Security

• [CRuby] (Low) Fixed a possible invalid memory read when XML::Node#initialize_copy_with_args is called with an argument that is not a Node. See GHSA-g9g8-vgvw-g3vf for more information.
• [CRuby] (Low) Fixed a possible use-after-free when an XML::XPathContext is used after its source document has been garbage collected. See GHSA-p67v-3w7g-wjg7 for more information.
• [CRuby] (Low) Fixed a possible use-after-free during XInclude processing via Node#do_xinclude. See GHSA-wfpw-mmfh-qq69 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#root= is assigned a non-element node. See GHSA-wjv4-x9w8-wm3h for more information.
• [CRuby] (Low) Fixed a possible use-after-free when setting an attribute value via XML::Attr#value= or #content=. See GHSA-phwj-rprq-35pp for more information.
• [CRuby] (Low) Fixed a null pointer dereference when methods are called on uninitialized wrapper objects (e.g. via allocate); these now raise instead of crashing the process. See GHSA-9cv2-cfxc-v4v2 for more information.
• [CRuby] (Low) Fixed a possible use-after-free when Document#encoding= raises an exception. See GHSA-5v8h-3h3q-446p for more information.
• [CRuby] (Medium) Fixed an out-of-bounds read in XML::NodeSet#[] (alias #slice) when given a large negative index. See GHSA-5prr-v3j2-97mh for more information.
• [JRuby] (Low) XML::Schema now enforces the NONET parse option, which Nokogiri enables by default. It was not enforced on JRuby, so a schema parsed with default options could still fetch external resources over the network, potentially enabling SSRF or XXE attacks and bypassing the mitigation for CVE-2020-26247. See GHSA-8678-w3jw-xfc2 for more information.

Commits

• 8cfb9da version bump to v1.19.4
• a856d1e fix: JRuby NONET bypass in XML::Schema (v1.19.x) (#3639)
• 6a0aa1e fix(CRuby): use-after-free in Document#encoding= when setter raises (v1.19.x)...
• f658a54 fix: JRuby NONET bypass in XML::Schema
• 39d26fe fix(CRuby): use-after-free in Document#encoding= when setter raises
• 04a09dd fix(CRuby): out-of-bounds read in NodeSet#[] with large negative index (v1.19...
• 7799fbd fix: avoid NPE on uninitialized XML::Node structs (v1.19.x) (#3645)
• ef19e13 fix(CRuby): avoid UAF in XML::Attr#value= (v1.19.x) (#3644)
• 5524fa9 fix: Document#root= rejects non-element nodes (v1.19.x) (#3643)
• 9891ad1 fix(CRuby): use-after-free in XPathContext document lifetime (v1.19.x) (#3641)
• Additional commits viewable in compare view

Updates opentelemetry-api from 1.9.0 to 1.11.0

Release notes

Sourced from opentelemetry-api's releases.

opentelemetry-api 1.11.0

v1.11.0 / 2026-07-21

• ADDED: Add attributes support to instrumentation scope for tracers (#2094)

opentelemetry-api 1.10.1

v1.10.1 / 2026-07-08

• DOCS: Update source for gemspec links to RubyDoc (#2123)

opentelemetry-api 1.10.0

v1.10.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-logs-api from 0.3.0 to 0.4.1

Release notes

Sourced from opentelemetry-logs-api's releases.

opentelemetry-logs-api 0.4.1

v0.4.1 / 2026-07-08

• DOCS: Update source for gemspec links to RubyDoc (#2123)

opentelemetry-logs-api 0.4.0

v0.4.0 / 2026-05-12

• ADDED: Add event_name field to Logs (#2077)
• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates opentelemetry-metrics-api from 0.5.0 to 0.6.1

Release notes

Sourced from opentelemetry-metrics-api's releases.

opentelemetry-metrics-api 0.6.1

v0.6.1 / 2026-07-08

• DOCS: Update source for gemspec links to RubyDoc (#2123)

opentelemetry-metrics-api 0.6.0

v0.6.0 / 2026-05-12

• ADDED: Add git tag to source URI in gemspec (#2101)

Commits

• See full diff in compare view

Updates parser from 3.3.11.1 to 3.3.12.0

Changelog

Sourced from parser's changelog.

v3.3.12.0 (2026-07-16)

API modifications:

• Bump maintenance branches to 3.3.12 (#1091) (Koichi ITO)

Commits

• 1aa0616 Bump version
• e35a5d0 * Bump maintenance branches to 3.3.12 (#1091)
• f0728b0 Update changelog.
• See full diff in compare view

Updates psych from 5.3.1 to 5.4.0

Release notes

Sourced from psych's releases.

v5.4.0

What's Changed

• update README.md to reflect that Ruby is no longer at 1.9.3 by @​brandonzylstra in ruby/psych#768
• Use TruffleRuby release in CI by @​eregon in ruby/psych#769
• Remove excessive check of message by @​nobu in ruby/psych#770
• Update SnakeYAML-Engine to 3.0.1 by @​headius in ruby/psych#781
• Revert "Update SnakeYAML-Engine to 3.0.1" by @​headius in ruby/psych#785
• Clamp io_reader copy to the buffer libyaml provides by @​hsbt in ruby/psych#795

New Contributors

• @​brandonzylstra made their first contribution in ruby/psych#768

Full Changelog: ruby/psych@v5.3.1...v5.4.0

Commits

• f7066d8 v5.4.0
• 6201ae1 Round the io_reader clamp down to a character boundary
• 99ecd94 Clamp io_reader copy to libyaml's buffer size
• 7a73514 Merge pull request #794 from ruby/dependabot/github_actions/step-security/har...
• cada6bb Bump step-security/harden-runner from 2.19.3 to 2.19.4
• c06a2c5 Merge pull request #793 from ruby/dependabot/github_actions/step-security/har...
• 4a7ca7e Bump step-security/harden-runner from 2.19.1 to 2.19.3
• 790494a Merge pull request #792 from ruby/dependabot/github_actions/step-security/har...
• 16d8518 Bump step-security/harden-runner from 2.19.0 to 2.19.1
• 1366654 Bump step-security/harden-runner from 2.17.0 to 2.19.0
• Additional commits viewable in compare view

Updates sorbet-runtime from 0.6.13296 to 0.6.13371

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.6.13370.20260729110556-7060231cb

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13370', :group => :development
gem 'sorbet-runtime', '0.6.13370'

sorbet 0.6.13369.20260729093301-f01991c53

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13369', :group => :development
gem 'sorbet-runtime', '0.6.13369'

sorbet 0.6.13368.20260729102156-6c1372244

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13368', :group => :development
gem 'sorbet-runtime', '0.6.13368'

sorbet 0.6.13367.20260728094725-39f12e164

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13367', :group => :development
gem 'sorbet-runtime', '0.6.13367'

sorbet 0.6.13366.20260728094500-6c7c8ba6f

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13366', :group => :development
gem 'sorbet-runtime', '0.6.13366'

sorbet 0.6.13365.20260727205640-d94a4d014

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13365', :group => :development
gem 'sorbet-runtime', '0.6.13365'

sorbet 0.6.13364.20260727134127-4b2db3390

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13364', :group => :development
gem 'sorbet-runtime', '0.6.13364'

sorbet 0.6.13363.20260725103232-e4f765e5e

... (truncated)

Commits

• See full diff in compare view

Updates zeitwerk from 2.7.5 to 2.8.2

Changelog

Sourced from zeitwerk's changelog.

2.8.2 (23 May 2026)

• on_load and on_unload accept constant paths with leading colons. For example:

  loader.on_load('::User') { ... }

• on_load and on_unload validate that their input is a constant path. For example:

  loader.on_load(':User') { ... }

  raises NameError.

2.8.1 (19 May 2026)

• Replace anonymous block parameters with regular named ones.

  Ruby 3.3.0 has a bug: it does not parse anonymous block parameters, which were introduced in Ruby 3.1.

  While this is a Ruby bug and people could upgrade to 3.3.1, I prefer users just do not hit this. At the end of the day, it is cosmetic.

2.8.0 (18 May 2026)

• Adds support for namespace files, nsfiles for short.

  If a loader has an nsfile configured (nil by default):

  loader.nsfile = 'ns.rb' # must be set before setup

  explicit namespaces can be defined by such special file inside their directories:

  my_component/ns.rb     # MyComponent
  my_component/widget.rb # MyComponent::Widget
  

  This may be handy for self-contained units for which a my_component.rb file in the parent directory would feel unnatural.

  If an nsfile is set, you can still define explicit namespaces as always. Both styles can coexist in the project. However, it is an error condition to try to define the same namespace using both conventions.

... (truncated)

Commits

• 76f0790 Ready for 2.8.2
• 14cff5e Refactor cpath validation for TruffleRuby
• 8c26393 on_load and on_unload validate their input is a constant path
• ea55f02 Add a constant path validator
• 80e925b Let on_load/on_unload use a sentinel for 0 args
• 2a25bce Add RuboCop to CI
• 198fe83 Linting
• 27b9a58 Merge pull request #335 from Shopify/on_load_qualifier
• 14e4143 Ready for 2.8.1
• 94d607d Remove anonymous blocks
• Additional commits viewable in compare view

Updates aws-sdk-codecommit from 1.97.0 to 1.102.0

Changelog

Sourced from aws-sdk-codecommit's changelog.

1.102.0 (2026-07-09)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.101.0 (2026-05-29)

• Feature - Adding new BDD representation of endpoint ruleset

1.100.0 (2026-05-21)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.99.0 (2026-05-19)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.98.0 (2026-05-13)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

Commits

• See full diff in compare view

Updates aws-sdk-ecr from 1.126.0 to 1.131.0

Changelog

Sourced from aws-sdk-ecr's changelog.

1.131.0 (2026-07-09)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.130.0 (2026-06-01)

• Feature - Adding new BDD representation of endpoint ruleset

1.129.0 (2026-05-21)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.128.0 (2026-05-19)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.127.0 (2026-05-13)

• Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

Commits

• See full diff in compare view

Updates commonmarker from 2.8.2 to 2.9.0

Release notes

Sourced from commonmarker's releases.

v2.9.0

What's Changed

• Fix i686 with u32 parsing hack by @​kivikakk in gjtorikian/commonmarker#471
• feat: Upgrade to comrak 0.54 with math_latex + alert_style options, and changed header_ids by @​gjtorikian in gjtorikian/commonmarker#472
• [skip test] Release v2.9.0 by @​github-actions[bot] in gjtorikian/commonmarker#474

Full Changelog: gjtorikian/commonmarker@v2.8.3...v2.9.0

v2.8.3

What's Changed

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in gjtorikian/commonmarker#464
• Bump actions/cache from 5 to 6 by @​dependabot[bot] in gjtorikian/commonmarker#466
• fix: switch Windows builds to a different regex engine by @​gjtorikian in gjtorikian/commonmarker#468
• [skip test] Release v2.8.3 by @​github-actions[bot] in gjtorikian/commonmarker#469

Full Changelog: gjtorikian/commonmarker@v2.8.2...v2.8.3

Changelog

Sourced from commonmarker's changelog.

[v2.9.0] - 13-07-2026

What's Changed

• Fix i686 with u32 parsing hack by @​kivikakk in gjtorikian/commonmarker#471
• feat: Upgrade to comrak 0.54 with math_latex + alert_style options, and changed header_ids by @​gjtorikian in gjtorikian/commonmarker#472

⚠️ The heading anchor markup changed (from upstream). The id now lives on the heading element and the anchor moved to the end with aria-label + data-heading-content, replacing the leading aria-hidden link. CSS/JS targeting the old markup will be affected. See kivikakk/comrak#808 for more information.

Full Changelog: gjtorikian/commonmarker@v2.8.3...v2.9.0

[v2.8.3] - 03-07-2026

What's Changed

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in gjtorikian/commonmarker#464
• Bump actions/cache from 5 to 6 by @​dependabot[bot] in gjtorikian/commonmarker#466
• fix: switch Windows builds to a different regex engine by @​gjtorikian in gjtorikian/commonmarker#468

Full Changelog: gjtorikian/commonmarker@v2.8.2...v2.8.3

Commits

• 2fc7731 Merge pull request #474 from gjtorikian/release/v2.9.0
• 29d0c80 Update CHANGELOG with heading anchor markup changes
• 177d592 Update CHANGELOG.md
• 3ac1e23 [skip test] update changelog
• cc220cb Bump version to 2.9.0
• 027aa7a Merge pull request #472 from gjtorikian/comrak-54
• 729a867 feat: Add math_latex and alert_style options
• cc7c850 build(deps): Bump comrak from 0.53 to 0.54
• aa268bd Merge pull request #471 from gjtorikian/push-wnxmumqvttrt
• 8b63464 fix i686 with u32 parsing hack.
• Additional commits viewable in compare view

Updates excon from 1.4.2 to 1.6.0

Changelog

Sourced from excon's changelog.

1.6.0 2026-07-16

• bump actions/checkout
• fix incorrect e vs error (x2)
• add read_buffer_scratch to optimize memory/GC

1.5.0 2026-05-03

• update bundled certs
• invalid parameter error for nil host
• close security issues around headers and redirect following

1.4.1 2026-03-18

• change cgi require to cgi/escape for ruby 4.0+

1.4.0 2026-03-02

• fixes for ruby4
• add ruby 4.0 and drop 3.2 from ci
• add user-configurable global resolver factory
• add SOCK5 proxy support

1.3.2 2025-12-03

• update bundled certs

1.3.1 2025-11-05

• update bundled certs

1.3.0 2025-08-18

• proxy connect should always include port, regardless of default

1.2.9 2025-08-15

• bump actions/checkout
• update bundled certs

1.2.8 2025-07-16

... (truncated)

Commits

• c81513d v1.6.0
• afe503f Introduce read_buffer_scratch (#903)
• 5356039 fix an erroneous e vs error reference in error handling (#905)
• bbad91b Fix incorrect variable name (#904)
• 30167a4 Bump actions/checkout from 6 to 7 (#902)

[JamieMagee]

@dependabot rebase