chore(deps-dev): bump the development-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the development-dependencies group with 3 updates in the / directory: lefthook, sqlite3 and yard.

Updates lefthook from 2.1.9 to 2.1.12

Release notes

Sourced from lefthook's releases.

v2.1.12

Changelog

• b8350fde604197b2422adfc4ae0af080725822b9 ci: fix npm publishing by bumping Node to 24 (#1508)
• 9fb290d786a0e122fe113b1b49a45bbd0ffa7d28 fix: LEFTHOOK_OUTPUT precedence (#1506)
• 2f0a9f37cef73e10d95043ba3754329a21850d57 fix: fail the hook when staging fixed files errors (#1484)

v2.1.11

Changelog

• e5b10ac3a2645784ee2e4260620c49c31b44992a deps: bump Go to 1.26.6 (#1495)
• d4a259f460b7c1d8c512dd75eedc7068310ee961 fix: inherit terminal size for PTY commands (#1498)

v2.1.10

Changelog

• c0a32e900407bf3e2e97c99a7dd2e3f2864ba13a deps: July 2026 (#1463)
• 0b87ca6dc643dab804a1aad59c24003ef147c11a deps: June 2026 (#1447)
• afce7244cf02abaf996ebe87bb557a725e46993e deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443)
• fbb61b369b57a17469bd6997d1624608ce977f61 feat: AI coding agents integration (#1448)
• cbfb4a5db29b46ac8bf399665cd9ada81022b848 fix: make test suite stable when NO_COLOR is set (#1449)

Changelog

Sourced from lefthook's changelog.

2.1.12 (2026-08-28)

• fix: fail the hook when staging fixed files errors (#1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#1508) by @​mariokresic

2.1.11 (2026-08-21)

• fix: inherit terminal size for PTY commands (#1498) by @​mariokresic
• docs: correct Lefthook commit message configuration (#1499) by @​codersjj
• docs: hide contributors regenerate tip from the site (#1500) by @​MikevPeeren
• docs: clarify signed-off commit example (#1492) by @​nightcityblade
• deps: bump Go to 1.26.6 (#1495) by @​quaacxlok
• docs: fix em notice by @​mrexox
• docs: update docmd (#1481) by @​mrexox
• docs: fix EM mention HTML by @​mrexox
• docs: clarify remote script folders (#1477) by @​scop
• docs: document script args (#1479) by @​lntutor
• docs: update em logo by @​mrexox

2.1.10 (2026-07-08)

• deps: July 2026 (#1463) by @​mrexox
• feat: AI coding agents integration (#1448) by @​viralpraxis
• docs: fix language (#1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#1449) by @​viralpraxis
• deps: June 2026 (#1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#1443) by @​maguowei
• docs: upgrade docmd (#1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

Commits

• 4ad40c3 2.1.12: fix LEFTHOOK_OUTPUT env precedence
• 2f0a9f3 fix: fail the hook when staging fixed files errors (#1484)
• 9fb290d fix: LEFTHOOK_OUTPUT precedence (#1506)
• b8350fd ci: fix npm publishing by bumping Node to 24 (#1508)
• c145646 2.1.11: pty terminal size fix
• d4a259f fix: inherit terminal size for PTY commands (#1498)
• db7ca05 docs: correct Lefthook commit message configuration (#1499)
• fd88b10 docs: hide contributors regenerate tip from the site (#1500)
• 7ccb1d8 docs: clarify signed-off commit example (#1492)
• e5b10ac deps: bump Go to 1.26.6 (#1495)
• Additional commits viewable in compare view

Updates sqlite3 from 2.9.5 to 2.9.6

Release notes

Sourced from sqlite3's releases.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

d8b1f7d23efd7abac285775a9566562fc7debfef79d594e3a20354406fb7907c  gems/sqlite3-2.9.6-aarch64-linux-gnu.gem
3579e1c98cdc7ff5c3722847bb63ed4e1efb7ff675cb5e1e48ef2d4da5fb3bc9  gems/sqlite3-2.9.6-aarch64-linux-musl.gem
33541500e3615da02afe54a9cc38b17a6985d3cf9d8b76d6d0a83002f114e7ec  gems/sqlite3-2.9.6-arm-linux-gnu.gem
c5490af48bb228fefa54314e9541375c3907e70f8109f3881b5ff97e1c93ae33  gems/sqlite3-2.9.6-arm-linux-musl.gem
849b5d7f795e60fe25076d62c72dd722beb45b3850b516ad978d60ee848ec15b  gems/sqlite3-2.9.6-arm64-darwin.gem
1f2b88f417fd0a8c1d5ef19c7e817d8b9c61bee6e33b6b36255fb6e40148e6f8  gems/sqlite3-2.9.6-x64-mingw-ucrt.gem
fbaa9f46f9708f57dd8a459b37fc269f9613e0cacf1547df01aa439cc45c20c0  gems/sqlite3-2.9.6-x86-linux-gnu.gem
6715026fbb5530e810b28ef43b9c4f84cd3c991f67b9d808a31fcc32b847abbd  gems/sqlite3-2.9.6-x86-linux-musl.gem
b5842fea77781c14da03fa7bc0feb82db03a69e135affcb6f5399cbd2797a5f3  gems/sqlite3-2.9.6-x86_64-darwin.gem
613188ce02f614126ddbc38c5e217ccffd6306d0dcd9adca9764547aa890a634  gems/sqlite3-2.9.6-x86_64-linux-gnu.gem
d493b11818a3573387a1d56e1ee8fa00da23a683a7a1cc063e7a0feeed843abf  gems/sqlite3-2.9.6-x86_64-linux-musl.gem
956fe606956420d04ac7157d3ace620c8caba2135b2e05c76e483493da24d08e  gems/sqlite3-2.9.6.gem

Changelog

Sourced from sqlite3's changelog.

2.9.6 / 2026-08-11

Security / Stability

• Fix a garbage collection bug where the argument array passed to a custom aggregate function's step was not visible to the GC, so arguments could be collected mid-conversion when the aggregate takes two or more arguments, corrupting the values passed to step or crashing the process. See GHSA-mwm8-39rw-8826 for more information. #733 @​jeremy

Fixed

• Fix a leak where custom aggregate handler instances were never released, so a connection accumulated one instance per GROUP BY group per query for its lifetime. #722 @​djmb
• Fix GC compaction issues with custom functions, aggregates, collations, #trace and #authorizer=. These callbacks were registered with sqlite by passing a raw Ruby object pointer as user data; keeping the object reachable prevented collection but not relocation, after which sqlite held a stale address and the next call could raise NoMethodError, return a wrong result, or segfault. Affects applications that call GC.compact or run with GC.auto_compact = true. The equivalent issue in #busy_handler was fixed in #466. #723 @​djmb
• Fix the private methods Database#open_v2 and #open16 silently replacing a live connection and leaking the previous connection handle when invoked via send on an open database. They now raise SQLite3::Exception. #729 @​flavorjones
• Fix TEXT values containing an embedded NUL byte being truncated at the first NUL when passed as arguments to functions created with Database#define_function. #730 @​flavorjones
• Fix an exception raised inside a Database#define_function block leaving the connection's sqlite mutex held, which deadlocked any other thread that later used the connection. The exception now propagates to the caller and the connection remains usable. #731 @​flavorjones
• Database.new now raises ArgumentError when the filename or VFS name contains an embedded NUL byte (or an embedded 0x0000 code unit in a UTF-16 filename), instead of silently opening a path truncated at the NUL. #732 @​flavorjones

Improved

• When Database.new fails to open the database file, the underlying sqlite3 connection handle is now closed immediately instead of waiting for the garbage collector to clean it up. #719 @​katafrakt

Commits

• a52dc0d version bump to v2.9.6
• cc5ac0c Root the aggregate argument array so GC cannot free live values (GHSA-mwm8-39...
• abcb0f6 Reject database filenames and VFS names containing NUL (#732)
• 1d86b7a Raise when open_v2 or open16 is called on an open database (#729)
• 7230171 Stop a raise inside a UDF block from deadlocking other threads (#731)
• 2677f9a Pass TEXT values containing embedded NULs to UDFs intact (#730)
• 3de8f6e doc: update CHANGELOG.md
• ac6bd2f Release aggregate instances when sqlite finishes with them (#722)
• 32460e9 Stop sqlite calling into moved Ruby objects (#723)
• f600993 build(deps-dev): update rubocop-minitest requirement (#727)
• Additional commits viewable in compare view

Updates yard from 0.9.44 to 0.9.45

Release notes

Sourced from yard's releases.

Release v0.9.45

• Use @param types to document generated Struct.new and Data.define members (#1684)
• Add compatibility with RDoc 8
• Fix TypesExplainer parsing of types following Hash collections (#1688)
• Fix HTML generation for RBS constants without source values (#1686)
• Fix method redefinition warnings when loading YARD with Ruby warnings enabled (#1687)
• Improve sanitization of yard server request paths

Changelog

Sourced from yard's changelog.

0.9.45 - July 14th, 2026

• Use @param types to document generated Struct.new and Data.define members (#1684)
• Add compatibility with RDoc 8
• Fix TypesExplainer parsing of types following Hash collections (#1688)
• Fix HTML generation for RBS constants without source values (#1686)
• Fix method redefinition warnings when loading YARD with Ruby warnings enabled (#1687)
• Improve sanitization of yard server request paths

Commits

• 2659ecd Release: v0.9.45
• 2b467e0 Create a gh-fix skill
• 2842ba7 Update changelog
• 00fe9b1 Refactor server sanitization logic
• c6fd371 Use @​param types for Struct and Data members (#1695)
• d2a8883 Merge remote-tracking branch 'origin/main' into fix/issue-1684-struct-data-pa...
• 674d0cf Fix parser method redefinition warnings (#1694)
• 9483cd3 Use param types for Struct and Data members
• 12ed8b7 Merge main into fix/issue-1687-method-redefined-warnings
• 9b874e2 Fix HTML generation for RBS constants
• Additional commits viewable in compare view