chore(deps): bump the bundler-patch group across 1 directory with 6 updates

[dependabot]

Bumps the bundler-patch group with 6 updates in the / directory:

Package	From	To
erb	6.0.6	6.0.7
mini_magick	5.3.2	5.3.3
image_processing	2.0.2	2.0.3
brakeman	8.0.5	8.0.6
solargraph	0.60.2	0.60.3
sidekiq	8.1.6	8.1.7

Updates erb from 6.0.6 to 6.0.7

Release notes

Sourced from erb's releases.

v6.0.7

What's Changed

• Fix Ractor compatibility regression, add tests by @​hmcguire-shopify in ruby/erb#127

New Contributors

• @​hmcguire-shopify made their first contribution in ruby/erb#127

Full Changelog: ruby/erb@v6.0.6...v6.0.7

Changelog

Sourced from erb's changelog.

6.0.7

• Fix Ractor compatibility regression in v6.0.5

Commits

• 9907393 Version 6.0.7
• 50f434e Simplify Scanner's Ractor safety code
• 75f1ea0 Fix Ractor compatibility regression, add tests
• 26f674e Bump lewagon/wait-on-check-action from 1.8.0 to 1.9.0
• 5841135 Bump step-security/harden-runner from 2.19.4 to 2.20.0
• See full diff in compare view

Updates mini_magick from 5.3.2 to 5.3.3

Release notes

Sourced from mini_magick's releases.

v5.3.3

• Restored support for passing an IO object such as StringIO as :stdin to MiniMagick::Tool#call, which got broken in 5.3.2 when Open3.capture3 was replaced with Open3.popen3 for manual timeouts.

Commits

• 5709761 Bump to 5.3.3
• 40829a1 Restore support for StringIO stdin passed to MiniMagick::Tool#call
• See full diff in compare view

Updates image_processing from 2.0.2 to 2.0.3

Changelog

Sourced from image_processing's changelog.

2.0.3 (2026-06-08)

• Prevent remote code execution when operation names come from user input, closing bypasses through the #operation meta-builder, #method_missing, and nested #send calls (reported by @​szymonsec)

• [minimagick] Prevent remote code execution through unsafe public methods (e.g. #instance_eval, #send) passed as loader/saver option names

Commits

• 1611c00 Bump to 2.0.3
• 8cd14e9 Test on JRuby 10.1.x
• 28684e7 Close more RCE security gaps
• 0360dbd Remove ruby2_keywords usage (#145)
• See full diff in compare view

Updates brakeman from 8.0.5 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

• Fix EOL date for Rails 8.0 (@​yeaseul-kim)
• Fix command injection false positives (@​JacobEvelyn )
• Fix unused variable warning (@​viralpraxis)
• Add EOL dates for Rails 8.1 and Ruby 4.0

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

• Fix EOL date for Rails 8.0 (yeaseul-kim)
• Add EOL dates for Rails 8.1 and Ruby 4.0
• Fix command injection false positives (Jacob Evelyn)
• Fix unused variable warning (viralpraxis)

Commits

• fffc483 Bump to 8.0.6
• b7218fe Update CHANGES
• c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
• 4c191dd Fix EOL date for Rails 8.0
• e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
• dd4f0b9 Add EOL date for Ruby 4.0
• 7ca100a Add EOL date for Rails 8.1
• a53a456 Merge pull request #2022 from JacobEvelyn/main
• bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
• 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
• Additional commits viewable in compare view

Updates solargraph from 0.60.2 to 0.60.3

Changelog

Sourced from solargraph's changelog.

0.60.3 - August 5, 2026

• Pin rdoc to ~> 7.0 (#1216)
• (tag: v0.60.2) Release 0.60.2 (rdoc fix)
• Fix stale Hash::_Key expectations from upstream RBS core drift (#1224)
• Bump overcommit to ~> 0.71.0 (#1221)
• Resolve remote constants (#1234)
• Fix exponential blowup in Pin::Method#combine_same_type_arity_signatures (#1238)
• Respect #- yard comment-block separator (#1218)
• Typecheck attribute return tags against their backing ivar's type (#1219)
• Fix recursive-mutex deadlock in Library#sync_catalog (#1220)
• Fix Gemspecs#in_this_bundle? crash when no Gemfile is discoverable (#1225)
• Remove duplicate dead methods in RbsMap::Conversions (#1253)

Commits

• 8fda633 Release 0.60.3
• 6e4eccd Remove duplicate dead methods in RbsMap::Conversions (#1253)
• 7e44d48 Fix Gemspecs#in_this_bundle? crash when no Gemfile is discoverable (#1225)
• 0e0ddeb Fix recursive-mutex deadlock in Library#sync_catalog (#1220)
• d5aeaa9 Typecheck attribute return tags against their backing ivar's type (#1219)
• d5d5a32 Respect #- yard comment-block separator (#1218)
• 6b1efca Fix exponential blowup in Pin::Method#combine_same_type_arity_signatures (#1238)
• a410917 Resolve remote constants (#1234)
• 967c358 Bump overcommit to ~> 0.71.0 (#1221)
• e6017cd Fix stale Hash::_Key expectations from upstream RBS core drift (#1224)
• See full diff in compare view

Updates sidekiq from 8.1.6 to 8.1.7

Changelog

Sourced from sidekiq's changelog.

8.1.7

• Forward compatibililty with Active Job 8.1 #7019
• Many minor fixes and test improvements [hammadxcm]

Commits

• 1bb4aa0 prep for release
• f7d4e43 Disable happy eyeballs to minimize thread noise in profiler output
• 8cd683e re-fmt with latest standard
• e1f808a Updated Hindi locale wrt latest en.yml (#7059)
• 0679cb4 Update documentation with forum (#7058)
• 27ec982 updated locale to the latest (#7057)
• 3ab01da Metrics: draw deploy marks from every day the queried window spans (#7056)
• e375338 TUI: Render controls dynamically based on terminal width (#7052)
• c809c57 Convert help screen hotkeys to table (#7051)
• 6ced4c2 changes
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
rubygems/brakeman	8.0.6	🟢 6	Details Check Score Reason Code-Review 🟢 6 Found 9/15 approved changesets -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 27 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/erb	6.0.7	Unknown	Unknown
rubygems/image_processing	2.0.3	🟢 3.8	Details Check Score Reason Maintained 🟢 10 10 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/language_server-protocol	3.17.0.6	Unknown	Unknown
rubygems/mini_magick	5.3.3	🟢 4.7	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 2 Found 7/29 approved changesets -- score normalized to 2 Maintained 🟢 7 5 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 7 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/parser	3.3.12.0	🟢 3	Details Check Score Reason Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Maintained 🟢 3 3 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
rubygems/psych	5.5.0	🟢 5.1	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 5 Found 2/4 approved changesets -- score normalized to 5 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/rbs	4.2.0	🟢 5.8	Details Check Score Reason Code-Review ⚠️ 1 Found 2/12 approved changesets -- score normalized to 1 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed License 🟢 9 license file detected Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Packaging 🟢 10 packaging workflow detected Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/redis-client	0.30.1	Unknown	Unknown
rubygems/rubocop	1.90.0	🟢 5.6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 9 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 5 Found 13/23 approved changesets -- score normalized to 5 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/rubocop-ast	1.50.0	🟢 5	Details Check Score Reason Code-Review 🟢 5 Found 14/27 approved changesets -- score normalized to 5 Maintained 🟢 10 22 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/sidekiq	8.1.7	Unknown	Unknown
rubygems/solargraph	0.60.3	🟢 5.2	Details Check Score Reason Code-Review 🟢 3 Found 10/27 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/sorbet-runtime	0.6.13459	🟢 6	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 9 Found 29/30 approved changesets -- score normalized to 9 Maintained 🟢 10 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. SAST 🟢 9 SAST tool detected but not run on all commits
rubygems/tilt	2.9.0	🟢 3.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 9 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
rubygems/yard	0.9.45	🟢 4.6	Details Check Score Reason Maintained 🟢 10 23 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 1 Found 4/22 approved changesets -- score normalized to 1 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• Gemfile.lock