Bump grape from 3.2.1 to 3.3.0

[dependabot]

Bumps grape from 3.2.1 to 3.3.0.

Changelog

Sourced from grape's changelog.

3.3.0 (2026-06-20)

Features

• #2679: Extract entity dsl and refactor :with to keyword argument - @​ericproulx.
• #2681: Extract Grape::Endpoint.before_each into Grape::Testing - @​ericproulx.
• #2686: Add Grape::Middleware::PrecomputedContentTypes to warm content-type caches on the parent middleware instance (opt-in via include); short-circuit Middleware::Base#merge_headers when no headers were set - @​ericproulx.
• #2683: Introduce Grape::Util::Lazy::Base for unified lazy-type dispatch - @​ericproulx.
• #2685: Skip run_filters and endpoint_run_filters.grape instrumentation when the filter list is empty - @​ericproulx.
• #2684: Readability refactors: case/when, guard clauses, small cleanups - @​ericproulx.
• #2687: Skip backtrace capture on internal validation exceptions - @​ericproulx.
• #2688: Consolidate user-registered rescue handler lookup into Middleware::Error#registered_rescue_handler backed by a shared rescue_handler_from primitive - @​ericproulx.
• #2689: Avoid empty-hash merges on request hot paths - @​ericproulx.
• #2690: Avoid allocating an empty array on every StackableValues#[] miss - @​ericproulx.
• #2691: Precompute the prefix list in Middleware::Versioner::Path - @​ericproulx.
• #2692: Replace per-request Proc allocation in Router#transaction with a halt? helper - @​ericproulx.
• #2694: Split Versioner::Base#available_media_types into an attr_reader plus build_available_media_types - @​ericproulx.
• #2695: Lift trailing if/else into guard clauses - @​ericproulx.
• #2698: Collapse DSL::RequestResponse#extract_handler type-dispatch into a case/when - @​ericproulx.
• #2697: Extract Grape::Util::PathNormalizer from Grape::Router; Grape::Router.normalize_path is now a deprecated alias - @​ericproulx.
• #2696: Reduce per-request allocations on the request hot path; migrate middleware options to attr_reader and freeze @options post-init - @​ericproulx.
• #2693: Introduce Grape::Exceptions::ErrorResponse value object to replace the implicit-schema Hash thrown via throw - @​ericproulx.
• #2701: Replace .tap usages in lib/ with explicit local variables - @​ericproulx.
• #2704: Add Grape::Endpoint#logger so the API's configured logger is reachable inside route handlers, filters, and rescue_from blocks without a helper - @​ericproulx.
• #2705: Add Grape.config.warn_on_helper_overrides (off by default) to emit a warning when a helper method masks a Grape::Endpoint instance method - @​ericproulx.
• #2706: Refactor ParamsScope#validates and ParamsDocumentation around a frozen Grape::Validations::ValidationsSpec value object; the validations hash supplied by the DSL is no longer mutated and the helper chain becomes pure - @​ericproulx.
• #2707: Tighten six guard conditions in lib/ via De Morgan and blank?/present?/include? rewrites; no behaviour change - @​ericproulx.
• #2708: Tighten dynamic define_method in DSL::Callbacks and DSL::Routing - @​ericproulx.
• #2709: Lift trailing if/else into guard clauses; tighten Util::Lazy::ValueEnumerable - @​ericproulx.
• #2702: Add oneof: option for requires/optional to accept a Hash parameter matching one of several variant schemas (resolves #2385) - @​ericproulx.
• #2715: Normalize == / eql? aliasing across value-like classes - @​ericproulx.
• #2710: Tidy up Grape::DeclaredParamsHandler - @​ericproulx.
• #2712: Pass a Grape::Exceptions::ErrorResponse value object to error_formatter#call instead of separate kwargs - @​ericproulx.
• #2714: Drop unused Grape::Middleware::Globals and its grape.request* env constants - @​ericproulx.
• #2717: Convert Grape::Exceptions::ErrorResponse to a Data value object - @​ericproulx.
• #2723: Deprecate passing a positional options Hash to Grape::DSL::Desc#desc; pass options as keyword arguments. Add a grape-swagger integration spec - @​ericproulx.
• #2722: Introduce Grape::Validations::CoerceOptions value object for the internal coerce options - @​ericproulx.
• #2721: Use an internal Grape::Validations::SharedOptions value object in Validators::Base (public opts Hash contract unchanged) - @​ericproulx.
• #2719: Move content-type helpers from Middleware::Base into PrecomputedContentTypes - @​ericproulx.
• #2716: Refactor DSL::Routing#version: guard clause, explicit kwargs in place of **options, and a Grape::DSL::VersionOptions value object stored internally - @​ericproulx.
• #2720: Move declaration-coherence checks into Grape::Validations::ValidationsSpec - @​ericproulx.
• #2725: Encapsulate Grape::Validations::Validators::Base state behind readers; add required?/allow_blank? predicates - @​ericproulx.
• #2726: Reuse one AttributesIterator per validator and drop the unused Enumerable mixin - @​ericproulx.
• #2728: Deprecate passing a positional options Hash to auth/http_basic/http_digest; pass keyword arguments instead - @​ericproulx.
• #2733: Drop the dead active_support/core_ext/hash/reverse_merge require; call ActiveSupport::HashWithIndifferentAccess.new(...) directly at call sites - @​ericproulx.
• #2734: Extract options_route_enabled from the Endpoint options Hash into a dedicated attr_accessor - @​ericproulx.
• #2736: Collapse Endpoint#run_validators rescue branches via ValidationErrors flatten; ValidationErrors#initialize keyword renamed errors: → exceptions: - @​ericproulx.
• #2747: Drop Enumerable from Grape::Exceptions::ValidationErrors and remove its public #each; rewrite #full_messages to walk #errors directly - @​ericproulx.
• #2749: Middleware tidy-up — dedupe Versioner::Base#build_available_media_types (was emitting application/vnd.<vendor>-<version> once per content_type) and assorted Formatter cleanups (guard clauses, in-place merges, drop a no-op splat) - @​ericproulx.
• #2718: Generalize middleware options to per-class Options Data value objects (Middleware::Error, ::Formatter, ::Versioner::Base); expose them via a new config reader, keep options Hash for back-compat, deprecate Options#[] Hash-style access - @​ericproulx.

... (truncated)

Commits

• 74a825f Preparing for release, 3.3.0
• 8c7d07f Add benchmark throughput RESULTS (#2766)
• 0e23f01 Detect the MultiXML constant to avoid the multi_xml deprecation (#2765)
• 9c56aa0 Merge pull request #2764 from ruby-grape/fix/2763-multijson-deprecations
• 2716af9 Fix documentation for :type Array notation to be different from :types (#2758)
• 39422f9 Route Grape::Json through the non-deprecated MultiJSON API
• 1477dc5 Inline mustermann-grape into Grape::Router::MustermannPattern (#2755)
• 18e69cc Merge pull request #2762 from ruby-grape/chore/json-parse-fallback
• 2aa3b3d Parse request bodies with JSON.parse in the stdlib fallback
• 0f9f44f Use create_additions: false in Grape::Json.load (#2759)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Warning

This pull request does not link an OpenProject work package.

Please add a link to the work package in the description, or reference it in the
title in square brackets, e.g. [SLUG-123] My title here.

[github-actions]

Warning

This pull request does not link an OpenProject work package.

Please add a link to the work package in the description, or reference it in the
title in square brackets, e.g. [SLUG-123] My title here.

[github-actions]

Warning

This pull request does not link an OpenProject work package.

Please add a link to the work package in the description, or reference it in the
title in square brackets, e.g. [SLUG-123] My title here.

[klaustopher]

As mentioned in chat, they seem to have included quite a few performance improvements in this release. We should maybe make it a prio getting this in.

[github-actions]

Warning

Flaky specs

• rspec ./spec/features/work_packages/table/switch_types_spec.rb[1:1:1]

🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #24111, linked for reference only):

- `rspec ./spec/features/work_packages/table/switch_types_spec.rb[1:1:1]`

Treat this as a standalone task, unrelated to PR #24111. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #24111 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @dependabot[bot] to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @dependabot[bot], and request a review from @dependabot[bot].
On every commit, set @dependabot[bot] as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

[github-actions]

Warning

Flaky specs

• rspec ./spec/features/portfolios/create_spec.rb[1:1:1]

🤖 Ask Copilot to investigate

Copy the prompt below into a new comment on this PR to delegate the investigation to GitHub Copilot. It will look into the flakiness and open a separate pull request with you as reviewer.

@copilot The following spec(s) are flaky in CI (first seen on PR #24111, linked for reference only):

- `rspec ./spec/features/portfolios/create_spec.rb[1:1:1]`

Treat this as a standalone task, unrelated to PR #24111. Create a new branch from origin/dev and open a new pull request targeting dev — do not stack it on PR #24111 or reuse that branch.

Follow the playbook in docs/development/testing/handling-flaky-tests/README.md to find the root cause and fix the underlying race — do not skip, delete, or weaken the spec to make it pass; disabling is a last resort per the playbook, and only with a bug ticket. Verify the fix by running the spec(s) repeatedly (e.g. `script/bulk_run_rspec --run-count 10`).

If you cannot reproduce the flake or are not confident in a fix after reasonable investigation, do not fabricate a change or skip the spec to force CI green. Instead, leave the pull request in draft and document what you tried, the suspected cause, and any leads in its description, then assign @dependabot[bot] to take over.

Once the fix is verified, title the PR after the spec(s) it fixes, and use the PR description to explain the root cause, how the change resolves it, and the before/after results. Label the PR `flaky-spec`, assign @dependabot[bot], and request a review from @dependabot[bot].
On every commit, set @dependabot[bot] as the sole co-author with a `Co-authored-by:` trailer (use their GitHub no-reply email so it links to their account), so it is traceable who dispatched the fix.

[ulferts]

I haven't measured the performance impacts. I started the server in dev mode and checked that everything still works. For the actual performance results, I suggest to just merge it and see the results in production.

[ulferts]

Most of the changes are quite straight forward. The one that is the most surprising is the one change from

rescue_subclasses: nil

to

rescue_subclasses: true

It seems that the rescue_subclasses: nil was surprisingly always rescuing the subclasses in the past. Only a precise false would have actually prevented it. That changed in 3.3.0 which is why now, it needs to be set to true explicitly.