[dependabot]

Bumps the production-dependencies group with 5 updates in the / directory:

Package	From	To
sqlite3	2.9.6	2.10.2
bootsnap	1.26.0	1.26.1
thruster	0.1.26	0.1.27
ruby_llm	2.1.0	2.1.1
ruby_llm-schema	0.4.0	1.0.0

Updates sqlite3 from 2.9.6 to 2.10.2

Release notes

Sourced from sqlite3's releases.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

e9aea2c2b3476fc875dd8a89313a9a2862818519c0186bfb5b56d6f57bb08d98  gems/sqlite3-2.10.2-aarch64-linux-gnu.gem
4986fc40cdf21342362b72a941df28e95cfe0e644f3ad2532d948b157c39dbee  gems/sqlite3-2.10.2-aarch64-linux-musl.gem
762f609ef891463226b472d3df66aea84d5466ff4376d3ccf4a059718c4ce9c9  gems/sqlite3-2.10.2-arm-linux-gnu.gem
833623eaf1157b1b85d1c0830e3e8f9beb3bb95a9bec3d252f20557a50e9803a  gems/sqlite3-2.10.2-arm-linux-musl.gem
5b0d235ea037e6dcd1b8387a19d73be571917db9f93044d35741cf933a21a37d  gems/sqlite3-2.10.2-arm64-darwin.gem
7fe1bf1adfca4fffeaec27371e0a20c1162d9d985681ec9560971a44fc41d198  gems/sqlite3-2.10.2-x64-mingw-ucrt.gem
46a02a29e9ae452824082388be5c24fd26f133b14bdd268610c6aa9a8d924c44  gems/sqlite3-2.10.2-x86-linux-gnu.gem
38980cf01eb2e4ac1c0755964d60b3d743ccf00686798a626bab852ff4cd3d1e  gems/sqlite3-2.10.2-x86-linux-musl.gem
fd2c67b49d313031af112e172c83ab321681a2b4996bf882eefac50be7bea08f  gems/sqlite3-2.10.2-x86_64-darwin.gem
ca92731ab464df9cae503fa1a439a549e2724f6953c8c05a7769b59366e38f15  gems/sqlite3-2.10.2-x86_64-linux-gnu.gem
b9f8fc62f3e0eb8966b41de251b492b4c8e9d1b23559beb6e150ad7f8d590941  gems/sqlite3-2.10.2-x86_64-linux-musl.gem
f1ea68cd3287f8a49f39a088ac9e4bd0ef4e7f394c3d4a60dd4c7e44b0566964  gems/sqlite3-2.10.2.gem

... (truncated)

Changelog

Sourced from sqlite3's changelog.

2.10.2 / 2026-10-26

Security / Stability

• Raise RangeError when a SQL string, a bound String or Blob value, or a String or Blob returned from a custom function or aggregate is longer than INT_MAX bytes. Previously the length was truncated to 32 bits, so SQLite could read only part of the string and drop trailing clauses from a query. See GHSA-4fqr-96q8-xrfx for more information. #762 @​flavorjones
• Fix a crash when a custom aggregate's finalize returns a value that can't be converted to a SQLite result. The exception is now raised from the query and the connection remains usable. #762 @​flavorjones
• Fix a use-after-free when the hash returned by Database#collations is cleared, modified or frozen. GC could free a comparator that SQLite still called. When that hash is frozen, Database#collation still raises FrozenError, but the new comparator stays registered and in use. #764 @​flavorjones
• Fix a deadlock when a collation comparator, trace block, busy_handler block or authorizer raises, or when an interrupt such as Thread#raise arrives while an aggregate's handler is being created. Another thread that used the connection blocked forever. The exception is now raised from the query and the connection remains usable. See "Changed" below for what SQLite does before the exception is raised. #764 @​flavorjones
• Fix a crash when a custom function or aggregate uses throw. The throw now unwinds to its catch. #764 @​flavorjones

Changed

• When a callback raises or throws, SQLite now finishes its current call before the exception is raised, instead of being unwound in the middle of it. #764 @​flavorjones
  • When a trace block raises, SQLite runs the statement up to its first row, or to completion, before the exception is raised. Previously the statement stopped where the block raised. For example, an INSERT whose trace block raises now inserts its row.
  • The other callbacks in that SQLite call skip their Ruby code: collation comparators return 0, functions and aggregates report an error to SQLite, the busy handler stops retrying and the authorizer denies.
  • Database#execute_batch2 now raises the exception from a custom function, instead of SQLite3::SQLException "Ruby Exception occurred".
  • An exception from a callback that SQLite runs during Statement#reset! or Database#close is discarded.
• The extension keeps per-fiber state in Thread.current[:__sqlite3_callback_frames__]. A query raises FrozenError on a Thread that was frozen before its first query. #764 @​flavorjones
• When SQLite can't allocate an aggregate's context, the query raises SQLite3::MemoryException instead of aborting the process. #764 @​flavorjones

Improved

• Statement#step no longer allocates and discards an array when the statement has no more rows. This saves one object per statement execution. #758 @​thomasklemm
• ObjectSpace.dump and heap profilers now report SQLite3::Database and SQLite3::Statement objects under their own type names, instead of SQLite3::Backup. #764 @​flavorjones

Documentation

• Document that parameters bound by Statement#execute, #execute!, #bind_param and #bind_params stay bound across executions, and that Statement#clear_bindings! clears them. #751 @​flavorjones

2.10.1 / 2026-10-19

Dependencies

• Vendored sqlite is updated to v3.54.1 (from v3.54.0). This release contains a fix for a possible heap buffer overflow on 32-bit builds, including the precompiled x86-linux-gnu and x86-linux-musl gems. #756 @​flavorjones

Improved

• Database#define_aggregator no longer creates an anonymous class for each aggregate function it defines. Each invocation of the function still runs on a clone of the template object. #752 @​jhawthorn

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.

... (truncated)

Commits

• 1d2aa7a version bump to v2.10.2
• 5329061 Merge pull request #764 from sparklemotion/card-342-callback-lifetime-followups
• 8e81efa test: stop counting the finalizer probes
• 60bf60e doc: list the callback behavior changes in CHANGELOG
• 083d734 Stop a raise inside a callback from deadlocking other threads
• ab14f58 doc: add PR number to CHANGELOG
• e4f3d58 Merge pull request #763 from sparklemotion/card-345-fork-safety-test-flake
• dab7eb2 doc: update CHANGELOG
• 03e5469 test: release aggregate instances on more routes to xFinal
• 621c692 test: skip compaction tests where compaction raises
• Additional commits viewable in compare view

Updates bootsnap from 1.26.0 to 1.26.1

Changelog

Sourced from bootsnap's changelog.

1.26.1

• Fix Bootsnap.enable_frozen_string_literal(app_only: true) raising NameError when the compile cache is disabled. App files are now compiled with frozen string literals on every load, without caching.

• Avoid transcoding Ruby source when the Prism workaround runs with a default internal encoding.

• Better detect support for fast path scanning. Fix compilation on Illumos.

Commits

• 681429d Release 1.26.1
• 9298a58 Merge pull request #582 from byroot/compiler-no-cache
• e340dd0 Support custom compilers even whith caching disabled
• 82b9598 Merge pull request #578 from byroot/windows-binmode
• 8ad8d73 Read and write loadpath cache in binmode
• dd767a4 Merge pull request #581 from czj/ci-old-rubies-on-ubuntu-24.04
• a53f3de CI: run Ruby < 3.2 on ubuntu-24.04 now that ubuntu-latest is 26.04
• db216d1 Merge pull request #576 from pauljccode/fix/source-internal-encoding
• d53eb60 Declare the UTF-8 regression fixture encoding
• d5cdf8a Preserve source encoding in the Prism workaround
• Additional commits viewable in compare view

Updates thruster from 0.1.26 to 0.1.27

Changelog

Sourced from thruster's changelog.

v0.1.27 / 2026-09-28

• Update dependencies (#154)
• Bump golang.org/x/crypto to v0.56.0 (#152)
• Build with Go 1.27.1, update dependencies, add make check (#150)

Commits

• 669643f Merge commit from fork
• 38d3721 Merge pull request #155 from erikthoreson24/version-0.1.27
• 0992970 Bump version
• 72796d7 Merge pull request #154 from basecamp/deps
• 0864e8a Use http.Transport for h2c test client
• 80e89ee Update dependencies
• 22a9978 Merge pull request #152 from erikthoreson24/fix/bump-x-crypto-0.56.0
• b186518 Bump golang.org/x/crypto to v0.56.0
• 3ef8516 Merge pull request #150 from basecamp/go-1.27.1
• fa31b96 Add make check to run go vet and govulncheck
• Additional commits viewable in compare view

Updates ruby_llm from 2.1.0 to 2.1.1

Release notes

Sourced from ruby_llm's releases.

RubyLLM 2.1.1 fixes fresh installs that today's faraday-net_http 3.5.0 release broke, connects to MCP servers that predate the 2026-07-28 revision, and keeps batch embeddings paired with the right inputs.

bundle add ruby_llm --version 2.1.1

Already on 2.1? Run bundle update ruby_llm. No schema or code changes are needed.

Fixed

• Install RubyLLM with the latest faraday-net_http. faraday-net_http 3.5.0 falls outside the range every Faraday from 2.0.1 to 2.14.4 accepts, so a fresh bundle install resolved Faraday 2.0.0, which loads no default adapter, and every request failed with :net_http is not registered on Faraday::Adapter. RubyLLM now excludes Faraday 2.0.0. By @​crmne; thanks @​juneira. (ef2bebdb)
• Connect to MCP servers that predate the 2026-07-28 revision. A server that rejects the revision with -32022 now gets the initialize handshake whether it lists the legacy revisions it speaks, as Atlassian's does, or lists none, as Datadog's does. By @​ebeigarts, @​juneira, and @​crmne. (#1056, #1057, #1053, #1055)
• Pair batch embeddings with the right inputs. OpenAI-compatible and Mistral batch results now place each vector by the position the provider reports, and mark a result with duplicate, missing, or out-of-range positions as failed instead of pairing its vectors with the wrong texts. By @​D41910. (#1051, #1052)
• Keep the Bedrock inference profile you choose. An id that already names a geography, such as eu.anthropic.claude-sonnet-5-5, is no longer rewritten to another region's profile, so requests stay where your IAM policy allows them. By @​s-andringa. (#1050)
• Keep chat replies when a usage row cannot be linked. A persisted chat saves the reply and logs the failed link, instead of rolling back an answer the provider already billed. By @​yorzi. (#1048, #1049)
• Upload converted attachments again after a provider deletes them. The chat forgets the stale upload and retries, as it already did for plain attachments. By @​yorzi. (#1046, #1047)

Thanks

Thanks to @​yorzi, @​s-andringa, @​D41910, @​ebeigarts, and @​juneira for the fixes and reports in this release.

Full changelog: crmne/ruby_llm@v2.1.0...v2.1.1

Changelog

Sourced from ruby_llm's changelog.

RubyLLM 2.1.1 fixes fresh installs that today's faraday-net_http 3.5.0 release broke, connects to MCP servers that predate the 2026-07-28 revision, and keeps batch embeddings paired with the right inputs.

bundle add ruby_llm --version 2.1.1

Already on 2.1? Run bundle update ruby_llm. No schema or code changes are needed.

Fixed

• Install RubyLLM with the latest faraday-net_http. faraday-net_http 3.5.0 falls outside the range every Faraday from 2.0.1 to 2.14.4 accepts, so a fresh bundle install resolved Faraday 2.0.0, which loads no default adapter, and every request failed with :net_http is not registered on Faraday::Adapter. RubyLLM now excludes Faraday 2.0.0. By @​crmne; thanks @​juneira. (ef2bebdb)
• Connect to MCP servers that predate the 2026-07-28 revision. A server that rejects the revision with -32022 now gets the initialize handshake whether it lists the legacy revisions it speaks, as Atlassian's does, or lists none, as Datadog's does. By @​ebeigarts, @​juneira, and @​crmne. (#1056, #1057, #1053, #1055)
• Pair batch embeddings with the right inputs. OpenAI-compatible and Mistral batch results now place each vector by the position the provider reports, and mark a result with duplicate, missing, or out-of-range positions as failed instead of pairing its vectors with the wrong texts. By @​D41910. (#1051, #1052)
• Keep the Bedrock inference profile you choose. An id that already names a geography, such as eu.anthropic.claude-sonnet-5-5, is no longer rewritten to another region's profile, so requests stay where your IAM policy allows them. By @​s-andringa. (#1050)
• Keep chat replies when a usage row cannot be linked. A persisted chat saves the reply and logs the failed link, instead of rolling back an answer the provider already billed. By @​yorzi. (#1048, #1049)
• Upload converted attachments again after a provider deletes them. The chat forgets the stale upload and retries, as it already did for plain attachments. By @​yorzi. (#1046, #1047)

Thanks

Thanks to @​yorzi, @​s-andringa, @​D41910, @​ebeigarts, and @​juneira for the fixes and reports in this release.

Full changelog: crmne/ruby_llm@v2.1.0...v2.1.1

Commits

• a40182d Prepare RubyLLM 2.1.1 for release
• e5a7a42 MCP: shake hands when a version reject lists nothing
• a8c17eb Check the Faraday 2.0.0 exclusion under the v1 job too
• ef2bebd Exclude Faraday 2.0.0, which has no default adapter
• e9dcd62 MCP: fall back to the handshake when a version reject lists a legacy revision...
• fa28fe3 Check Mistral batch embedding row positions before pairing vectors with input...
• 5556592 Check embedding batch row positions before pairing vectors with inputs (#1051)
• a67da2c Keep Bedrock ids that already name an inference profile (#1050)
• 93e2179 Keep chat replies when a usage row cannot be linked (#1049)
• 661f3d8 Restore uploads for converted attachments (#1047)
• Additional commits viewable in compare view

Updates ruby_llm-schema from 0.4.0 to 1.0.0

Release notes

Sourced from ruby_llm-schema's releases.

v1.0.0

RubyLLM::Schema is now Schematist. Schematist is a general purpose JSON Schema DSL that emits Draft 2020-12 schemas. Trapping that inside another gem's namespace was a disservice to anyone looking for a great JSON Schema DSL.

gem 'schematist'                         # was: gem 'ruby_llm-schema'
class Person < Schematist::Schema        # was: RubyLLM::Schema
end

Breaking

• to_json_schema returns a Draft 2020-12 document with string keys. The old {name:, description:, schema:} wrapper was OpenAI's response_format shape, and building that belongs in whatever talks to the provider.
• strict is gone. It's an OpenAI request flag, not a JSON Schema keyword.
• Errors moved up a level: Schematist::ValidationError, not RubyLLM::Schema::ValidationError.
• RubyLLM::Helpers is now Schematist::Helpers.

A final ruby_llm-schema 1.0.0 depends on this gem and aliases the old constants, so RubyLLM::Schema keeps resolving while you migrate.

New

Schematist now speaks most of Draft 2020-12:

• Composition: all_of, one_of, none_of join any_of
• Unevaluated: unevaluated_properties: and unevaluated_items:
• Object keys: min_properties:, max_properties:, keys for propertyNames, keys_matching for patternProperties
• Arrays: unique: for uniqueItems, tuple for prefixItems, contains with min: / max:
• Annotations: title, description, default, examples, deprecated, read_only, write_only, as keywords or inside the block
• Encoded content: content_encoding:, content_media_type:, content_schema
• Core keywords: $id, $anchor, $comment, $dynamicAnchor, $dynamicRef, $vocabulary
• Boolean and raw schemas: any_schema, no_schema, and raw for anything the DSL doesn't model
• const on every primitive, and greater_than: / less_than: for the exclusive bounds

Runtime values. Any value can be a proc, resolved when the document is rendered, so one schema class gives you a different document per instance:

string :role, enum: -> { @account.roles.pluck(:name) }

No runtime dependencies.

Fixed

number, integer, boolean and null didn't accept a block, so integer(:a) { title "A" } dropped the annotation silently instead of raising.

Changelog

Sourced from ruby_llm-schema's changelog.

Release process

1. Bump the version in lib/schematist/version.rb
2. Run bundle install
3. Write the release notes in packaging/release-notes/vX.Y.Z.md
4. Commit the changes with a message like "Bump version to X.Y.Z"
5. Run bundle exec rake release:prepare
6. Push to main
7. GitHub Actions will publish the gem if the version is not already on RubyGems
8. GitHub Actions will create the vX.Y.Z tag and a GitHub Release whose description is packaging/release-notes/vX.Y.Z.md, if they do not already exist

Note that step 7 fires on any change to lib/schematist/version.rb, so a version bump on main is a release. Hold the bump until everything else for that release has landed.

If the notes file is missing, the release gate fails before anything is published. Pushing the notes file reruns it and completes the release.

The ruby_llm-schema compatibility gem

compat/ruby_llm-schema is the final release of the old name. It depends on schematist ~> 1.0 and aliases RubyLLM::Schema, so anyone still on it picks up every schematist 1.x release from a normal bundle update. It does not need a release of its own when schematist ships a new minor, and it should not get one: releasing a deprecated gem on a schedule makes it look maintained.

It publishes from CI like schematist does, in a job that runs after schematist so the dependency resolves. The version lives in compat/ruby_llm-schema/ruby_llm-schema.gemspec, and the job is a no-op once that version is on RubyGems. To release it by hand instead:

cd compat/ruby_llm-schema
gem build ruby_llm-schema.gemspec
gem push ruby_llm-schema-1.0.0.gem

Revisit at schematist 2.0. ~> 1.0 will freeze those users on 1.x, so that is the point to either cut a compatibility 2.0 or let the old name go.

Commits

• ac1a66e Point contributor docs at the new repo name
• 388b179 Drop the zeitwerk dependency, keep the layout
• 40f3b65 Follow Zeitwerk conventions for file layout
• fa30b95 Rename the gem to Schematist
• f4b436c Accept blocks on every primitive property
• d2269a9 Remove the provider envelope from schema output
• dfac29c Return a Draft 2020-12 document from to_json_schema (#57)
• 761de5c Support runtime schema values (#47)
• 84d043b Add boolean and raw schemas (#55)
• 1a3f042 Add core identifier and reference keywords (#54)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions