[dependabot]

Updates the requirements on semantic_logger to permit the latest version.

Changelog

Sourced from semantic_logger's changelog.

[5.2.0] 2026-10-30

Security

• The HTTP appender, and the appenders built on it (:elasticsearch_http, :splunk_http, :loki, and the :signalfx metrics appender), no longer write credentials to the internal logger when the server rejects a request. The logged url keeps only the scheme, host, and port, omitting the user, password, path, and query string (any of which can carry a token or api key), and the response body is truncated to 512 bytes. The error raised for an invalid url no longer includes the url, nor does the one for an invalid proxy_url:, or an invalid url given to the :loki, :elasticsearch, :opensearch, :syslog, or :graylog appenders or the :statsd metrics appender, or an invalid seed broker given to the :kafka appender, whose client gems put it in their errors.
• #inspect on every appender shows only the class, the object address, and what that appender says is safe to show, such as its url without credentials, its log group, or its queue name, instead of every instance variable. The :elasticsearch and :opensearch appenders showed the password in their url, :rabbitmq its password, :kafka its TLS private key and SASL passwords, :cloudwatch_logs its AWS credentials, and :tcp and :syslog their TLS options, for example whenever SemanticLogger.appenders was printed in a console or an error report. The proxy that async: true or batch: true wraps an appender in does the same: it shows whether it batches and the appender's own #inspect, instead of every instance variable of the proxy and of its queue processor.
• The :sentry_ruby appender no longer deletes the keys it reads from the log entry's payload and named tags, which it shares with every other appender and which can be the application's own Hash: the user fields and fingerprint it took for Sentry were missing from every appender after it, and from the application's Hash. A fingerprint that is not an Array of Strings, Symbols, or numbers, or a payload that is not a Hash, is sent to Sentry as data instead of raising, which lost the error report. Taking the user and fingerprint from the payload, which can hold untrusted data, is deprecated; set them with named tags instead. Until then the named tags win: a user field or user Hash in the payload no longer replaces one they set, and only a String, Symbol, or Integer is taken from the payload for a user field, so other values are sent as data.
• The :cloudwatch_logs appender splits the buffered log messages into batches that PutLogEvents accepts (at most 1 MB and 10,000 events, in chronological order), cuts short a message too large for a batch of its own, and reports a request that fails to the internal logger. It sent up to 4,000 messages in one request, which AWS rejects once over 1 MB, for example when one logged value is large, and the error was swallowed by the flush timer, so every message in the batch was lost without a trace. Each message is now formatted when it is logged, so that one that AWS would reject along with the rest of its request (the formatter fails, or returns something other than a String with content) is discarded on its own, and invalid UTF-8 is repaired. A failure to create a missing log group or stream is reported too, instead of stopping the remaining batches, as are the messages that AWS rejects from a request it accepts, for being too new, too old, or past the log group's retention period.
• The :statsd metrics appender sends a counter as a single packet (metric:amount|c), instead of one increment packet per unit of metric_amount. A large amount, for example one derived from user input, could otherwise flood the network and stall the logging thread. Amounts that are not finite (Infinity, NaN) are ignored.
• escape_control_chars now also escapes the message of each exception that caused the logged exception (Cause: ... in the backtrace), and each backtrace line, in the :default, :color, :pattern (%{backtrace}), and :syslog formatters. Previously a newline in a cause, which often quotes untrusted input, could forge a log entry even with

... (truncated)

Commits

• 5b605c5 Merge pull request #425 from reidmorrison/drop-thread-name-patch
• 3683f0a Code review changes: name worker threads safely, fix thread name docs and tests
• b3ac4db Release 5.2.0
• 1e8f314 Drop the Thread#name monkey patch
• 0042052 Merge pull request #423 from reidmorrison/dependabot/github_actions/ruby/setu...
• 7f0934a Bump ruby/setup-ruby from 1.328.0 to 1.329.0
• 2e11fda Merge pull request #421 from reidmorrison/security/docs-and-ci
• 8532f11 Mark only the latest 5.x minor version as supported
• 89047ad Wait two weeks before Dependabot proposes an action release
• f772d25 Point the Log event docs at on_log for changes and at the redaction recipe
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)