[dependabot]

Bumps the bundler group with 2 updates: sqlite3 and ransack.

Updates sqlite3 from 2.10.1 to 2.10.2

Release notes

Sourced from sqlite3's releases.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

e9aea2c2b3476fc875dd8a89313a9a2862818519c0186bfb5b56d6f57bb08d98  gems/sqlite3-2.10.2-aarch64-linux-gnu.gem
4986fc40cdf21342362b72a941df28e95cfe0e644f3ad2532d948b157c39dbee  gems/sqlite3-2.10.2-aarch64-linux-musl.gem
762f609ef891463226b472d3df66aea84d5466ff4376d3ccf4a059718c4ce9c9  gems/sqlite3-2.10.2-arm-linux-gnu.gem
833623eaf1157b1b85d1c0830e3e8f9beb3bb95a9bec3d252f20557a50e9803a  gems/sqlite3-2.10.2-arm-linux-musl.gem
5b0d235ea037e6dcd1b8387a19d73be571917db9f93044d35741cf933a21a37d  gems/sqlite3-2.10.2-arm64-darwin.gem
7fe1bf1adfca4fffeaec27371e0a20c1162d9d985681ec9560971a44fc41d198  gems/sqlite3-2.10.2-x64-mingw-ucrt.gem
46a02a29e9ae452824082388be5c24fd26f133b14bdd268610c6aa9a8d924c44  gems/sqlite3-2.10.2-x86-linux-gnu.gem
38980cf01eb2e4ac1c0755964d60b3d743ccf00686798a626bab852ff4cd3d1e  gems/sqlite3-2.10.2-x86-linux-musl.gem
fd2c67b49d313031af112e172c83ab321681a2b4996bf882eefac50be7bea08f  gems/sqlite3-2.10.2-x86_64-darwin.gem
ca92731ab464df9cae503fa1a439a549e2724f6953c8c05a7769b59366e38f15  gems/sqlite3-2.10.2-x86_64-linux-gnu.gem
b9f8fc62f3e0eb8966b41de251b492b4c8e9d1b23559beb6e150ad7f8d590941  gems/sqlite3-2.10.2-x86_64-linux-musl.gem
f1ea68cd3287f8a49f39a088ac9e4bd0ef4e7f394c3d4a60dd4c7e44b0566964  gems/sqlite3-2.10.2.gem

Changelog

Sourced from sqlite3's changelog.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

Commits

• 1d2aa7a version bump to v2.10.2
• 5329061 Merge pull request #764 from sparklemotion/card-342-callback-lifetime-followups
• 8e81efa test: stop counting the finalizer probes
• 60bf60e doc: list the callback behavior changes in CHANGELOG
• 083d734 Stop a raise inside a callback from deadlocking other threads
• ab14f58 doc: add PR number to CHANGELOG
• e4f3d58 Merge pull request #763 from sparklemotion/card-345-fork-safety-test-flake
• dab7eb2 doc: update CHANGELOG
• 03e5469 test: release aggregate instances on more routes to xFinal
• 621c692 test: skip compaction tests where compaction raises
• Additional commits viewable in compare view

Updates ransack from 5.0.2 to 5.0.3

Release notes

Sourced from ransack's releases.

5.0.3

Security release.

Fixes a reflected XSS and open redirect in sort_link and sort_url. Request parameters were passed to url_for, so a crafted query string such as ?script_name=javascript:... could make every sort link on a page run script in the application's origin or point to another site when clicked. Ransack now drops url_for's URL options (script_name, host, protocol, only_path and others) from the request params it carries into the link. Affects any page that renders a sort link.

GHSA-58rx-96gf-w92x. Also released as 6.0.1 and 4.4.4.

Commits

• 425c321 Version 5.0.3
• c92a483 Match reserved url_for options on string keys, test the XSS payload
• 022da7e Drop url_for options from the params sort_link and sort_url carry over
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.85%. Comparing base (f40c960) to head (a6e2644).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1011   +/-   ##
=======================================
  Coverage   98.85%   98.85%           
=======================================
  Files          21       21           
  Lines         522      522           
=======================================
  Hits          516      516           
  Misses          6        6           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.