deps(gems): bump the gems group with 2 updates

[dependabot]

Bumps the gems group with 2 updates: bootsnap and brakeman.

Updates bootsnap from 1.24.6 to 1.25.0

Release notes

Sourced from bootsnap's releases.

v1.25.0

What's Changed

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.25.0

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits

• e099ec7 Release 1.25.0
• b694a11 Merge pull request #563 from stanhu/sh-ignore-yjit-in-compile-cache-key
• 51898f9 Ignore YJIT status in the compile cache key
• 1ad589b Merge pull request #560 from rails/hm-qnqlnylzkqkltqsz
• 21fbd65 Merge pull request #561 from jeremy/fix-path-conversion-entry-points
• 4898853 Convert the path argument in the frame that reads it
• 8ee47c4 Add MessagePack::Bigint type
• 49e3eb7 Replace Date Marshalling with recursive msgpack
• 711fd0b Bump minimum msgpack to 1.5.0
• 160fc10 Merge pull request #558 from viralpraxis/fix-yaml-cache-kwargs-mutation
• Additional commits viewable in compare view

Updates brakeman from 8.0.5 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

• Fix EOL date for Rails 8.0 (@​yeaseul-kim)
• Fix command injection false positives (@​JacobEvelyn )
• Fix unused variable warning (@​viralpraxis)
• Add EOL dates for Rails 8.1 and Ruby 4.0

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

• Fix EOL date for Rails 8.0 (yeaseul-kim)
• Add EOL dates for Rails 8.1 and Ruby 4.0
• Fix command injection false positives (Jacob Evelyn)
• Fix unused variable warning (viralpraxis)

Commits

• fffc483 Bump to 8.0.6
• b7218fe Update CHANGES
• c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
• 4c191dd Fix EOL date for Rails 8.0
• e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
• dd4f0b9 Add EOL date for Ruby 4.0
• 7ca100a Add EOL date for Rails 8.1
• a53a456 Merge pull request #2022 from JacobEvelyn/main
• bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
• 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions