build(deps): Bump the all group with 3 updates

[dependabot]

Updates the requirements on puma, minitest and mocha to permit the latest version.
Updates puma to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

• CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
• CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

8.0.1 / 2026-04-27

• Bugfixes

  • Fix prune_bundler stripping user-configured BUNDLE_* env vars (e.g. BUNDLE_WITHOUT) on re-exec, which caused workers to crash on boot (#3929)

• Performance

  • Use blocks for debug logging to avoid creating log messages when debug is disabled (#3920)

• Docs

  • Fix incorrect hook names in gRPC docs (#3923)
  • Reword v8 upgrade guide IPv6 bullet for clarity (#3928)

8.0.0 / 2026-03-27

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

• Breaking changes

  • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

7.2.1 / 2026-05-27

• Bugfixes

... (truncated)

Commits

• 8085b75 Release v8.0.2 (#3945)
• 439c613 8.0.2 backport (#3944)
• cee7e61 Release v8.0.1 (#3932)
• f955caf Fix prune_bundler stripping user-configured BUNDLE_* env vars on re-exec (#3929)
• 97996aa ci: test_error_logger.rb - fix TruffleRuby error (#3930)
• 03825bc Build(deps): Bump actions/github-script from 8 to 9 (#3925)
• 053efae Reword v8 upgrade guide ipv6 bullet (#3928)
• b19f35a Fix incorrect hook names in gRPC docs (#3923)
• eeabe4b Use blocks for debug logging to avoid creating messages if debug disabled (#3...
• 08f63d4 Release v8.0.0 (#3914)
• Additional commits viewable in compare view

Updates minitest to 6.0.6

Changelog

Sourced from minitest's changelog.

=== 6.0.6 / 2026-04-30

• 2 bug fixes:

  • Fix using assert_equal/same/nil w/ BasicObject by comparing w/ nil == exp. (mtasaka)
  • Removed private Assertions#_where as it is no longer used.

=== 6.0.5 / 2026-04-20

• 2 bug fixes:

  • Avoid circular requires in lib/minitest/server_plugin.rb.
  • Raise TypeError if assert_raises is passed anything but modules/classes.

=== 6.0.4 / 2026-04-14

• 1 bug fix:

  • Fixed refute_predicate to call assert_respond_to w/ include_all:true like assert_predicate does. (jparker)

=== 6.0.3 / 2026-03-31

• 1 bug fix:

  • assert_same(nil, value) no longer allowed. Use assert_nil to be explicit. (paddor)

=== 6.0.2 / 2026-02-23

• 7 bug fixes:

  • Added missing drb dependency from minitest-server. (y-yagi)
  • Cleaned up bisect's sub-commands to load files directly, not ruby+require.
  • Fixed bisect to use same cmd ($0) to run tests as original invocation.
  • load server_plugin if server is loaded. (y-yagi)
  • Manipulate local args instead of ARGV in Sprint.run.
  • Only show --bisect in usage if using minitest.
  • Remove -Itest:lib from bisect's rb_flags since bin/minitest adds them.

=== 6.0.1 / 2025-12-26

• 1 minor enhancement:

  • Added new rake task test:fu to Minitest::TestTask, to only run tests with FU (focused units?) in their name. This should mostly obviate the need for the minitest-focus plugin.

• 5 bug fixes:

  • Fixed --help and --version exiting 1. (grosser)
  • Fixed method signature of Minitest::Benchmark.run. (flavorjones)

... (truncated)

Commits

• f6180b0 prepped for release
• 23bc7f2 - Removed private Assertions#_where as it is no longer used.
• c471347 - Fix using assert_equal/same/nil w/ BasicObject by comparing w/ nil == exp...
• 89c3e62 Branching minitest to version 6.0.5
• 6790f86 - Raise TypeError if assert_raises is passed anything but modules/classes.
• 235fa5b - Avoid circular requires in lib/minitest/server_plugin.rb.
• 5f0482e prepped for release
• b12f87f - Fixed refute_predicate to call assert_respond_to w/ include_all:true like a...
• 649b075 prepped for release
• a2d0904 - assert_same(nil, value) no longer allowed. Use assert_nil to be explicit. (...
• Additional commits viewable in compare view

Updates mocha to 3.1.0

Changelog

Sourced from mocha's changelog.

3.1.0

External changes

• Format warnings consistently and include source location (#794)

Internal changes

• Fix Style/OneClassPerFile violations (#796)
• Remove mise.toml which was added accidentally (6c5f84db)
• Add .ruby-version to .gitignore (8516ccc1)

3.0.2

External changes

• Fix NoMethodError on deprecation warning - broken since v3.0.0 (#790)

Internal changes

• Update commands in release docs to use bundle exec (7692c735)
• Fix test:performance rake task for minitest v6 (d925ad27)
• Fix prism gem install on JRuby (683c27b4)
• Add Ruby v4.0-rc to CI build matrix and change weekly build to nightly (#777)
• Add Ruby v4.0 to CI build matrix (6ced2025)
• Add irb to Gemfile to fix warning in Ruby v4 (a0fc7798)
• Auto-correct Style/EmptyClassDefinition violation (9ba0a09f)
• Ensure every test can run in isolation (be12ef06)
• Rename run-fail-fast CircleCI command -> run-fail-on-warning (72fc6fe8)

3.0.1

External changes

• Fix Mocha/RSpec integration by reinstating argument default value for Hooks#mocha_setup (#768 & #769) - thanks to @​mackuba for reporting.

3.0.0

External changes

• Improvements to docs for cardinality-related methods (#700)
• Drop support for Ruby v2.1 (#628 & #695)
• Improve gemspec description (#692 & #696)
• Remove docs for use_test_unit_gem option (eaf03493)
• Correct docs for MOCHA_OPTIONS "debug" value (69ef41c0)
• Use built-in Ruby debug option vs custom module (#714 & #715)
• Enable strict keyword argument matching by default in Ruby >= v3 (#697 & #718)
• Use Ruby v1.9 Hash syntax in Hash#mocha_inspect used in failure messages (#651 & #719)
• Improve #mocha_inspect for empty keyword argument Hash (#588 & #720) - thanks to @​herwinw for reporting
• Improve error if Mockery.teardown called before Mockery.setup (#611, #646 & #721) - thanks to @​riniculous for reporting

... (truncated)

Commits

• 3d08fea [skip ci] Update documentation for v3.1.0
• 55b7113 Bump version to 3.1.0 & prepare for release
• 84ff8a2 Merge pull request #794 from freerange/format-warnings-consistently-and-inclu...
• c569071 Make Expectation#definition_location consistent
• 8e2c12a Exclude source code from deprecation warning
• 69f93fa Extract BacktraceFilter#exclude?
• 0251ec1 Rename block variable from location -> line
• 88e22e4 Move source location to end of warning message
• 1713bfc Display source location for all warnings
• e5a8e7b Distinguish deprecation warnings in tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions