build(deps): bump appsignal from 4.8.6 to 4.9.0

[dependabot]

Bumps appsignal from 4.8.6 to 4.9.0.

Changelog

Sourced from appsignal's changelog.

4.9.0

Published on 2026-07-16.

Added

• Improve Faraday support. AppSignal now instruments Faraday requests automatically, without double-instrumenting the underlying HTTP client. Turn it off with the instrument_faraday option. (minor c3354af3, 24aa25da)

• Add config options to turn individual integrations off. Set instrument_sidekiq, instrument_shoryuken, instrument_que, instrument_resque, instrument_delayed_job, instrument_active_job, instrument_excon or instrument_mongo to false to disable that integration entirely. This turns off both the instrumentation of the jobs or requests and the enqueue instrumentation for that integration. They all default to true. Each can also be set through its environment variable, such as APPSIGNAL_INSTRUMENT_SIDEKIQ.

  (minor d899994e)

• Instrument background job enqueues. Enqueuing a job now records an enqueue event on the active transaction, so enqueues made from within a web request or another job show up in the event timeline. This is recorded for Sidekiq (enqueue.sidekiq), Que (enqueue.que, plus bulk_enqueue.que for bulk enqueues on Que 2), Resque (enqueue.resque), Shoryuken (enqueue.shoryuken) and Delayed Job (enqueue.delayed_job). Each event is titled after the job being enqueued.

  For Active Job, the enqueue.active_job event is now recorded by AppSignal's own instrumentation rather than by Rails' native enqueue.active_job notification. The native notification is suppressed so the enqueue is recorded once, and the event is now titled after the job being enqueued.

  These enqueue events can be turned off with the enable_job_enqueue_instrumentation config option. Set it to false to stop recording enqueue events across all integrations, without affecting the instrumentation of the jobs themselves. It defaults to true and can also be set through the APPSIGNAL_ENABLE_JOB_ENQUEUE_INSTRUMENTATION environment variable.

  (minor caa8fbc7)

• Report the grape gem version in the environment metadata. For more information, see our environment metadata docs. (patch 6e91223c)

Fixed

• Instrument HTTP.rb chained requests on http 6. Requests made through a chained client -- HTTP.follow.get(...), HTTP.headers(...).get(...), and so on -- go through HTTP::Session rather than HTTP::Client, and were not being recorded. They now produce a request.http_rb event like any other request.

  (patch 9de9522a)

Commits

• bbf6aeb Publish package v4.9.0
• 6182e02 Merge pull request #1545 from appsignal/prepare-minor-release
• 5aa8bf0 Update diagnose tests for the new config options
• d899994 Add config options to control instrumentation
• caa8fbc Merge the enqueue changesets into one
• c6b8ed2 Merge pull request #1540 from appsignal/sidekiq-delayed-enqueue-name
• 506dd65 Merge pull request #1537 from appsignal/add-delayed-job-enqueue-instrumentation
• ee9b5be Name Sidekiq delayed enqueues after their target
• 723c0f6 Honor appsignal_name in Delayed Job enqueue title
• 0a63cdd Instrument Delayed Job enqueues
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)