Bump dalli from 4.0.0 to 4.3.3

[dependabot]

Bumps dalli from 4.0.0 to 4.3.3.

Changelog

Sourced from dalli's changelog.

4.3.3

Performance:

• Reduce object allocations in pipelined get response processing (#1072)
  • Offset-based ResponseBuffer: track a read offset instead of slicing a new string after every parsed response; compact only when the consumed portion exceeds 4KB and more than half the buffer
  • Inline response processor parsing: avoid intermediate array allocations from split-based header parsing in both binary and meta protocols
  • Block-based pipeline_next_responses: yield (key, value, cas) directly when a block is given, avoiding per-call Hash allocation
  • PipelinedGetter: replace Hash-based socket-to-server mapping with linear scan (faster for typical 1-5 server counts); use Process.clock_gettime(CLOCK_MONOTONIC) instead of Time.now
• Add cross-version benchmark script (bin/compare_versions) for reproducible performance comparisons across Dalli versions

Bug Fixes:

• Skip OTel integration tests when meta protocol is unavailable (#1072)

4.3.2

OpenTelemetry:

• Migrate to stable OTel semantic conventions
  • db.system renamed to db.system.name
  • db.operation renamed to db.operation.name
  • server.address now contains hostname only; server.port is a separate integer attribute
  • get_with_metadata and fetch_with_lock now include server.address/server.port
• Add db.query.text span attribute with configurable modes
  • :otel_db_statement option: :include, :obfuscate, or nil (default: omitted)
• Add peer.service span attribute
  • :otel_peer_service option for logical service naming

4.3.1

Bug Fixes:

• Fix socket compatibility with gems that monkey-patch TCPSocket (#996, #1012)

  • Gems like socksify and resolv-replace modify TCPSocket#initialize, breaking Ruby 3.0+'s connect_timeout: keyword argument
  • Detection now uses parameter signature checking instead of gem-specific method detection
  • Falls back to Timeout.timeout when monkey-patching is detected
  • Detection result is cached for performance

• Fix network retry bug with socket_max_failures: 0 (#1065)

  • Previously, setting socket_max_failures: 0 could still cause retries due to error handling
  • Introduced RetryableNetworkError subclass to distinguish retryable vs non-retryable errors
  • down! now raises non-retryable NetworkError, reconnect! raises RetryableNetworkError
  • Thanks to Graham Cooper (Shopify) for this fix

• Fix "character class has duplicated range" Ruby warning (#1067)

  • Fixed regex in KeyManager::VALID_NAMESPACE_SEPARATORS that caused warnings on newer Ruby versions

... (truncated)

Commits

• c38ced1 Prep release 4.3.3
• 889bc87 Merge pull request #1072 from petergoldstein/perf/pipeline-optimizations
• 207ec53 Add forward-port guide for 5.0
• 8fd4077 Add cross-version benchmark script
• d585d79 Reduce allocations in pipelined get response processing
• 3fd87c5 Skip OTel integration tests when meta protocol unavailable
• 2b4559f Bump version to 4.3.2
• b3404ea Align OTel instrumentation with stable semantic conventions
• ab534ff Merge pull request #1066 from petergoldstein/fix/socket-compatibility-996-1012
• 1ce4cae Update CHANGELOG for PR #1069
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)