Bump the "all" group with 3 updates across multiple ecosystems

[dependabot]

Bumps the all group with 1 update in the /Library/Homebrew/formula-analytics directory: certifi.

Updates certifi from 2025.7.9 to 2025.7.14

Commits

• ddd90c6 2025.07.14 (#359)
• See full diff in compare view

Bumps the all group with 1 update: github/codeql-action.

Updates github/codeql-action from 3.29.2 to 3.29.4

Release notes

Sourced from github/codeql-action's releases.

v3.29.4

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.4 - 23 Jul 2025

No user facing changes.

See the full CHANGELOG.md for more information.

v3.29.3

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

3.29.3 - 21 Jul 2025

No user facing changes.

See the full CHANGELOG.md for more information.

Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

[UNRELEASED]

No user facing changes.

3.29.4 - 23 Jul 2025

No user facing changes.

3.29.3 - 21 Jul 2025

No user facing changes.

3.29.2 - 30 Jun 2025

• Experimental: When the quality-queries input for the init action is provided with an argument, separate .quality.sarif files are produced and uploaded for each language with the results of the specified queries. Do not use this in production as it is part of an internal experiment and subject to change at any time. #2935

3.29.1 - 27 Jun 2025

• Fix bug in PR analysis where user-provided include query filter fails to exclude non-included queries. #2938
• Update default CodeQL bundle version to 2.22.1. #2950

3.29.0 - 11 Jun 2025

• Update default CodeQL bundle version to 2.22.0. #2925
• Bump minimum CodeQL bundle version to 2.16.6. #2912

3.28.20 - 21 July 2025

• Remove support for combining SARIF files from a single upload for GHES 3.18, see the changelog post. #2959

3.28.19 - 03 Jun 2025

• The CodeQL Action no longer includes its own copy of the extractor for the actions language, which is currently in public preview. The actions extractor has been included in the CodeQL CLI since v2.20.6. If your workflow has enabled the actions language and you have pinned your tools: property to a specific version of the CodeQL CLI earlier than v2.20.6, you will need to update to at least CodeQL v2.20.6 or disable actions analysis.
• Update default CodeQL bundle version to 2.21.4. #2910

3.28.18 - 16 May 2025

• Update default CodeQL bundle version to 2.21.3. #2893
• Skip validating SARIF produced by CodeQL for improved performance. #2894
• The number of threads and amount of RAM used by CodeQL can now be set via the CODEQL_THREADS and CODEQL_RAM runner environment variables. If set, these environment variables override the threads and ram inputs respectively. #2891

3.28.17 - 02 May 2025

... (truncated)

Commits

• 4e828ff Merge pull request #2989 from github/update-v3.29.4-37264dc0b
• b3114b8 Update changelog for v3.29.4
• 37264dc Merge pull request #2988 from github/koesie10/disable-combine-single-file
• 5a29823 Merge remote-tracking branch 'origin/main' into koesie10/disable-combine-sing...
• 5a2327a Merge pull request #2987 from github/mbg/combine-sarif-error
• 287d421 Disable combining runs within a single file
• 43afe6e Treat processing error for multiple runs with the same category as configurat...
• 8f2e636 Merge pull request #2981 from github/dependabot/npm_and_yarn/npm-fe13dfda46
• 76bf77d Merge pull request #2980 from github/dependabot/github_actions/actions-504b6c...
• 9e7d13d Merge pull request #2983 from github/koesie10/update-changelog-link
• Additional commits viewable in compare view

Bumps the all group with 4 updates in the /Library/Homebrew directory: rubocop-ast, parallel_tests, sorbet-static-and-runtime and spoom.

Updates rubocop-ast from 1.45.1 to 1.46.0

Release notes

Sourced from rubocop-ast's releases.

RuboCop AST v1.46.0

New features

• #379: Support RuboCop::AST::ComplexNode. ([@​koic][])

Bug fixes

• #380: Fix RuboCop::AST::NumericNode#sign? to return boolean. ([@​viralpraxis][])

Changelog

Sourced from rubocop-ast's changelog.

1.46.0 (2025-07-16)

New features

• #379: Support RuboCop::AST::ComplexNode. ([@​koic][])

Bug fixes

• #380: Fix RuboCop::AST::NumericNode#sign? to return boolean. ([@​viralpraxis][])

Commits

• 9cba9c7 Cut 1.46.0
• b3469e4 Update Changelog
• 745ae82 Support RuboCop::AST::ComplexNode
• c8a2a52 Fix RuboCop::AST::NumericNode#sign? to return boolean
• 8c26dbb Suppress a RuboCop's offense
• 4f97e54 Suppress RuboCop's offenses
• 993e9ea Add release notes
• 73ad40b Restore docs/antora.yml
• See full diff in compare view

Updates parallel_tests from 5.3.0 to 5.3.1

Changelog

Sourced from parallel_tests's changelog.

5.3.1 - 2025-07-23

Fixed

• The --multiply-processes option was being parsed into options[:multiply-processes] but was being referenced as options[:multiply] in the code

Commits

• c9f15e8 v5.3.1
• ba7362e Correct options key passed to ParallelTests.determine_multiple (#1018)
• ed3b62d silence ruby head logger warnings (#1016)
• 84dab0c bootstrap example (#1013)
• See full diff in compare view

Updates sorbet-static-and-runtime from 0.5.12230 to 0.5.12357

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.5.12356.20250721162534-89c7068a1

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12356', :group => :development
gem 'sorbet-runtime', '0.5.12356'

sorbet 0.5.12355.20250721134806-66ca130d3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12355', :group => :development
gem 'sorbet-runtime', '0.5.12355'

sorbet 0.5.12354.20250720084934-b98376cd3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12354', :group => :development
gem 'sorbet-runtime', '0.5.12354'

sorbet 0.5.12353.20250718194949-822af3882

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12353', :group => :development
gem 'sorbet-runtime', '0.5.12353'

sorbet 0.5.12352.20250718152848-c4842ad89

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12352', :group => :development
gem 'sorbet-runtime', '0.5.12352'

sorbet 0.5.12351.20250718150208-c9302080f

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12351', :group => :development
gem 'sorbet-runtime', '0.5.12351'

sorbet 0.5.12350.20250718143344-7c3257147

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12350', :group => :development
gem 'sorbet-runtime', '0.5.12350'

sorbet 0.5.12349.20250717104933-df989a30f

... (truncated)

Commits

• See full diff in compare view

Updates spoom from 1.7.4 to 1.7.5

Release notes

Sourced from spoom's releases.

v1.7.5

What's Changed

✨ Enhancements

• Allow translation of abstract methods by @​Morriar in Shopify/spoom#765
• Make translation of generics, helpers and abstract methods optional by @​Morriar in Shopify/spoom#770
• Make translation of each kind of T assertions optional by @​Morriar in Shopify/spoom#771

🐛 Bug Fixes

• Fix RBS to RBI signature translation for def nodes within sends by @​Morriar in Shopify/spoom#779

🛠 Other Changes

• Raise NotImplementedError from abstract methods by @​Morriar in Shopify/spoom#766

Full Changelog: Shopify/spoom@v1.7.4...v1.7.5

Commits

• 8070574 Bump version to v1.7.5
• d4ffeb4 Merge pull request #779 from Shopify/at-rbs-visibility
• d0c967e Update exported RBI
• c8acc71 Scope rescues to specific lines
• e407a00 Fix RBS to RBI signature translation for def nodes within sends
• 40e192d Merge pull request #778 from Shopify/dependabot/bundler/minor-and-patch-482a9...
• d6b8883 Bump sorbet-static-and-runtime in the minor-and-patch group
• c55280b Merge pull request #775 from Shopify/dependabot/bundler/minor-and-patch-20010...
• f2f3f30 Bump the minor-and-patch group with 2 updates
• f69ec98 Merge pull request #774 from Shopify/dependabot/bundler/minor-and-patch-76f86...
• Additional commits viewable in compare view

Updates sorbet-runtime from 0.5.12230 to 0.5.12357

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.5.12356.20250721162534-89c7068a1

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12356', :group => :development
gem 'sorbet-runtime', '0.5.12356'

sorbet 0.5.12355.20250721134806-66ca130d3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12355', :group => :development
gem 'sorbet-runtime', '0.5.12355'

sorbet 0.5.12354.20250720084934-b98376cd3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12354', :group => :development
gem 'sorbet-runtime', '0.5.12354'

sorbet 0.5.12353.20250718194949-822af3882

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12353', :group => :development
gem 'sorbet-runtime', '0.5.12353'

sorbet 0.5.12352.20250718152848-c4842ad89

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12352', :group => :development
gem 'sorbet-runtime', '0.5.12352'

sorbet 0.5.12351.20250718150208-c9302080f

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12351', :group => :development
gem 'sorbet-runtime', '0.5.12351'

sorbet 0.5.12350.20250718143344-7c3257147

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12350', :group => :development
gem 'sorbet-runtime', '0.5.12350'

sorbet 0.5.12349.20250717104933-df989a30f

... (truncated)

Commits

• See full diff in compare view

Updates parser from 3.3.8.0 to 3.3.9.0

Changelog

Sourced from parser's changelog.

v3.3.9.0 (2025-07-25)

API modifications:

• Bump maintenance branches to 3.3.9 (#1080) (Koichi ITO)
• Bump maintenance branches to 3.2.9 (#1079) (Koichi ITO)

v3.3.7.5 (2025-04-14)

API modifications:

• Bump maintenance branches to 3.3.8 (#1077) (Koichi ITO)
• YARD docs for Parser::CurrentRuby and Parser::Base#version (#1076) (Vince Broz)

v3.3.7.4 (2025-03-31)

Bugs fixed:

• lexer-strings.rb: Avoid an exception on utf8 surrogate pair codepoints (#1051) (Earlopain)
• builder.rb: emit kwargs node for indexasgn when opted in (#1053) (Earlopain)
• builder.rb: correctly handle ... forwarding to super with explicit block (#1049) (Earlopain)
• numbered parameters are valid for pattern matching pinning (#1060) (Earlopain)

v3.3.7.3 (2025-03-26)

API modifications:

• Bump maintenance branches to 3.2.8 and 3.1.7 (#1074) (Koichi ITO)

v3.3.7.2 (2025-03-20)

Features implemented:

• add prism-specific node types (#1071) (Earlopain)

Bugs fixed:

• builder.rb: fix hash value omission considering some local vars as constants (#1064) (Earlopain)

v3.3.7.1 (2025-02-05)

API modifications:

• parser/current: add -dev prefix to 3.4 branch (#1067) (Ilya Bylich)
• parser/current: bump 3.2 branch to 3.2.7 (#1066) (Ilya Bylich)

v3.3.7.0 (2025-01-16)

API modifications:

• Bump maintenance branches to 3.3.7 (#1061) (Koichi ITO)

... (truncated)

Commits

• f1af918 Update changelog.
• acb5d43 Bump version
• 2605e95 * Bump maintenance branches to 3.3.9 (#1080)
• 087fce1 * Bump maintenance branches to 3.2.9 (#1079)
• 74439e5 Update changelog.
• See full diff in compare view

Updates sorbet from 0.5.12230 to 0.5.12357

Release notes

Sourced from sorbet's releases.

sorbet 0.5.12356.20250721162534-89c7068a1

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12356', :group => :development
gem 'sorbet-runtime', '0.5.12356'

sorbet 0.5.12355.20250721134806-66ca130d3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12355', :group => :development
gem 'sorbet-runtime', '0.5.12355'

sorbet 0.5.12354.20250720084934-b98376cd3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12354', :group => :development
gem 'sorbet-runtime', '0.5.12354'

sorbet 0.5.12353.20250718194949-822af3882

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12353', :group => :development
gem 'sorbet-runtime', '0.5.12353'

sorbet 0.5.12352.20250718152848-c4842ad89

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12352', :group => :development
gem 'sorbet-runtime', '0.5.12352'

sorbet 0.5.12351.20250718150208-c9302080f

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12351', :group => :development
gem 'sorbet-runtime', '0.5.12351'

sorbet 0.5.12350.20250718143344-7c3257147

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12350', :group => :development
gem 'sorbet-runtime', '0.5.12350'

sorbet 0.5.12349.20250717104933-df989a30f

... (truncated)

Commits

• See full diff in compare view

Updates sorbet-static from 0.5.12230 to 0.5.12357

Release notes

Sourced from sorbet-static's releases.

sorbet 0.5.12356.20250721162534-89c7068a1

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12356', :group => :development
gem 'sorbet-runtime', '0.5.12356'

sorbet 0.5.12355.20250721134806-66ca130d3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12355', :group => :development
gem 'sorbet-runtime', '0.5.12355'

sorbet 0.5.12354.20250720084934-b98376cd3

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12354', :group => :development
gem 'sorbet-runtime', '0.5.12354'

sorbet 0.5.12353.20250718194949-822af3882

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12353', :group => :development
gem 'sorbet-runtime', '0.5.12353'

sorbet 0.5.12352.20250718152848-c4842ad89

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12352', :group => :development
gem 'sorbet-runtime', '0.5.12352'

sorbet 0.5.12351.20250718150208-c9302080f

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12351', :group => :development
gem 'sorbet-runtime', '0.5.12351'

sorbet 0.5.12350.20250718143344-7c3257147

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.5.12350', :group => :development
gem 'sorbet-runtime', '0.5.12350'

sorbet 0.5.12349.20250717104933-df989a30f

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[MikeMcQuaid]

@Bo98 I vaguely recall there being something about sorbet-runtime that means we have to handle it differently/separately. Should that be extracted into a separate group again for Homebrew/brew? If you can elaborate on the "why" that'd be helpful too for my understanding/documentation 🙇🏻 ❤️

[p-linnane]

@Bo98 @dduugg Looks like we hit the (possible) Bundler bug we encountered last week when vendoring gems.

==> bundle clean
Writing lockfile to /opt/homebrew/Library/Homebrew/Gemfile.lock
Fetching gem metadata from https://rubygems.org/.......
Resolving dependencies...
Could not find gems matching 'sorbet-static (= 0.5.12357)' valid for all
resolution platforms (aarch64-linux, universal-darwin, x86_64-linux, arm-linux,
arm64-darwin-20) in rubygems repository https://rubygems.org/ or installed
locally.

The source contains the following gems matching 'sorbet-static (= 0.5.12357)':
  * sorbet-static-0.5.12357-aarch64-linux
  * sorbet-static-0.5.12357-java
  * sorbet-static-0.5.12357-universal-darwin
  * sorbet-static-0.5.12357-x86_64-linux
Error: Failure while executing; `bundle lock --add-platform aarch64-linux arm-linux` exited with 7.
Error: Process completed with exit code 1.

[Bo98]

Looks like we hit the (possible) Bundler bug we encountered last week when vendoring gems.

The issue here is specific to a change in 2.6.9 so 2.6.8 should be a quick fix here, and we can handle any further changes for Ruby 3.5 if the issue is still present.

Technically the change in 2.6.9 is a bug fix but the presence of that now-fixed bug reduced the impact of the other bug we face. Now there's just one bigger bug.

[Bo98]

@Bo98 I vaguely recall there being something about sorbet-runtime that means we have to handle it differently/separately. Should that be extracted into a separate group again for Homebrew/brew? If you can elaborate on the "why" that'd be helpful too for my understanding/documentation 🙇🏻 ❤️

The runtime issue you're seeing is just because the changes to vendor haven't been committed. sorbet-runtime is a required dependency nowadays - brew cannot run without it.

Dependabot PRs require you to manually run this workflow to commit these changes: https://github.com/Homebrew/brew/actions/workflows/vendor-gems.yml?query=event%3Aworkflow_dispatch. We removed doing so automatically a while back. A maintainer reviews the changes and approves it by dispatching the workflow.

[Bo98]

We removed doing so automatically a while back

See #17718 for context:

maintainers can manually run this from workflow_dispatch after reviewing the changes

[p-linnane]

Thanks @Bo98!

[MikeMcQuaid]

Thanks @Bo98! Could we bring that back perhaps scoped entirely to run automatically for just Dependabot?

[Bo98]

Already was and we removed it. Can discuss some further ideas on Slack.