[openstreetmap/openstreetmap-website] Bump the dependencies group with 6 updates (PR #7319)

Wed Aug 12 23:17:04 UTC 2026

Bumps the dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [bootsnap](https://github.com/rails/bootsnap) | `1.24.6` | `1.25.0` |
| [doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) | `5.9.3` | `5.9.5` |
| [opentelemetry-instrumentation-all](https://github.com/open-telemetry/opentelemetry-ruby-contrib) | `0.94.0` | `0.95.0` |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.228.2` | `1.229.0` |
| [image_processing](https://github.com/janko/image_processing) | `2.0.2` | `2.0.3` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.8` | `3.0.9` |

Updates `bootsnap` from 1.24.6 to 1.25.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/rails/bootsnap/releases">bootsnap's releases</a>.</em></p>
<blockquote>
<h2>v1.25.0</h2>
<h2>What's Changed</h2>
<ul>
<li>
<p>Improve YAML parsing cache to more efficiently handle <code>Time</code>, <code>Date</code> and <code>DateTime</code>.</p>
</li>
<li>
<p>Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the
serialized instruction sequences that are cached, but enabling it (via <code>--yjit</code>, <code>RUBYOPT</code>, or
<code>RubyVM::YJIT.enable</code>) adds a <code> +YJIT</code> marker to <code>RUBY_DESCRIPTION</code> (<code> +YJIT <token></code> on <code>YJIT_SUPPORT</code>
builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT
was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.</p>
</li>
<li>
<p>Fix <code>CompileCache::Native.fetch</code> and <code>.precompile</code> reading a non-<code>String</code> path argument (e.g. a <code>Pathname</code>)
with <code>RSTRING_PTR</code>. Regression from 1.24.0.</p>
</li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/rails/bootsnap/compare/v1.24.6...v1.25.0">https://github.com/rails/bootsnap/compare/v1.24.6...v1.25.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/rails/bootsnap/blob/main/CHANGELOG.md">bootsnap's changelog</a>.</em></p>
<blockquote>
<h1>1.25.0</h1>
<ul>
<li>
<p>Improve YAML parsing cache to more efficiently handle <code>Time</code>, <code>Date</code> and <code>DateTime</code>.</p>
</li>
<li>
<p>Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the
serialized instruction sequences that are cached, but enabling it (via <code>--yjit</code>, <code>RUBYOPT</code>, or
<code>RubyVM::YJIT.enable</code>) adds a <code> +YJIT</code> marker to <code>RUBY_DESCRIPTION</code> (<code> +YJIT <token></code> on <code>YJIT_SUPPORT</code>
builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT
was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.</p>
</li>
<li>
<p>Fix <code>CompileCache::Native.fetch</code> and <code>.precompile</code> reading a non-<code>String</code> path argument (e.g. a <code>Pathname</code>)
with <code>RSTRING_PTR</code>. Regression from 1.24.0.</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/rails/bootsnap/commit/e099ec707644d0b50eb811b64debdbb78d306822"><code>e099ec7</code></a> Release 1.25.0</li>
<li><a href="https://github.com/rails/bootsnap/commit/b694a1156efef018bb307b6894dce0772fa27bcf"><code>b694a11</code></a> Merge pull request <a href="https://redirect.github.com/rails/bootsnap/issues/563">#563</a> from stanhu/sh-ignore-yjit-in-compile-cache-key</li>
<li><a href="https://github.com/rails/bootsnap/commit/51898f96aef63b1df96d444b026911e2fd680b85"><code>51898f9</code></a> Ignore YJIT status in the compile cache key</li>
<li><a href="https://github.com/rails/bootsnap/commit/1ad589bc4090f67b822cd80b386b3999f1c286b6"><code>1ad589b</code></a> Merge pull request <a href="https://redirect.github.com/rails/bootsnap/issues/560">#560</a> from rails/hm-qnqlnylzkqkltqsz</li>
<li><a href="https://github.com/rails/bootsnap/commit/21fbd657e7fe9cf270428be25079790031ab767e"><code>21fbd65</code></a> Merge pull request <a href="https://redirect.github.com/rails/bootsnap/issues/561">#561</a> from jeremy/fix-path-conversion-entry-points</li>
<li><a href="https://github.com/rails/bootsnap/commit/4898853ba09baba5af649228061519328833b478"><code>4898853</code></a> Convert the path argument in the frame that reads it</li>
<li><a href="https://github.com/rails/bootsnap/commit/8ee47c4095b2beb5435c7f4f51b13e53ef968e58"><code>8ee47c4</code></a> Add MessagePack::Bigint type</li>
<li><a href="https://github.com/rails/bootsnap/commit/49e3eb7395569845602882dc17e83f118f839eb7"><code>49e3eb7</code></a> Replace Date Marshalling with recursive msgpack</li>
<li><a href="https://github.com/rails/bootsnap/commit/711fd0becc71dd5547c0d4fa9012d6b25e2babab"><code>711fd0b</code></a> Bump minimum msgpack to 1.5.0</li>
<li><a href="https://github.com/rails/bootsnap/commit/160fc10a7994510ef22f4c5aa81f5a07614c7102"><code>160fc10</code></a> Merge pull request <a href="https://redirect.github.com/rails/bootsnap/issues/558">#558</a> from viralpraxis/fix-yaml-cache-kwargs-mutation</li>
<li>Additional commits viewable in <a href="https://github.com/rails/bootsnap/compare/v1.24.6...v1.25.0">compare view</a></li>
</ul>
</details>
<br />

Updates `doorkeeper` from 5.9.3 to 5.9.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/doorkeeper-gem/doorkeeper/releases">doorkeeper's releases</a>.</em></p>
<blockquote>
<h2>v5.9.5</h2>
<ul>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/issues/1901">#1901</a> Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an <code>invalid_request</code> error, instead of silently authenticating with the first method that matched and discarding the other credentials.</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/issues/1853">#1853</a> Fix <code>reuse_access_token</code> reusing a token that was created with <code>custom_access_token_attributes</code> values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/doorkeeper-gem/doorkeeper/blob/main/CHANGELOG.md">doorkeeper's changelog</a>.</em></p>
<blockquote>
<h2>5.9.5</h2>
<ul>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/issues/1901">#1901</a> Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an <code>invalid_request</code> error, instead of silently authenticating with the first method that matched and discarding the other credentials.</li>
<li><a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/issues/1853">#1853</a> Fix <code>reuse_access_token</code> reusing a token that was created with <code>custom_access_token_attributes</code> values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper/commit/4a8758221ebe6d485d4241f1cff080b2fa3aa718"><code>4a87582</code></a> Release 5.9.5</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper/commit/896ca00d7e7c95c201542b54fe5f8c1228f100c4"><code>896ca00</code></a> Merge commit from fork</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper/commit/f9e80977b3299483ef16cdce5082fb7abd701bd6"><code>f9e8097</code></a> Reject requests using multiple client authentication methods (RFC 6749 §2.3)</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper/commit/932c966bc731ed522e2f7d2de23e14b468ae6a1f"><code>932c966</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/issues/1856">#1856</a> from 55728/backport/v5.9-stable/custom-attributes-to...</li>
<li><a href="https://github.com/doorkeeper-gem/doorkeeper/commit/696cdc00909a3e4303f98e65592851154accc376"><code>696cdc0</code></a> Merge pull request <a href="https://redirect.github.com/doorkeeper-gem/doorkeeper/issues/1853">#1853</a> from 55728/fix/custom-attributes-token-reuse</li>
<li>See full diff in <a href="https://github.com/doorkeeper-gem/doorkeeper/compare/v5.9.3...v5.9.5">compare view</a></li>
</ul>
</details>
<br />

Updates `opentelemetry-instrumentation-all` from 0.94.0 to 0.95.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/open-telemetry/opentelemetry-ruby-contrib/releases">opentelemetry-instrumentation-all's releases</a>.</em></p>
<blockquote>
<h2>opentelemetry-instrumentation-all 0.95.0</h2>
<h2>v0.95.0 / 2026-08-05</h2>
<ul>
<li>ADDED: Upgrade opentelemetry-instrumentation-pg to 0.37.0</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/open-telemetry/opentelemetry-ruby-contrib/compare/opentelemetry-instrumentation-all/v0.94.0...opentelemetry-instrumentation-all/v0.95.0">compare view</a></li>
</ul>
</details>
<br />

Updates `aws-sdk-s3` from 1.228.2 to 1.229.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md">aws-sdk-s3's changelog</a>.</em></p>
<blockquote>
<h2>1.229.0 (2026-08-06)</h2>
<ul>
<li>Feature - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/aws/aws-sdk-ruby/commits">compare view</a></li>
</ul>
</details>
<br />

Updates `image_processing` from 2.0.2 to 2.0.3
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/janko/image_processing/blob/master/CHANGELOG.md">image_processing's changelog</a>.</em></p>
<blockquote>
<h2>2.0.3 (2026-06-08)</h2>
<ul>
<li>
<p>Prevent remote code execution when operation names come from user input, closing bypasses through the <code>#operation</code> meta-builder, <code>#method_missing</code>, and nested <code>#send</code> calls (reported by <a href="https://github.com/szymonsec"><code>@szymonsec</code></a>)</p>
</li>
<li>
<p>[minimagick] Prevent remote code execution through unsafe public methods (e.g. <code>#instance_eval</code>, <code>#send</code>) passed as loader/saver option names</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/janko/image_processing/commit/1611c00ed4eb3764e4b85db006c5667a0c50e817"><code>1611c00</code></a> Bump to 2.0.3</li>
<li><a href="https://github.com/janko/image_processing/commit/8cd14e9cac4fd6dc7e27dfee2fb87d694a8697fd"><code>8cd14e9</code></a> Test on JRuby 10.1.x</li>
<li><a href="https://github.com/janko/image_processing/commit/28684e76c018e73eea9928045290b5766569e92e"><code>28684e7</code></a> Close more RCE security gaps</li>
<li><a href="https://github.com/janko/image_processing/commit/0360dbd0b75f04e02b7eff6ad2234fd23e088fdf"><code>0360dbd</code></a> Remove <code>ruby2_keywords</code> usage (<a href="https://redirect.github.com/janko/image_processing/issues/145">#145</a>)</li>
<li>See full diff in <a href="https://github.com/janko/image_processing/compare/v2.0.2...v2.0.3">compare view</a></li>
</ul>
</details>
<br />

Updates `database_consistency` from 3.0.8 to 3.0.9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md">database_consistency's changelog</a>.</em></p>
<blockquote>
<h3>[3.0.9] - 2026/08/05</h3>
<ul>
<li>Fix <code>NumericalityConstraintChecker</code> to skip <code>numericality</code> validators without a range option (e.g. bare <code>numericality: true</code>), since no <code>CHECK</code> constraint can express them.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/djezzzl/database_consistency/commit/42fbbc9fab2cc615e54350ef3916e8d5aaf331a0"><code>42fbbc9</code></a> Release v3.0.9</li>
<li><a href="https://github.com/djezzzl/database_consistency/commit/d2fddf9a4984a0d41e314725d621e91a90422361"><code>d2fddf9</code></a> Skip numericality validators without a range option (<a href="https://redirect.github.com/djezzzl/database_consistency/issues/311">#311</a>)</li>
<li>See full diff in <a href="https://github.com/djezzzl/database_consistency/compare/v3.0.8...v3.0.9">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions

</details>
You can view, comment on, or merge this pull request online at:

  https://github.com/openstreetmap/openstreetmap-website/pull/7319

-- Commit Summary --

  * Bump the dependencies group with 6 updates

-- File Changes --

    M Gemfile.lock (50)

-- Patch Links --

https://github.com/openstreetmap/openstreetmap-website/pull/7319.patch
https://github.com/openstreetmap/openstreetmap-website/pull/7319.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/pull/7319
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/pull/7319 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20260812/c0803c38/attachment-0001.htm>