chore(deps-dev): bump the development-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the development-dependencies group with 3 updates in the / directory: lefthook, sqlite3 and yard.

Updates lefthook from 2.1.9 to 2.1.10

Release notes

Sourced from lefthook's releases.

v2.1.10

Changelog

• c0a32e900407bf3e2e97c99a7dd2e3f2864ba13a deps: July 2026 (#1463)
• 0b87ca6dc643dab804a1aad59c24003ef147c11a deps: June 2026 (#1447)
• afce7244cf02abaf996ebe87bb557a725e46993e deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)
• fbb61b369b57a17469bd6997d1624608ce977f61 feat: AI coding agents integration (#1448)
• cbfb4a5db29b46ac8bf399665cd9ada81022b848 fix: make test suite stable when NO_COLOR is set (#1449)

Changelog

Sourced from lefthook's changelog.

2.1.10 (2026-07-08)

• deps: July 2026 (#1463) by @​mrexox
• feat: AI coding agents integration (#1448) by @​viralpraxis
• docs: fix language (#1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#1449) by @​viralpraxis
• deps: June 2026 (#1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443) by @​maguowei
• docs: upgrade docmd (#1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

Commits

• 8d9cfec 2.1.10: add experimental ai hooks
• c0a32e9 deps: July 2026 (#1463)
• 2ceca38 docs: fix links to new beta feature
• fbb61b3 feat: AI coding agents integration (#1448)
• 82a794f docs: fix language (#1453)
• cbfb4a5 fix: make test suite stable when NO_COLOR is set (#1449)
• 0b87ca6 deps: June 2026 (#1447)
• afce724 deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)
• b9549b8 docs: upgrade docmd (#1442)
• 0bffc85 docs: use single quotes in example to handle filepaths with $
• See full diff in compare view

Updates sqlite3 from 2.9.5 to 2.9.6

Release notes

Sourced from sqlite3's releases.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Updates yard from 0.9.44 to 0.9.45

Release notes

Sourced from yard's releases.

Release v0.9.45

• Use @param types to document generated Struct.new and Data.define members (#1684)
• Add compatibility with RDoc 8
• Fix TypesExplainer parsing of types following Hash collections (#1688)
• Fix HTML generation for RBS constants without source values (#1686)
• Fix method redefinition warnings when loading YARD with Ruby warnings enabled (#1687)
• Improve sanitization of yard server request paths

Changelog

Sourced from yard's changelog.

0.9.45 - July 14th, 2026

• Use @param types to document generated Struct.new and Data.define members (#1684)
• Add compatibility with RDoc 8
• Fix TypesExplainer parsing of types following Hash collections (#1688)
• Fix HTML generation for RBS constants without source values (#1686)
• Fix method redefinition warnings when loading YARD with Ruby warnings enabled (#1687)
• Improve sanitization of yard server request paths

Commits

• 2659ecd Release: v0.9.45
• 2b467e0 Create a gh-fix skill
• 2842ba7 Update changelog
• 00fe9b1 Refactor server sanitization logic
• c6fd371 Use @​param types for Struct and Data members (#1695)
• d2a8883 Merge remote-tracking branch 'origin/main' into fix/issue-1684-struct-data-pa...
• 674d0cf Fix parser method redefinition warnings (#1694)
• 9483cd3 Use param types for Struct and Data members
• 12ed8b7 Merge main into fix/issue-1687-method-redefined-warnings
• 9b874e2 Fix HTML generation for RBS constants
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions