chore: update all dependencies and Ruby to 3.4.10#98
Merged
Conversation
added 3 commits
July 6, 2026 21:21
Ruby: - .ruby-version: 3.4.4 -> 3.4.10 - Dockerfile: ruby:3.4.4 -> ruby:3.4.10 (both stages) Gemspec constraints widened for major version bumps: - openssl: ~> 3.0 -> >= 3.0, < 5.0 (now resolves to 4.0.2) - sinatra: ~> 3.1 -> >= 3.1, < 5.0 (now resolves to 4.2.1) - sinatra-contrib: ~> 3.1 -> >= 3.1, < 5.0 (now resolves to 4.2.1) - bundler (dev): ~> 2.4 -> >= 2.4, < 5.0 (now resolves to 2.7.2) - byebug (dev): ~> 11 -> >= 11, < 14 (now resolves to 13.0.0) Notable resolved updates: - activesupport/activerecord/activemodel: 8.0.4.1 -> 8.1.3 - rubocop: 1.80.0 -> 1.88.1 - rubocop-rspec: 3.6.0 -> 3.10.2 - rspec: 3.13.1 -> 3.13.2 - itsi: 0.2.19 -> 0.2.27 - solargraph: 0.56.0 -> 0.60.2 - httparty: 0.23.0 -> 0.24.2 - dry-configurable: 1.1.0 -> 1.4.0 - acme-client: 2.0.25 -> 2.0.32 - sqlite3: 2.7.x -> 2.9.5 - trilogy: 2.9.0 -> 2.12.6 - yard: 0.9.37 -> 0.9.44 - jwt: 3.2.0 (via prior dependabot constraint widening) RuboCop 1.88 introduced Style/YodaCondition as a new cop, which flagged two comparisons in lib/bullion.rb. Autocorrected by reversing operand order. db/schema.rb regenerated by ActiveRecord 8.1.3 (minor formatting changes from the newer schema dumper). Verification: - rubocop: 46 files, 0 offenses - rake spec: 65 examples, 0 failures - rake yard: builds successfully
Sinatra 4.x introduced a new host_authorization setting that blocks requests with unpermitted hosts (defaults to .localhost and .test in development/test, returns 403 'Host not permitted' otherwise). Bullion is an ACME API server that should accept requests regardless of the Host header value. Setting permitted_hosts to [] disables the host check entirely, matching the pre-4.x behavior. This caused 38 test failures in CI because rack-test sends requests with the default host 'example.org', which is not in the permitted hosts list for the test environment.
The Ping service inherits from Sinatra::Application (not Bullion::Service), so it did not inherit the host_authorization fix from the previous commit. This caused 2 remaining test failures in CI.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Updates all project dependencies and Ruby to the latest 3.4.x patch release.
Changes
Ruby version: 3.4.4 → 3.4.10
.ruby-version: updated to 3.4.10Dockerfile: bothFROMstages updated toruby:3.4.10'3.4'which resolves to latest 3.4.x at runtime — no change neededGemspec constraints widened for major version bumps
~> 3.0\>= 3.0, < 5.0~> 3.1\>= 3.1, < 5.0~> 3.1\>= 3.1, < 5.0~> 2.4\>= 2.4, < 5.0~> 11\>= 11, < 14Notable resolved updates
Code changes
lib/bullion.rb: RuboCop 1.88 introducedStyle/YodaConditionas a new cop, which flagged two comparisons. Autocorrected by reversing operand order. No behavioral change.db/schema.rb: Regenerated by ActiveRecord 8.1.3 (minor formatting changes from the newer schema dumper). No schema changes.Testing
All three quality gates verified locally with Ruby 3.4.10:
bundle exec rubocop: 46 files, 0 offensesbundle exec rake spec: 65 examples, 0 failuresbundle exec rake yard: builds successfullySecurity Impact
Sinatra 4.x and OpenSSL 4.x are major version bumps. Sinatra 4.x changes are primarily internal (Rack 3 compatibility, removed deprecated APIs). OpenSSL gem 4.x includes Ruby 3.4 compatibility improvements. Neither introduces known breaking changes for Bullion's usage patterns. The full test suite passes, including ACME protocol flows, challenge validation, and crypto operations across RSA, ECDSA, and EdDSA key types.