[ruby-on-rails] Update Gem Dependencies

[hayat01sh1da]

1. Puma: 7.2.0 → 8.0.0

	7.2.0	8.0.0
Release Date	2026-01-20	2026-03-27
Codename	On The Corner	Into the Arena
Type	Minor release	Major release

1-1. Breaking Changes (8.0.0)

• Default production bind address changed from 0.0.0.0 (IPv4) to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 otherwise (#3847)

1-2. New Features

Version	Feature
7.2.0	Add workers :auto (#3827)
7.2.0	Restrict control server commands to stats only (#3787)
8.0.0	env["puma.mark_as_io_bound"] API and max_io_threads config for mixed workloads (#3816, #3894)
8.0.0	single and cluster DSL hooks for mode-specific configuration (#3621)
8.0.0	on_force option for shutdown_debug (#3671)
8.0.0	Runtime thread pool tuning via update_thread_pool_min_max and ServerPluginControl (#3658)
8.0.0	SIGPWR for thread backtrace dumps on Linux/JRuby (#3829)

1-3. Bugfixes

Version	Fix
7.2.0	Don't break if WEB_CONCURRENCY is blank (#3837)
7.2.0	Don't share server between worker 0 and descendants on refork (#3602)
7.2.0	Fix phase check race condition in Puma::Cluster#check_workers (#3690)
7.2.0	Fix advertising of CLI config before config files load (#3823)
8.0.0	Fix phased restart for fork_worker with stale worker 0 (#3853)

1-4. Performance

Version	Improvement
7.2.0	17% faster HTTP parsing via pre-interned env keys (#3825)
7.2.0	GC-compactible C extension (dsize/dcompact for HttpParser) (#3828)
8.0.0	JRuby HTTP parser: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
8.0.0	Cache downcased header key in str_headers, ~50% fewer allocations per response (#3874)

1-5. Upgrade Notes

Review the 8.0 Upgrade Guide before upgrading. The IPv6 default bind change is the primary breaking change to watch for.

2. Propshaft: 1.1.0 → 1.3.1

	1.1.0	1.3.1
Release Date	2024-10-01	2025-09-24

2-1. Intermediate Versions: 1.2.0, 1.2.1, 1.3.0, 1.3.1

2-2. v1.2.0 (2025-07-16) — Major Changes

• Manifest format updated to support Subresource Integrity (SRI). The manifest now uses an object per asset instead of a simple string:

  // Old format
  { "logical_path.js": "logical_path-digest123.js" }
  // New format
  { "logical_path.js": { "digested_path": "logical_path-digest123.js", "integrity": "sha384-hash..." } }

  Propshaft can still read the old format. If tools manually parse .manifest.json, they need updating.
• Read asset content in binary mode (fixes CRLF conversion on Windows) (#222)
• Add quotes to ETags (#220)
• Fix CSS Asset Compiler to work with files starting with data and http (#224)
• Server should also sweep cache (#232)
• Remove railties runtime dependency (#239)
• Add Subresource Integrity value to manifest (#238)

2-3. v1.2.1 (2025-07-19)

• Only sweep the cache if cache sweeping is enabled (#245)
• Change stylesheet_link_tag and javascript_include_tag to extract options from sources
• Add a method to delete manifest entries

2-4. v1.3.0 (2025-09-24)

• Turn Propshaft::Server into a proper middleware (#249)

2-5. v1.3.1 (2025-09-24)

• Same-day patch release for v1.3.0 (minor fix, no release notes published)

2-6. Key Takeaways

1. Manifest format change in 1.2.0 — any code manually parsing .manifest.json must be updated.
2. SRI support — integrity hashes are now available in the manifest.
3. railties is no longer a runtime dependency — Propshaft is now more standalone.
4. Propshaft::Server is now a proper Rack middleware (1.3.0).

3. selenium-webdriver: 4.41.0 → 4.43.0

	4.41.0	4.43.0
Release Date	2026-02-19	2026-04-09

3-1. v4.41.0 (2026-02-19)

• Support CDP versions: v143, v144, v145
• Remove stored atoms — these get generated by build (#16971)
• Output driver logs when SE_DEBUG is enabled (#16901)
• Update lint configuration and fix RuboCop offenses (#17008)
• Add missing unit tests (#17025)
• Add session event API for server-side event bus integration (Grid) (#17015)
• Update dependencies (#17111)

3-2. v4.42.0 (2026-04-08)

• Support CDP versions: v144, v145, v146

3-3. v4.43.0 (2026-04-09)

• Support CDP versions: v145, v146, v147

3-4. Key Takeaways

1. CDP version updates are the primary changes — rotating Chrome DevTools Protocol support through v143–v147.
2. Debug logging — driver logs are now output when SE_DEBUG is enabled.
3. Grid session events — new API for server-side event bus integration.
4. These are minor, incremental updates with no breaking changes.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates Ruby on Rails sample app dependencies by bumping several gem versions (primarily Puma) across multiple subprojects to keep servers, asset pipeline, and test tooling current.

Changes:

• Bumped puma from ~> 7.2.x to ~> 8.0.0 across restful-api, perfect-ruby-on-rails, and e-navigator.
• Bumped selenium-webdriver from ~> 4.41.0 to ~> 4.43.0 in perfect-ruby-on-rails and e-navigator.
• Bumped propshaft from ~> 1.1.0 to ~> 1.3.1 in perfect-ruby-on-rails, with corresponding lockfile updates.

Reviewed changes

Copilot reviewed 3 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
ruby-on-rails/restful-api/Gemfile	Updates Puma version constraint to ~> 8.0.0.
ruby-on-rails/restful-api/Gemfile.lock	Locks Puma to 8.0.0 and updates checksum accordingly.
ruby-on-rails/perfect-ruby-on-rails/Gemfile	Updates Puma, Propshaft, and Selenium WebDriver version constraints.
ruby-on-rails/perfect-ruby-on-rails/Gemfile.lock	Locks updated versions for Puma/Propshaft/Selenium WebDriver and updates checksums/deps.
ruby-on-rails/e-navigator/Gemfile	Updates Puma and Selenium WebDriver version constraints.
ruby-on-rails/e-navigator/Gemfile.lock	Locks updated versions for Puma/Selenium WebDriver and updates checksums accordingly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[hayat01sh1da]