Bump the minor-updates group across 1 directory with 5 updates

[dependabot]

Bumps the minor-updates group with 3 updates in the /example/web directory: async-http, rouge and rmagick.

Updates async-http from 0.95.1 to 0.103.0

Release notes

Sourced from async-http's releases.

v0.103.0

• Handle RST_STREAM(NO_ERROR) as an orderly HTTP/2 stream closure while still failing requests whose streams close before any response headers are received.

v0.102.0

• Requests assigned to an HTTP/2 connection which has already closed are refused before being written, allowing them to be retried safely.
• HTTP/2 connections which received a graceful GOAWAY are removed from availability immediately, but remain in the pool until the server has finished answering the streams it accepted. The connection is closed after its final user releases it, so those requests no longer fail with EOFError: Connection closed with N active stream(s)!.

v0.101.0

• Handle remote disconnects in Async::HTTP::Protocol::HTTP1::Server#each without reporting them as server failures.

v0.100.0

• Added transport-neutral TLS configuration support to Async::HTTP::Endpoint.

v0.99.0

• Retry safe requests when a remote HTTP/2 endpoint resets the stream with INTERNAL_ERROR before returning a response.

v0.98.1

• Probe idle HTTP/1 connections before reuse, avoiding requests on connections already closed by the peer.

v0.98.0

• Rewind request bodies before retrying requests.

v0.97.0

• Exposed all supported protocol names from the plaintext HTTP protocol negotiator.

v0.96.0

• Made metrics and traces optional runtime dependencies. Applications that use the providers should depend on the corresponding gem and require the provider explicitly.

Changelog

Sourced from async-http's changelog.

v0.103.0

• Handle RST_STREAM(NO_ERROR) as an orderly HTTP/2 stream closure while still failing requests whose streams close before any response headers are received.

v0.102.0

• Requests assigned to an HTTP/2 connection which has already closed are refused before being written, allowing them to be retried safely.
• HTTP/2 connections which received a graceful GOAWAY are removed from availability immediately, but remain in the pool until the server has finished answering the streams it accepted. The connection is closed after its final user releases it, so those requests no longer fail with EOFError: Connection closed with N active stream(s)!.

v0.101.0

• Handle remote disconnects in Async::HTTP::Protocol::HTTP1::Server#each without reporting them as server failures.

v0.100.0

• Added transport-neutral TLS configuration support to Async::HTTP::Endpoint.

v0.99.0

• Retry safe requests when a remote HTTP/2 endpoint resets the stream with INTERNAL_ERROR before returning a response.

v0.98.1

• Probe idle HTTP/1 connections before reuse, avoiding requests on connections already closed by the peer.

v0.98.0

• Rewind request bodies before retrying requests.

v0.97.0

• Exposed all supported protocol names from the plaintext HTTP protocol negotiator.

v0.96.0

• Made metrics and traces optional runtime dependencies. Applications that use the providers should depend on the corresponding gem and require the provider explicitly.

Commits

• cae5a83 Bump minor version.
• 22e174f Bump dependency on protocol-http2.
• 01b255d Handle orderly HTTP/2 stream closure. (#249)
• 9fd1f21 Bump minor version.
• 0085d9d Preserve orderly HTTP/2 duplex shutdown. (#248)
• 65a5087 Modernize code.
• e57967c Refuse requests assigned to closed HTTP/2 connections. (#246)
• 1dfa85b Do not close HTTP/2 connections while a graceful GOAWAY is being drained. (#245)
• ddd067e Add concurrent requests and pooling guide. (#243)
• 82c7137 Add guide for choosing a client. (#242)
• Additional commits viewable in compare view

Updates rouge from 5.0.0 to 5.1.0

Release notes

Sourced from rouge's releases.

v5.1.0

This release adds a new lexer for AddmusicK/Ramekin assembly and a substantial overhaul of the Perl lexer. The Java lexer now supports more modern syntax and no longer splits import static into separate tokens. The Shell lexer gains support for bash 5.3 curly substitutions and bitwise shift operators in math contexts. We also improved comment handling in Makefile body blocks and added delimited comment support to VHDL, along with fixes to the AppleScript, Markdown, Properties, Vue, and YAML lexers.

Thanks to all our contributors for your help and continuous support!

Changelog

Sourced from rouge's changelog.

version 5.1.0: 2026-08-05

Comparison with the previous version

• General
  • add a more helpful #inspect method for lexers (#2303 by Jeanine Adkisson)
  • Wrap code/pre references in changelog (#2293 by Matt Jankowski)
  • remove redundant alias declarations, and warn on duplicate registration (#2317 by Jeanine Adkisson)
  • update AGENTS.md and CONTRIBUTING.md (#2316 by Jeanine Adkisson)
• AddmusicK/Ramekin Lexer (NEW)
  • Add an AddmusicK/Ramekin lexer (#2277 by Jeanine Adkisson)
• AppleScript Lexer
  • Fix applescript warning and move files to locations that match the tag (#2321 by Jeanine Adkisson)
• Makefile Lexer
  • Add comment support in Makefile body blocks (#2305 by Tan Le)
• Markdown Lexer
  • Fix edge case in markdown lexer for links (#2308 by Marcel Amirault)
• Java Lexer
  • Support modern Java syntax (#2300 by Tan Le)
  • Fix Java import static tokenized as separate tokens (#2298 by Tan Le)
• Perl Lexer
  • Overhaul the perl lexer (#2307 by Jeanine Adkisson)
• Properties Lexer
  • properties: fix comments at eof and escaped chars in keys (#2320 by Jeanine Adkisson)
• Shell Lexer
  • shell: use Str::Interpol instead of Str::Escape (#2310 by Jeanine Adkisson)
  • Add bitwise shift operators to shell math context (#2297 by Tan Le)
  • add support for bash 5.3 curly substitutions (#2309 by Jeanine Adkisson)
• VHDL Lexer
  • VHDL: support delimited comments (#2304 by marph91)
• Vue Lexer
  • Fix @ event shorthand in Vue templates (#2296 by Tan Le)
• YAML Lexer
  • Fix bug with yaml separator in code blocks (#2313 by Marcel Amirault)

Commits

• afc3c52 Release v5.1.0 (#2315)
• 1e5bad1 properties: fix comments at eof and escaped chars in keys (#2320)
• bf1806d Fix applescript warning and move files to locations that match the tag (#2321)
• 1b39fb6 update AGENTS.md and CONTRIBUTING.md (#2316)
• e31b904 remove redundant alias declarations, and warn on duplicate registration (#2317)
• aed8a2f Fix bug with yaml separator in code blocks (#2313)
• 5208dfa shell: use Str::Interpol instead of Str::Escape (#2310)
• 11dce33 Overhaul the perl lexer (#2307)
• 1bfcbf9 add support for bash 5.3 curly substitutions (#2309)
• ab9e21e Fix edge case in markdown lexer for links (#2308)
• Additional commits viewable in compare view

Updates async from 2.42.0 to 2.45.1

Release notes

Sourced from async's releases.

v2.45.1

• Fixed Scheduler#io_wait returning nil instead of false when an explicit timeout expired. Native callers such as Socket#connect with connect_timeout: distinguish a timeout by checking for false, so the nil caused TypeError: no implicit conversion from nil to integer instead of the intended IO::TimeoutError.

v2.45.0

• Fixed scheduler I/O and process waits returning prematurely after stale or interrupted wake-ups. I/O waits now preserve their original timeout, while blocking process waits retry and non-blocking Process::WNOHANG waits still return nil.

v2.44.1

No release notes provided.

v2.44.0

• Fixed scheduler cleanup after forking while other fibers are blocked.

v2.43.0

• Propagate cancellation causes through task trees so child tasks observe the original cancellation cause.

Changelog

Sourced from async's changelog.

v2.45.1

• Fixed Scheduler#io_wait returning nil instead of false when an explicit timeout expired. Native callers such as Socket#connect with connect_timeout: distinguish a timeout by checking for false, so the nil caused TypeError: no implicit conversion from nil to integer instead of the intended IO::TimeoutError.

v2.45.0

• Fixed scheduler I/O and process waits returning prematurely after stale or interrupted wake-ups. I/O waits now preserve their original timeout, while blocking process waits retry and non-blocking Process::WNOHANG waits still return nil.

v2.44.0

• Fixed scheduler cleanup after forking while other fibers are blocked.

v2.43.0

• Propagate cancellation causes through task trees so child tasks observe the original cancellation cause.

Commits

• e8ecf58 Bump patch version.
• 24633aa Return false from io_wait for timeouts. (#472)
• fbb7c77 Fix buffered IO signatures for Ruby 4.1 (#471)
• 5b925fa Bump minor version.
• 78f3ce6 Retry interrupted waits in io_wait and process_wait. (#469)
• e16c769 Fix URing backend probe on Ruby head. (#470)
• bc86231 Bump patch version.
• 279e868 Modernize code. Fixes #464.
• 4d29457 Improve Async and Sync documentation. (#465)
• 9bbc07d Bump minor version.
• Additional commits viewable in compare view

Updates protocol-url from 0.4.0 to 0.18.0

Release notes

Sourced from protocol-url's releases.

v0.18.0

• Support explicit URL serialization for mixed grammars, and remove explicit prefixes from relative path calculation.

v0.17.0

• Add optional explicit ./ prefixes when generating same-directory relative URLs.

v0.16.0

• Preserve directory and file semantics when generating relative URL paths.

v0.15.0

• Add Protocol::URL::Relative#relative_to for expressing root-relative URLs relative to a base path.

v0.14.0

• Allow paths to compare with their encoded string representation.

v0.13.0

• Add conservative normalization of encoded URL paths.

v0.12.0

• Allow unfrozen relative and absolute URLs to replace their components.

v0.11.0

No release notes provided.

Changelog

Sourced from protocol-url's changelog.

v0.18.0

• Support explicit URL serialization for mixed grammars, and remove explicit prefixes from relative path calculation.

v0.17.0

• Add optional explicit ./ prefixes when generating same-directory relative URLs.

v0.16.0

• Preserve directory and file semantics when generating relative URL paths.

v0.15.0

• Add Protocol::URL::Relative#relative_to for expressing root-relative URLs relative to a base path.

v0.14.0

• Allow paths to compare with their encoded string representation.

v0.13.0

• Add conservative normalization of encoded URL paths.

v0.12.0

• Allow unfrozen relative and absolute URLs to replace their components.

v0.10.0

• Rename Protocol::URL::FormData::Parser::CONTENT_TYPE to MEDIA_TYPE.

v0.9.0

• Add Protocol::URL::LimitError for configured processing limits.

v0.8.0

• Use consistent limit naming for form data parser constraints.

v0.7.0

• Allow Protocol::URL::FormData::Parser#parse to populate a supplied result object.

v0.6.0

• Add Protocol::URL::FormData::Parser for incremental, limited parsing of application/x-www-form-urlencoded form data.
• Add Protocol::URL::FormData::Nested for consistently building nested form data while preserving absent and empty values.

v0.5.0

... (truncated)

Commits

• e234f4a Bump minor version.
• e740110 Serialize relative URLs explicitly if requested. (#20)
• 3676599 Bump minor version.
• e17a07a Support explicit relative URL paths. (#19)
• 0306af5 Bump minor version.
• 1b8bfa2 Preserve relative URL path semantics. (#18)
• bf81879 Bump minor version.
• 0b20bf6 Add relative URL conversion. (#17)
• 033cf9f Bump minor version.
• 10b99c3 Compare paths with encoded strings. (#16)
• Additional commits viewable in compare view

Updates rmagick from 7.0.5 to 7.1.3

Release notes

Sourced from rmagick's releases.

RMagick 7.1.3

Bug Fixes

• Fix Magick.limit_resource truncating 64-bit limits on 32-bit platforms by @​Watson1978 in rmagick/rmagick#1864
• Fix Magick.set_cache_threshold truncating the threshold on 32-bit platforms by @​Watson1978 in rmagick/rmagick#1865

Full Changelog: rmagick/rmagick@RMagick_7-1-2...RMagick_7-1-3

RMagick 7.1.2

Bug Fixes

• Fix memory leak in Draw#annotate when a geometry argument raises by @​OskarEichler in rmagick/rmagick#1850
• Fix Steep self type crash in RVG helper by @​OskarEichler in rmagick/rmagick#1851
• Fix use-after-free in Draw#annotate when a callback destroys the image by @​Watson1978 in rmagick/rmagick#1852
• Fix affine matrix not being restored when Draw#annotate raises by @​Watson1978 in rmagick/rmagick#1853
• Fix memory leak in Draw#annotate when the geometry copy fails by @​Watson1978 in rmagick/rmagick#1854

New Contributors

• @​OskarEichler made their first contribution in rmagick/rmagick#1850

Full Changelog: rmagick/rmagick@RMagick_7-1-1...RMagick_7-1-2

RMagick 7.1.1

Bug Fixes

• Fix Strings being recycled while the C pointers into them are in use by @​Watson1978 in rmagick/rmagick#1847

Full Changelog: rmagick/rmagick@RMagick_7-1-0...RMagick_7-1-1

RMagick 7.1.0

[!IMPORTANT] Draw#annotate and Draw#get_type_metrics no longer interpret the text they are given. A %[...] or %x escape is now drawn as written instead of being replaced.

Build the string in Ruby instead — everything those escapes provided has a direct accessor:

# before
img.annotate(gc, 0, 0, 10, 20, '%wx%h')
after
img.annotate(gc, 0, 0, 10, 20, "#{img.columns}x#{img.rows}")

%[width]/%w → Image#columns, %[height]/%h → Image#rows, %f/%d → Image#filename, %m → Image#format, %b → Image#filesize, %[EXIF:*] and other properties → Image#[], %[artifact:KEY] → Image#artifact (new in this release), %[mean] → Image#channel_mean, %[pixel:p{x,y}] → Image#pixel_color, %[fx:...] → Image#fx or plain Ruby.

The interpolation was never documented, and leaving it in place meant that passing user-supplied text to annotate also handed that text to an expression evaluator, a pixel and metadata reader, and an unbounded CPU sink — on a 1500x1500 image, a 10 KB caption of %[mean] took 78 seconds. It also corrupted ordinary text: %d expanded to the directory the image had been read from, so a caption of "%d items" was drawn as /srv/app/uploads items.

Upgrading

• Text starting with @ is drawn instead of being read from that file. annotate(gc, 0, 0, 0, 20, '@notes.txt') now draws @notes.txt; read the file yourself if that is what you wanted.
• RVG path data is validated against the SVG path grammar. canvas.path(d) raises ArgumentError if d contains anything outside MmZzLlHhVvCcSsQqTtAa, digits, .,+-eE and whitespace.
• Pathnames containing a NUL byte raise ArgumentError instead of being silently truncated.
• Draw#clip_path and Draw#encoding now quote their argument in the generated MVG, and values interpolated by Draw#enquote have " and \ escaped. Rendering is unchanged; this is only visible if you compare Draw#inspect output.

... (truncated)

Changelog

Sourced from rmagick's changelog.

RMagick 7.1.3

Bug Fixes

• Fix Magick.set_cache_threshold truncating the threshold on 32-bit platforms (#1865)
• Fix Magick.limit_resource truncating 64-bit limits on 32-bit platforms (#1864)

RMagick 7.1.2

Bug Fixes

• Fix memory leak in Draw#annotate when the geometry copy fails (#1854)
• Fix affine matrix not being restored when Draw#annotate raises (#1853)
• Fix use-after-free in Draw#annotate when a callback destroys the image (#1852)
• Fix Steep self type crash in RVG helper (#1851)
• Fix memory leak in Draw#annotate when a geometry argument raises (#1850)

RMagick 7.1.1

Bug Fixes

• Fix Strings being recycled while the C pointers into them are in use (#1847)

RMagick 7.1.0

[!IMPORTANT] Draw#annotate and Draw#get_type_metrics no longer interpret the text they are given. A %[...] or %x escape in it is now drawn as written instead of being replaced by an image property. Everything those escapes provided is available directly from Ruby -- Image#columns, Image#rows, Image#format, Image#filesize, Image#filename, Image#[], Image#artifact, Image#channel_mean, Image#pixel_color and Image#fx -- so build the string in Ruby and pass the result.

The interpolation was undocumented, and it handed any caller that passed user-supplied text an expression evaluator, a pixel and metadata reader, and an unbounded CPU sink. It also corrupted ordinary captions: "%d items" was drawn as the directory the image had been read from.

Breaking Changes

• Draw annotation text as given instead of interpreting it (#1843)
• Draw text starting with '@' instead of reading it from that file (#1837)
• Validate RVG path data against the SVG path grammar (#1839)
• Escape values and quote the clip-path and encoding names in the MVG program (#1841)
• Reject embedded NUL bytes in pathname arguments (#1827)

Improvements

• Add Image#artifact to read the artifacts Image#define writes (#1842)
• Fix grammar, typos, and content errors in the documentation (#1824)

Bug Fixes

• Fix RVG text being quoted twice and the added quotes being drawn (#1840)
• Fix MVG injection in Draw#text from unescaped backslashes (#1838)
• Fix memory leak in ImageList#composite_layers with an unusable source list (#1836)

... (truncated)

Commits

• See full diff in compare view

[aalin]

@dependabot rebase