Bump the all-demo group in /demo with 2 updates

[dependabot]

Bumps the all-demo group in /demo with 2 updates: puma and bootsnap.

Updates puma from 8.0.1 to 8.0.2

Release notes

Sourced from puma's releases.

v8.0.2

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Security advisories

• CVE-2026-47736 / GHSA-qpgp-93vx-g8v8: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion
• CVE-2026-47737 / GHSA-2vqw-3mp8-cgmx: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Changelog

Sourced from puma's changelog.

8.0.2 / 2026-05-27

• Bugfixes
  • Anchor PROXY protocol v1 regex to string start and enforce max line length to prevent injection via crafted request bodies (#3944)
  • Parse PROXY protocol header only on the first request per connection to prevent spoofing on keep-alive connections (#3944)

Commits

• 8085b75 Release v8.0.2 (#3945)
• 439c613 8.0.2 backport (#3944)
• See full diff in compare view

Updates bootsnap from 1.24.1 to 1.24.5

Release notes

Sourced from bootsnap's releases.

v1.24.4

What's Changed

• Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
• Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
• Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
• Avoid leaking a private method in Object when testing for Parse.y bugs.

Full Changelog: rails/bootsnap@v1.24.3...v1.24.4

v1.24.3

• Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

Full Changelog: rails/bootsnap@v1.24.2...v1.24.3

v1.24.2

What's Changed

• Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

Full Changelog: rails/bootsnap@v1.24.1...v1.24.2

Changelog

Sourced from bootsnap's changelog.

1.24.5

• No longer load the config file by default when setup is done manually. This is so cli applications like homebrew don't mistakenly load another app's boostnap config.

1.24.4

• Fix several compatibility issues with Ruby 4.0.4, particularly the should not compile with coverage error. See #547.
• Fix Bootsnap.enable_frozen_string_literal to work even when coverage is enabled. Unfortunately only possible on Ruby 4.0.4+. On older rubies if coverage is enabled a warning will be issued and the feature won't work.
• Reduced cache files header size from 64 to 32 bytes, and got rid of the random padding element.
• Avoid leaking a private method in Object when testing for Parse.y bugs.

1.24.3

• Fix the 1.24.2 workaround to parse Ruby files with UTF-8 even when the LANG environment variable is unset or set to C.

1.24.2

• Workaround two Ruby bugs in RubyVM::InstructionSequence.compile_file, that were causing files to be loaded with the old Ruby parser instead of Prism, causing issues with some pattern matching syntax. Ref: https://bugs.ruby-lang.org/issues/22023

Commits

• d6ca050 Release 1.24.5
• 579aa0e Merge pull request #552 from byroot/fix-bootsnap-config
• 2884e89 Only load config file is directed to by .setup
• 103a92b Merge pull request #551 from byroot/enable-fstr-global
• 33c927d Update compiler options when global options change
• 122db7f Simplify enable_frozen_string_literal(app_only: false)
• 0d8a0a6 Release 1.24.4
• 6ccc5eb Merge pull request #550 from byroot/fstr-and-coverage
• 86e9586 Make Bootsnap.enable_frozen_string_literal work even with coverage on
• 36c2224 Merge pull request #549 from byroot/integration-tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[changeset-bot]

⚠️ No Changeset found

Latest commit: 5354471

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR