Skip to content

Bump the bundler group across 1 directory with 11 updates - #1444

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-da7964906a
Closed

Bump the bundler group across 1 directory with 11 updates#1444
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-da7964906a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the bundler group with 10 updates in the / directory:

Package From To
aws-sdk-s3 1.228.1 1.229.0
bootsnap 1.24.6 1.25.0
devise 4.9.4 5.0.4
newrelic_rpm 10.6.0 10.7.0
brakeman 8.0.5 8.0.6
rubocop 1.88.2 1.89.0
rubocop-performance 1.26.1 1.27.0
rubocop-rails 2.36.0 2.37.0
rspec-openapi 0.31.0 0.33.0
selenium-webdriver 4.46.0 4.47.0

Updates aws-sdk-s3 from 1.228.1 to 1.229.0

Changelog

Sourced from aws-sdk-s3's changelog.

1.229.0 (2026-08-06)

  • Feature - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.

1.228.2 (2026-07-30)

  • Issue - S3 Encryption Client, encryptionV2 and encryptionV3, returns a decryption error for a malformed material description.
Commits

Updates bootsnap from 1.24.6 to 1.25.0

Release notes

Sourced from bootsnap's releases.

v1.25.0

What's Changed

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.25.0

  • Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

  • Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

  • Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits
  • e099ec7 Release 1.25.0
  • b694a11 Merge pull request #563 from stanhu/sh-ignore-yjit-in-compile-cache-key
  • 51898f9 Ignore YJIT status in the compile cache key
  • 1ad589b Merge pull request #560 from rails/hm-qnqlnylzkqkltqsz
  • 21fbd65 Merge pull request #561 from jeremy/fix-path-conversion-entry-points
  • 4898853 Convert the path argument in the frame that reads it
  • 8ee47c4 Add MessagePack::Bigint type
  • 49e3eb7 Replace Date Marshalling with recursive msgpack
  • 711fd0b Bump minimum msgpack to 1.5.0
  • 160fc10 Merge pull request #558 from viralpraxis/fix-yaml-cache-kwargs-mutation
  • Additional commits viewable in compare view

Updates devise from 4.9.4 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

5.0.3 - 2026-03-16

5.0.2 - 2026-02-18

  • enhancements
    • Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825
      • Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.
    • Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

  • bug fixes
    • Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31

  • breaking changes

    • Drop support to Ruby < 2.7

    • Drop support to Rails < 7.0

    • Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

    • Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

    • Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

    • Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

    • Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

    • Remove deprecated Devise.activerecord51? method.

    • Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

      This is potentially a breaking change because Devise previously used the following order to find a secret key:

      app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base

      Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645

    • Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

    • Change <br> tags separating form elements to wrapping them in <p> tags #5494

    • Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

... (truncated)

Commits
  • 9ea459d Release v5.0.4 with sec fix for timeoutable
  • 025fe21 Merge commit from fork
  • 7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
  • 605de86 Update links to https [ci skip]
  • 5e3a8bf Bundle update
  • 5d20277 Cleanup old Rails.version check for db migration path
  • 4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
  • 2f80920 Release v5.0.3
  • 5334707 Add CVE to changelog [ci skip]
  • 0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
  • Additional commits viewable in compare view

Updates devise_token_auth from 1.2.6 to 1.3.0

Commits

Updates newrelic_rpm from 10.6.0 to 10.7.0

Changelog

Sourced from newrelic_rpm's changelog.

v10.7.0

  • Feature: Add transaction_tracer.cap_segment_artifacts configuration option

    Long-running transactions with many segments can cause continuously increasing memory usage for the lifetime of the transaction. The agent now offers an opt-in transaction_tracer.cap_segment_artifacts configuration option (defaults to false). When enabled, once transaction_tracer.limit_segments is reached, the agent also stops recording exclusive time for any segments created afterward in that transaction, reducing memory usage at the cost of less accurate timing data for the transaction.PR#3615

  • Feature: Add Puma server-statistics instrumentation

    The agent now samples Puma's cluster-wide server statistics and reports them as Ruby/Puma/* timeslice metrics, including backlog, running, pool_capacity, max_threads, and requests_count. Statistics are sampled in single mode and in clustered mode when preload_app! is enabled. This instrumentation is disabled by default; enable it by setting disable_puma_instrumentation to false. When enabled, the agent starts a reporting thread in the Puma master process to deliver these metrics, which runs an additional agent connection alongside the Puma workers. The sampling interval is configurable via the new puma.sample_rate setting (default 60 seconds). Requires Puma 6.6 or later. See our docs for more information.

    Thanks so much to @​ashleyboehs contributing this new feature. PR#3578

  • Feature: Report a unique hostname for Google Cloud Run instances

    The agent now detects Cloud Run and reports the GCP instance id as the hostname so individual instances can be distinguished. Before this change, all Google Cloud Run hostnames were localhost. This feature is controlled by the new utilization.gcp_cloud_run.use_instance_as_host configuration option (default true). Set utilization.gcp_cloud_run.include_revision_in_host (default false) to true to report the hostname as {K_REVISION}-{instance id} instead, where K_REVISION is the Cloud Run revision name. Thank you to @​kawa-onushi for suggesting this improvement. Issue#3295 PR#3609

  • Bugfix: Slow SQL no longer recorded after transaction_tracer.limit_segments exceeded

    Once a transaction exceeded transaction_tracer.limit_segments, datastore segments created afterward still could have their slow SQL recorded. The agent now stops recording slow SQL for any segment created after the limit is reached. PR#3615

  • Bugfix: Explain plans could target the wrong database in multi-database Rails apps (Rails >= 7.2)

    On Rails 7.2+, the agent gathered explain plans using a connection from the app's default/shared pool rather than a dedicated one. This primarily affected multi-database apps. Explain plans could be generated against the wrong database, and a failed explain could leave a shared connection in a bad state, affecting unrelated requests. The agent now uses its own dedicated connection for explain plans, as it did before Rails 7.2, and resets or discards that connection whenever an explain attempt fails, so a bad connection is never reused. Thank you, @​masiafrest for the detailed report! Issue#3610 PR#3612

  • Bugfix: Browser monitoring instrumentation no longer fails with FrozenError

    When a response body's first fragment was a frozen String and there were multiple fragments, browser instrumentation hit a FrozenError and the browser timing header was never injected. This began appearing with ERB 6.0.3+, which started freezing more of its compiled strings. This issue is now fixed. Thank you to @​md5 for reporting this issue! Issue#3624PR#3625

  • Bugfix: Normalize boolean configuration values to allow all casing

    In version 9.x, the agent accepted capitalized boolean values, like "FALSE", and mixed-case values like "True". Version 10.0.0 included PR#3341, which unintentionally removed the case-insensitive requirement. This caused users who had any casing besides all lowercase to have their configuration options fall back to the defaults. Now, the agent uses case-insensitive checks again. Our thanks go to @​willie for bringing this to our attention. Issue#3632 PR#3633

Commits
  • ae791df Merge pull request #3634 from newrelic/prerelease_updates_10.7.0-pre
  • 18c12a7 bump version
  • 1e1da8f Merge pull request #3633 from newrelic/fix-boolean-env-var-casing
  • 5b3e9f4 Apply suggestion from @​hannahramadan
  • b8b813a Use case-insensitive boolean config validation
  • ffc1969 Merge pull request #3602 from newrelic/server_side_ai_config
  • ac98788 Merge pull request #3628 from newrelic/dependabot/github_actions/ruby/setup-r...
  • 08eaa7d Merge branch 'dev' into dependabot/github_actions/ruby/setup-ruby-1.321.0
  • 3ca2fa5 Merge pull request #3630 from newrelic/dependabot/github_actions/softprops/ac...
  • d0a32b7 Merge pull request #3629 from newrelic/dependabot/github_actions/actions/chec...
  • Additional commits viewable in compare view

Updates brakeman from 8.0.5 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

  • Fix EOL date for Rails 8.0 (yeaseul-kim)
  • Add EOL dates for Rails 8.1 and Ruby 4.0
  • Fix command injection false positives (Jacob Evelyn)
  • Fix unused variable warning (viralpraxis)
Commits
  • fffc483 Bump to 8.0.6
  • b7218fe Update CHANGES
  • c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
  • 4c191dd Fix EOL date for Rails 8.0
  • e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
  • dd4f0b9 Add EOL date for Ruby 4.0
  • 7ca100a Add EOL date for Rails 8.1
  • a53a456 Merge pull request #2022 from JacobEvelyn/main
  • bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
  • 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
  • Additional commits viewable in compare view

Updates rubocop from 1.88.2 to 1.89.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.89.0

New features

  • #15492: Add AllCops/ProjectIndexIncludesGems for bundle-wide indexing. ([@​bbatsov][])
  • #15498: Add DelegatingMethods option to Lint/DuplicateMethods to register custom delegate-shaped methods. ([@​bbatsov][])
  • #15042: Add DisallowedCops configuration option to Style/DisableCopsWithinSourceCodeDirective. ([@​hammadxcm][])
  • #15441: Add new AllowYARDCommentBlockSeparator option to Layout/LeadingCommentSpace. ([@​koic][])
  • #15466: Add new Lint/DeprecatedReference cop to detect references to methods and constants documented as @deprecated, powered by the project index. ([@​bbatsov][])
  • #15491: Add new Lint/NameTypo cop. ([@​bbatsov][])
  • #15468: Add new Lint/UnusedPrivateMethod cop for project-wide dead-code detection via the project index (disabled by default). ([@​bbatsov][])
  • #14598: Make Style/DisableCopsWithinSourceCodeDirective impossible to disable via directive comments when explicitly enabled with Enabled: true. ([@​rafaelfranca][])
  • #15511: Support textDocument/codeAction requests in the built-in language server, so LSP clients that request code actions (Eglot, Helix, Flycheck, ...) can apply RuboCop's autocorrects, not only clients that read them off the published diagnostic. ([@​bbatsov][])
  • #8565: Support NewCops in department configuration to enable pending cops per department, including cops added up to a specific version (e.g. Style: NewCops: '1.19'). ([@​koic][])
  • #9373: Support autocorrection for tab indentation in Layout/IndentationWidth and Style/ClassAndModuleChildren. ([@​ioquatix][], [@​koic][])

Bug fixes

  • #15257: Fix a false negative for Lint/ToEnumArguments when explicit extra keyword arguments are passed (e.g. def m(x:); to_enum(:m, x: x, y: 1); end), which raises ArgumentError when the enumerator is used. ([@​RedZapdos123][])
  • #15452: Fix a false positive for Layout/HashAlignment when using EnforcedHashRocketStyle: table and a hash key spans multiple lines. ([@​dduugg][])
  • #12269: Fix a false positive for Lint/UselessAssignment with modifier conditions. ([@​bbatsov][])
  • #13786: Fix a false positive for Lint/Void with setter methods. ([@​bbatsov][])
  • #15507: Fix a false positive for Naming/VariableNumber when using an empty symbol hash key. ([@​koic][])
  • #15284: Fix a false positive for Style/MutableConstant with Data.define. ([@​bbatsov][])
  • #15483: Fix a false positive for Style/MissingRespondToMissing when respond_to_missing? is defined in a reopening of the class and UseProjectIndex is enabled. ([@​bbatsov][])
  • #15500: Fix an error for Lint/LiteralAsCondition when a literal condition has an empty branch. ([@​koic][])
  • #15499: Fix an error for Lint/UselessRuby2Keywords when ruby2_keywords is used with a symbol but no method definition is found. ([@​koic][])
  • #15453: Fix an error for Metrics/MethodLength when a method contains a heredoc and __ENCODING__. ([@​koic][])
  • #15442: Fix an error for Style/ArrayIntersect cop when the block-based check calls member?/include? without an explicit receiver. ([@​dduugg][])
  • #15434: Fix an error for Style/NegativeArrayIndex cop. ([@​viralpraxis][])
  • #15469: Fix an error for Style/RedundantFormat when a format string uses a positional argument number beyond the 64-bit range. ([@​koic][])
  • #15454: Fix an error for Style/RedundantFormat when the argument for a positional variable width is missing. ([@​koic][])
  • #15298: Fix an incorrect autocorrect for Lint/LiteralInInterpolation. ([@​bbatsov][])
  • #15515: Fix an incorrect autocorrect for Style/ArrayIntersect when using safe navigation none? with a block. ([@​koic][])
  • #15364: Fix an incorrect autocorrect for Style/MultipleComparison that dropped an allowed method comparison appearing between the compared values. ([@​bbatsov][])
  • #15367: Fix an incorrect autocorrect for Style/RedundantFileExtensionInRequire that produced invalid Ruby when a backslash preceded the .rb extension. ([@​bbatsov][])
  • #12017: Fix Lint/Void to no longer autocorrect a constant used in a void context, since removing it can change behavior through constant autoloading side effects. ([@​bbatsov][])
  • #14797: Avoid cache writes during server checks. ([@​sjh9714][])
  • #15484: Fix false negatives for Lint/InheritException when Exception is inherited indirectly through a project class (UseProjectIndex). ([@​bbatsov][])
  • #15357: Fix a false negative for Lint/AmbiguousAssignment when using attribute or index assignment. ([@​sngsmz][])
  • #9571: Fix false negatives in Layout/ClassStructure when class body elements are wrapped in begin blocks. ([@​koic][])
  • #9570: Fix false negatives in Layout/ClassStructure when using private_class_method or public_class_method def modifiers. ([@​koic][])
  • #15438: Fix false positives in Style/ArrayIntersect when the receiver of include? in a block is not an array literal. ([@​koic][])
  • #15445: Fix false positives in Style/MultilineIfThen when using the Prism parser engine and an elsif without then follows a branch using then with a body on the same line. ([@​koic][])
  • #15058: Fix false positives in Lint/DuplicateMethods for anonymous classes (Class.new) passed as arguments to the same named-receiver method call (e.g. T.cast). Each Class.new block is an independent class, so methods defined in different blocks should not be treated as duplicates. ([@​rafaelfranca][])
  • #15486: Fix false negatives for Style/RedundantConstantBase inside namespaces when the constant provably resolves identically without :: (UseProjectIndex). ([@​bbatsov][])
  • #15505: Fix incompatible autocorrect between Style/Lambda and Style/SymbolProc producing a syntax error like ->(x)(&:method) when both cops run on lambda { |x| x.method }. ([@​koic][])
  • #15481: Fix cross-file offenses depending on which files are inspected: the project index now always covers the whole project (UseProjectIndex). ([@​bbatsov][])
  • #13794: Fix Layout/LineLength autocorrection for endless methods with block bodies. ([@​hervetatche][])
  • #15462: Fix an error for Lint/ConstantReassignment when a built-in constant name is assigned and UseProjectIndex is enabled. ([@​bbatsov][])
  • #15321: Fix Style/ClassAndModuleChildren ignoring EnforcedStyleForClasses and EnforcedStyleForModules, and skip autocorrection when mixed per-type styles make the result ambiguous. ([@​bbatsov][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.89.0 (2026-08-04)

New features

  • #15492: Add AllCops/ProjectIndexIncludesGems for bundle-wide indexing. ([@​bbatsov][])
  • #15498: Add DelegatingMethods option to Lint/DuplicateMethods to register custom delegate-shaped methods. ([@​bbatsov][])
  • #15042: Add DisallowedCops configuration option to Style/DisableCopsWithinSourceCodeDirective. ([@​hammadxcm][])
  • #15441: Add new AllowYARDCommentBlockSeparator option to Layout/LeadingCommentSpace. ([@​koic][])
  • #15466: Add new Lint/DeprecatedReference cop to detect references to methods and constants documented as @deprecated, powered by the project index. ([@​bbatsov][])
  • #15491: Add new Lint/NameTypo cop. ([@​bbatsov][])
  • #15468: Add new Lint/UnusedPrivateMethod cop for project-wide dead-code detection via the project index (disabled by default). ([@​bbatsov][])
  • #14598: Make Style/DisableCopsWithinSourceCodeDirective impossible to disable via directive comments when explicitly enabled with Enabled: true. ([@​rafaelfranca][])
  • #15511: Support textDocument/codeAction requests in the built-in language server, so LSP clients that request code actions (Eglot, Helix, Flycheck, ...) can apply RuboCop's autocorrects, not only clients that read them off the published diagnostic. ([@​bbatsov][])
  • #8565: Support NewCops in department configuration to enable pending cops per department, including cops added up to a specific version (e.g. Style: NewCops: '1.19'). ([@​koic][])
  • #9373: Support autocorrection for tab indentation in Layout/IndentationWidth and Style/ClassAndModuleChildren. ([@​ioquatix][], [@​koic][])

Bug fixes

  • #15257: Fix a false negative for Lint/ToEnumArguments when explicit extra keyword arguments are passed (e.g. def m(x:); to_enum(:m, x: x, y: 1); end), which raises ArgumentError when the enumerator is used. ([@​RedZapdos123][])
  • #15452: Fix a false positive for Layout/HashAlignment when using EnforcedHashRocketStyle: table and a hash key spans multiple lines. ([@​dduugg][])
  • #12269: Fix a false positive for Lint/UselessAssignment with modifier conditions. ([@​bbatsov][])
  • #13786: Fix a false positive for Lint/Void with setter methods. ([@​bbatsov][])
  • #15507: Fix a false positive for Naming/VariableNumber when using an empty symbol hash key. ([@​koic][])
  • #15284: Fix a false positive for Style/MutableConstant with Data.define. ([@​bbatsov][])
  • #15483: Fix a false positive for Style/MissingRespondToMissing when respond_to_missing? is defined in a reopening of the class and UseProjectIndex is enabled. ([@​bbatsov][])
  • #15500: Fix an error for Lint/LiteralAsCondition when a literal condition has an empty branch. ([@​koic][])
  • #15499: Fix an error for Lint/UselessRuby2Keywords when ruby2_keywords is used with a symbol but no method definition is found. ([@​koic][])
  • #15453: Fix an error for Metrics/MethodLength when a method contains a heredoc and __ENCODING__. ([@​koic][])
  • #15442: Fix an error for Style/ArrayIntersect cop when the block-based check calls member?/include? without an explicit receiver. ([@​dduugg][])
  • #15434: Fix an error for Style/NegativeArrayIndex cop. ([@​viralpraxis][])
  • #15469: Fix an error for Style/RedundantFormat when a format string uses a positional argument number beyond the 64-bit range. ([@​koic][])
  • #15454: Fix an error for Style/RedundantFormat when the argument for a positional variable width is missing. ([@​koic][])
  • #15298: Fix an incorrect autocorrect for Lint/LiteralInInterpolation. ([@​bbatsov][])
  • #15515: Fix an incorrect autocorrect for Style/ArrayIntersect when using safe navigation none? with a block. ([@​koic][])
  • #15364: Fix an incorrect autocorrect for Style/MultipleComparison that dropped an allowed method comparison appearing between the compared values. ([@​bbatsov][])
  • #15367: Fix an incorrect autocorrect for Style/RedundantFileExtensionInRequire that produced invalid Ruby when a backslash preceded the .rb extension. ([@​bbatsov][])
  • #12017: Fix Lint/Void to no longer autocorrect a constant used in a void context, since removing it can change behavior through constant autoloading side effects. ([@​bbatsov][])
  • #14797: Avoid cache writes during server checks. ([@​sjh9714][])
  • #15484: Fix false negatives for Lint/InheritException when Exception is inherited indirectly through a project class (UseProjectIndex). ([@​bbatsov][])
  • #15357: Fix a false negative for Lint/AmbiguousAssignment when using attribute or index assignment. ([@​sngsmz][])
  • #9571: Fix false negatives in Layout/ClassStructure when class body elements are wrapped in begin blocks. ([@​koic][])
  • #9570: Fix false negatives in Layout/ClassStructure when using private_class_method or public_class_method def modifiers. ([@​koic][])
  • #15438: Fix false positives in Style/ArrayIntersect when the receiver of include? in a block is not an array literal. ([@​koic][])
  • #15445: Fix false positives in Style/MultilineIfThen when using the Prism parser engine and an elsif without then follows a branch using then with a body on the same line. ([@​koic][])
  • #15058: Fix false positives in Lint/DuplicateMethods for anonymous classes (Class.new) passed as arguments to the same named-receiver method call (e.g. T.cast). Each Class.new block is an independent class, so methods defined in different blocks should not be treated as duplicates. ([@​rafaelfranca][])
  • #15486: Fix false negatives for Style/RedundantConstantBase inside namespaces when the constant provably resolves identically without :: (UseProjectIndex). ([@​bbatsov][])
  • #15505: Fix incompatible autocorrect between Style/Lambda and Style/SymbolProc producing a syntax error like ->(x)(&:method) when both cops run on lambda { |x| x.method }. ([@​koic][])
  • #15481: Fix cross-file offenses depending on which files are inspected: the project index now always covers the whole project (UseProjectIndex). ([@​bbatsov][])
  • #13794: Fix Layout/LineLength autocorrection for endless methods with block bodies. ([@​hervetatche][])
  • #15462: Fix an error for Lint/ConstantReassignment when a built-in constant name is assigned and UseProjectIndex is enabled. ([@​bbatsov][])

... (truncated)

Commits
  • 65854e6 Cut 1.89
  • f5dbd74 Update Changelog
  • 2f96cd7 Add new Lint/NameTypo cop
  • 9a91e2b Promote the resolved-ancestry guard to ProjectIndexHelp
  • e917b65 Merge pull request #15522 from joklek-vinted/fix/mise-toml-with-single-quotes
  • 619e3d2 Fix Ruby version detection from mise.toml with single quotes
  • 7999d1a [Fix #15501] Improve Style/RedundantLineContinuation performance on adjacen...
  • 63d9361 Advertise executeCommandProvider in the language server
  • 893a02f Cache the LSP project index across requests
  • 3b9755f Merge pull request #15516 from koic/fix_a_flaky_line_length_spec_timeout_on_j...
  • Additional commits viewable in compare view

Updates rubocop-performance from 1.26.1 to 1.27.0

Release notes

Sourced from rubocop-performance's releases.

RuboCop Performance v1.27.0

Bug fixes

  • #532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. (@​koic)

Changes

  • #530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. (@​koic)
Changelog

Sourced from rubocop-performance's changelog.

1.27.0 (2026-08-16)

Bug fixes

  • #532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. ([@​koic][])

Changes

  • #530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])
Commits
  • c07064d Cut 1.27.0
  • 0e7abe8 Update Changelog
  • 0d43a61 Suppress RuboCop offenses
  • 72eb77d Merge pull request #533 from koic/fix_chain_array_allocation_false_negatives
  • 9c60244 Merge pull request #528 from koic/fix_regexp_match_offense_message_for_bang_t...
  • c3515cb [Fix #532] Fix false negatives for Performance/ChainArrayAllocation
  • dba3d75 Merge pull request #530 from koic/lazy_load_cops
  • dd5f992 Load cops lazily
  • f1763dd [Fix #510] Clarify Performance/RegexpMatch message for !~
  • 9c969a6 Fix JRuby CI failure caused by rbs native extension build
  • Additional commits viewable in compare view

Updates rubocop-rails from 2.36.0 to 2.37.0

Release notes

Sourced from rubocop-rails's releases.

RuboCop Rails v2.37.0

Changes

  • #1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. (@​kuboon)
  • #1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. (@​moberegger)
  • #1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. (@​koic)
Changelog

Sourced from rubocop-rails's changelog.

2.37.0 (2026-08-16)

Changes

  • #1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. ([@​kuboon][])
  • #1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. ([@​moberegger][])
  • #1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])
Commits

@dependabot
Bump the bundler group across 1 directory with 11 updates
7df769c 
Bumps the bundler group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.228.1` | `1.229.0` |
| [bootsnap](https://github.com/rails/bootsnap) | `1.24.6` | `1.25.0` |
| [devise](https://github.com/heartcombo/devise) | `4.9.4` | `5.0.4` |
| [newrelic_rpm](https://github.com/newrelic/newrelic-ruby-agent) | `10.6.0` | `10.7.0` |
| [brakeman](https://github.com/presidentbeef/brakeman) | `8.0.5` | `8.0.6` |
| [rubocop](https://github.com/rubocop/rubocop) | `1.88.2` | `1.89.0` |
| [rubocop-performance](https://github.com/rubocop/rubocop-performance) | `1.26.1` | `1.27.0` |
| [rubocop-rails](https://github.com/rubocop/rubocop-rails) | `2.36.0` | `2.37.0` |
| [rspec-openapi](https://github.com/exoego/rspec-openapi) | `0.31.0` | `0.33.0` |
| [selenium-webdriver](https://github.com/SeleniumHQ/selenium) | `4.46.0` | `4.47.0` |



Updates `aws-sdk-s3` from 1.228.1 to 1.229.0
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Updates `bootsnap` from 1.24.6 to 1.25.0
- [Release notes](https://github.com/rails/bootsnap/releases)
- [Changelog](https://github.com/rails/bootsnap/blob/main/CHANGELOG.md)
- [Commits](rails/bootsnap@v1.24.6...v1.25.0)

Updates `devise` from 4.9.4 to 5.0.4
- [Release notes](https://github.com/heartcombo/devise/releases)
- [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md)
- [Commits](heartcombo/devise@v4.9.4...v5.0.4)

Updates `devise_token_auth` from 1.2.6 to 1.3.0
- [Changelog](https://github.com/lynndylanhurley/devise_token_auth/blob/master/CHANGELOG.md)
- [Commits](lynndylanhurley/devise_token_auth@v1.2.6...v1.3.0)

Updates `newrelic_rpm` from 10.6.0 to 10.7.0
- [Release notes](https://github.com/newrelic/newrelic-ruby-agent/releases)
- [Changelog](https://github.com/newrelic/newrelic-ruby-agent/blob/dev/CHANGELOG.md)
- [Commits](newrelic/newrelic-ruby-agent@10.6.0...10.7.0)

Updates `brakeman` from 8.0.5 to 8.0.6
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](presidentbeef/brakeman@v8.0.5...v8.0.6)

Updates `rubocop` from 1.88.2 to 1.89.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.88.2...v1.89.0)

Updates `rubocop-performance` from 1.26.1 to 1.27.0
- [Release notes](https://github.com/rubocop/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-performance@v1.26.1...v1.27.0)

Updates `rubocop-rails` from 2.36.0 to 2.37.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rails@v2.36.0...v2.37.0)

Updates `rspec-openapi` from 0.31.0 to 0.33.0
- [Release notes](https://github.com/exoego/rspec-openapi/releases)
- [Changelog](https://github.com/exoego/rspec-openapi/blob/master/CHANGELOG.md)
- [Commits](exoego/rspec-openapi@v0.31.0...v0.33.0)

Updates `selenium-webdriver` from 4.46.0 to 4.47.0
- [Release notes](https://github.com/SeleniumHQ/selenium/releases)
- [Changelog](https://github.com/SeleniumHQ/selenium/blob/trunk/rb/CHANGES)
- [Commits](SeleniumHQ/selenium@selenium-4.46.0...selenium-4.47.0)

---
updated-dependencies:
- dependency-name: aws-sdk-s3
  dependency-version: 1.229.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: bootsnap
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: devise
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: bundler
- dependency-name: devise_token_auth
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: newrelic_rpm
  dependency-version: 10.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: brakeman
  dependency-version: 8.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: bundler
- dependency-name: rubocop
  dependency-version: 1.89.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-performance
  dependency-version: 1.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rubocop-rails
  dependency-version: 2.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: rspec-openapi
  dependency-version: 0.33.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
- dependency-name: selenium-webdriver
  dependency-version: 4.47.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: bundler
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code labels Aug 21, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 28, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 28, 2026
@dependabot
dependabot Bot deleted the dependabot/bundler/bundler-da7964906a branch August 28, 2026 18:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants