Bump the ruby-production-dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the ruby-production-dependencies group with 5 updates in the / directory:

Package	From	To
shakapacker	10.1.0	10.3.0
aws-partitions	1.1264.0	1.1267.0
aws-sdk-lambda	1.186.0	1.187.0
http-2	1.2.0	1.2.1
tilt	2.7.0	2.8.0

Updates shakapacker from 10.1.0 to 10.3.0

Release notes

Sourced from shakapacker's releases.

v10.3.0

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

v10.2.0

Added

• Added webpack_compile_flags configuration. [PR #1180](shakacode/shakapacker#1180) by justin808. Allows Rails-driven Shakapacker compiles to pass extra webpack/rspack CLI flags, such as --fail-on-warnings or --progress, through bin/shakapacker. Fixes #1175.
• Added AI analysis prompt generation to the config exporter. [PR #695](shakacode/shakapacker#695), [PR #1184](shakacode/shakapacker#1184) by justin808. When running doctor mode (bin/shakapacker-config --doctor), the exporter now also writes an AI-ANALYSIS-PROMPT.md: a ready-to-paste prompt that guides an AI assistant (ChatGPT, Claude, Gemini, etc.) to review the configuration for migration issues (webpack ↔ rspack), build errors, client/server and development/production optimizations, and best practices. The React on Rails–specific guidance in the generated prompt is included only when React on Rails is detected in the app (via package.json, Gemfile, or Gemfile.lock). This is purely additive; existing exports are unchanged, and a failure to write the prompt file only warns without affecting the exported configs.
• Added support for sass-loader v17. [PR #1141](shakacode/shakapacker#1141) by fukayatsu. Widened the optional sass-loader peer range to ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 in core shakapacker, shakapacker-webpack, and shakapacker-rspack. The Sass rule already selects loadPaths for v16+ and keeps api: "modern", both of which remain valid in v17. Note that sass-loader v17 requires Node.js 22.11.0+ and drops node-sass and the legacy Sass JS API, so apps that opt into v17 must already be on Node 22.12+ (the upper branch of Shakapacker's engines.node range).
• Added Babel 8 peer dependency support. [PR #1187](shakacode/shakapacker#1187) by justin808. Widened the Babel peer ranges in core shakapacker and the shakapacker-webpack supplemental package to allow Babel 8, and updated the Shakapacker Babel preset to omit options removed in Babel 8 while preserving existing Babel 7 behavior. Repository development pins stay on Babel 7, with added compatibility tests covering Babel 8. Refs #1163.

Changed

• New installs now default to Rspack instead of webpack. [PR #1150](shakacode/shakapacker#1150) by justin808. bundle exec rake shakapacker:install now scaffolds an Rspack project (config, dependencies, and config/shakapacker.yml) by default. This is a new-install default only: existing applications are unaffected. The Rspack default applies only to brand-new installs — re-running the installer on an app that already has a config/shakapacker.yml keeps that app's current bundler (and installs that bundler's dependencies), so the installer never silently switches an existing project's bundler. To install with webpack, run bundle exec rake shakapacker:install[webpack] or set SHAKAPACKER_ASSETS_BUNDLER=webpack; to change an existing app's bundler, use bundle exec rake shakapacker:switch_bundler.
• Changed Rspack support to target Rspack v2 only. [PR #1179](shakacode/shakapacker#1179) by justin808. Core, installer, switch-bundler defaults, supplemental package, dummy app, and docs now use @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh v2 ranges. Rspack installs now also require rspack-manifest-plugin@^5.2.2, and shakapacker-rspack requires css-loader@^7.1.4 for Rspack v2 peer compatibility. The Rspack React Refresh loader now uses the v2 named ReactRefreshRspackPlugin export instead of retaining legacy v1 export-shape fallbacks.

Fixed

• Fixed helper binstubs and doctor checks for subdirectory JavaScript layouts. [PR #1192](shakacode/shakapacker#1192) by justin808. bin/shakapacker-config and bin/diff-bundler-config now resolve package scripts from a configured client package root before falling back to the Rails root, and shakapacker:doctor now searches package metadata, lockfiles, and installed packages across client/root layouts while reducing false SWC dependency issues for custom hybrid webpack/Rspack setups. Fixes #1170 and #1090.
• Fixed dev-server passthrough argument validation messages. [PR #1180](shakacode/shakapacker#1180) by justin808. bin/shakapacker-dev-server -- --host ... or --port ... now fails with a clearer Shakapacker message instead of forwarding the separator to the bundler; set dev_server.host and dev_server.port in config/shakapacker.yml instead.
• Fixed shakapacker:export_bundler_config regression on apps upgraded from older Shakapacker versions. [PR #1127](shakacode/shakapacker#1127) by justin808. The task previously invoked bin/shakapacker-config unconditionally via RbConfig.ruby, which crashed when the file was still the legacy JavaScript binstub (#!/usr/bin/env node) left over from earlier installs. The task now inspects the shebang and exec's the file directly when it points at Node, while keeping the Ruby+RbConfig.ruby path for the current Ruby binstub. Affected users are also nudged to run bundle exec rake shakapacker:binstubs to refresh their helper binstub. Refs #1123.
• Fixed shakapacker:doctor Sass implementation detection for sass-embedded apps. [PR #1178](shakacode/shakapacker#1178) by justin808. The doctor now accepts either modern Sass implementation package (sass or sass-embedded) when Sass files are present, matching Shakapacker's default modern Sass API instead of incorrectly requiring Dart Sass. New installs also include sass alongside sass-loader. Fixes #1172.
• Fixed Psych::DisallowedClass boot crash when pnpm-lock.yaml contains a time: section. [PR #1161](shakacode/shakapacker#1161) by justin808. pnpm >= 10.16 (default in pnpm 11) writes publish timestamps into pnpm-lock.yaml that Psych 4+ refuses to safe-load, so the shakapacker.version_checker boot initializer raised Psych::DisallowedClass: Tried to load unspecified class: Time and crashed every Rails boot — even when version checking was disabled. The lockfile is now parsed with YAML.safe_load(..., permitted_classes: [Time, Date]). Fixes #1160.
• Fixed Rspack dev-server lazy compilation defaults for Rails split dev-server topology. [PR #1179](shakacode/shakapacker#1179) by justin808. Generated Rspack development configs now set top-level lazyCompilation: false while the dev server is running, preventing Rspack CLI dev-server auto-lazy behavior from routing dynamic imports through lazy trigger URLs Rails does not serve. Apps that intentionally use lazy compilation can still set a safe top-level lazyCompilation value in their Rspack config.
• Fixed Rspack dev-server config loading during static watch builds. [PR #1142](shakacode/shakapacker#1142) by justin808. The Rspack devServer configuration is now gated behind WEBPACK_SERVE=true, matching the webpack development config, so static watch builds (bin/shakapacker --watch) no longer load the dev-server client. The devMiddleware.writeToDisk filter that skips hot-update files is preserved. Fixes #1137.
• Fixed compiler strategies ignoring the instance config of custom Shakapacker::Instance objects. [PR #1147](shakacode/shakapacker#1147) by justin808. Ports #976 by brunodccarvalho. Strategies now read the instance-specific config and watch both webpack and rspack config directories.

Changelog

Sourced from shakapacker's changelog.

[v10.3.0] - July 5, 2026

Added

• Allowed webpack-dev-server v6. [PR #1102](shakacode/shakapacker#1102) by G-Rath.

Fixed

• Fixed implicit SWC defaults for existing webpack/Babel apps without swc-loader. [PR #1206](shakacode/shakapacker#1206) by justin808. Webpack apps that omit both javascript_transpiler and the deprecated webpack_loader now fall back to Babel with a warning when Shakapacker's bundled SWC default is active, swc-loader is missing, and Babel is present. Explicit transpiler settings, webpack apps with swc-loader, and Rspack's built-in SWC path keep their existing behavior. Closes #1203.
• Fixed JavaScript config loading for missing Rails environments to use the production fallback. [PR #1206](shakacode/shakapacker#1206) by justin808. When RAILS_ENV has no matching section in config/shakapacker.yml, the Node package config now merges the production section instead of only bundled defaults, matching Ruby configuration loading and honoring explicit production javascript_transpiler, source_path, dev_server, and related settings for custom environments such as staging.
• Added a shakapacker:doctor warning for Rspack React Refresh v2 configs that still use the v1 default-export constructor pattern. [PR #1207](shakacode/shakapacker#1207) by justin808. Existing configs with const ReactRefreshPlugin = require("@rspack/plugin-react-refresh") followed by new ReactRefreshPlugin() can fail after upgrading to @rspack/plugin-react-refresh v2 with ReactRefreshPlugin is not a constructor; Doctor now points to the affected JS/TS config file and suggests the named-export/default/module compatibility form. Fixes #1204.
• Fixed helper binstubs delegating Node resolution to Ruby exec in unset and empty PATH environments. [PR #1200](shakacode/shakapacker#1200) and [PR #1201](shakacode/shakapacker#1201) by justin808. Restores shell-compatible Node lookup for bin/shakapacker-config and bin/diff-bundler-config after the v10.2.0 Ruby-binstub regression, while keeping friendly missing-Node errors for ENOENT and EACCES.

[v10.2.0] - July 3, 2026

Added

• Added webpack_compile_flags configuration. [PR #1180](shakacode/shakapacker#1180) by justin808. Allows Rails-driven Shakapacker compiles to pass extra webpack/rspack CLI flags, such as --fail-on-warnings or --progress, through bin/shakapacker. Fixes #1175.
• Added AI analysis prompt generation to the config exporter. [PR #695](shakacode/shakapacker#695), [PR #1184](shakacode/shakapacker#1184) by justin808. When running doctor mode (bin/shakapacker-config --doctor), the exporter now also writes an AI-ANALYSIS-PROMPT.md: a ready-to-paste prompt that guides an AI assistant (ChatGPT, Claude, Gemini, etc.) to review the configuration for migration issues (webpack ↔ rspack), build errors, client/server and development/production optimizations, and best practices. The React on Rails–specific guidance in the generated prompt is included only when React on Rails is detected in the app (via package.json, Gemfile, or Gemfile.lock). This is purely additive; existing exports are unchanged, and a failure to write the prompt file only warns without affecting the exported configs.
• Added support for sass-loader v17. [PR #1141](shakacode/shakapacker#1141) by fukayatsu. Widened the optional sass-loader peer range to ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0 in core shakapacker, shakapacker-webpack, and shakapacker-rspack. The Sass rule already selects loadPaths for v16+ and keeps api: "modern", both of which remain valid in v17. Note that sass-loader v17 requires Node.js 22.11.0+ and drops node-sass and the legacy Sass JS API, so apps that opt into v17 must already be on Node 22.12+ (the upper branch of Shakapacker's engines.node range).
• Added Babel 8 peer dependency support. [PR #1187](shakacode/shakapacker#1187) by justin808. Widened the Babel peer ranges in core shakapacker and the shakapacker-webpack supplemental package to allow Babel 8, and updated the Shakapacker Babel preset to omit options removed in Babel 8 while preserving existing Babel 7 behavior. Repository development pins stay on Babel 7, with added compatibility tests covering Babel 8. Refs #1163.

Changed

• New installs now default to Rspack instead of webpack. [PR #1150](shakacode/shakapacker#1150) by justin808. bundle exec rake shakapacker:install now scaffolds an Rspack project (config, dependencies, and config/shakapacker.yml) by default. This is a new-install default only: existing applications are unaffected. The Rspack default applies only to brand-new installs — re-running the installer on an app that already has a config/shakapacker.yml keeps that app's current bundler (and installs that bundler's dependencies), so the installer never silently switches an existing project's bundler. To install with webpack, run bundle exec rake shakapacker:install[webpack] or set SHAKAPACKER_ASSETS_BUNDLER=webpack; to change an existing app's bundler, use bundle exec rake shakapacker:switch_bundler.
• Changed Rspack support to target Rspack v2 only. [PR #1179](shakacode/shakapacker#1179) by justin808. Core, installer, switch-bundler defaults, supplemental package, dummy app, and docs now use @rspack/core, @rspack/cli, @rspack/dev-server, and @rspack/plugin-react-refresh v2 ranges. Rspack installs now also require rspack-manifest-plugin@^5.2.2, and shakapacker-rspack requires css-loader@^7.1.4 for Rspack v2 peer compatibility. The Rspack React Refresh loader now uses the v2 named ReactRefreshRspackPlugin export instead of retaining legacy v1 export-shape fallbacks.

Fixed

• Fixed helper binstubs and doctor checks for subdirectory JavaScript layouts. [PR #1192](shakacode/shakapacker#1192) by justin808. bin/shakapacker-config and bin/diff-bundler-config now resolve package scripts from a configured client package root before falling back to the Rails root, and shakapacker:doctor now searches package metadata, lockfiles, and installed packages across client/root layouts while reducing false SWC dependency issues for custom hybrid webpack/Rspack setups. Fixes #1170 and #1090.
• Fixed dev-server passthrough argument validation messages. [PR #1180](shakacode/shakapacker#1180) by justin808. bin/shakapacker-dev-server -- --host ... or --port ... now fails with a clearer Shakapacker message instead of forwarding the separator to the bundler; set dev_server.host and dev_server.port in config/shakapacker.yml instead.
• Fixed shakapacker:export_bundler_config regression on apps upgraded from older Shakapacker versions. [PR #1127](shakacode/shakapacker#1127) by justin808. The task previously invoked bin/shakapacker-config unconditionally via RbConfig.ruby, which crashed when the file was still the legacy JavaScript binstub (#!/usr/bin/env node) left over from earlier installs. The task now inspects the shebang and exec's the file directly when it points at Node, while keeping the Ruby+RbConfig.ruby path for the current Ruby binstub. Affected users are also nudged to run bundle exec rake shakapacker:binstubs to refresh their helper binstub. Refs #1123.
• Fixed shakapacker:doctor Sass implementation detection for sass-embedded apps. [PR #1178](shakacode/shakapacker#1178) by justin808. The doctor now accepts either modern Sass implementation package (sass or sass-embedded) when Sass files are present, matching Shakapacker's default modern Sass API instead of incorrectly requiring Dart Sass. New installs also include sass alongside sass-loader. Fixes #1172.
• Fixed Psych::DisallowedClass boot crash when pnpm-lock.yaml contains a time: section. [PR #1161](shakacode/shakapacker#1161) by justin808. pnpm >= 10.16 (default in pnpm 11) writes publish timestamps into pnpm-lock.yaml that Psych 4+ refuses to safe-load, so the shakapacker.version_checker boot initializer raised Psych::DisallowedClass: Tried to load unspecified class: Time and crashed every Rails boot — even when version checking was disabled. The lockfile is now parsed with YAML.safe_load(..., permitted_classes: [Time, Date]). Fixes #1160.
• Fixed Rspack dev-server lazy compilation defaults for Rails split dev-server topology. [PR #1179](shakacode/shakapacker#1179) by justin808. Generated Rspack development configs now set top-level lazyCompilation: false while the dev server is running, preventing Rspack CLI dev-server auto-lazy behavior from routing dynamic imports through lazy trigger URLs Rails does not serve. Apps that intentionally use lazy compilation can still set a safe top-level lazyCompilation value in their Rspack config.
• Fixed Rspack dev-server config loading during static watch builds. [PR #1142](shakacode/shakapacker#1142) by justin808. The Rspack devServer configuration is now gated behind WEBPACK_SERVE=true, matching the webpack development config, so static watch builds (bin/shakapacker --watch) no longer load the dev-server client. The devMiddleware.writeToDisk filter that skips hot-update files is preserved. Fixes #1137.
• Fixed compiler strategies ignoring the instance config of custom Shakapacker::Instance objects. [PR #1147](shakacode/shakapacker#1147) by justin808. Ports #976 by brunodccarvalho. Strategies now read the instance-specific config and watch both webpack and rspack config directories.

Commits

• 73ba063 Release 10.3.0
• e8cb3c8 Bump version to v10.3.0 in CHANGELOG.md
• 7ae6b33 Update changelog for v10.2.1 (#1210)
• 564cc4e Add v10 upgrade guide (#1208)
• bef38d6 Fallback to Babel for implicit SWC webpack configs (#1206)
• fc16549 fix: allow webpack-dev-server v6 (#1102)
• 29f855a Fix Claude OAuth token env for Actions (#1202)
• 9b56482 [codex] Document and harden helper binstub PATH fix (#1201)
• aa94c79 [codex] Delegate helper binstub Node resolution to exec (#1200)
• 6fecdd3 Release 10.2.0
• Additional commits viewable in compare view

Updates aws-partitions from 1.1264.0 to 1.1267.0

Changelog

Sourced from aws-partitions's changelog.

1.1267.0 (2026-07-07)

• Feature - Added support for enumerating regions for Aws::PartnerCentralRevenueMeasurement.

1.1266.0 (2026-07-06)

• Feature - Updated the partitions source data that determines the AWS service regions and endpoints.

1.1265.0 (2026-07-02)

• Feature - Updated the partitions source data that determines the AWS service regions and endpoints.

Commits

• See full diff in compare view

Updates aws-sdk-lambda from 1.186.0 to 1.187.0

Changelog

Sourced from aws-sdk-lambda's changelog.

1.187.0 (2026-07-07)

• Feature - AWS Lambda Durable Functions now supports customer managed KMS keys. This allows customers to configure a KMS key in Durable Config to have all their durable execution data encrypted.

Commits

• See full diff in compare view

Updates http-2 from 1.2.0 to 1.2.1

Changelog

Sourced from http-2's changelog.

1.2.1

• fix: encode the string to binary when using String#bytesplice (if the string is UTF-8 and the range would split multibyte characters, bytesplicing raises an error).

Commits

• 07621f0 Merge pull request #191 from HoneyryderChuck/fix-bytesplice
• bf3cdc0 bump version to 1.2.1
• dc550fb fix String#bytesplice usage, which in order to be able to cut UTF-8 character...
• 4f990ca remove dead code
• See full diff in compare view

Updates tilt from 2.7.0 to 2.8.0

Changelog

Sourced from tilt's changelog.

2.8.0 (2026-07-06)

• Support rdoc 8 in the rdoc template (jeremyevans)
• Support options added in recent Commonmarker versions in the Commonmarker template (halo) (#26)

Commits

• b0ad5b9 Bump version to 2.8.0
• 4aabc43 Fix CI rdoc version guard on JRuby
• ba41618 Limit rdoc to < 8 on JRuby in CI
• 95afeb0 Support rdoc 8 in the rdoc template
• 5ebaf2f Decrease repetitions in Prawn test
• 8c68520 Add Add JRuby 10.1 to CI
• 6a0dae1 Bump copyright year
• 9ae7371 Update to actions/checkout@v6
• 5e934cb Update CHANGELOG
• 689d22d Update rdoc guard in CI gemfile
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.