Bump puma from 7.2.0 to 8.0.0

[dependabot]

Bumps puma from 7.2.0 to 8.0.0.

Release notes

Sourced from puma's releases.

v8.0.0 - Into the Arena

Read our Version 8 Upgrade Guide.

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

• Breaking changes

  • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

Changelog

Sourced from puma's changelog.

8.0.0 / 2026-03-27

• Features

  • Add env["puma.mark_as_io_bound"] API and max_io_threads config to allow IO-bound requests to exceed the thread pool max, enabling better handling of mixed workloads (#3816, #3894)
  • Add single and cluster DSL hooks for mode-specific configuration (#3621)
  • Add on_force option to shutdown_debug to only dump thread backtraces on forced (non-graceful) shutdown (#3671)
  • Add API to dynamically update min and max thread counts at runtime via update_thread_pool_min_max and ServerPluginControl (#3658)
  • Use SIGPWR for thread backtrace dumps on Linux/JRuby where SIGINFO is unavailable (#3829)

• Bugfixes

  • Fix phased restart for fork_worker to avoid forking from stale worker 0 when it has been replaced (#3853)

• Performance

  • JRuby HTTP parser improvements: pre-allocated header keys, perfect hash lookup, reduced memory copies (#3838)
  • Cache downcased header key in str_headers to avoid redundant String#downcase calls, reducing allocations by ~50% per response (#3874)

• Refactor

  • Collect env processing into dedicated client_env.rb module (#3582)
  • Move event to default configuration (#3872)

• Docs

  • Add gRPC guide for configuring gRPC lifecycle hooks in clustered mode (#3885)
  • Add 7.0 upgrade guide, move 5.0/6.0 upgrade guides to docs directory (#3900)
  • Correct default values for persistent_timeout and worker_boot_timeout in DSL docs (#3912)
  • Add file descriptor limit warning in test helper for contributors (#3893)

• Breaking changes

  • Default production bind address changed from 0.0.0.0 to :: (IPv6) when a non-loopback IPv6 interface is available; falls back to 0.0.0.0 if IPv6 is unavailable (#3847)

Commits

• 08f63d4 Release v8.0.0 (#3914)
• 7406cc1 Fix IPv4-mapped IPv6 addresses in REMOTE_ADDR and request logs (#3916)
• e090243 Build(deps): Bump actions/checkout from 4 to 6 (#3915)
• 7d5dca1 Update SECURITY.md, native Github vuln reports [ci skip] (#3913)
• 66e6a32 Minor correction to defaults documented in dsl.rb (#3912)
• 3788eca ci: limit rack-conform to main pushes and scope ragel PR runs (#3908)
• 57b7799 ci: run turbo-rails only on latest stable Ruby and Rails (#3909)
• 6685d6b ci: replace skip-duplicate jobs with concurrency and trigger filters (#3907)
• 2848c82 ci: run push workflows only on main and release branches (#3906)
• 97a37bb Add release pre-merge checks and align Release.md [ci skip] (#3904)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.