Bump the minor-and-patch group with 6 updates by dependabot[bot] · Pull Request #2697 · Shopify/tapioca

dependabot · 2026-08-10T21:44:59Z

Bumps the minor-and-patch group with 6 updates:

Package	From	To
rubocop-shopify	`3.0.1`	`3.0.2`
rubocop-sorbet	`0.13.2`	`0.14.0`
dalli	`5.0.5`	`5.0.6`
sorbet-static	`0.6.13386`	`0.6.13414`
sorbet-static-and-runtime	`0.6.13386`	`0.6.13414`
rbi	`0.4.2`	`0.4.3`

Updates rubocop-shopify from 3.0.1 to 3.0.2

Release notes

Sourced from rubocop-shopify's releases.

3.0.2

What's Changed

Add cop to disallow case structures where all when clauses are proc literals by @rwstauner in Shopify/ruby-style-guide#797

Enable Style/RedundantFreeze cop by @rafaelfranca in Shopify/ruby-style-guide#801

New Contributors

@rwstauner made their first contribution in Shopify/ruby-style-guide#797

Full Changelog: Shopify/ruby-style-guide@v3.0.1...v3.0.2

Commits

f3c065b Merge pull request #801 from Shopify/rmf-enable-Style/RedundantFreeze
4ab2555 Merge pull request #797 from Shopify/rwstauner/case-when-all-procs
653e603 Enable Style/RedundantFreeze cop
74af8cb Merge pull request #799 from Shopify/dependabot/github_actions/actions-ccd97f...
1eea91e Use nix in our dev configuration
c4832ff Add cop to disallow case structures where all when clauses are proc literals
b930e5b Bump the actions group with 2 updates
See full diff in compare view

Updates rubocop-sorbet from 0.13.2 to 0.14.0

Release notes

Sourced from rubocop-sorbet's releases.

v0.14.0

What's Changed

🛠 Other Changes

Add Sorbet/SetterReturnType cop and extract RBSParser helper by @rafaelfranca in Shopify/rubocop-sorbet#389

Fix TLetCorrection corrupting files with interior heredocs by @dduugg in Shopify/rubocop-sorbet#387

Patch Lint/Void to be RBS #: absurd aware by @rafaelfranca in Shopify/rubocop-sorbet#390

Drop support for Ruby 3.1 and 3.2 by @Morriar in Shopify/rubocop-sorbet#392

Full Changelog: Shopify/rubocop-sorbet@v0.13.2...v0.14.0

Commits

0c73cb1 Release v0.14.0
19dde04 Merge pull request #394 from Shopify/dependabot/github_actions/actions/stale-...
48db432 Bump actions/stale from 10.4.0 to 11.0.0
1ac9184 Merge pull request #392 from Shopify/drop-ruby-3-1-3-2
8b872be Test against Ruby 4.0
1910358 Drop support for Ruby 3.1 and 3.2
88c5512 Merge pull request #390 from Shopify/rm-Lint/Void
38d21fc Merge pull request #387 from dduugg/fix-t-let-interior-heredoc-corruption
cac0d1a Merge pull request #389 from Shopify/attr-writer-void
fc60898 Add on_itblock alias to cops with on_block
Additional commits viewable in compare view

Updates dalli from 5.0.5 to 5.0.6

Release notes

Sourced from dalli's releases.

v5.0.6

Performance:

Skip the cas-return flag on quiet meta_set requests (#1131)

In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request

Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter

Extracted from #1130; thanks to Jianbin Chen for this contribution

Reduce allocations in KeyRegularizer and multi-key request paths (#1120)

Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value

Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers

Thanks to Jean Boussier for this contribution

Reduce allocations in ResponseBuffer pipelined getk parsing (#1117)

process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response

Also skips trailing nils in the token array

Thanks to Jean Boussier for this contribution

Enable frozen string literals in RequestFormatter (#1118)

Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)

Thanks to Jean Boussier for this contribution

Reduce allocations in ResponseProcessor#value_from_tokens (#1113)

token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons

Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)

Thanks to Jean Boussier for this contribution

Reduce allocations in common operation paths (#1111)

Use Symbol#name over Symbol#to_s to return a frozen string without allocation

Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled

Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation

Use match? in KeyRegularizer#encode to avoid MatchData object allocation

Reduces objects allocated by ~26% and memory by ~6% for a simple get workload

Thanks to Jean Boussier for this contribution

Fix pathological memory behavior in ResponseBuffer (#1114)

compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original

Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read

Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations

Accompanied by new unit tests for ResponseBuffer (#1115)

Thanks to Jean Boussier for this contribution

Features:

delete_multi now returns the number of keys found and deleted (#1126)

Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed

The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted

The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted

Thanks to Iliana Hadzhiatanasova for this contribution

... (truncated)

Changelog

Sourced from dalli's changelog.

5.0.6

Performance:

Skip the cas-return flag on quiet meta_set requests (#1131)

In quiet mode memcached suppresses the ms response entirely, so the CAS requested by the c flag can never be read; sending it only added two bytes to every request

Applies to the bulk-write paths, where quiet sets are emitted: Dalli::Client#multi blocks and the pipelined setter

Extracted from #1130; thanks to Jianbin Chen for this contribution

Reduce allocations in KeyRegularizer and multi-key request paths (#1120)

Decomposed KeyRegularizer#encode into separate needs_encoding? and encode calls so the common happy path avoids allocating an intermediate array for the two-element return value

Refactored multi_get/multi_set/multi_delete command generation into RequestFormatter to share its key-encoding helpers

Thanks to Jean Boussier for this contribution

Reduce allocations in ResponseBuffer pipelined getk parsing (#1117)

process_single_getk_response was building a fresh array to return results alongside the updated offset; refactored to store the offset as the last element of the existing tokens array and pop it, saving one allocation per response

Also skips trailing nils in the token array

Thanks to Jean Boussier for this contribution

Enable frozen string literals in RequestFormatter (#1118)

Frozen string literals had been inadvertently disabled; re-enabling reduces allocations by ~300,000 objects in a 10,000-iteration get_multi_cas benchmark (562 MB → 550 MB total allocated)

Thanks to Jean Boussier for this contribution

Reduce allocations in ResponseProcessor#value_from_tokens (#1113)

token[1..].to_i was allocating a new string for every token parsed; replaced with in-place slice! followed by a token reset to avoid poisoning subsequent token comparisons

Saves 4 allocations per entry in get_multi_cas workloads (a hotspot for IdentityCache)

Thanks to Jean Boussier for this contribution

Reduce allocations in common operation paths (#1111)

Use Symbol#name over Symbol#to_s to return a frozen string without allocation

Skip trace attribute hash construction when OpenTelemetry instrumentation is disabled

Use argument forwarding (...) in Client#perform and Threadsafe#request to avoid splat array allocation

Use match? in KeyRegularizer#encode to avoid MatchData object allocation

Reduces objects allocated by ~26% and memory by ~6% for a simple get workload

Thanks to Jean Boussier for this contribution

Fix pathological memory behavior in ResponseBuffer (#1114)

compact_if_needed was intended to reclaim memory by slicing off consumed bytes, but buffer.byteslice(@offset..) on an unfrozen string causes Ruby to allocate a hidden third string as the copy-on-write owner rather than freeing the original

Redesigns buffer management to pass reusable buffer objects directly to read/read_nonblock, avoiding reallocation on each response read

Reduces allocations from ~2.38 GB to ~649 MB in a get_multi_cas benchmark over 10,000 iterations

Accompanied by new unit tests for ResponseBuffer (#1115)

Thanks to Jean Boussier for this contribution

Features:

delete_multi now returns the number of keys found and deleted (#1126)

Previously the return value was unspecified; callers (e.g. Rails, see rails/rails#58071) had no way to tell how many keys were actually removed

The count is derived from the meta protocol's quiet-mode delete responses with no extra round-trips: successful deletes are suppressed while misses report NF, so any response received before the terminator is a key that was not deleted

The single-server fast path now shares the pipelined path's bounded retry on transient (RetryableNetworkError) network errors, so both paths behave consistently; the returned count is best-effort and may under-report if a network error triggers a retry, since keys deleted before the error are not recounted

... (truncated)

Commits

6c8dabe Merge pull request #1138 from petergoldstein/release/5.0.6
f740e6a Credit Dan Mayer for the original non-StandardError teardown fix
b833b05 Prepare 5.0.6 release
4e83dd6 Drop the dependabot entry from the CHANGELOG
3ba0937 Merge pull request #1137 from petergoldstein/changelog/1128-1129-1131-1132-11...
95cc90c Add CHANGELOG entries for #1135 and #1136
87ac35f Add CHANGELOG entries for #1124, #1128, #1129, #1131, #1132, #1133, #1134
3e5fc76 Merge pull request #1136 from petergoldstein/fix/teardown-on-non-standard-error
e7b88b0 Merge pull request #1135 from petergoldstein/fix/exact-length-reads
96ff9af Tear down the connection when a non-StandardError aborts a request
Additional commits viewable in compare view

Updates sorbet-static from 0.6.13386 to 0.6.13414

Release notes

Sourced from sorbet-static's releases.

sorbet 0.6.13413.20260807140951-67a4dc6d0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13413', :group => :development
gem 'sorbet-runtime', '0.6.13413'
sorbet 0.6.13412.20260806165344-819748576

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13412', :group => :development
gem 'sorbet-runtime', '0.6.13412'
sorbet 0.6.13411.20260806161103-2bf77bd0f

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13411', :group => :development
gem 'sorbet-runtime', '0.6.13411'
sorbet 0.6.13410.20260806094322-1ff040f9b

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13410', :group => :development
gem 'sorbet-runtime', '0.6.13410'
sorbet 0.6.13409.20260805180005-b81866b59

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13409', :group => :development
gem 'sorbet-runtime', '0.6.13409'
sorbet 0.6.13408.20260805160952-e6edf1896

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13408', :group => :development
gem 'sorbet-runtime', '0.6.13408'
sorbet 0.6.13407.20260805135550-7a90787b0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13407', :group => :development
gem 'sorbet-runtime', '0.6.13407'
sorbet 0.6.13406.20260805133454-3be756837

... (truncated)

Commits

See full diff in compare view

Updates sorbet-static-and-runtime from 0.6.13386 to 0.6.13414

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.6.13413.20260807140951-67a4dc6d0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13413', :group => :development
gem 'sorbet-runtime', '0.6.13413'
sorbet 0.6.13412.20260806165344-819748576

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13412', :group => :development
gem 'sorbet-runtime', '0.6.13412'
sorbet 0.6.13411.20260806161103-2bf77bd0f

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13411', :group => :development
gem 'sorbet-runtime', '0.6.13411'
sorbet 0.6.13410.20260806094322-1ff040f9b

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13410', :group => :development
gem 'sorbet-runtime', '0.6.13410'
sorbet 0.6.13409.20260805180005-b81866b59

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13409', :group => :development
gem 'sorbet-runtime', '0.6.13409'
sorbet 0.6.13408.20260805160952-e6edf1896

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13408', :group => :development
gem 'sorbet-runtime', '0.6.13408'
sorbet 0.6.13407.20260805135550-7a90787b0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13407', :group => :development
gem 'sorbet-runtime', '0.6.13407'
sorbet 0.6.13406.20260805133454-3be756837

... (truncated)

Commits

See full diff in compare view

Updates rbi from 0.4.2 to 0.4.3

Release notes

Sourced from rbi's releases.

v0.4.3

What's Changed

🛠 Other Changes

Deduplicate method signature printing by @Morriar in Shopify/rbi#638

Support multiple type parameters on T.class_of by @Morriar in Shopify/rbi#643

Support Prism::NoKeywordsParameterNode by @Morriar in Shopify/rbi#639

Fix RBS translation of braceless shape return types by @Morriar in Shopify/rbi#644

Support braceless shape types in T::Struct fields by @Morriar in Shopify/rbi#647

Add support for top-level bind in sigs by @Morriar in Shopify/rbi#645

Add test for Method#add_no_kw_param by @Morriar in Shopify/rbi#649

Full Changelog: Shopify/rbi@v0.4.2...v0.4.3

Commits

2c28d36 Bump version v0.4.3
60e3d14 Merge pull request #649 from Shopify/test-add-no-kw-param
c1642fc Add test for Method#add_no_kw_param
c1f1390 Merge pull request #645 from Shopify/support-top-level-sig-bind
57bae18 Merge pull request #647 from Shopify/support-tstruct-shape-types
625644b Support braceless shape types in T::Struct fields
ca22dce Update exported RBI
49b2381 Handle top level bind in rewriters
51eecf4 Parse bind sig builder
1cee661 Add support for top level bind in sigs
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 6 updates: | Package | From | To | | --- | --- | --- | | [rubocop-shopify](https://github.com/Shopify/ruby-style-guide) | `3.0.1` | `3.0.2` | | [rubocop-sorbet](https://github.com/shopify/rubocop-sorbet) | `0.13.2` | `0.14.0` | | [dalli](https://github.com/petergoldstein/dalli) | `5.0.5` | `5.0.6` | | [sorbet-static](https://github.com/sorbet/sorbet) | `0.6.13386` | `0.6.13414` | | [sorbet-static-and-runtime](https://github.com/sorbet/sorbet) | `0.6.13386` | `0.6.13414` | | [rbi](https://github.com/Shopify/rbi) | `0.4.2` | `0.4.3` | Updates `rubocop-shopify` from 3.0.1 to 3.0.2 - [Release notes](https://github.com/Shopify/ruby-style-guide/releases) - [Commits](Shopify/ruby-style-guide@v3.0.1...v3.0.2) Updates `rubocop-sorbet` from 0.13.2 to 0.14.0 - [Release notes](https://github.com/shopify/rubocop-sorbet/releases) - [Commits](Shopify/rubocop-sorbet@v0.13.2...v0.14.0) Updates `dalli` from 5.0.5 to 5.0.6 - [Release notes](https://github.com/petergoldstein/dalli/releases) - [Changelog](https://github.com/petergoldstein/dalli/blob/main/CHANGELOG.md) - [Commits](petergoldstein/dalli@v5.0.5...v5.0.6) Updates `sorbet-static` from 0.6.13386 to 0.6.13414 - [Release notes](https://github.com/sorbet/sorbet/releases) - [Commits](https://github.com/sorbet/sorbet/commits) Updates `sorbet-static-and-runtime` from 0.6.13386 to 0.6.13414 - [Release notes](https://github.com/sorbet/sorbet/releases) - [Commits](https://github.com/sorbet/sorbet/commits) Updates `rbi` from 0.4.2 to 0.4.3 - [Release notes](https://github.com/Shopify/rbi/releases) - [Commits](Shopify/rbi@v0.4.2...v0.4.3) --- updated-dependencies: - dependency-name: rubocop-shopify dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: rubocop-sorbet dependency-version: 0.14.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: dalli dependency-version: 5.0.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: sorbet-static dependency-version: 0.6.13414 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: sorbet-static-and-runtime dependency-version: 0.6.13414 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: rbi dependency-version: 0.4.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 10, 2026

dependabot Bot requested a review from a team as a code owner August 10, 2026 21:45

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 10, 2026

Update gem RBIs

84d9d12

Morriar approved these changes Aug 11, 2026

View reviewed changes

Morriar merged commit 9153f30 into main Aug 11, 2026
17 checks passed

Morriar deleted the dependabot/bundler/minor-and-patch-37f465cd1d branch August 11, 2026 16:06

Navigation Menu

Uh oh!

Bump the minor-and-patch group with 6 updates - #2697

Bump the minor-and-patch group with 6 updates#2697
Morriar merged 2 commits into
mainfrom
dependabot/bundler/minor-and-patch-37f465cd1d

dependabot Bot commented on behalf of github Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 10, 2026

3.0.2

What's Changed

New Contributors

v0.14.0

What's Changed

🛠 Other Changes

v5.0.6

5.0.6

sorbet 0.6.13413.20260807140951-67a4dc6d0

sorbet 0.6.13412.20260806165344-819748576

sorbet 0.6.13411.20260806161103-2bf77bd0f

sorbet 0.6.13410.20260806094322-1ff040f9b

sorbet 0.6.13409.20260805180005-b81866b59

sorbet 0.6.13408.20260805160952-e6edf1896

sorbet 0.6.13407.20260805135550-7a90787b0

sorbet 0.6.13406.20260805133454-3be756837

sorbet 0.6.13413.20260807140951-67a4dc6d0

sorbet 0.6.13412.20260806165344-819748576

sorbet 0.6.13411.20260806161103-2bf77bd0f

sorbet 0.6.13410.20260806094322-1ff040f9b

sorbet 0.6.13409.20260805180005-b81866b59

sorbet 0.6.13408.20260805160952-e6edf1896

sorbet 0.6.13407.20260805135550-7a90787b0

sorbet 0.6.13406.20260805133454-3be756837

v0.4.3

What's Changed

🛠 Other Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant