[dependabot]

Bumps the minor-and-patch group with 6 updates:

Package	From	To
dalli	5.2.2	5.2.5
graphql	2.6.12	2.6.14
sorbet-static	0.6.13591	0.6.13610
rubydex	0.4.2	0.4.4
sorbet-static-and-runtime	0.6.13591	0.6.13610
spoom	1.8.12	1.8.13

Updates dalli from 5.2.2 to 5.2.5

Release notes

Sourced from dalli's releases.

v5.2.5

Bug fixes:

• set_multi across more than one server stored nil for a Symbol key or a key over 250 bytes, in place of the value given

v5.2.4

Security release. Released together with 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15: a connection shared by several threads or fibers could get out of step during a quiet block or after a get_multi that stopped early, so that reads returned another key's value (GHSA-5xvx-r8rg-5qm2). Upgrading is strongly recommended. It also makes the TLS handshake fix from 5.2.3 work when openssl isn't loaded before Dalli.

Security:

• Keep a connection shared by several threads or fibers in step during a quiet block (GHSA-5xvx-r8rg-5qm2)
  • A quiet (or multi) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an add of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
• Don't let a get_multi that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
  • A pipelined get_multi stopped by a non-network exception (its block raising or breaking, Timeout.timeout, or a value that can't be deserialized) left its unread replies in the response buffer, and a later get_multi large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
  • Affects every supported line (the get_multi issue, 4.3 and later); fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15. On 5.2, clients with defer_drain: true weren't affected by the quiet issue

Bug fixes:

• A failed TLS handshake is now handled as a network error even when openssl wasn't loaded before Dalli
  • The fix in 5.2.3 (#1215) took effect only when the application had already required openssl: otherwise Dalli's list of TLS errors was empty, so a failed handshake still raised OpenSSL::SSL::SSLError and left the socket open

v5.2.3

Security release. Released together with 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14: with the meta protocol, a counter that incr or decr created with an initial value for a key containing spaces, CR/LF or non-ASCII characters could let a crafted key forge the value of another key in a multi-get (GHSA-r47x-6p6r-mvcp). Upgrading is strongly recommended. This release also includes the bug fixes and the new connect_timeout option below.

Security:

• Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
  • memcached stores an item made by auto-create (ma with N/J, or mg with N) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
  • incr and decr with an initial value now create such counters with an add instead. Return values are unchanged
  • The new verify_reply_keys option makes get_multi, get_multi_cas and get_multi_with_metadata ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
  • Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes

Bug fixes:

• get_multi_with_metadata and its CacheResult adapter now retry transient network errors and raise Dalli::NetworkError on terminal failures instead of returning misses or partial results (#1222, @​jaideeppyne)
• A per-request raw: true write no longer compresses the value (#1213)
  • Values at or above the compression threshold (4 KB by default) were compressed and flagged even with raw: true. Raw reads ignore flags, so reading them back with raw: true returned the compressed bytes
  • Raw values are now stored exactly as given. Callers that pass raw: true without compress: false store large values uncompressed; Rails' MemCacheStore passes compress: false and isn't affected
• Fix cas and cas! edge cases, and make flush attempt every server (#1214)
  • cas! on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns false if another client got there first
  • With cache_nils: true, cas treated a stored nil as a miss and didn't call the block
  • The docs now say what cas and cas! return on success: the new CAS value, not true. The return values are unchanged
  • flush stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
• Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
  • A failed or timed-out handshake left the TCP socket open until GC and raised OpenSSL::SSL::SSLError directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and socket_max_failures handling, raising Dalli::NetworkError (or Dalli::RingError once no server is available)
  • Certificate and hostname checks come only from the ssl_context you pass, and a bare OpenSSL::SSL::SSLContext.new checks neither. Dalli now logs a warning once per process when verify_mode doesn't include VERIFY_PEER or verify_hostname is false; see the new TLS section in the README
• Connection and configuration fixes (#1216)
  • memcached:// URIs with a bracketed IPv6 host (memcached://[::1]:11211) now connect
  • A server weight below 1 raises ArgumentError. Before, a ring where every weight was 0 raised FloatDomainError
  • A reply line longer than 8 KiB without a CRLF, or one cut short by the connection closing, is now a network error that closes the connection. Before, the line had no length limit

... (truncated)

Changelog

Sourced from dalli's changelog.

5.2.5

Bug fixes:

• set_multi across more than one server stored nil for a Symbol key or a key over 250 bytes, in place of the value given

5.2.4

Security:

• Keep a connection shared by several threads or fibers in step during a quiet block (GHSA-5xvx-r8rg-5qm2)
  • A quiet (or multi) block is quiet only for the thread or fiber that runs it. memcached still replies to a quiet request that fails (for example an add of a key that exists), and another thread or fiber using the same client while the block was open read that reply as its own, so its later requests could return another key's value. A non-quiet request now reads any pending quiet replies first
• Don't let a get_multi that stopped early leave replies for a later request (GHSA-5xvx-r8rg-5qm2)
  • A pipelined get_multi stopped by a non-network exception (its block raising or breaking, Timeout.timeout, or a value that can't be deserialized) left its unread replies in the response buffer, and a later get_multi large enough to use the interleaved path returned them as its own. The buffer is now cleared when a connection closes or a pipelined get starts, and unfinished pipelines are aborted
  • Affects every supported line (the get_multi issue, 4.3 and later); fixed in 5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15. On 5.2, clients with defer_drain: true weren't affected by the quiet issue

Bug fixes:

• A failed TLS handshake is now handled as a network error even when openssl wasn't loaded before Dalli
  • The fix in 5.2.3 (#1215) took effect only when the application had already required openssl: otherwise Dalli's list of TLS errors was empty, so a failed handshake still raised OpenSSL::SSL::SSLError and left the socket open

5.2.3

Security:

• Don't rely on memcached's auto-create for keys that need base64 encoding (GHSA-r47x-6p6r-mvcp)
  • memcached stores an item made by auto-create (ma with N/J, or mg with N) for a base64-encoded key without its binary-key flag, and later replies name the item by its raw key bytes. A key containing spaces or CR/LF could then make a multi-get read the replies after it as different ones
  • incr and decr with an initial value now create such counters with an add instead. Return values are unchanged
  • The new verify_reply_keys option makes get_multi, get_multi_cas and get_multi_with_metadata ignore replies for keys they didn't request, which guards against items created by older Dalli versions or other clients until memcached is upgraded. It's off by default, since it costs a multi-get about 15%
  • Affects the meta protocol since 3.2.0; fixed in 5.2.3, 5.1.5, 5.0.11, 4.3.8 and 3.2.14. memcached 1.6.45 and earlier still name these items by their raw key bytes

Bug fixes:

• get_multi_with_metadata and its CacheResult adapter now retry transient network errors and raise Dalli::NetworkError on terminal failures instead of returning misses or partial results (#1222, @​jaideeppyne)
• A per-request raw: true write no longer compresses the value (#1213)
  • Values at or above the compression threshold (4 KB by default) were compressed and flagged even with raw: true. Raw reads ignore flags, so reading them back with raw: true returned the compressed bytes
  • Raw values are now stored exactly as given. Callers that pass raw: true without compress: false store large values uncompressed; Rails' MemCacheStore passes compress: false and isn't affected
• Fix cas and cas! edge cases, and make flush attempt every server (#1214)
  • cas! on a missing key used an unconditional set, so a value another client created while the block ran was overwritten. It now adds the key and returns false if another client got there first
  • With cache_nils: true, cas treated a stored nil as a miss and didn't call the block
  • The docs now say what cas and cas! return on success: the new CAS value, not true. The return values are unchanged
  • flush stopped at the first server that raised, so later servers weren't flushed. It now flushes every server it can reach, then raises the first error
• Handle failed TLS handshakes like other connection failures, and warn when TLS verification is off (#1215)
  • A failed or timed-out handshake left the TCP socket open until GC and raised OpenSSL::SSL::SSLError directly, so the server was never marked down. The socket is now closed, and the error goes through the usual retry and socket_max_failures handling, raising Dalli::NetworkError (or Dalli::RingError once no server is available)
  • Certificate and hostname checks come only from the ssl_context you pass, and a bare OpenSSL::SSL::SSLContext.new checks neither. Dalli now logs a warning once per process when verify_mode doesn't include VERIFY_PEER or verify_hostname is false; see the new TLS section in the README
• Connection and configuration fixes (#1216)
  • memcached:// URIs with a bracketed IPv6 host (memcached://[::1]:11211) now connect

... (truncated)

Commits

• 94edb6e Merge pull request #1261 from petergoldstein/release/5.2.5
• 6c18c5c Merge pull request #1254 from petergoldstein/fix/set-multi-keys-5-2
• 0e74525 Prepare 5.2.5 release
• 79b91bc Store set_multi values under the keys given on multi-server clients
• 5bf6980 Merge pull request #1245 from petergoldstein/release/5.2.4
• 95c69f8 Merge pull request #1238 from petergoldstein/fix/flaky-delete-cas-test
• 650de92 Merge pull request #1244 from petergoldstein/docs/hardening-plan-r47x
• ac8959b Prepare 5.2.4 release
• 457ad39 Require openssl before defining SSL_ERRORS
• 0a34a51 Don't let a stopped get_multi's replies reach a later request
• Additional commits viewable in compare view

Updates graphql from 2.6.12 to 2.6.14

Changelog

Sourced from graphql's changelog.

2.6.14 (29 Oct 2026)

Security

Two patches relating to loopholes in authorization edge cases (legacy and next runtimes):

• GHSA-q3cc-p5hm-55wj
• GHSA-4rw8-495r-pf6j

New Features

• Schema.from_definition: speed up #5832
• Execution::Next: improve dataloader batching in .authorized?
• Sorbet adoption #5825 #5852

Bug Fixes

• Connections: #5838 #5840 #5845 #5846
• Complexity: use legacy mode when enforcing limits #5839
• rescue_from: prevent leaking into arguments #5837
• Parser: Correctly ignore BOM in documents #5849

2.6.13 (22 Oct 2026)

New features

• Move documentation to RDoc #5689 #5782
• Begin type-checking the project with Sorbet #5746 #5801 #5800
• Improve CI #5781 #5783 #5785
• Language::Nodes: flatten class definitions and add RBS types #5790
• rake graphql:pro:validate: harden against misuse #5795

Bug fixes

• FieldsHaveAppropriateSelections: don't crash on inline fragments without type conditions inside leaf selections #5791
• Execution::Next: propagate nulls in nested lists #5779
• Lexer: handle more comments than max_tokens #5795
• Schema.from_definition: support directive with cyclic argument types #5802
• Execution::Next: fix field alignment for legacy fields with authorization #5738
• Connections: paginate duplicate items #5755
• RelationConnection: peek an extra row to avoid hasNextPage query #5775
• Complexity: fix __typename with count_introspection_fields: false
• Legacy interpreter: fix TypeError in nested lists #5777
• Schema.from_definition: correctly handle interface possible types when defined later in the document #5827
• Validation: improve detection of unused variables with legacy compatibility support #5796
• Validation: improve detection of conflicting fields with legacy compatibility support #5797

Commits

• 4eb5899 2.6.14
• 179cadf Merge commit from fork
• 25fe018 Merge pull request #5849 from ydah/fix-lexer-bom2
• 16c59bd Merge pull request #5846 from ydah/fix-oversized-relation-cursors
• cd2931b Fix unauthorized object handling in Execution::Next and legacy runtime
• 6da4b36 Merge pull request #5845 from yskttm/fix/raw-value-connection-lookahead
• 23a5d65 Merge pull request #5837 from austinjb32/fix-argument-validation-error-leak
• edbd65f Merge pull request #5852 from rmosolgo/claude/graphql-ruby-5851-replicate-a420c6
• c50c142 Use raise #: absurd(...) for newer Sorbet
• 5a1d5c7 Run the Sorbet consumer check on the latest Sorbet and Tapioca, from fresh RBIs
• Additional commits viewable in compare view

Updates sorbet-static from 0.6.13591 to 0.6.13610

Release notes

Sourced from sorbet-static's releases.

sorbet 0.6.13609.20261029194706-d26497505

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13609', :group => :development
gem 'sorbet-runtime', '0.6.13609'

sorbet 0.6.13608.20261029162309-7791e5511

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13608', :group => :development
gem 'sorbet-runtime', '0.6.13608'

sorbet 0.6.13607.20261029140610-836c52796

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13607', :group => :development
gem 'sorbet-runtime', '0.6.13607'

sorbet 0.6.13606.20261029133941-89359d9a5

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13606', :group => :development
gem 'sorbet-runtime', '0.6.13606'

sorbet 0.6.13605.20261029131140-9e6744b11

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13605', :group => :development
gem 'sorbet-runtime', '0.6.13605'

sorbet 0.6.13604.20261029124426-4ab41f8ba

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13604', :group => :development
gem 'sorbet-runtime', '0.6.13604'

sorbet 0.6.13602.20261028163457-afc4c47f3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13602', :group => :development
gem 'sorbet-runtime', '0.6.13602'

sorbet 0.6.13601.20261028132748-c4fdbccd3

... (truncated)

Commits

• See full diff in compare view

Updates rubydex from 0.4.2 to 0.4.4

Release notes

Sourced from rubydex's releases.

v0.4.4

What's Changed

🐛 Bug Fixes

• Do not abort when an indexed string contains a NUL byte by @​st0012 in Shopify/rubydex#1072
• Bump minimum Rust version to 1.99.1 by @​vinistock in Shopify/rubydex#1092

Full Changelog: Shopify/rubydex@v0.4.3...v0.4.4

v0.4.3

Full Changelog: Shopify/rubydex@v0.4.2...v0.4.3

Commits

• 8d1a72e Bump version to v0.4.4
• 81337bf Merge pull request #1092 from Shopify/vs_bump_minimum_rust
• c30c1af Bump minimum Rust version to 1.99.1
• 02ed772 Do not abort when an indexed string contains a NUL byte (#1072)
• 9e1a0df Merge pull request #1090 from Shopify/ar-release-doc-update
• 3805295 Merge pull request #1079 from Shopify/vs_fix_deprecated_lint
• cfc2837 Remove local validation step from release docs
• b553f94 Bump version to v0.4.3
• 6f65c7f Merge pull request #1083 from Shopify/ar-gate-header-generation
• a38e5da Verify crate packaging before releasing
• Additional commits viewable in compare view

Updates sorbet-static-and-runtime from 0.6.13591 to 0.6.13610

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.6.13609.20261029194706-d26497505

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13609', :group => :development
gem 'sorbet-runtime', '0.6.13609'

sorbet 0.6.13608.20261029162309-7791e5511

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13608', :group => :development
gem 'sorbet-runtime', '0.6.13608'

sorbet 0.6.13607.20261029140610-836c52796

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13607', :group => :development
gem 'sorbet-runtime', '0.6.13607'

sorbet 0.6.13606.20261029133941-89359d9a5

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13606', :group => :development
gem 'sorbet-runtime', '0.6.13606'

sorbet 0.6.13605.20261029131140-9e6744b11

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13605', :group => :development
gem 'sorbet-runtime', '0.6.13605'

sorbet 0.6.13604.20261029124426-4ab41f8ba

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13604', :group => :development
gem 'sorbet-runtime', '0.6.13604'

sorbet 0.6.13602.20261028163457-afc4c47f3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13602', :group => :development
gem 'sorbet-runtime', '0.6.13602'

sorbet 0.6.13601.20261028132748-c4fdbccd3

... (truncated)

Commits

• See full diff in compare view

Updates spoom from 1.8.12 to 1.8.13

Release notes

Sourced from spoom's releases.

v1.8.13

What's Changed

🐛 Bug Fixes

• Allow commented multiline type alias by @​vinistock in Shopify/spoom#1044

🛠 Other Changes

• Use forwarding super when translating abstract sigs to RBS by @​alexcrocha in Shopify/spoom#1028

Full Changelog: Shopify/spoom@v1.8.12...v1.8.13

Commits

• 8b6f3d6 Bump version to v1.8.13
• 85f362d Merge pull request #1044 from Shopify/vs_allow_commented_multiline_alias
• 26ea68c Preserve comments when translating from RBS to Sorbet style
• 7c85237 Allow commented multiline type alias
• d617c88 Merge pull request #1043 from Shopify/dependabot/bundler/minor-and-patch-d10e...
• 88a5b0d Merge pull request #1042 from Shopify/dependabot/github_actions/ruby/setup-ru...
• ef20dd4 Bump the minor-and-patch group with 3 updates
• b3872e7 Bump ruby/setup-ruby from 1.329.0 to 1.334.0
• 0e9c73e Merge pull request #1028 from Shopify/ar-translate-abstract-sigs-super
• 2055450 Use forwarding super when translating abstract sigs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions