Skip to content

chore(deps): bump the ruby-deps group with 15 updates - #2839

Merged
mroderick merged 2 commits into
masterfrom
dependabot/bundler/ruby-deps-6bd10cec0c
Sep 3, 2026
Merged

chore(deps): bump the ruby-deps group with 15 updates#2839
mroderick merged 2 commits into
masterfrom
dependabot/bundler/ruby-deps-6bd10cec0c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the ruby-deps group with 15 updates:

Package From To
haml 7.2.2 7.4.1
reline 0.6.3 0.7.0
pagy 43.6.1 43.6.2
icalendar 2.12.3 2.12.4
commonmarker 2.9.0 2.10.0
view_component 4.12.0 4.15.0
haml_lint 0.76.0 0.78.0
overcommit 0.71.0 0.72.0
rubocop 1.88.2 1.90.0
rubocop-performance 1.26.1 1.27.0
rubocop-rails 2.36.0 2.37.0
simplecov 1.0.3 1.1.1
webmock 3.26.2 3.26.3
scout_apm 6.2.0 6.3.0
prawn 2.4.0 2.5.0

Updates haml from 7.2.2 to 7.4.1

Release notes

Sourced from haml's releases.

v7.4.1

What's Changed

Full Changelog: haml/haml@v7.4.0...v7.4.1

v7.4.0

What's Changed

Full Changelog: haml/haml@v7.3.1...v7.4.0

v7.3.1

What's Changed

New Contributors

Full Changelog: haml/haml@v7.3.0...v7.3.1

v7.3.0

What's Changed

New Contributors

Full Changelog: haml/haml@v7.2.2...v7.3.0

Changelog

Sourced from haml's changelog.

7.4.1

  • Build the preserve regex once per tag list instead of per call haml/haml#1220

7.4.0

  • Haml::BOOLEAN_ATTRIBUTES is changed from Array to Set haml/haml#1216
  • A guard on respond_to?(:html_safe?) is removed from Haml::Util.escape_html_safe haml/haml#1217
  • Keep interpolated text in the source encoding, fixing the Encoding::CompatibilityError remaining on an ASCII-8BIT template source that mixes plain text and interpolation with non-ASCII characters haml/haml#1218

7.3.1

  • Keep Prism-derived fragments in the source encoding, fixing Encoding::CompatibilityError on an ASCII-8BIT template source with non-ASCII characters (regression in 7.3.0) haml/haml#1218

7.3.0

  • Replace Ripper with Prism haml/haml#1214
    • Interpolate #@ivar, #$gvar and #@@cvar in string literals instead of dropping them
    • Keep an escaped delimiter of a percent literal, so = %q{a\}b} renders a}b
    • Deprecate Haml::AttributeParser.available?, which is now always true and will be removed in the future
Commits
  • 7f51ae7 Version 7.4.1
  • fce2365 Move find_and_preserve into Haml::Preserver
  • 26c36cd Drop the tag list from the emitted find_and_preserve call
  • 11796e2 Build the preserve regex once per tag list instead of per call
  • 4b26909 Move find_and_preserve into Haml::Helpers
  • 7da8851 Drop an empty tag from the preserve pattern
  • 2e3e512 Match a newline with a String in preserve
  • 9acd59c Require haml/helpers in the script compiler
  • 5dc327f Version 7.4.0
  • 78ddd14 Escape interpolated tag text through Haml::Escape (#1217)
  • Additional commits viewable in compare view

Updates reline from 0.6.3 to 0.7.0

Release notes

Sourced from reline's releases.

v0.7.0

What's Changed

🛠 Other Changes

New Contributors

Full Changelog: ruby/reline@v0.6.3...v0.7.0

Commits
  • 841ab2f Bump version to v0.7.0 (#916)
  • 0bd5775 Use Reline::ANSI when ruby is built with the msys/cygwin runtime (#910)
  • 15a61b8 Fix Windows hang when stdin is redirected (#907) (#908)
  • 11e925b Bump step-security/harden-runner from 2.19.1 to 2.20.0 (#906)
  • 0d85b7c Bump rubygems/release-gem from 1.2.0 to 1.4.0 (#904)
  • f352385 Bump actions/checkout from 6.0.2 to 7.0.1 (#911)
  • edf8d6b Fix iogate.getc input byte order shuffled bug (#891)
  • 4167623 Merge pull request #899 from ruby/dependabot/github_actions/step-security/har...
  • 50fd248 Bump step-security/harden-runner from 2.19.0 to 2.19.1
  • 5663d93 Merge pull request #898 from ruby/dependabot/github_actions/step-security/har...
  • Additional commits viewable in compare view

Updates pagy from 43.6.1 to 43.6.2

Release notes

Sourced from pagy's releases.

Version 43.6.2

Changes in 43.6.2

  • Fix nil records returned for Array collections on page overflow (#920) (Fix #919)

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

  • New :countish Paginator
    • Faster than OFFSET and supporting the full UI
  • New Keynav Pagination
    • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
  • New interactive dev-tools
    • New PagyWand to integrate the pagy CSS with your app themes.
    • New Pagy AI available right inside your own app.
  • Intelligent automation
  • Simpler API
    • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
    • Methods are autoloaded only if used, and consume no memory otherwise.
    • Methods have narrower scopes and can be overridden without deep knowledge.
  • New documentation
    • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

Changelog

Sourced from pagy's changelog.

Version 43.6.2

  • Fix nil records returned for Array collections on page overflow (#920) (Fix #919)
Commits
  • e854305 Merge branch 'dev'
  • 6f0ebbe Version 43.6.2
  • 871fb4a 💎 Fix nil records returned for Array collections on page overflow (#920) (Fix...
  • 1ad8485 Fix broken links in CHANGELOG.md when displayed on GitHub (close #913)
  • 5248145 Update gems and packages
  • 4b5f6f9 Update RM run configs
  • 44afd3f Improve docs templating
  • 2d72e39 Improve Retype config, allowing url override to github actions (#918)
  • See full diff in compare view

Updates icalendar from 2.12.3 to 2.12.4

Changelog

Sourced from icalendar's changelog.

2.12.4 - 2026-07-31

  • TEXT unescape fix - Vincent Gao
Commits
  • 2a83c51 Bump version to 2.12.4
  • a3ce4aa Merge pull request #323 from gaoflow/fix-text-unescape-inverse
  • a98b40a Fix TEXT unescape so it is the exact inverse of value_ical
  • See full diff in compare view

Updates commonmarker from 2.9.0 to 2.10.0

Release notes

Sourced from commonmarker's releases.

v2.10.0

2.10.0 (2026-08-24)

Features

  • node: Report accessor support by node type (#478)

Miscellaneous Chores

  • Run release prep on every push to main (e63aa0d)
  • Satisfy rubocop cops that only CI enables (#478)
Changelog

Sourced from commonmarker's changelog.

2.10.0 (2026-08-24)

Features

  • node: Report accessor support by node type (#478)

Miscellaneous Chores

  • Run release prep on every push to main (e63aa0d)
  • Satisfy rubocop cops that only CI enables (#478)
Commits
  • 0e629d6 Merge pull request #479 from gjtorikian/release-please
  • f0c992a [skip test] release v2.10.0
  • e63aa0d ci: Run release prep on every push to main
  • 326bf28 Merge pull request #478 from gjtorikian/type-aware-node-accessors
  • b6f3a99 chore: Satisfy rubocop cops that only CI enables
  • 0827a06 feat(node): Report accessor support by node type
  • See full diff in compare view

Updates view_component from 4.12.0 to 4.15.0

Release notes

Sourced from view_component's releases.

4.15.0

  • Add experimental caching support, opt-in per component via include ViewComponent::ExperimentallyCacheable.

    Components have never participated in Rails' template digests, so a <% cache %> block wrapping render MyComponent.new was never invalidated when the component changed (#234, open since 2020).

    Including the module registers the component with Rails' own ActionView::Digestor, so fragment caches are invalidated when the component's template, Ruby class, sidecar files, superclasses, child components, or rendered partials change. This includes components and partials rendered from inline templates and #call methods. Adding cache_on caches the component's own rendered output, optionally guarded by if:/unless:, and .cache_digest exposes the digest for use outside a request.

    class MessageComponent < ViewComponent::Base
  include ViewComponent::ExperimentallyCacheable
cache_on :message, unless: -> { message.draft? }
def initialize(message:)
@​message = message
end
end

    This API is experimental and may change or be removed in a non-major release. It's shipping opt-in and per-component precisely so we can iterate on it in response to real-world use. Please try it and tell us what breaks, what's missing, and what feels wrong in #234. We're especially interested in feedback on: whether cache_on is the right shape for declaring cache keys, how the feature behaves with slots and content blocks, and whether the # Template Dependency: escape hatch is sufficient for dynamic renders. See the caching guide for details and known caveats.

    This work builds directly on prior art from the community. The cache_on API and the case for component-local caching come from #2126 by Reegan Viljoen. The approach of integrating with Rails' digest tree rather than reimplementing it comes from view_component-cache_digest by Godfrey Chan. The invalidation cases it's tested against were contributed by JWShuff and timburgan, drawing on view_component-fragment_caching by Patrick Arnett. The issue was opened and researched by ozzyaaron, pinzonjulian, and Derek Kniffin, and the digest workaround that surfaced the superclass gap came from cannikin and rnestler. Cache-key correctness issues (formats sharing an entry, positional nil collisions, conditional caching, and ignored cache_on blocks) were found and reported by Reegan Viljoen.

    Reegan Viljoen, Godfrey Chan, JWShuff, timburgan, Patrick Arnett, ozzyaaron, pinzonjulian, Derek Kniffin, cannikin, rnestler, Joel Hawksley

4.14.0

  • Freeze ReusedInstanceError::MESSAGE and update test_renders_component_with_asset_url to build a fresh AssetComponent per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.

    Joel Hawksley

  • [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak with_content and renders_one/renders_many slot content from an earlier render into a later render because slot state and content set via with_content are populated by the caller before render_in runs and were not cleared by the previous per-render reset. Reinstate the ViewComponent::ReusedInstanceError guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of Collection/spacer objects continues to work.

    Yazan Balawneh, Cystack.ps

  • Update GitHub Actions workflows to use actions/checkout v7.

    Richard Macklin

4.13.0

  • Add support for Turbo-streaming ViewComponents.

    Ben Sheldon, Joel Hawksley

  • Reduce allocations and avoid redundant compiler work when rendering components and collections.

    Joel Hawksley

  • Stabilize rendering allocation tests with explicit warmups and exact expectations by Rails and Ruby.

    Joel Hawksley

... (truncated)

Changelog

Sourced from view_component's changelog.

4.15.0

  • Add experimental caching support, opt-in per component via include ViewComponent::ExperimentallyCacheable.

    Components have never participated in Rails' template digests, so a <% cache %> block wrapping render MyComponent.new was never invalidated when the component changed (#234, open since 2020).

    Including the module registers the component with Rails' own ActionView::Digestor, so fragment caches are invalidated when the component's template, Ruby class, sidecar files, superclasses, child components, or rendered partials change. This includes components and partials rendered from inline templates and #call methods. Adding cache_on caches the component's own rendered output, optionally guarded by if:/unless:, and .cache_digest exposes the digest for use outside a request.

    class MessageComponent < ViewComponent::Base
  include ViewComponent::ExperimentallyCacheable
cache_on :message, unless: -> { message.draft? }
def initialize(message:)
@​message = message
end
end

    This API is experimental and may change or be removed in a non-major release. It's shipping opt-in and per-component precisely so we can iterate on it in response to real-world use. Please try it and tell us what breaks, what's missing, and what feels wrong in #234. We're especially interested in feedback on: whether cache_on is the right shape for declaring cache keys, how the feature behaves with slots and content blocks, and whether the # Template Dependency: escape hatch is sufficient for dynamic renders. See the caching guide for details and known caveats.

    This work builds directly on prior art from the community. The cache_on API and the case for component-local caching come from #2126 by Reegan Viljoen. The approach of integrating with Rails' digest tree rather than reimplementing it comes from view_component-cache_digest by Godfrey Chan. The invalidation cases it's tested against were contributed by JWShuff and timburgan, drawing on view_component-fragment_caching by Patrick Arnett. The issue was opened and researched by ozzyaaron, pinzonjulian, and Derek Kniffin, and the digest workaround that surfaced the superclass gap came from cannikin and rnestler. Cache-key correctness issues (formats sharing an entry, positional nil collisions, conditional caching, and ignored cache_on blocks) were found and reported by Reegan Viljoen.

    Reegan Viljoen, Godfrey Chan, JWShuff, timburgan, Patrick Arnett, ozzyaaron, pinzonjulian, Derek Kniffin, cannikin, rnestler, Joel Hawksley

4.14.0

  • Freeze ReusedInstanceError::MESSAGE and update test_renders_component_with_asset_url to build a fresh AssetComponent per render, fixing CI regressions introduced by the GHSA-8qw7-6phv-7q6p remediation.

    Joel Hawksley

  • [Security] Fix incomplete remediation for CVE-2026-54497 (GHSA-8qw7-6phv-7q6p): reused ViewComponent instances could still leak with_content and renders_one/renders_many slot content from an earlier render into a later render because slot state and content set via with_content are populated by the caller before render_in runs and were not cleared by the previous per-render reset. Reinstate the ViewComponent::ReusedInstanceError guard that raises when a component instance is rendered more than once. Rebuild collection child components per render and dup collection spacer components before each render so that legitimate re-rendering of Collection/spacer objects continues to work.

    Yazan Balawneh, Cystack.ps

  • Update GitHub Actions workflows to use actions/checkout v7.

    Richard Macklin

4.13.0

  • Add support for Turbo-streaming ViewComponents.

    Ben Sheldon, Joel Hawksley

  • Reduce allocations and avoid redundant compiler work when rendering components and collections.

    Joel Hawksley

... (truncated)

Commits
  • e0f40c5 Merge pull request #2707 from ViewComponent/release-4-15-0
  • 3258db0 release 4.15.0
  • 0071477 Merge pull request #2685 from ViewComponent/experimentally-cacheable
  • 1948a8e Rescue Errno::ENOENT in system-test entrypoint controller
  • 6d92d61 Rewrite CHANGELOG em-dash clauses as separate sentence and parenthetical
  • f1da3e3 Restore Microsoft.Dashes rule; unspace em-dashes in CHANGELOG
  • 46d5b6c Disable Microsoft.Dashes; keep spaced em-dashes as house style
  • 449bd26 Fix vale warnings on PR-added lines and make vale fail CI
  • 510e36c Recompile components after modify_file to prevent test pollution
  • f8f987c Merge branch 'main' into experimentally-cacheable
  • Additional commits viewable in compare view

Updates haml_lint from 0.76.0 to 0.78.0

Release notes

Sourced from haml_lint's releases.

0.78.0

What's Changed

New Contributors

Full Changelog: sds/haml-lint@v0.77.0...v0.78.0

0.77.0

What's Changed

Full Changelog: sds/haml-lint@v0.76.0...v0.77.0

Changelog

Sourced from haml_lint's changelog.

0.78.0

  • Add support for Haml 7.4, which dropped the escape_html parameter from Haml::Util#unescape_interpolation and raised ArgumentError on any template containing interpolation

0.77.0

  • Relax haml gem constraint to not have an upper bound, so we're not blocking usage when new Haml versions are released
Commits

Updates overcommit from 0.71.0 to 0.72.0

Release notes

Sourced from overcommit's releases.

0.72.0

What's Changed

New Contributors

Full Changelog: sds/overcommit@v0.71.0...v0.72.0

Changelog

Sourced from overcommit's changelog.

0.72.0

  • Fix Solargraph regexp capture warning
  • Fix Flay hook when flay crashes instead of silently passing
  • Fix operation state restoration in linked worktrees
  • Update rexml constraint to patch CVE-2025-58767
Commits

Updates rubocop from 1.88.2 to 1.90.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.90.0

New features

  • #15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@​bbatsov][])
  • #9505: Add disable-next directives scoped to the following statement. ([@​bbatsov][])
  • #15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@​bbatsov][])
  • #15523: Add new Lint/ArgumentMismatch cop. ([@​bbatsov][])
  • #15594: Add new Lint/SuperArgumentMismatch cop. ([@​bbatsov][])
  • #15581: Add new Style/TimeNow cop. ([@​Starlexxx][])
  • #15111: Add NumberOfEmptyLines option to Layout/EmptyLineAfterMagicComment to configure the minimum number of empty lines required after magic comments. ([@​alejofraga][])
  • #13037: Add --report-unused-todo-entries to catch rotting todo files. ([@​bbatsov][])
  • #15559: Add new Style/DirectiveScope cop to flag disable/enable pairs and disable-only push/pop scopes that wrap a single statement and can use disable-next instead. ([@​bbatsov][])
  • #15547: Make Lint/RedundantCopEnableDirective flag # rubocop:pop directives without a matching # rubocop:push. ([@​bbatsov][])

Bug fixes

  • #15584: Fix a crash in Lint/NameTypo and Lint/UnusedPrivateMethod on string literals with invalid encoding. ([@​bbatsov][])
  • #15541: Fix a false negative for Lint/OutOfRangeRegexpRef when a preceding element access with a non-string literal argument (e.g. hash[:key]) discarded the tracked capture count. ([@​koic][])
  • #7958: Add todo comments for skipped unsafe corrections with --disable-uncorrectable. ([@​bbatsov][])
  • #15569: Fix an error for the built-in language server when a workspace/executeCommand request has no document URI in its arguments. ([@​koic][])
  • #15410: Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName. ([@​bbatsov][])
  • #15576: Fix an incorrect autocorrect for Style/Sample when shuffle is given a random: argument; the offense is still reported but no longer autocorrected, since shuffle and sample consume a seeded generator differently and would select different elements. ([@​koic][])
  • #15590: Fix an infinite loop error for Layout/FirstArgumentIndentation when EnforcedStyle: with_fixed_indentation is specified for Layout/ArgumentAlignment and Layout/FirstMethodArgumentLineBreak is enabled with AllowMultilineFinalElement: true. ([@​Starlexxx][])
  • #15588: Fix RuboCop::Cop::IgnoredMethods and RuboCop::Cop::IgnoredPattern being unreachable after require 'rubocop'. ([@​SeanLF][])
  • #8349: Don't autocorrect away directives for unknown cops. ([@​bbatsov][])
  • #7894: Don't flag disables of pending cops as redundant. ([@​bbatsov][])
  • #9963: Fix false negatives for Layout/ExtraSpacing. ([@​Starlexxx][])
  • #15525: Fix false negatives in Layout/LineLength when a constant path like Http::UploadedFile matches URISchemes case-insensitively. ([@​koic][])
  • #13941: Fix false positives for Lint/UselessConstantScoping when assigning with Class.new, Module.new, Struct.new, or Data.define after private. ([@​pdobb][])
  • #15526: Fix false positives in Layout/MultilineMethodCallIndentation when a line has multiple single-line blocks before a multiline block. ([@​koic][])
  • #15538: Fix false positives in Lint/ConstantReassignment when a constant is assigned in compact-style namespaces (e.g. module A::B). ([@​alex-tan][])
  • #15517: Fix false positives in Lint/RedundantSafeNavigation when InferNonNilReceiver is enabled and the receiver name is rebound by a nested block (it or a shadowed block parameter). ([@​koic][])
  • #15572: Fix RuboCop::Cop::Registry#freeze to freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@​koic][])
  • #15585: Make Lint/DuplicateMethods honor silence_redefinition_of_method and redefine_method as intentional redefinitions. ([@​bbatsov][])
  • #15558: Fix --display-suppressed reporting a nil justification when the offense is loaded from the result cache. ([@​corsonknowles][])
  • #10449: Fix Layout/ClassStructure autocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@​koic][])
  • #15568: Fix Lint/NameTypo registering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@​HoneyryderChuck][])
  • #15556: Fix Lint/UnusedPrivateMethod retaining every past project_index object it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such as rubocop --server. ([@​bquorning][])
  • #10046: Fix Lint/UselessMethodDefinition false positive for methods with **kwargs. ([@​bbatsov][])
  • #15589: Fix --lsp and --mcp being silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@​koic][])
  • #11148: Merge department and cop-level Exclude settings. ([@​bbatsov][])
  • #15531: Fix a regression in RuboCop 1.89 where the modifier cops could produce lines longer than Layout/LineLength Max when exemptions like AllowedPatterns matched the result. ([@​bbatsov][])
  • #15574: Fix an incorrect warning such as AllCops does not support TargetRailsVersion parameter when a plugin declares a custom AllCops key with a nil value and another plugin is loaded after it. ([@​koic][])
  • #9543: Preserve escape notation in Style/StringConcatenation autocorrect. ([@​bbatsov][])
  • #11119: Preserve persistent cop instances across files. ([@​Eljees][])
  • #13022: Fix rubocop . (and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower than rubocop in projects with large ignored trees. ([@​bbatsov][])
  • #15561: Fix Lint/RedundantCopDisableDirective and Lint/RedundantCopEnableDirective leaving a directive's -- reason behind when removing the directive. ([@​corsonknowles][])
  • #15593: Fix false positives for Lint/UnusedPrivateMethod for private definitions of Ruby runtime hooks like inherited and const_missing. ([@​bbatsov][])
  • #15547: Make Lint/MissingCopEnableDirective suggest # rubocop:pop instead of # rubocop:enable for an unclosed # rubocop:push. ([@​bbatsov][])
  • #14379: Suppress multi-line offenses with a directive on any of their lines. ([@​bbatsov][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.90.0 (2026-08-24)

New features

  • #15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@​bbatsov][])
  • #9505: Add disable-next directives scoped to the following statement. ([@​bbatsov][])
  • #15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@​bbatsov][])
  • #15523: Add new Lint/ArgumentMismatch cop. ([...

    Description has been truncated

@dependabot
chore(deps): bump the ruby-deps group with 15 updates
58c194d 
Bumps the ruby-deps group with 15 updates:

| Package | From | To |
| --- | --- | --- |
| [haml](https://github.com/haml/haml) | `7.2.2` | `7.4.1` |
| [reline](https://github.com/ruby/reline) | `0.6.3` | `0.7.0` |
| [pagy](https://github.com/ddnexus/pagy) | `43.6.1` | `43.6.2` |
| [icalendar](https://github.com/icalendar/icalendar) | `2.12.3` | `2.12.4` |
| [commonmarker](https://github.com/gjtorikian/commonmarker) | `2.9.0` | `2.10.0` |
| [view_component](https://github.com/viewcomponent/view_component) | `4.12.0` | `4.15.0` |
| [haml_lint](https://github.com/sds/haml-lint) | `0.76.0` | `0.78.0` |
| [overcommit](https://github.com/sds/overcommit) | `0.71.0` | `0.72.0` |
| [rubocop](https://github.com/rubocop/rubocop) | `1.88.2` | `1.90.0` |
| [rubocop-performance](https://github.com/rubocop/rubocop-performance) | `1.26.1` | `1.27.0` |
| [rubocop-rails](https://github.com/rubocop/rubocop-rails) | `2.36.0` | `2.37.0` |
| [simplecov](https://github.com/simplecov-ruby/simplecov) | `1.0.3` | `1.1.1` |
| [webmock](https://github.com/bblimke/webmock) | `3.26.2` | `3.26.3` |
| [scout_apm](https://github.com/scoutapp/scout_apm_ruby) | `6.2.0` | `6.3.0` |
| [prawn](https://github.com/prawnpdf/prawn) | `2.4.0` | `2.5.0` |


Updates `haml` from 7.2.2 to 7.4.1
- [Release notes](https://github.com/haml/haml/releases)
- [Changelog](https://github.com/haml/haml/blob/main/CHANGELOG.md)
- [Commits](haml/haml@v7.2.2...v7.4.1)

Updates `reline` from 0.6.3 to 0.7.0
- [Release notes](https://github.com/ruby/reline/releases)
- [Commits](ruby/reline@v0.6.3...v0.7.0)

Updates `pagy` from 43.6.1 to 43.6.2
- [Release notes](https://github.com/ddnexus/pagy/releases)
- [Changelog](https://github.com/ddnexus/pagy/blob/master/docs/CHANGELOG.md)
- [Commits](ddnexus/pagy@43.6.1...43.6.2)

Updates `icalendar` from 2.12.3 to 2.12.4
- [Changelog](https://github.com/icalendar/icalendar/blob/main/CHANGELOG.md)
- [Commits](icalendar/icalendar@v2.12.3...v2.12.4)

Updates `commonmarker` from 2.9.0 to 2.10.0
- [Release notes](https://github.com/gjtorikian/commonmarker/releases)
- [Changelog](https://github.com/gjtorikian/commonmarker/blob/main/CHANGELOG.md)
- [Commits](gjtorikian/commonmarker@v2.9.0...v2.10.0)

Updates `view_component` from 4.12.0 to 4.15.0
- [Release notes](https://github.com/viewcomponent/view_component/releases)
- [Changelog](https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md)
- [Commits](ViewComponent/view_component@v4.12.0...v4.15.0)

Updates `haml_lint` from 0.76.0 to 0.78.0
- [Release notes](https://github.com/sds/haml-lint/releases)
- [Changelog](https://github.com/sds/haml-lint/blob/main/CHANGELOG.md)
- [Commits](sds/haml-lint@v0.76.0...v0.78.0)

Updates `overcommit` from 0.71.0 to 0.72.0
- [Release notes](https://github.com/sds/overcommit/releases)
- [Changelog](https://github.com/sds/overcommit/blob/main/CHANGELOG.md)
- [Commits](sds/overcommit@v0.71.0...v0.72.0)

Updates `rubocop` from 1.88.2 to 1.90.0
- [Release notes](https://github.com/rubocop/rubocop/releases)
- [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop@v1.88.2...v1.90.0)

Updates `rubocop-performance` from 1.26.1 to 1.27.0
- [Release notes](https://github.com/rubocop/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-performance@v1.26.1...v1.27.0)

Updates `rubocop-rails` from 2.36.0 to 2.37.0
- [Release notes](https://github.com/rubocop/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rails@v2.36.0...v2.37.0)

Updates `simplecov` from 1.0.3 to 1.1.1
- [Release notes](https://github.com/simplecov-ruby/simplecov/releases)
- [Changelog](https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md)
- [Commits](simplecov-ruby/simplecov@v1.0.3...v1.1.1)

Updates `webmock` from 3.26.2 to 3.26.3
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](bblimke/webmock@v3.26.2...v3.26.3)

Updates `scout_apm` from 6.2.0 to 6.3.0
- [Changelog](https://github.com/scoutapp/scout_apm_ruby/blob/master/CHANGELOG.markdown)
- [Commits](scoutapp/scout_apm_ruby@v6.2.0...v6.3.0)

Updates `prawn` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/prawnpdf/prawn/releases)
- [Changelog](https://github.com/prawnpdf/prawn/blob/master/CHANGELOG.md)
- [Commits](prawnpdf/prawn@2.4.0...2.5.0)

---
updated-dependencies:
- dependency-name: haml
  dependency-version: 7.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: reline
  dependency-version: 0.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: pagy
  dependency-version: 43.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-deps
- dependency-name: icalendar
  dependency-version: 2.12.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ruby-deps
- dependency-name: commonmarker
  dependency-version: 2.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: view_component
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: haml_lint
  dependency-version: 0.78.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: overcommit
  dependency-version: 0.72.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: rubocop
  dependency-version: 1.90.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: rubocop-performance
  dependency-version: 1.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: rubocop-rails
  dependency-version: 2.37.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: simplecov
  dependency-version: 1.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: webmock
  dependency-version: 3.26.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: ruby-deps
- dependency-name: scout_apm
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
- dependency-name: prawn
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ruby-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies ruby Pull requests that update Ruby code labels Sep 3, 2026
@mroderick

mroderick commented Sep 3, 2026

Copy link
Copy Markdown
Collaborator

Dependency Upgrade Review: ruby-deps group (15 updates)

PR scope: dependency-only (Gemfile.lock, dependabot).

Package From → To Change type Risk
haml 7.2.2 → 7.4.1 Internal parser rewrite (Ripper → Prism), encoding fixes, perf; BOOLEAN_ATTRIBUTES Array→Set Medium — renders every view
haml_lint 0.76.0 → 0.78.0 Adds Haml 7.4 support (pairs with the haml bump) Low
view_component 4.12.0 → 4.15.0 Security fix (CVE-2026-54497 / GHSA-8qw7-6phv-7q6p, reused instance content leak) + reinstated ReusedInstanceError guard Medium
rubocop 1.88.2 → 1.90.0 New cops + fixes; repo has NewCops: disable Low (dev)
rubocop-performance / rubocop-rails minor Same Low (dev)
simplecov 1.0.3 → 1.1.1 Minor, CI coverage only Low
webmock patch Bug fix Low
overcommit 0.71 → 0.72 Fixes + rexml CVE-2025-58767 constraint Low (dev)
pagy 43.6.1 → 43.6.2 Patch: fixes nil records for Array collections on page overflow Low
icalendar 2.12.3 → 2.12.4 Patch: TEXT unescape now exact inverse of escaping Low
prawn 2.4.0 → 2.5.0 68 commits: font-metric caching fix on modern Ruby, style churn Low-medium
scout_apm 6.2.0 → 6.3.0 Minor; release notes unavailable via API Low-medium
reline 0.6.3 → 0.7.0 Console/irb input library; not used by app code Low
commonmarker 2.9.0 → 2.10.0 New feature; gem not referenced anywhere in app code Low

Usage in this repository

  • haml renders every view. The paired haml_lint bump is the compatibility companion (haml 7.4 dropped an escape_html parameter that haml-lint ≤0.77 chokes on) — dependabot grouped them correctly.
  • view_component: three components (chapter_picker, chapters_sidebar, event_card); no instance reuse or with_content chaining found, so ReusedInstanceError should not trip.
  • prawn: app/services/check_in_pdf.rb (admin check-in PDF).
  • pagy: used throughout controllers; the overflow fix is a strict improvement.
  • commonmarker: unused — candidate for a separate removal PR.

Local validation (worktree at the PR head)

  • bundle exec rubocop: 375 files, no offenses.
  • Test suite: 1283 examples — one parallel run had 1 failure; serial and repeat parallel runs were fully green. Flaky test, not upgrade-related.

Compatibility assessment

Likely Compatible. The one structurally risky bump (haml 7.4) is paired with matching haml_lint, the suite exercises every HAML view and the prawn/icalendar/view_component paths, and the view_component security fix is a reason to merge rather than wait.

Confidence

High.

mroderick
mroderick approved these changes Sep 3, 2026
View reviewed changes

@mroderick mroderick left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. See analysis comment above.

mroderick
mroderick approved these changes Sep 3, 2026
View reviewed changes

@mroderick mroderick left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. See analysis comment above.

@mroderick
mroderick enabled auto-merge September 3, 2026 07:11
@mroderick
mroderick merged commit 50f587f into master Sep 3, 2026
9 checks passed
@mroderick
mroderick deleted the dependabot/bundler/ruby-deps-6bd10cec0c branch September 3, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mroderick mroderick mroderick approved these changes

Assignees

No one assigned

Labels

dependencies ruby Pull requests that update Ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@mroderick