Skip to content

bundle: bump the ruby-dependencies group across 1 directory with 3 updates - #181

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-dependencies-1726ca61d6
Open

bundle: bump the ruby-dependencies group across 1 directory with 3 updates#181
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/ruby-dependencies-1726ca61d6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the ruby-dependencies group with 3 updates in the / directory: haml, dalli and simplecov.

Updates haml from 7.2.0 to 7.2.2

Release notes

Sourced from haml's releases.

v7.2.2

What's Changed

New Contributors

Full Changelog: haml/haml@v7.2.1...v7.2.2

v7.2.1

What's Changed

New Contributors

Full Changelog: haml/haml@v7.2.0...v7.2.1

Changelog

Sourced from haml's changelog.

7.2.2

7.2.1

  • Do not rely on Ripper quirk in parsing old-style Haml attributes haml/haml#1212
Commits

Updates dalli from 5.0.5 to 5.0.6

Release notes

Sourced from dalli's releases.

v5.0.6

Performance:

  • Skip the cas-return flag on quiet meta_set requests (#1131)

    • In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request
    • Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Reduce allocations in KeyRegularizer and multi-key request paths (#1120)

    • Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value
    • Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseBuffer pipelined getk parsing (#1117)

    • process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response
    • Also skips trailing nils in the token array
    • Thanks to Jean Boussier for this contribution

  • Enable frozen string literals in RequestFormatter (#1118)

    • Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseProcessor#value_from_tokens (#1113)

    • token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons
    • Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in common operation paths (#1111)

    • Use Symbol#name over Symbol#to_s to return a frozen string without allocation
    • Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled
    • Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation
    • Use match? in KeyRegularizer#encode to avoid MatchData object allocation
    • Reduces objects allocated by ~26% and memory by ~6% for a simple get workload
    • Thanks to Jean Boussier for this contribution

  • Fix pathological memory behavior in ResponseBuffer (#1114)

    • compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original
    • Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read
    • Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations
    • Accompanied by new unit tests for ResponseBuffer (#1115)
    • Thanks to Jean Boussier for this contribution

Features:

  • delete_multi now returns the number of keys found and deleted (#1126)
    • Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed
    • The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted
    • The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted
    • Thanks to Iliana Hadzhiatanasova for this contribution

... (truncated)

Changelog

Sourced from dalli's changelog.

5.0.6

Performance:

  • Skip the cas-return flag on quiet meta_set requests (#1131)

    • In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request
    • Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter
    • Extracted from #1130; thanks to Jianbin Chen for this contribution

  • Reduce allocations in KeyRegularizer and multi-key request paths (#1120)

    • Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value
    • Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseBuffer pipelined getk parsing (#1117)

    • process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response
    • Also skips trailing nils in the token array
    • Thanks to Jean Boussier for this contribution

  • Enable frozen string literals in RequestFormatter (#1118)

    • Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in ResponseProcessor#value_from_tokens (#1113)

    • token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons
    • Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)
    • Thanks to Jean Boussier for this contribution

  • Reduce allocations in common operation paths (#1111)

    • Use Symbol#name over Symbol#to_s to return a frozen string without allocation
    • Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled
    • Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation
    • Use match? in KeyRegularizer#encode to avoid MatchData object allocation
    • Reduces objects allocated by ~26% and memory by ~6% for a simple get workload
    • Thanks to Jean Boussier for this contribution

  • Fix pathological memory behavior in ResponseBuffer (#1114)

    • compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original
    • Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read
    • Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations
    • Accompanied by new unit tests for ResponseBuffer (#1115)
    • Thanks to Jean Boussier for this contribution

Features:

  • delete_multi now returns the number of keys found and deleted (#1126)
    • Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed
    • The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted
    • The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted

... (truncated)

Commits

Updates simplecov from 1.0.1 to 1.0.3

Release notes

Sourced from simplecov's releases.

v1.0.3

What's Changed

New Contributors

Full Changelog: simplecov-ruby/simplecov@v1.0.2...v1.0.3

v1.0.2

What's Changed

Full Changelog: simplecov-ruby/simplecov@v1.0.1...v1.0.2

Changelog

Sourced from simplecov's changelog.

1.0.3 (2026-07-26)

Bugfixes

  • Generating a report no longer crashes when the coverage universe contains a module that shadows #inspect with an incompatible signature. Rendering a method coverage key's receiver calls to_s, and a singleton class's to_s renders its attached object via #inspect — Liquid's Utils module defines inspect(value, max_depth = 2) as a module_function, so any suite whose report included Liquid's files (typically a vendored bundle under the project root, which is why this surfaced only in CI) raised ArgumentError from the at_exit hook and lost its report. The exposure predates 1.0.2's key normalization, which only moved the call. Rendering now recovers by rebuilding the name from Module#name via bound methods, which user code cannot shadow, falling back to an address form that the existing normalization collapses. The external_at_exit workaround is no longer needed. Reported with an exemplary diagnosis by @​bkuhlmann. See #1236.
  • Method coverage entries are now aggregated by source location alone, completing the aggregation introduced in 1.0.2 (which keyed on name and location). Ruby records one method entry per defined method, so a builder looping container.each_key { |key| define_method(key) { ... } } produces an entry per generated name, all at the block's location — and every name whose generated wrapper no test happened to call showed as an uncovered method on a line with full line and branch coverage. A source location is the unit a file-based report can express, and regular defs map one location to one name, so they are unaffected. The same identity is used when merging resultsets across processes. This also covers methods copied into refinements via import_methods, which Ruby records once per importing refinement at the shared module's original location, so exercising the method through any refinement now marks the shared definition covered and the skip workaround for shared refinement modules can be dropped. Reported with exemplary diagnoses by @​bkuhlmann. See #1234 and #1237.
  • SimpleCov.formatter and SimpleCov.formatters now accept formatter instances in addition to formatter classes, so constructor options can actually be passed — most notably SimpleCov::Formatter::HTMLFormatter.new(silent: true) to suppress the "Coverage report generated" status line. Previously SimpleCov unconditionally called .new on whatever was configured, so passing an instance crashed with NoMethodError at report time. See #1240.

Performance

  • Fix 5x performance regression on report combining (introduced in 1.0.0 as a result of using Ripper#parse in a hot path) by adding parsed key memoisation to RubyDataParser.call.

1.0.2 (2026-07-18)

Bugfixes

  • The standalone simplecov CLI's colorizing subcommands (report, uncovered, coverage, diff) no longer crash with NoMethodError: undefined method 'color' when run in a project without a .simplecov file. The CLI deliberately loads only simplecov/cli rather than the full library, so SimpleCov.color was undefined unless a dotfile load had incidentally defined it — and --no-color was the only workaround, since the documented NO_COLOR env var was checked after the line that raised. Color.enabled? now treats missing configuration the same as its :auto default and falls through to NO_COLOR / FORCE_COLOR / TTY detection. Reported with an exemplary diagnosis by @​hasghari. See #1231.
  • Branch tuples synthesized for tracked-but-unloaded files now match Ruby's Coverage for a safe-navigation call that takes a block. For x&.foo { ... } (and the second link of a chain like x&.foo&.bar { ... }) the extractor keyed the branch on the call node's full source range, which extends through the attached block, while Coverage ends the range at the call itself — so a simulated entry merging with a real one produced a phantom, permanently-missed branch, the same failure mode as the elsif fix in 1.0.1. Reported with an exemplary diagnosis and a suggested fix by @​alexdeng-mp. See #1233.
  • Prompted by the two reports above, an exhaustive differential audit of StaticCoverageExtractor against Ruby's Coverage — a fuzzing harness that runs thousands of generated programs through both and diffs the branch tuples, now part of the spec suite (opt-in via SIMPLECOV_FUZZ=1) — surfaced and fixed four more mismatches of the same phantom-branch class. Conditions that are compile-time literals (if true, if 1, a ternary on a literal) are folded away by Ruby's compiler and no longer produce synthesized branches (while true still does — loops are not folded). On Ruby 3.3, three legacy conventions now match: the body range of a do-while (begin ... end while), the location of empty branch arms (which on 3.3 depends on whether the construct is in value or void position), and one-line pattern matching (x => pattern / x in pattern), which emits a :case branch on 3.3 and nothing on 3.4+. The audit also caught a crash on Ruby 3.3's stdlib Prism (0.19), which still exposes the else clause of UnlessNode / CaseNode / CaseMatchNode under its pre-1.3 name consequent: the extractor raised internally and silently dropped simulated branch and method data for any file containing unless/else or a case with an empty arm, unless a newer prism gem happened to be installed.
  • As a defensive layer against any future extractor drift, merging now treats an actually-executed file's branch and method data as authoritative: when a resultset that merely tracked a file (with simulated, statically-derived tuples) merges with one from a process that really loaded it, the synthesized tuples are dropped rather than unioned. This contains any undiscovered mismatch to denominator inflation on files no process loaded, instead of phantom misses on fully-covered ones. Line coverage still combines from both sides, so tracked-but-unloaded files keep contributing to the line denominator as before.
  • Method coverage no longer reports phantom uncovered methods for define_method / define_singleton_method blocks defined onto more than one receiver — e.g. a module's included hook defining the same block on every including class. Ruby records one method entry per receiver, all pointing at the same source location, so any receiver whose copy was never called showed as an uncovered method on a line with 100% line coverage. Entries are now aggregated by (name, source location) with hit counts summed, and cross-process merging matches methods on the same source identity rather than on the receiver class. Reported with an exemplary diagnosis by @​bkuhlmann. See #1234.
  • Branch coverage under enable_coverage :eval no longer inflates denominators or reports phantom missed branches for templates compiled more than once — e.g. hanami-view compiles each template once per view class, and every ERB.new(...).result is a fresh compile. Ruby's Coverage emits a fresh set of branch entries per compile of the same file (nondeterministically through Ruby 4.0, consistently on current ruby master — see https://bugs.ruby-lang.org/issues/22203), each counting only the renders that flowed through that compile, so a side exercised under one compile appeared as a permanently-missed branch in another compile's entry at the same location, and ignore_branches :implicit_else swung the report wildly by stripping only the synthetic-else halves of the duplicates. Duplicated conditions are now aggregated by source location with arm counts summed. Reported with an exemplary diagnosis by @​bkuhlmann. See #1235.
Commits
  • e9fddf0 Bump version to 1.0.3
  • 1bc8a8c bundle update
  • 0e6eae8 fix: memoise key parsing in RubyDataParser to fix combiner performance regres...
  • 1a8a9ba Accept formatter instances in formatter configuration
  • 3ef1068 Bump ruby/setup-ruby from 1.316.0 to 1.318.0
  • f33a574 Assert engine-independent invariants for receiver name fallbacks
  • 3492da6 Aggregate method coverage by source location alone
  • 2e60550 Survive user code that breaks receiver name rendering
  • 803dcbc Bump version to 1.0.2
  • 177b0cc Restore a clean Steep check for the post-1.0.1 code
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
bundle: bump the ruby-dependencies group across 1 directory with 3 up…
4e2b602 
…dates

Bumps the ruby-dependencies group with 3 updates in the / directory: [haml](https://github.com/haml/haml), [dalli](https://github.com/petergoldstein/dalli) and [simplecov](https://github.com/simplecov-ruby/simplecov).


Updates `haml` from 7.2.0 to 7.2.2
- [Release notes](https://github.com/haml/haml/releases)
- [Changelog](https://github.com/haml/haml/blob/main/CHANGELOG.md)
- [Commits](haml/haml@v7.2.0...v7.2.2)

Updates `dalli` from 5.0.5 to 5.0.6
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md)
- [Commits](petergoldstein/dalli@v5.0.5...v5.0.6)

Updates `simplecov` from 1.0.1 to 1.0.3
- [Release notes](https://github.com/simplecov-ruby/simplecov/releases)
- [Changelog](https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md)
- [Commits](simplecov-ruby/simplecov@v1.0.1...v1.0.3)

---
updated-dependencies:
- dependency-name: haml
  dependency-version: 7.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-dependencies
- dependency-name: dalli
  dependency-version: 5.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-dependencies
- dependency-name: simplecov
  dependency-version: 1.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ruby-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Aug 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants