build(deps): bump the bundler-patch group across 2 directories with 2 updates

[dependabot]

Bumps the bundler-patch group with 2 updates in the /dummy directory: sqlite3 and thruster.
Bumps the bundler-patch group with 1 update in the /gem directory: sqlite3.

Updates sqlite3 from 2.9.5 to 2.9.6

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Updates thruster from 0.1.23 to 0.1.25

Changelog

Sourced from thruster's changelog.

v0.1.25 / 2026-08-11

• Bypass all uncacheable requests (#142)

v0.1.24 / 2026-08-11

• Use struct types as cache keys

Commits

• 343c415 Bump version
• 0b8f646 Merge pull request #142 from basecamp/avoid-hits-from-uncacheable-requests
• 9b084d4 Bypass all uncacheable requests
• e38276c Bump version
• 5a6ae0f Merge commit from fork
• 71e703d Bump the github-actions group across 1 directory with 5 updates (#133)
• See full diff in compare view

Updates sqlite3 from 2.9.5 to 2.9.6

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions