Skip to content

Bump the all-dependencies group across 1 directory with 35 updates - #807

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/all-dependencies-b1f3d6257e
Open

Bump the all-dependencies group across 1 directory with 35 updates#807
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/all-dependencies-b1f3d6257e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown

Bumps the all-dependencies group with 34 updates in the / directory:

Package From To
shakapacker 10.2.0 10.3.1
rails 8.1.3 8.1.3.1
pg 1.5.6 1.6.3
bootsnap 1.23.0 1.24.6
puma 6.4.2 8.0.2
thruster 0.1.16 0.1.23
uglifier 4.2.0 4.2.1
jbuilder 2.12.0 2.15.1
redis 5.3.0 6.0.0
sdoc 2.6.1 2.6.5
rails-html-sanitizer 1.7.0 1.7.1
autoprefixer-rails 10.4.16.0 10.4.21.0
redcarpet 3.6.0 3.6.1
web-console 4.2.1 4.3.0
spring 4.2.1 4.7.0
factory_bot_rails 6.4.3 6.5.1
foreman 0.88.1 0.90.0
rubocop 1.69.0 1.88.2
rubocop-performance 1.23.1 1.26.1
rubocop-rails 2.29.1 2.36.0
rubocop-rspec 3.4.0 3.10.2
debug 1.9.2 1.11.1
pry 0.14.2 0.16.0
pry-doc 1.5.0 1.7.0
pry-stack_explorer 0.6.1 0.6.3
capybara-screenshot 1.0.26 1.0.27
coveralls_reborn 0.25.0 1.0.0
database_cleaner 2.0.2 2.1.0
launchy 3.0.1 3.1.1
rails_best_practices 1.23.2 1.23.4
rspec-rails 6.0.4 8.0.4
selenium-webdriver 4.22.0 4.46.0
stimulus-rails 1.3.3 1.3.4
turbo-rails 2.0.11 2.0.23

Updates shakapacker from 10.2.0 to 10.3.1

Release notes

Sourced from shakapacker's releases.

v10.3.0

Added

Fixed

  • Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
  • Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
  • Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.
Changelog

Sourced from shakapacker's changelog.

[v10.3.1] - August 3, 2026

Fixed

  • Fixed 502 responses for proxied dev server assets under rack-proxy v1. [PR #1222](shakacode/shakapacker#1222) by jcbpl. Fixes #1220.
  • Fixed dev-server liveness checks treating refused macOS 27 connections as running. The Ruby probe now verifies the connected socket's SO_ERROR result before proxying asset requests, avoiding false-positive dev-server detection and resulting 502 responses. [PR #1225](shakacode/shakapacker#1225) by justin808. Fixes #1224.
  • Fixed webpack Babel, SWC, and esbuild rules skipping explicitly included .cjs files. [PR #1219](shakacode/shakapacker#1219) by oiahoon. Fixes #1218.
  • Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
  • Fixed the missing-@babel/core failure to report an actionable install message. [PR #1212](shakacode/shakapacker#1212) by justin808. Babel-transpiled builds whose app lacks @babel/core previously surfaced a raw module-resolution error from the Babel 8 compatibility check; the rule now explains which package to install and how to switch javascript_transpiler instead. Refs #1163.

Documentation

  • Documented the required css-loader@^7.1.4 in the v10 Rspack upgrade instructions. [PR #1211](shakacode/shakapacker#1211) by justin808. The v10 upgrade guide's copy-paste Rspack v2 commands omitted css-loader, so apps following them could upgrade into an unsatisfied peer dependency.

[v10.3.0] - July 5, 2026

Added

Fixed

  • Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
  • Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
  • Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.
Commits

Updates rails from 8.1.3 to 8.1.3.1

Release notes

Sourced from rails's releases.

8.1.3.1

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • Disable libvips's unfuzzed image loaders and savers.

    libvips flags some of its loaders and savers as "unfuzzed" or "untrusted", meaning they are only safe for trusted content. Active Storage will call Vips.block_untrusted(true) to disable them while booting. An application that needs a specific loader or saver may re-enable it in an initializer.

... (truncated)

Commits

Updates pg from 1.5.6 to 1.6.3

Changelog

Sourced from pg's changelog.

v1.6.3 [2025-12-29] Lars Kanis lars@greiz-reinsdorf.de

Added:

  • Add binary gems for ruby-4.0, now providing ruby-3.0 to 4.0. #682
  • Update fat binary gem to OpenSSL-3.6.0 and PostgreSQL-18.1.
  • Improve documentation of PG::Result and README. #676
  • Update errorcodes to PostgreSQL-18.
  • Use rb_hash_new_capa on Ruby-3.2+ . #674
  • Deny any server communication on a frozen PG::Connection . #677
  • Fix possible race condition in PG::Result in Ractor context. #674

Removed:

  • Drop binary gem support for platform x86-mingw32. #682
  • Drop binary gems for ruby-2.7.

v1.6.2 [2025-09-02] Lars Kanis lars@greiz-reinsdorf.de

  • Remove several absolute paths from native binaries which pointed to build directories. #668
  • Fix bad fallback path to pg_service.conf. #666
  • Use rbpg_ prefix for base64_* functions to avoid name clashes with functions provided by other libraries like Heimdal on Macos. #667
  • Raise a more descriptive error message in case of pg_ext LoadError. #664
  • Freeze some constants to make them available in a Ractor context. #660
  • Several documentation improvements.
  • Update native binary gems to OpenSSL-3.5.2, krb5-1.22.1 and PostgreSQL-17.6.

v1.6.1 [2025-08-03] Lars Kanis lars@greiz-reinsdorf.de

  • Add binary gems for platforms aarch64-linux-musl and x86_64-linux-musl without the need to install package gcompat. #657.
  • Serialize CompositeCoder#dimensions only when set. #652 This fixes the compatibility to pg-1.5.9, when deserializing Marshal data from pg-1.6, as long as the new attribute isn't used.
  • Remove dependency to MSYS2 package "postgresql" from binary Windows gem #654

v1.6.0 [2025-07-27] Lars Kanis lars@greiz-reinsdorf.de

Added:

  • Add binary gems for Ruby 3.4.
  • Add fat binary gem for platform aarch64-mingw-ucrt aka Windows on ARM #626, for platform Macos on Intel and ARM #643, for platform aarch64-linux #646 and for platform x86_64-linux #551.
  • Update fat binary gem to OpenSSL-3.5.1 and PostgreSQL-17.5.
  • Add a patch to libpq to avoid starvation on bigger SSL records, which some database engines other than vanilla PostgreSQL use. This patch applies to platform specific binary gems only. #616
  • Add support for new query cancel functions of PostgreSQL-17. This adds the new class PG::CancelConnection which provides the ability to cancel a query per blocking or per non-blocking functions. If the new functions are available they are used and the older are no longer compiled in.

... (truncated)

Commits
  • d4539c2 Bump VERSION to pg-1.6.3 and add release notes
  • 720900d Merge pull request #682 from larskanis/ruby-4.0
  • f605b59 Remove x86-mingw32 from binary builds
  • 5c69000 Update to ruby-4.0
  • 2acaf3d CI: workaround missing ruby-4.0 on Window
  • b500ded fix comment
  • bc3f2f8 CI: Macos-13 on Intel is deprecated
  • 77667eb Merge pull request #678 from larskanis/ci-update
  • 6e52ce5 CI: Update PostgreSQL on Macos
  • 6d40f50 CI: Print mkmf.log on failure on Macos
  • Additional commits viewable in compare view

Updates bootsnap from 1.23.0 to 1.24.6

Release notes

Sourced from bootsnap's releases.

v1.24.4

What's Changed

  • Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
  • Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
  • Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
  • Avoid leaking a private method in Object when testing for Parse.y bugs.

Full Changelog: rails/bootsnap@v1.24.3...v1.24.4

v1.24.3

  • Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

Full Changelog: rails/bootsnap@v1.24.2...v1.24.3

v1.24.2

What's Changed

  • Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

Full Changelog: rails/bootsnap@v1.24.1...v1.24.2

v1.24.1

What's Changed

  • Fix encoding of Ruby source files loaded when BOOTSNAP_READONLY is set. Files would incorectly be loaded in ASCII-8BIT causing literal strings outside the pure ASCII range to have ASCII-8BIT encoding instead of UTF-8. This bug was introduced in 1.24.0.

Full Changelog: rails/bootsnap@v1.24.0...v1.24.1

v1.24.0

What's Changed

  • Added a hook API to customize Ruby compilation.

Full Changelog: rails/bootsnap@v1.23.0...v1.24.0

Changelog

Sourced from bootsnap's changelog.

1.24.6

  • Fix detection of Ruby bug #22023 on some patch versions of Ruby 3.4, and properly apply the workaround.

1.24.5

  • No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

1.24.4

  • Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
  • Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
  • Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
  • Avoid leaking a private method in Object when testing for Parse.y bugs.

1.24.3

  • Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

1.24.2

  • Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

1.24.1

  • Fix encoding of Ruby source files loaded when BOOTSNAP_READONLY is set. Files would incorectly be loaded in ASCII-8BIT causing literal strings outside the pure ASCII range to have ASCII-8BIT encoding instead of UTF-8. This bug was introduced in 1.24.0.

1.24.0

  • Added a hook API to customize Ruby compilation.
Commits
  • 026e183 Release 1.24.6
  • 263e346 Merge pull request #556 from byroot/remove-canary
  • 7c31cd8 Check for [Bug #22023] by checking Ruby version rather than a canary
  • 54eba76 Merge pull request #554 from byroot/namespace-overflow
  • fe963d5 bs_cache_path: account for namespace length
  • 7b42db6 Merge pull request #553 from arpitjain099/chore/declare-workflow-perms
  • 113b184 ci: add permissions: contents: read to ci
  • d6ca050 Release 1.24.5
  • 579aa0e Merge pull request #552 from byroot/fix-bootsnap-config
  • 2884e89 Only load config file is directed to by .setup
  • Additional commits viewable in compare view

Updates puma from 6.4.2 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

v8.0.1

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

... (truncated)

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

  • Bugfixes
    • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
    • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

  • Bugfixes

    • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

  • Performance

    • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

  • Docs

    • Fix incorrect hook names in gRPC docs (#3923)
    • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

  • Features

    • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
    • Add single and cluster DSL hooks for mode-specific configuration (#3621)
    • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
    • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
    • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

  • Bugfixes

    • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

  • Performance

    • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
    • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

  • Refactor

    • Collect env processing into dedicated client_env.rb module (#3582)
    • Move event to default configuration (#3872)

  • Docs

    • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
    • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
    • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
    • Add file descriptor limit warning in test helper for contributors (#3893)

  • Breaking changes

    • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

7.2.1 / 2026-05-27

  • Bugfixes

... (truncated)

Commits

Updates thruster from 0.1.16 to 0.1.23

Changelog

Sourced from thruster's changelog.

v0.1.22 / 2026-06-29

  • Build with Go 1.26.4
  • Exclude image types from compression (#137)

v0.1.21 / 2026-05-17

  • Build with Go 1.26.3

v0.1.20 / 2026-03-25

  • Only redirect HTTP->HTTPS for policy-allowed hosts

v0.1.19 / 2026-03-06

  • Build with Go 1.26.1

v0.1.18 / 2026-02-02

  • Return correct exit code when terminated with signal (#110)
  • Build with Go 1.25.6

v0.1.17 / 2025-12-16

  • Mitigate BREACH attacks with random jitter and optional compression guard (#102)
Commits
  • 168dc1f Update version & changelog
  • 900411c Merge pull request #140 from rafafloresta/bump-go-1.26.5-security
  • 2eb7870 Bump Go to 1.26.5 to fix crypto/tls ECH de-anonymization (CVE-2026-42505)
  • 3acd601 Merge pull request #138 from basecamp/version-0.1.22
  • 43dfae9 Version 0.1.22
  • 6c45e38 Merge pull request #137 from basecamp/compression-exclude-image-types
  • 33ea926 Exclude image types from compression
  • 043a28e Merge pull request #136 from basecamp/check-fmt-in-ci
  • 22e7ee8 Check formatting during CI
  • c64f358 Merge pull request #135 from basecamp/go-1-26-4
  • Additional commits viewable in compare view

Updates uglifier from 4.2.0 to 4.2.1

Changelog

Sourced from uglifier's changelog.

4.2.1 (22 September 2024)

  • fix Ruby 3.4 compatiblity, drop Ruby 2.3 and older support (#195)
  • fix typos (#194)
Commits
  • 959b740 Bump version to 4.2.1
  • 5a6a6f4 Update changelog
  • f7ee1a2 Merge branch 'drop-base64'
  • b808f14 Merge pull request #194 from kianmeng/fix-typos
  • 46b75e4 Bump required ruby version to 2.4
  • 81fbc31 Merge pull request #196 from lautis/ci-ruby-versions
  • 030a33e Use released version of alaska runtime to run tests
  • 15d317d Update build matrix
  • 89c6136 Drop base64 gem from dependency
  • 0947f7c Merge pull request #191 from SimenB/master-1
  • Additional commits viewable in compare view

Updates jbuilder from 2.12.0 to 2.15.1

Release notes

Sourced from jbuilder's releases.

v2.15.1

What's Changed

New Contributors

Full Changelog: rails/jbuilder@v2.15.0...v2.15.1

v2.15.0

What's Changed

New Contributors

Full Changelog: rails/jbuilder@v2.14.1...v2.15.0

v2.14.1

What's Changed

New Contributors

Full Changelog: rails/jbuilder@v2.14.0...v2.14.1

v2.14.0

What's Changed

... (truncated)

Commits
  • 31eb6e9 Prepare for 2.15.1
  • 154b0fe Merge pull request #617 from rails/rm-fix-616
  • d3e763b Fix partial for Active Model when extra locals are passed in
  • 018083d Prepare for 2.15.0
  • 72cf067 Update devcontainer image to Ruby 4.0.4 and add devcontainer-lock.json
  • d35a962 Merge pull request #615 from taketo1113/ci-rails8.1-ruby4.0
  • cc42e7e CI: Add Rails 8.1 & Ruby 4.0 to CI Matrix
  • cd7482e Merge pull request #613 from affinity/moberegger/fix-inline-partial-locals-be
  • 58283a0 Merge pull request #612 from affinity/moberegger/optimize-_map_collection
  • 09ca3e1 Merge pull request #603 from taketo1113/update-rack-unprocessable_content
  • Additional commits viewable in compare view

Updates redis from 5.3.0 to 6.0.0

Release notes

Sourced from redis's releases.

6.0.0

This is a major release of the redis and redis-clustering gems. The headline change is that the client now speaks RESP3 by default, alongside first-class support for the Redis Query Engine and the JSON module, a batch of new Redis 6.2–8.10 commands, and experimental support for the Redis 8.10 HIMPORT bulk-ingestion command family.

Command return values are unchanged from 5.x with one exception (GEO coordinates, see below), so for most applications this upgrade is a Gemfile bump.

Requires Ruby 3.2+ and works with Redis server 6.0+ (older servers are handled via automatic RESP2 fallback).

RESP3 by default

RESP3's richer wire types (native maps, doubles, booleans) let the parser deliver replies already in their final Ruby shape. Under RESP2, structured replies arrive as flat arrays of bulk strings that the client must re-shape in Ruby — e.g. HGETALL builds a Hash from a flat [field, value, ...] array, and sorted-set scores are converted String → Float pair by pair. Under RESP3 that re-shaping pass disappears.

Measured with bench/resp_comparison.rb (redis-rb 6.0.0, Ruby 3.4.1, Redis 8.8, localhost, 100-element replies):

Pure-Ruby driver (default):

Workload RESP2 → RESP3 RPS (8 threads) RESP2 → RESP3 µs CPU/op
GET (50B string) 4251 → 4436 (+4%) 23.4 → 22.9 (~0)
HGETALL (100 fields) 2361 → 2560 (+8%) 164 → 129 (−22%)
ZRANGE WITHSCORES (100) 2597 → 2459 (−5%) 130 → 147 (~0, noise)
XRANGE (100 entries) 1544 → 1570 (+2%) 346 → 328 (~0)

hiredis driver (C parser):

Workload RESP2 → RESP3 RPS (8 threads) RESP2 → RESP3 µs CPU/op
GET 12756 → 12620 (~0) 69 → 70 (~0)
HGETALL 10175 → 10592 (+4%) 97 → 89 (−8%; 1 thread: 88 → 63, −28%)
ZRANGE WITHSCORES 10036 → 11629 (+16%) 108 → 85 (−22%)
XRANGE 7053 → 6999 (~0) 152 → 152 (~0)

In short: hash reads use ~10–25% less client CPU per call on both drivers; sorted-set reads with scores gain up to 16% throughput and ~20% less CPU with hiredis (unchanged on the pure-Ruby driver, where parsing RESP3 doubles costs roughly what the re-shaping pass did); simple string and stream commands are unaffected — their reply shapes are the same in both protocols. RESP3 pairs best with the hiredis driver, which moves all reply construction out of Ruby and into C.

Methodology note: figures are per-reply CPU measurements against a localhost server; wall-clock throughput gains in production depend on how network-bound your workload is.

Beyond performance, RESP3 also lays the groundwork for push-based features — such as server-assisted client-side caching (CLIENT TRACKING invalidation events) — in future 6.x releases, without another protocol migration.

🔥 Breaking changes

  • RESP3 by default (see above); pass protocol: 2 to keep RESP2. The only return-value change is GEO coordinates as Float. (#1351)
  • Requires Ruby 3.2+ (previously 2.7/2.6). Bundler will keep older Rubies on the 5.4.x series automatically. (#1353, #1365)

Cluster gem (redis-clustering) only

  • Commands are now routed by their server-declared command tips (redis-cluster-client 0.16.6+): SLOWLOG GET returns one entry list per master; SLOWLOG LEN and LATENCY RESET return the sum across all masters; FUNCTION LOAD/DELETE/FLUSH/RESTORE now execute on all masters (previously a single arbitrary node — this also fixes FCALL failing for keys on other masters); commands with keys in subcommands (e.g. XINFO STREAM) route to the key's slot owner.

🚀 New features

  • Redis Query Engine (RediSearch, FT.*): ft_create, ft_alter, ft_dropindex, ft_info, ft_search, ft_aggregate, vector and hybrid search, suggestions, dictionaries, synonyms, aliases, and spellcheck. Not supported by Redis::Distributed. (#1356, #1359, #1360, #1361)
  • JSON module: json_set, json_get, json_mset, json_mget, json_del, json_forget, json_clear, json_merge, json_arr*, json_obj*, json_str*, json_numincrby, json_toggle, json_type, json_debug_memory. (#1346, #1347, #1348, #1349)

... (truncated)

Changelog

Sourced from redis's changelog.

6.0.0

Breaking changes

  • Use RESP3 (HELLO 3) by default; pass protocol: 2 to keep RESP2. GEOPOS and GEOSEARCH/GEORADIUS with WITHCOORD now return coordinates as Float instead of String. See

@dependabot
Bump the all-dependencies group across 1 directory with 35 updates
5469c81 
Bumps the all-dependencies group with 34 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [shakapacker](https://github.com/shakacode/shakapacker) | `10.2.0` | `10.3.1` |
| [rails](https://github.com/rails/rails) | `8.1.3` | `8.1.3.1` |
| [pg](https://github.com/ged/ruby-pg) | `1.5.6` | `1.6.3` |
| [bootsnap](https://github.com/rails/bootsnap) | `1.23.0` | `1.24.6` |
| [puma](https://github.com/puma/puma) | `6.4.2` | `8.0.2` |
| [thruster](https://github.com/basecamp/thruster) | `0.1.16` | `0.1.23` |
| [uglifier](https://github.com/lautis/uglifier) | `4.2.0` | `4.2.1` |
| [jbuilder](https://github.com/rails/jbuilder) | `2.12.0` | `2.15.1` |
| [redis](https://github.com/redis/redis-rb) | `5.3.0` | `6.0.0` |
| [sdoc](https://github.com/zzak/sdoc) | `2.6.1` | `2.6.5` |
| [rails-html-sanitizer](https://github.com/rails/rails-html-sanitizer) | `1.7.0` | `1.7.1` |
| [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) | `10.4.16.0` | `10.4.21.0` |
| [redcarpet](https://github.com/vmg/redcarpet) | `3.6.0` | `3.6.1` |
| [web-console](https://github.com/rails/web-console) | `4.2.1` | `4.3.0` |
| [spring](https://github.com/rails/spring) | `4.2.1` | `4.7.0` |
| [factory_bot_rails](https://github.com/thoughtbot/factory_bot_rails) | `6.4.3` | `6.5.1` |
| [foreman](https://github.com/ddollar/foreman) | `0.88.1` | `0.90.0` |
| [rubocop](https://github.com/rubocop/rubocop) | `1.69.0` | `1.88.2` |
| [rubocop-performance](https://github.com/rubocop/rubocop-performance) | `1.23.1` | `1.26.1` |
| [rubocop-rails](https://github.com/rubocop/rubocop-rails) | `2.29.1` | `2.36.0` |
| [rubocop-rspec](https://github.com/rubocop/rubocop-rspec) | `3.4.0` | `3.10.2` |
| [debug](https://github.com/ruby/debug) | `1.9.2` | `1.11.1` |
| [pry](https://github.com/pry/pry) | `0.14.2` | `0.16.0` |
| [pry-doc](https://github.com/pry/pry-doc) | `1.5.0` | `1.7.0` |
| [pry-stack_explorer](https://github.com/pry/pry-stack_explorer) | `0.6.1` | `0.6.3` |
| [capybara-screenshot](https://github.com/mattheworiordan/capybara-screenshot) | `1.0.26` | `1.0.27` |
| [coveralls_reborn](https://github.com/tagliala/coveralls-ruby-reborn) | `0.25.0` | `1.0.0` |
| [database_cleaner](https://github.com/DatabaseCleaner/database_cleaner) | `2.0.2` | `2.1.0` |
| [launchy](https://github.com/copiousfreetime/launchy) | `3.0.1` | `3.1.1` |
| [rails_best_practices](https://github.com/flyerhzm/rails_best_practices) | `1.23.2` | `1.23.4` |
| [rspec-rails](https://github.com/rspec/rspec-rails) | `6.0.4` | `8.0.4` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.22.0` | `4.46.0` |
| [stimulus-rails](https://github.com/hotwired/stimulus-rails) | `1.3.3` | `1.3.4` |
| [turbo-rails](https://github.com/hotwired/turbo-rails) | `2.0.11` | `2.0.23` |



Updates `shakapacker` from 10.2.0 to 10.3.1
- [Release notes](https://github.com/shakacode/shakapacker/releases)
- [Changelog](https://github.com/shakacode/shakapacker/blob/main/CHANGELOG.md)
- [Commits](shakacode/shakapacker@v10.2.0...v10.3.1)

Updates `rails` from 8.1.3 to 8.1.3.1
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](rails/rails@v8.1.3...v8.1.3.1)

Updates `pg` from 1.5.6 to 1.6.3
- [Changelog](https://github.com/ged/ruby-pg/blob/master/CHANGELOG.md)
- [Commits](ged/ruby-pg@v1.5.6...v1.6.3)

Updates `bootsnap` from 1.23.0 to 1.24.6
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](rails/bootsnap@v1.23.0...v1.24.6)

Updates `puma` from 6.4.2 to 8.0.2
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/main/History.md)
- [Commits](puma/puma@v6.4.2...v8.0.2)

Updates `thruster` from 0.1.16 to 0.1.23
- [Changelog](https://github.com/basecamp/thruster/blob/main/CHANGELOG.md)
- [Commits](basecamp/thruster@v0.1.16...v0.1.23)

Updates `uglifier` from 4.2.0 to 4.2.1
- [Changelog](https://github.com/lautis/uglifier/blob/master/CHANGELOG.md)
- [Commits](lautis/uglifier@v4.2.0...v4.2.1)

Updates `jbuilder` from 2.12.0 to 2.15.1
- [Release notes](https://github.com/rails/jbuilder/releases)
- [Commits](rails/jbuilder@v2.12.0...v2.15.1)

Updates `redis` from 5.3.0 to 6.0.0
- [Release notes](https://github.com/redis/redis-rb/releases)
- [Changelog](https://github.com/redis/redis-rb/blob/master/CHANGELOG.md)
- [Commits](redis/redis-rb@v5.3.0...v6.0.0)

Updates `sdoc` from 2.6.1 to 2.6.5
- [Changelog](https://github.com/zzak/sdoc/blob/main/CHANGELOG.md)
- [Commits](https://github.com/zzak/sdoc/commits)

Updates `rails-html-sanitizer` from 1.7.0 to 1.7.1
- [Release notes](https://github.com/rails/rails-html-sanitizer/releases)
- [Changelog](https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md)
- [Commits](rails/rails-html-sanitizer@v1.7.0...v1.7.1)

Updates `autoprefixer-rails` from 10.4.16.0 to 10.4.21.0
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](ai/autoprefixer-rails@10.4.16.0...10.4.21.0)

Updates `redcarpet` from 3.6.0 to 3.6.1
- [Release notes](https://github.com/vmg/redcarpet/releases)
- [Changelog](https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md)
- [Commits](vmg/redcarpet@v3.6.0...v3.6.1)

Updates `web-console` from 4.2.1 to 4.3.0
- [Release notes](https://github.com/rails/web-console/releases)
- [Changelog](https://github.com/rails/web-console/blob/main/CHANGELOG.markdown)
- [Commits](rails/web-console@v4.2.1...v4.3.0)

Updates `spring` from 4.2.1 to 4.7.0
- [Release notes](https://github.com/rails/spring/releases)
- [Changelog](https://github.com/rails/spring/blob/main/CHANGELOG.md)
- [Commits](rails/spring@v4.2.1...v4.7.0)

Updates `factory_bot_rails` from 6.4.3 to 6.5.1
- [Release notes](https://github.com/thoughtbot/factory_bot_rails/releases)
- [Changelog](https://github.com/thoughtbot/factory_bot_rails/blob/main/NEWS.md)
- [Commits](thoughtbot/factory_bot_rails@v6.4.3...v6.5.1)

Updates `foreman` from 0.88.1 to 0.90.0
- [Changelog](https://github.com/ddollar/foreman/blob/main/Changelog.md)
- [Commits](ddollar/foreman@v0.88.1...v0.90.0)

Updates `rubocop` from 1.69.0 to 1.88.2
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.69.0...v1.88.2)

Updates `rubocop-performance` from 1.23.1 to 1.26.1
- [Release notes](https://github.com/rubocop/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-performance@v1.23.1...v1.26.1)

Updates `rubocop-rails` from 2.29.1 to 2.36.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rails@v2.29.1...v2.36.0)

Updates `rubocop-rspec` from 3.4.0 to 3.10.2
- [Release notes](https://github.com/rubocop/rubocop-rspec/releases)
- [Changelog](https://github.com/rubocop/rubocop-rspec/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rspec@v3.4.0...v3.10.2)

Updates `debug` from 1.9.2 to 1.11.1
- [Release notes](https://github.com/ruby/debug/releases)
- [Commits](ruby/debug@v1.9.2...v1.11.1)

Updates `pry` from 0.14.2 to 0.16.0
- [Release notes](https://github.com/pry/pry/releases)
- [Changelog](https://github.com/pry/pry/blob/master/CHANGELOG.md)
- [Commits](pry/pry@v0.14.2...v0.16.0)

Updates `pry-byebug` from 3.10.1 to 3.12.0
- [Release notes](https://github.com/deivid-rodriguez/pry-byebug/releases)
- [Changelog](https://github.com/deivid-rodriguez/pry-byebug/blob/master/CHANGELOG.md)
- [Commits](deivid-rodriguez/pry-byebug@v3.10.1...v3.12.0)

Updates `pry-doc` from 1.5.0 to 1.7.0
- [Release notes](https://github.com/pry/pry-doc/releases)
- [Changelog](https://github.com/pry/pry-doc/blob/master/CHANGELOG.md)
- [Commits](pry/pry-doc@v1.5.0...v1.7.0)

Updates `pry-stack_explorer` from 0.6.1 to 0.6.3
- [Release notes](https://github.com/pry/pry-stack_explorer/releases)
- [Changelog](https://github.com/pry/pry-stack_explorer/blob/master/CHANGELOG)
- [Commits](pry/pry-stack_explorer@v0.6.1...v0.6.3)

Updates `capybara-screenshot` from 1.0.26 to 1.0.27
- [Release notes](https://github.com/mattheworiordan/capybara-screenshot/releases)
- [Changelog](https://github.com/mattheworiordan/capybara-screenshot/blob/master/CHANGELOG.md)
- [Commits](mattheworiordan/capybara-screenshot@v1.0.26...v1.0.27)

Updates `coveralls_reborn` from 0.25.0 to 1.0.0
- [Release notes](https://github.com/tagliala/coveralls-ruby-reborn/releases)
- [Changelog](https://github.com/tagliala/coveralls-ruby-reborn/blob/main/CHANGELOG.md)
- [Commits](tagliala/coveralls-ruby-reborn@v0.25.0...v1.0.0)

Updates `database_cleaner` from 2.0.2 to 2.1.0
- [Changelog](https://github.com/DatabaseCleaner/database_cleaner/blob/main/History.rdoc)
- [Commits](DatabaseCleaner/database_cleaner@v2.0.2...v2.1.0)

Updates `launchy` from 3.0.1 to 3.1.1
- [Changelog](https://github.com/copiousfreetime/launchy/blob/main/HISTORY.md)
- [Commits](copiousfreetime/launchy@v3.0.1...v3.1.1)

Updates `rails_best_practices` from 1.23.2 to 1.23.4
- [Changelog](https://github.com/flyerhzm/rails_best_practices/blob/main/CHANGELOG.md)
- [Commits](flyerhzm/rails_best_practices@v1.23.2...v1.23.4)

Updates `rspec-rails` from 6.0.4 to 8.0.4
- [Changelog](https://github.com/rspec/rspec-rails/blob/main/Changelog.md)
- [Commits](rspec/rspec-rails@v6.0.4...v8.0.4)

Updates `selenium-webdriver` from 4.22.0 to 4.46.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.22.0...selenium-4.46.0)

Updates `stimulus-rails` from 1.3.3 to 1.3.4
- [Release notes](https://github.com/hotwired/stimulus-rails/releases)
- [Commits](hotwired/stimulus-rails@v1.3.3...v1.3.4)

Updates `turbo-rails` from 2.0.11 to 2.0.23
- [Release notes](https://github.com/hotwired/turbo-rails/releases)
- [Commits](hotwired/turbo-rails@v2.0.11...v2.0.23)

---
updated-dependencies:
- dependency-name: shakapacker
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rails
  dependency-version: 8.1.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: pg
  dependency-version: 1.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: bootsnap
  dependency-version: 1.24.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: puma
  dependency-version: 8.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: thruster
  dependency-version: 0.1.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: uglifier
  dependency-version: 4.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: jbuilder
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: redis
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: sdoc
  dependency-version: 2.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: rails-html-sanitizer
  dependency-version: 1.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: autoprefixer-rails
  dependency-version: 10.4.21.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: redcarpet
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: web-console
  dependency-version: 4.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: spring
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: factory_bot_rails
  dependency-version: 6.5.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: foreman
  dependency-version: 0.90.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rubocop
  dependency-version: 1.88.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rubocop-performance
  dependency-version: 1.26.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rubocop-rails
  dependency-version: 2.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rubocop-rspec
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: debug
  dependency-version: 1.11.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: pry
  dependency-version: 0.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: pry-byebug
  dependency-version: 3.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: pry-doc
  dependency-version: 1.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: pry-stack_explorer
  dependency-version: 0.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: capybara-screenshot
  dependency-version: 1.0.27
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: coveralls_reborn
  dependency-version: 1.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: database_cleaner
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: launchy
  dependency-version: 3.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: rails_best_practices
  dependency-version: 1.23.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: rspec-rails
  dependency-version: 8.0.4
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: all-dependencies
- dependency-name: selenium-webdriver
  dependency-version: 4.46.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: all-dependencies
- dependency-name: stimulus-rails
  dependency-version: 1.3.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
- dependency-name: turbo-rails
  dependency-version: 2.0.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: all-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 6, 2026
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Aug 6, 2026

Copy link
Copy Markdown

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

🚀 Quick Review App Commands

Welcome! Here are the commands you can use in this PR:
They require the repository to have cpflow review apps configured, including the CPLN_TOKEN_STAGING secret.

+review-app-deploy

Deploy your PR branch for testing.

+review-app-delete

Remove the review app when done.

+review-app-help

Show detailed instructions, environment setup, and configuration options.

Comment +review-app-help for full setup details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants