Skip to content

Bump the minor-and-patch group with 11 updates - #2704

Merged
KaanOzkan merged 2 commits into
mainfrom
dependabot/bundler/minor-and-patch-8dbeb0b838
Aug 25, 2026
Merged

Bump the minor-and-patch group with 11 updates#2704
KaanOzkan merged 2 commits into
mainfrom
dependabot/bundler/minor-and-patch-8dbeb0b838

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 11 updates:

Package From To
rubocop-sorbet 0.14.0 0.15.0
ruby-lsp 0.26.10 0.26.11
sprockets 4.3.0 4.4.0
dalli 5.0.6 5.1.0
google-protobuf 4.35.1 4.36.0
graphql 2.6.8 2.6.9
sidekiq 8.1.6 8.1.7
sorbet-static 0.6.13426 0.6.13433
webmock 3.26.2 3.26.3
rubydex 0.3.0 0.4.0
sorbet-static-and-runtime 0.6.13426 0.6.13433

Updates rubocop-sorbet from 0.14.0 to 0.15.0

Release notes

Sourced from rubocop-sorbet's releases.

v0.15.0

What's Changed

🛠 Other Changes

New Contributors

Full Changelog: Shopify/rubocop-sorbet@v0.14.0...v0.15.0

Commits
  • a88afd4 Release v0.15.0
  • c3e4550 Merge pull request #405 from Shopify/t-must-rbs-autocorrection
  • 946e63b Add trailing comment autocorrection test
  • 673b342 Merge pull request #409 from Shopify/t-absurd-inline-else
  • 0dac722 Test inline unless absurd autocorrection
  • 6979d2e Handle inline if else T.absurd autocorrection
  • 0ce61e7 Autocorrect inline else T.absurd calls
  • 6468538 Merge pull request #404 from Shopify/t-unsafe-rbs-autocorrection
  • 5a5dc70 Merge pull request #407 from Shopify/t-let-rbs-autocorrection
  • 9cf7734 Merge pull request #406 from Shopify/t-cast-rbs-autocorrection
  • Additional commits viewable in compare view

Updates ruby-lsp from 0.26.10 to 0.26.11

Release notes

Sourced from ruby-lsp's releases.

v0.26.11

🐛 Bug Fixes

Commits
  • 6745c16 Bump version to v0.26.11
  • 3517da1 Ensure beta rails add-on is used when beta is enabled (#4194)
  • 33e50bd Merge pull request #4192 from Shopify/dependabot/submodules/test/fixtures/pri...
  • 929b79f Bump test/fixtures/prism from 115d58f to 9175663
  • b25bb6d Merge pull request #4190 from Shopify/dependabot/github_actions/pnpm/action-s...
  • 685138b Merge pull request #4189 from Shopify/dependabot/submodules/test/fixtures/pri...
  • 2d9610c Bump pnpm/action-setup from 6.0.9 to 6.0.10
  • 87bd973 Bump test/fixtures/prism from 03bde59 to 115d58f
  • a9e5a28 Merge pull request #4184 from Shopify/dependabot/submodules/test/fixtures/pri...
  • b789cd8 Merge pull request #4185 from Shopify/dependabot/github_actions/actions/stale...
  • Additional commits viewable in compare view

Updates sprockets from 4.3.0 to 4.4.0

Changelog

Sourced from sprockets's changelog.

4.4.0

  • Implement ignore_mtime option. #831
  • Allow disabling cache limits. #831
Commits
  • 73c5a53 Release 4.4.0
  • 2150282 Merge pull request #833 from davidenglishmusic/performance-tweaks
  • c740b84 Hoist relative_path? regexp into a constant
  • 073939c Fix performance cop offenses in tests
  • ec6a30a Merge pull request #832 from byroot/disable-digest
  • 2c367fa Implement ignore_mtime option
  • 00a73a9 Merge pull request #831 from byroot/no-cache-limit
  • 826bd23 Allow disabling the cache limits
  • 2d06c2d Update test matrix
  • See full diff in compare view

Updates dalli from 5.0.6 to 5.1.0

Release notes

Sourced from dalli's releases.

v5.1.0

Features:

  • Add opaque routing tokens: :p_token and :l_token request options (#1147, #1154)

    • get, gat, get_cas, get_with_metadata, fetch_with_lock, set/add/replace/set_cas/replace_cas, append/prepend, incr/decr, cas/cas!, delete/delete_cas, and the bulk operations (get_multi, get_multi_cas, get_multi_with_metadata, set_multi, delete_multi) all accept per-request :p_token/:l_token options, appended to the wire protocol as P<token>/L<token> -- applied to every key on the bulk methods
    • memcached itself ignores these tokens; per the meta protocol spec they exist as hints for a proxy or router sitting between the client and memcached
    • CRLF and NUL bytes raise ArgumentError before the request reaches the socket, both in Dalli::Client and in RequestFormatter, so a bad token can't be used for wire-protocol injection and can't close the connection out from under the caller the way a formatter-only check would
    • The bulk methods and delete/delete_cas were deferred out of #1147 to avoid racing other in-flight PRs touching the same method signatures; #1154 completes them, including both the single-server fast path and the multi-server pipelined path for each
    • Extracted from #1130; thanks to Nick Herson for the original idea and Jianbin Chen for porting it forward

  • Support tombstone (mark-stale) deletes on delete, delete_cas, and delete_multi (#1145, #1153)

    • :invalidate marks the item stale instead of removing it, so #get_with_metadata / #get_multi_with_metadata report stale: true and a reader can tell "another process is repopulating this" apart from "this was never here" -- a tombstoned key is not a miss
    • :tombstone_ttl controls how long the stale marker lives; requires :invalidate, since memcached only honors the TTL on a delete when it accompanies the invalidate flag
    • :drop_value removes the item's value but leaves the item; on its own it is not a tombstone -- reads are an ordinary hit with an empty value
    • delete_multi applies the same options to every key in the batch, on both the single-server and pipelined paths; its return value keeps counting keys the server found and acted on, so under :invalidate it reports how many keys were tombstoned rather than removed
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Add :miss and :return_ttl_remaining to get_with_metadata (#1143)

    • :miss is now always present in the returned Hash, distinguishing a true miss from a stored nil under cache_nils or a tombstoned, stale hit -- neither of which a nil :value alone can tell apart
    • :return_ttl_remaining exposes the meta protocol's t flag as :ttl_remaining (seconds remaining, or -1 for an item with no expiry), following the same opt-in shape as :return_hit_status / :return_last_access
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Add get_multi_with_metadata for stale-aware bulk reads (#1144)

    • Returns { key => { value:, cas:, stale:, miss: } } for the keys that were found; genuine misses are omitted, matching get_multi / get_multi_cas -- a tombstoned item is a hit at the protocol level, so it is still returned, with stale: true
    • Routes to the same single-server fast path / pipelined-getter split as get_multi
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

Other changes:

  • Raise the documented minimum supported memcached version to 1.6.27 (#1140)
    • Groundwork for the features above: drop_value tombstone deletes require 1.6.27, the highest floor of anything landing from #1130
    • Not enforced at runtime -- MIN_SUPPORTED_MEMCACHED_VERSION only gates the test harness and the README's support statement, so this changes no running client's behavior

Bug Fixes:

  • Retry a transient network error during a liveness check instead of treating it as terminal (#1150)

    • Dalli::Protocol::Base#alive? caught any NetworkError -- including RetryableNetworkError, a subclass -- and unconditionally converted it to false, with no retry. This didn't match the retry-then-raise contract every other network-facing path in Dalli follows: a single transient connection hiccup during the liveness check itself (as opposed to an actual request) permanently reported a healthy server as down for that check
    • Now retries once on RetryableNetworkError, letting error_on_request!'s own fail-count threshold decide when to actually give up (the same mechanism the rest of the codebase relies on): it keeps retrying until socket_max_failures is reached, then raises a terminal NetworkError, which is still converted to false as before
    • Behavior change: a server that was previously marked "down" (engaging the down_retry_delay cooldown) only via an actual request could now also reach that state via a liveness check (alive?, and anything that calls it -- Dalli::Client#stats, #reset_stats, and Ring's own server selection) exhausting its retries. Previously, a solitary transient failure during a liveness check was silently forgotten rather than tracked, so the cooldown was inconsistently applied depending on which code path first observed the failure
    • Likely a contributing cause of the same intermittently failing get_multi failover integration test noted in #1149: that fix addressed the send/receive phase, but the liveness-check retry it introduced can itself force a fresh connect() mid-retry, giving this separate, pre-existing gap in alive? more chances to fire
    • Also fixed a test (test_ring.rb, "detect when a dead server is up again") that had been unknowingly relying on the old behavior: it never engaged the down_retry_delay cooldown from a single transient failure, so its 0.5s delay never actually gated anything. Updated to use a 0s delay, since the test's intent is to verify reconnection is detected, not to test cooldown timing

  • Base64-encode keys containing control characters, not just NUL (#1148)

    • KeyRegularizer.required? decided whether a key needed base64 encoding using /\s/, which matches most whitespace but none of the C0 control range (0x00-0x1F) or DEL (0x7F) -- a key that was otherwise ASCII-only and contained no whitespace (e.g. "foo\x00bar" or a key with an embedded ESC byte) went out on the wire unencoded
    • Not a command-injection risk: the text protocol splits commands on CRLF, not other control bytes. The risk is key confusion -- anything downstream that treats one of these bytes specially (a C string terminating at NUL, a terminal or log line interpreting an escape byte) could silently act on a different key than Dalli believes it sent
    • A raw control byte in a key was never protocol-compliant in the first place: memcached's own spec (protocol.txt) states a key "must not include control characters or whitespace." The only sanctioned way to carry such content in a key is the meta protocol's base64 (b flag) path -- the one whitespace and non-ASCII keys already used, and the one these keys now use too. The check is now /[\p{Cntrl}\s]/, matching that rule directly rather than special-casing NUL
    • Behavior change: a key containing a control character now produces different bytes on the wire (base64-encoded, per the meta protocol's b flag) than before. Existing cache entries stored under the old, unencoded form of such a key will read as a miss once every reader has upgraded. During a rolling deploy, old and new Dalli versions disagree about which physical key such a logical key maps to -- not just a one-time cutover, but ongoing inconsistency between the old-version and new-version server pools for the duration of the rollout. Harmless for an ordinary cached value (worst case, extra cache misses); worth accounting for if such a key ever backs something stateful, like a lock or counter. Expected to be rare in practice: embedding a raw control byte in a cache key is unusual, and doing so was already outside what the protocol permits
    • Found while auditing request_formatter.rb during the routing-token work in #1130 / #1147; unrelated to that change and predates it

  • Retry transient network errors in get_multi, set_multi and delete_multi instead of silently swallowing them (#1149)

... (truncated)

Changelog

Sourced from dalli's changelog.

5.1.0

Features:

  • Add opaque routing tokens: :p_token and :l_token request options (#1147, #1154)

    • get, gat, get_cas, get_with_metadata, fetch_with_lock, set/add/replace/set_cas/replace_cas, append/prepend, incr/decr, cas/cas!, delete/delete_cas, and the bulk operations (get_multi, get_multi_cas, get_multi_with_metadata, set_multi, delete_multi) all accept per-request :p_token/:l_token options, appended to the wire protocol as P<token>/L<token> -- applied to every key on the bulk methods
    • memcached itself ignores these tokens; per the meta protocol spec they exist as hints for a proxy or router sitting between the client and memcached
    • CRLF and NUL bytes raise ArgumentError before the request reaches the socket, both in Dalli::Client and in RequestFormatter, so a bad token can't be used for wire-protocol injection and can't close the connection out from under the caller the way a formatter-only check would
    • The bulk methods and delete/delete_cas were deferred out of #1147 to avoid racing other in-flight PRs touching the same method signatures; #1154 completes them, including both the single-server fast path and the multi-server pipelined path for each
    • Extracted from #1130; thanks to Nick Herson for the original idea and Jianbin Chen for porting it forward

  • Support tombstone (mark-stale) deletes on delete, delete_cas, and delete_multi (#1145, #1153)

    • :invalidate marks the item stale instead of removing it, so #get_with_metadata / #get_multi_with_metadata report stale: true and a reader can tell "another process is repopulating this" apart from "this was never here" -- a tombstoned key is not a miss
    • :tombstone_ttl controls how long the stale marker lives; requires :invalidate, since memcached only honors the TTL on a delete when it accompanies the invalidate flag
    • :drop_value removes the item's value but leaves the item; on its own it is not a tombstone -- reads are an ordinary hit with an empty value
    • delete_multi applies the same options to every key in the batch, on both the single-server and pipelined paths; its return value keeps counting keys the server found and acted on, so under :invalidate it reports how many keys were tombstoned rather than removed
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Add :miss and :return_ttl_remaining to get_with_metadata (#1143)

    • :miss is now always present in the returned Hash, distinguishing a true miss from a stored nil under cache_nils or a tombstoned, stale hit -- neither of which a nil :value alone can tell apart
    • :return_ttl_remaining exposes the meta protocol's t flag as :ttl_remaining (seconds remaining, or -1 for an item with no expiry), following the same opt-in shape as :return_hit_status / :return_last_access
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Add get_multi_with_metadata for stale-aware bulk reads (#1144)

    • Returns { key => { value:, cas:, stale:, miss: } } for the keys that were found; genuine misses are omitted, matching get_multi / get_multi_cas -- a tombstoned item is a hit at the protocol level, so it is still returned, with stale: true
    • Routes to the same single-server fast path / pipelined-getter split as get_multi
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

Other changes:

  • Raise the documented minimum supported memcached version to 1.6.27 (#1140)
    • Groundwork for the features above: drop_value tombstone deletes require 1.6.27, the highest floor of anything landing from #1130
    • Not enforced at runtime -- MIN_SUPPORTED_MEMCACHED_VERSION only gates the test harness and the README's support statement, so this changes no running client's behavior

Bug Fixes:

  • Retry a transient network error during a liveness check instead of treating it as terminal (#1150)

    • Dalli::Protocol::Base#alive? caught any NetworkError -- including RetryableNetworkError, a subclass -- and unconditionally converted it to false, with no retry. This didn't match the retry-then-raise contract every other network-facing path in Dalli follows: a single transient connection hiccup during the liveness check itself (as opposed to an actual request) permanently reported a healthy server as down for that check
    • Now retries once on RetryableNetworkError, letting error_on_request!'s own fail-count threshold decide when to actually give up (the same mechanism the rest of the codebase relies on): it keeps retrying until socket_max_failures is reached, then raises a terminal NetworkError, which is still converted to false as before
    • Behavior change: a server that was previously marked "down" (engaging the down_retry_delay cooldown) only via an actual request could now also reach that state via a liveness check (alive?, and anything that calls it -- Dalli::Client#stats, #reset_stats, and Ring's own server selection) exhausting its retries. Previously, a solitary transient failure during a liveness check was silently forgotten rather than tracked, so the cooldown was inconsistently applied depending on which code path first observed the failure
    • Likely a contributing cause of the same intermittently failing get_multi failover integration test noted in #1149: that fix addressed the send/receive phase, but the liveness-check retry it introduced can itself force a fresh connect() mid-retry, giving this separate, pre-existing gap in alive? more chances to fire
    • Also fixed a test (test_ring.rb, "detect when a dead server is up again") that had been unknowingly relying on the old behavior: it never engaged the down_retry_delay cooldown from a single transient failure, so its 0.5s delay never actually gated anything. Updated to use a 0s delay, since the test's intent is to verify reconnection is detected, not to test cooldown timing

  • Base64-encode keys containing control characters, not just NUL (#1148)

    • KeyRegularizer.required? decided whether a key needed base64 encoding using /\s/, which matches most whitespace but none of the C0 control range (0x00-0x1F) or DEL (0x7F) -- a key that was otherwise ASCII-only and contained no whitespace (e.g. "foo\x00bar" or a key with an embedded ESC byte) went out on the wire unencoded
    • Not a command-injection risk: the text protocol splits commands on CRLF, not other control bytes. The risk is key confusion -- anything downstream that treats one of these bytes specially (a C string terminating at NUL, a terminal or log line interpreting an escape byte) could silently act on a different key than Dalli believes it sent
    • A raw control byte in a key was never protocol-compliant in the first place: memcached's own spec (protocol.txt) states a key "must not include control characters or whitespace." The only sanctioned way to carry such content in a key is the meta protocol's base64 (b flag) path -- the one whitespace and non-ASCII keys already used, and the one these keys now use too. The check is now /[\p{Cntrl}\s]/, matching that rule directly rather than special-casing NUL
    • Behavior change: a key containing a control character now produces different bytes on the wire (base64-encoded, per the meta protocol's b flag) than before. Existing cache entries stored under the old, unencoded form of such a key will read as a miss once every reader has upgraded. During a rolling deploy, old and new Dalli versions disagree about which physical key such a logical key maps to -- not just a one-time cutover, but ongoing inconsistency between the old-version and new-version server pools for the duration of the rollout. Harmless for an ordinary cached value (worst case, extra cache misses); worth accounting for if such a key ever backs something stateful, like a lock or counter. Expected to be rare in practice: embedding a raw control byte in a cache key is unusual, and doing so was already outside what the protocol permits
    • Found while auditing request_formatter.rb during the routing-token work in #1130 / #1147; unrelated to that change and predates it

... (truncated)

Commits
  • fc1b590 Merge pull request #1157 from petergoldstein/release/5.1.0
  • c79b4fb Prepare 5.1.0 release
  • aa545f8 Merge pull request #1154 from petergoldstein/feat/routing-tokens-bulk
  • fb25aa3 Merge remote-tracking branch 'origin/main' into feat/routing-tokens-bulk
  • 10b3561 Merge pull request #1150 from petergoldstein/fix/alive-retryable-network-error
  • ec71a9b Merge remote-tracking branch 'origin/main' into fix/alive-retryable-network-e...
  • 49d560b Merge remote-tracking branch 'origin/main' into feat/routing-tokens-bulk
  • 94613b9 Merge pull request #1155 from petergoldstein/fix/key-regularizer-nul-bytes
  • 10aa02e Fix comment accuracy per Copilot review
  • 917a9ff Broaden the fix to all control characters, not just NUL
  • Additional commits viewable in compare view

Updates google-protobuf from 4.35.1 to 4.36.0

Commits

Updates graphql from 2.6.8 to 2.6.9

Changelog

Sourced from graphql's changelog.

2.6.9 (17 Aug 2026)

Security

Commits

Updates sidekiq from 8.1.6 to 8.1.7

Changelog

Sourced from sidekiq's changelog.

8.1.7

  • Forward compatibililty with Active Job 8.1 #7019
  • Many minor fixes and test improvements [hammadxcm]
Commits

Updates sorbet-static from 0.6.13426 to 0.6.13433

Release notes

Sourced from sorbet-static's releases.

sorbet 0.6.13432.20260820170305-05aef5fd2

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13432', :group => :development
gem 'sorbet-runtime', '0.6.13432'

sorbet 0.6.13431.20260820141021-8989a4f33

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13431', :group => :development
gem 'sorbet-runtime', '0.6.13431'

sorbet 0.6.13430.20260820115544-0546350c8

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13430', :group => :development
gem 'sorbet-runtime', '0.6.13430'

sorbet 0.6.13429.20260819180422-749fc96b6

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13429', :group => :development
gem 'sorbet-runtime', '0.6.13429'

sorbet 0.6.13428.20260817173825-00e837aa9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13428', :group => :development
gem 'sorbet-runtime', '0.6.13428'

sorbet 0.6.13427.20260814125155-bfa865a8d

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13427', :group => :development
gem 'sorbet-runtime', '0.6.13427'

sorbet 0.6.13426.20260812133835-3e3c5be2d

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13426', :group => :development
gem 'sorbet-runtime', '0.6.13426'
Commits

Updates webmock from 3.26.2 to 3.26.3

Release notes

Sourced from webmock's releases.

3.26.3

  • Confirm to work with curb 1.3.7

    Thanks to Josch Bockler

  • Fix NameError in async-http adapter on protocol-http1 >= 0.40

    Thanks to Leslie Hoare

Changelog

Sourced from webmock's changelog.

3.26.3

  • Confirm to work with curb 1.3.7

    Thanks to Josch Bockler

  • Fix NameError in async-http adapter on protocol-http1 >= 0.40

    Thanks to Leslie Hoare

Commits
  • ee409ac Version 3.26.3
  • 2c976d5 Merge pull request #1127 from jbockler/curb-1.3
  • 5b40155 Confirm to work with curb 1.3.7
  • f685e7e Merge pull request #1130 from lesleh/fix-async-http-status-description
  • a50557e Fix NameError in async-http adapter on protocol-http1 >= 0.40
  • See full diff in compare view

Updates rubydex from 0.3.0 to 0.4.0

Release notes

Sourced from rubydex's releases.

v0.4.0

What's Changed

🚧 Breaking Changes

✨ Enhancements

🐛 Bug Fixes

🛠 Other Changes

... (truncated)

Commits
  • e0ed5e7 Bump version to v0.4.0
  • 97b8a6c Merge pull request #1018 from Shopify/vs_unify_diagnostic_filtering
  • b51ec64 Filter built-in and linter diagnostics uniformly
  • 99d79ac Merge pull request #1017 from Shopify/vs_remove_severity_from_diagnostic
  • ed2812c Take severity into account for sorting
  • 528099f Move resolved severity to rule identity
  • 591ce54 Merge pull request #1015 from Shopify/vs_make_diagnostics_hold_rule
  • b3393dc Merge pull request #970 from Shopify/codex/rbs-attribute-method-definitions
  • 8284a17 Avoid cloning single RBS attribute definitions
  • d08b996 Use attribute names for RBS writer parameters
  • Additional commits viewable in compare view

Updates sorbet-static-and-runtime from 0.6.13426 to 0.6.13433

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.6.13432.20260820170305-05aef5fd2

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13432', :group => :development
gem 'sorbet-runtime', '0.6.13432'

sorbet 0.6.13431.20260820141021-8989a4f33

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13431', :group => :development
gem 'sorbet-runtime', '0.6.13431'

sorbet 0.6.13430.20260820115544-0546350c8

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13430', :group => :development
gem 'sorbet-runtime', '0.6.13430'

sorbet 0.6.13429.20260819180422-749fc96b6

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13429', :group => :development
gem 'sorbet-runtime', '0.6.13429'

sorbet 0.6.13428.20260817173825-00e837aa9

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13428', :group => :development
gem 'sorbet-runtime', '0.6.13428'

sorbet 0.6.13427.20260814125155-bfa865a8d

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13427', :group => :development
gem 'sorbet-runtime', '0.6.13427'

sorbet 0.6.13426.20260812133835-3e3c5be2d

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13426', :group => :development
gem 'sorbet-runtime', '0.6.13426'
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the minor-and-patch group with 11 updates
6e8492e 
Bumps the minor-and-patch group with 11 updates:

| Package | From | To |
| --- | --- | --- |
| [rubocop-sorbet](https://github.com/shopify/rubocop-sorbet) | `0.14.0` | `0.15.0` |
| [ruby-lsp](https://github.com/Shopify/ruby-lsp) | `0.26.10` | `0.26.11` |
| [sprockets](https://github.com/rails/sprockets) | `4.3.0` | `4.4.0` |
| [dalli](https://github.com/petergoldstein/dalli) | `5.0.6` | `5.1.0` |
| [google-protobuf](https://github.com/protocolbuffers/protobuf) | `4.35.1` | `4.36.0` |
| [graphql](https://github.com/rmosolgo/graphql-ruby) | `2.6.8` | `2.6.9` |
| [sidekiq](https://github.com/sidekiq/sidekiq) | `8.1.6` | `8.1.7` |
| [sorbet-static](https://github.com/sorbet/sorbet) | `0.6.13426` | `0.6.13433` |
| [webmock](https://github.com/bblimke/webmock) | `3.26.2` | `3.26.3` |
| [rubydex](https://github.com/Shopify/rubydex) | `0.3.0` | `0.4.0` |
| [sorbet-static-and-runtime](https://github.com/sorbet/sorbet) | `0.6.13426` | `0.6.13433` |


Updates `rubocop-sorbet` from 0.14.0 to 0.15.0
- [Release notes](https://github.com/shopify/rubocop-sorbet/releases)
- [Commits](Shopify/rubocop-sorbet@v0.14.0...v0.15.0)

Updates `ruby-lsp` from 0.26.10 to 0.26.11
- [Release notes](https://github.com/Shopify/ruby-lsp/releases)
- [Commits](Shopify/ruby-lsp@v0.26.10...v0.26.11)

Updates `sprockets` from 4.3.0 to 4.4.0
- [Release notes](https://github.com/rails/sprockets/releases)
- [Changelog](https://github.com/rails/sprockets/blob/main/CHANGELOG.md)
- [Commits](rails/sprockets@v4.3.0...v4.4.0)

Updates `dalli` from 5.0.6 to 5.1.0
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](petergoldstein/dalli@v5.0.6...v5.1.0)

Updates `google-protobuf` from 4.35.1 to 4.36.0
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `graphql` from 2.6.8 to 2.6.9
- [Release notes](https://github.com/rmosolgo/graphql-ruby/releases)
- [Changelog](https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md)
- [Commits](rmosolgo/graphql-ruby@v2.6.8...v2.6.9)

Updates `sidekiq` from 8.1.6 to 8.1.7
- [Changelog](https://github.com/sidekiq/sidekiq/blob/main/Changes.md)
- [Commits](sidekiq/sidekiq@v8.1.6...v8.1.7)

Updates `sorbet-static` from 0.6.13426 to 0.6.13433
- [Release notes](https://github.com/sorbet/sorbet/releases)
- [Commits](https://github.com/sorbet/sorbet/commits)

Updates `webmock` from 3.26.2 to 3.26.3
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.26.2...v3.26.3)

Updates `rubydex` from 0.3.0 to 0.4.0
- [Release notes](https://github.com/Shopify/rubydex/releases)
- [Commits](Shopify/rubydex@v0.3.0...v0.4.0)

Updates `sorbet-static-and-runtime` from 0.6.13426 to 0.6.13433
- [Release notes](https://github.com/sorbet/sorbet/releases)
- [Commits](https://github.com/sorbet/sorbet/commits)

---
updated-dependencies:
- dependency-name: rubocop-sorbet
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruby-lsp
  dependency-version: 0.26.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sprockets
  dependency-version: 4.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: dalli
  dependency-version: 5.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: google-protobuf
  dependency-version: 4.36.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: graphql
  dependency-version: 2.6.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sidekiq
  dependency-version: 8.1.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: sorbet-static
  dependency-version: 0.6.13433
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: webmock
  dependency-version: 3.26.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: rubydex
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sorbet-static-and-runtime
  dependency-version: 0.6.13433
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 24, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner August 24, 2026 21:46
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 24, 2026
KaanOzkan
KaanOzkan approved these changes Aug 25, 2026
View reviewed changes

@KaanOzkan KaanOzkan left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @Morriar

@KaanOzkan
KaanOzkan merged commit d029cc9 into main Aug 25, 2026
17 checks passed
@KaanOzkan
KaanOzkan deleted the dependabot/bundler/minor-and-patch-8dbeb0b838 branch August 25, 2026 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KaanOzkan KaanOzkan KaanOzkan approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@KaanOzkan @Morriar