[dependabot]

Bumps the ruby-deps group with 7 updates in the / directory:

Package	From	To
omniauth	2.1.4	2.3.1
pagy	43.7.1	43.8.1
commonmarker	2.10.0	2.10.1
faraday	2.14.4	2.15.0
view_component	4.15.0	4.19.0
rubocop	1.92.0	1.92.1
rubocop-capybara	3.0.0	3.1.0

Updates omniauth from 2.1.4 to 2.3.1

Changelog

Sourced from omniauth's changelog.

[2.3.1] - 2026-10-22

Fixed

• remember_sign_in no longer raises KeyError when called outside the request phase, before omniauth.params is stored, as when a provider gem's specs call authorize_params directly.

[2.3.0] - 2026-10-22

Added

• Let strategies keep the origin and params of several sign-ins in progress at once, for example in several tabs, so each callback gets its own instead of the latest sign-in's. A strategy opts in by calling remember_sign_in in its request phase with a value the provider sends back, such as OAuth 2.0's state, and overriding callback_sign_in_key. The latest 5 are stored in session['omniauth.sign_ins'], and omniauth.origin and omniauth.params still hold the latest one. See the README. (omniauth-oauth2#195)

Changed

• The gem no longer includes CHANGELOG.md, which was about half its size. Its changelog_uri links to the changelog on GitHub.

[2.2.0] - 2026-10-22

Added

• Add a full_host option for each strategy, as a string or a proc that takes the Rack env. It takes precedence over OmniAuth.config.full_host. (#835)
• Ship RBS type signatures for OmniAuth in sig/.
• Document the Rack env keys OmniAuth sets, CSRF protection, sending origin as a form field, and how SameSite session cookies affect the callback in the README. (#909, #1075, #1048, #1149)
• Add this changelog.

Changed

• omniauth.params now includes params posted to the request phase's form, not just its query string, so they survive the POST-only request phase introduced in 2.0. The authenticity_token param is never included (see CVE-2017-18076 under 1.3.2). If your request form posts other fields, they now appear in omniauth.params and are stored in the session until the callback. (#975)
• OmniAuth::Builder builds its middleware stack on the first request and reuses it, instead of rebuilding every strategy on every request. Providers added after the first request are ignored. (#1083, #970)
• Strategy#call sends a request that isn't on the strategy's request or callback path straight to the app, instead of duplicating the strategy for it. It still duplicates it in test mode, with an other_phase, with path lambdas, or when the strategy overrides how #call! dispatches. Methods patched directly onto OmniAuth::Strategy, rather than overridden in a subclass, aren't detected, so a patched #call! no longer runs for requests outside the strategy's paths. (#1172)
• Require Ruby 2.5 or later (was 2.2). (#1167)
• Require Rack 2.2.8 or later (was 2.2.3), rack-protection 2.2.0 or later, and hashie 3.5.2 or later (was 3.4.6).
• The gem now contains only lib, sig, the license, the README, the changelog, and the security policy.

Fixed

• Run the before_callback_phase hook for mocked failures in test mode, as for real callbacks. (#1043, #1171)
• Recognize callback paths with a format suffix, such as /auth/:provider/callback.json. (#618, #1170)
• Don't fail callbacks when the app defines a method named uid, info, credentials, or extra on Object. (#898, #1169)
• Don't add a calculated name to the info hash subsets returned by slice, except, select, and reject. (#892, #1168)
• Collapse repeated slashes in the request path, as Rails routing does, so //auth/:provider from a misconfigured proxy reaches the strategy. (#1079)
• Avoid "instance variable not initialized" warnings on Ruby before 3.0.

Security

• Guard against forged hosts in callback URLs. Unless a full_host is set, OmniAuth builds the callback URL it sends to the provider from the request's Host, X-Forwarded-Host, or Forwarded header, which a client can forge. The new OmniAuth.config.allowed_hosts, a list of strings and regexps, makes the request and callback phases fail with invalid_host unless the request's host matches one of them. Until full_host or allowed_hosts is set, the request phase logs a warning. The README's full_host example, which copied the Host header, is fixed. (GHSA-m27g-v28p-f9fx, CVE-2026-63183)
• Run request_validation_phase before writing omniauth.params to the session, so a cross-site POST rejected by the authenticity check can no longer store attacker-controlled params. (#1162)

Commits

• 5813803 Release 2.3.1
• dde1f86 Let remember_sign_in run before omniauth.params is stored
• 9db25e1 Release 2.3.0
• d9f73a0 Require json in the sign-ins spec
• 4905b90 Let strategies keep several sign-ins' origins apart
• 8dc4b1e Stop shipping CHANGELOG.md in the gem
• 474bc91 Make rake release tag and push without pushing the gem
• 0d38078 Release 2.2.0
• 943b44f Add allowed_hosts to guard against forged hosts
• a241c94 Make the shipped signatures loadable from other gems
• Additional commits viewable in compare view

Updates pagy from 43.7.1 to 43.8.1

Release notes

Sourced from pagy's releases.

Version 43.8.1

Changes in 43.8.1

• Fix Active Record connection checkout in keyset pagination (#931)

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

• New :countish Paginator
  • Faster than OFFSET and supporting the full UI
• New Keynav Pagination
  • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
• New interactive dev-tools
  • New PagyWand to integrate the pagy CSS with your app themes.
  • New Pagy AI available right inside your own app.
• Intelligent automation
  • Configuration requirements reduced by 99%.
  • Simplified JavaScript setup.
  • Automatic I18n loading.
• Simpler API
  • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
  • Methods are autoloaded only if used, and consume no memory otherwise.
  • Methods have narrower scopes and can be overridden without deep knowledge.
• New documentation
  • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

Version 43.8.0

Changes in 43.8.0

• Add Romanian localization (#930)

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.8.1

• Fix Active Record connection checkout in keyset pagination (#931)

Version 43.8.0

• Add Romanian localization (#930)

Commits

• 0b1b56c Merge branch 'dev'
• 88afb38 Version 43.8.1
• 04a8bb8 💎 Fix Active Record connection checkout in keyset pagination (#931)
• 3c1a9ea Fix retype.yml
• 6a74ffb Update gems and packages and refactor dockshots
• 5a2de59 Add release RM run config
• bbc95ca Refactor top 100 contributors ordering by changes and commits.
• 07e1903 Merge branch 'dev'
• d8734bc Version 43.8.0
• eb6c50d 💎 Add Romanian localization (#930)
• Additional commits viewable in compare view

Updates commonmarker from 2.10.0 to 2.10.1

Release notes

Sourced from commonmarker's releases.

v2.10.1

2.10.1 (2026-10-16)

Bug Fixes

• prevent native stack overflows on deeply nested input (GHSA-c4fj-h48v-9fxp) (459585e)

Performance Improvements

• Reuse the CSS syntax highlighter across renders (#485)

Miscellaneous Chores

• Bump magnus from 0.9.2 to 0.9.3 (#487)
• Lint PR titles for Conventional Commits (65e9e12)
• Bump rb-sys to 0.9.130 (0253ccd)

Changelog

Sourced from commonmarker's changelog.

2.10.1 (2026-10-16)

Bug Fixes

• prevent native stack overflows on deeply nested input (GHSA-c4fj-h48v-9fxp) (459585e)

Performance Improvements

• Reuse the CSS syntax highlighter across renders (#485)

Miscellaneous Chores

• Bump magnus from 0.9.2 to 0.9.3 (#487)
• Lint PR titles for Conventional Commits (65e9e12)
• Bump rb-sys to 0.9.130 (0253ccd)

Commits

• 93a8ed9 [skip test] Release v2.10.1 (#486)
• a70bfd4 build: Bump magnus from 0.9.2 to 0.9.3 (#487)
• f300d53 perf: Reuse the CSS syntax highlighter across renders (#485)
• 459585e fix: prevent native stack overflows on deeply nested input (GHSA-c4fj-h48v-9fxp)
• dab784b Merge pull request #485 from volition-co/reuse-css-highlighter
• cea8adc Merge commit from fork
• 7886987 test deep nesting end to end
• 2ccadf4 walk the tree iteratively
• 3d0c84a enforce max_nesting_depth while parsing
• e26f4f6 copy the parse tree without recursing
• Additional commits viewable in compare view

Updates faraday from 2.14.4 to 2.15.0

Release notes

Sourced from faraday's releases.

v2.15.0

What's Changed

• [LOW] Keep Coveralls token out of pull-request code by @​OskarEichler in lostisland/faraday#1711
• [LOW] Remove vulnerable docs preview dependencies by @​OskarEichler in lostisland/faraday#1714
• chore: Use Docsify 5, to avoid the dropped 4.x version series by @​olleolleolle in lostisland/faraday#1670
• Fix typo in Faraday::Connection#options doc by @​Bo98 in lostisland/faraday#1674
• Preserve request ports for no_proxy matching by @​OskarEichler in lostisland/faraday#1705
• Preserve parallel manager across nested batches by @​OskarEichler in lostisland/faraday#1704
• Reject adapter changes after locking the stack by @​OskarEichler in lostisland/faraday#1701
• Preserve literal plus signs when decoding URI userinfo by @​OskarEichler in lostisland/faraday#1694
• Preserve explicit proxy settings when duplicating connections by @​OskarEichler in lostisland/faraday#1693
• Add GitHub Agentic Workflow for new-issue triage by @​iMacTia with @​Copilot in lostisland/faraday#1720
• Remove unused RackBuilder#adapter_set? by @​dpep in lostisland/faraday#1719
• Fetch current option values after mutation by @​OskarEichler in lostisland/faraday#1690
• gemspec: Relax faraday-net_http to < 3.6 by @​olleolleolle in lostisland/faraday#1722

New Contributors

• @​Bo98 made their first contribution in lostisland/faraday#1674

Full Changelog: lostisland/faraday@v2.14.4...v2.15.0

Commits

• af2db2d v2.15.0
• 8456969 gemspec: Relax faraday-net_http to < 3.6
• dc8c26b test: cover Options fetch after mutation
• a2a95dd Fetch current option values after mutation
• 19a9968 Remove unused RackBuilder#adapter_set?
• 9e369d2 Add issue triage agentic workflow (#1720)
• deeb6ef Test that Connection#dup preserves manually set proxy
• bbb8ab5 Preserve explicit proxy settings when duplicating connections
• fb42726 Add tests for literal plus signs in URI userinfo
• 5755083 Preserve literal plus signs when decoding URI userinfo
• Additional commits viewable in compare view

Updates view_component from 4.15.0 to 4.19.0

Release notes

Sourced from view_component's releases.

4.19.0

• Remove the unused concurrent-ruby dependency. require "concurrent-ruby" loaded every concurrent-ruby class at boot, a leftover from the Concurrent::ReadWriteLock the compiler no longer uses.

  Clément Joubert

• Fix every request raising NoMethodError in development when an autoload path is a Pathname, as engines such as Madmin add. The template watcher now passes the autoload paths to the file watcher as strings.

  Anthony Veaudry

• Fix the template annotations integration test failing when it ran after the coverage compile tests, which left components compiled without the annotation in the test cache.

  Anthony Veaudry

4.18.0

• Enable caching support for all components by default, and rename ViewComponent::ExperimentallyCacheable to ViewComponent::Cacheable. Including the module is no longer necessary. Breaking: remove existing include ViewComponent::ExperimentallyCacheable lines. Caching is no longer experimental.

  Erik Axel Nielsen, Joel Hawksley

4.17.0

• Only register the executor hook that watches component templates when Action View doesn't cache templates at boot. With template caching on, as in production, the hook did nothing but still read ActionView::Base.cache_template_loading on every request. That value lives in a class variable, which non-main Ractors can't read on Ruby 4.0, so under Rails' experimental Rails.application.ractorize! every request failed.

  Mikael Henriksson

• Fix Component.translate raising UncaughtThrowError for keys missing from the sidecar translations, and NoMethodError for components without sidecar translations. It now falls back to the global translations, like the instance method does. Fix translate returning the default: value instead of an existing global translation.

  Andrii Furmanets

• Only recompile components when a template or a translation file changed, instead of before every request, when templates aren't cached. Pages render about twice as fast in development.

  Clément Joubert

4.16.0

• Fix subclasses defined after their parent renders a collection using the parent's default collection parameter name instead of their own. Fix recompiling a component not refreshing its collection parameter, counter, and iteration detection. Compute that detection when a component compiles, and store the results frozen so they're shareable across Ractors.

  Ben Sheldon

• Fix collection counter and iteration detection, and collection and reserved parameter validation, when initialize arguments are forwarded through anonymous arguments (... or **), such as by prepended modules and subclasses calling super.

  Ben Sheldon

• Update development and documentation dependencies, baseline existing Audition findings, and accommodate updated lint rules.

  Joel Hawksley

• Invalidate Action View's memoized template digests when a component registers with ViewComponent::CacheDigest, so a digest computed before the component loaded isn't served for the rest of the process.

... (truncated)

Changelog

Sourced from view_component's changelog.

4.19.0

• Remove the unused concurrent-ruby dependency. require "concurrent-ruby" loaded every concurrent-ruby class at boot, a leftover from the Concurrent::ReadWriteLock the compiler no longer uses.

  Clément Joubert

• Fix every request raising NoMethodError in development when an autoload path is a Pathname, as engines such as Madmin add. The template watcher now passes the autoload paths to the file watcher as strings.

  Anthony Veaudry

• Fix the template annotations integration test failing when it ran after the coverage compile tests, which left components compiled without the annotation in the test cache.

  Anthony Veaudry

4.18.0

• Enable caching support for all components by default, and rename ViewComponent::ExperimentallyCacheable to ViewComponent::Cacheable. Including the module is no longer necessary. Breaking: remove existing include ViewComponent::ExperimentallyCacheable lines. Caching is no longer experimental.

  Erik Axel Nielsen, Joel Hawksley

4.17.0

• Only register the executor hook that watches component templates when Action View doesn't cache templates at boot. With template caching on, as in production, the hook did nothing but still read ActionView::Base.cache_template_loading on every request. That value lives in a class variable, which non-main Ractors can't read on Ruby 4.0, so under Rails' experimental Rails.application.ractorize! every request failed.

  Mikael Henriksson

• Fix Component.translate raising UncaughtThrowError for keys missing from the sidecar translations, and NoMethodError for components without sidecar translations. It now falls back to the global translations, like the instance method does. Fix translate returning the default: value instead of an existing global translation.

  Andrii Furmanets

• Only recompile components when a template or a translation file changed, instead of before every request, when templates aren't cached. Pages render about twice as fast in development.

  Clément Joubert

4.16.0

• Fix subclasses defined after their parent renders a collection using the parent's default collection parameter name instead of their own. Fix recompiling a component not refreshing its collection parameter, counter, and iteration detection. Compute that detection when a component compiles, and store the results frozen so they're shareable across Ractors.

  Ben Sheldon

• Fix collection counter and iteration detection, and collection and reserved parameter validation, when initialize arguments are forwarded through anonymous arguments (... or **), such as by prepended modules and subclasses calling super.

  Ben Sheldon

• Update development and documentation dependencies, baseline existing Audition findings, and accommodate updated lint rules.

  Joel Hawksley

• Invalidate Action View's memoized template digests when a component registers with ViewComponent::CacheDigest, so a digest computed before the component loaded isn't served for the rest of the process.

... (truncated)

Commits

• 17c986e Merge pull request #2737 from ViewComponent/release-4-19-0
• a574d60 release 4.19.0
• 753e193 Merge pull request #2736 from czj/drop-unused-concurrent-ruby-require
• ec77785 Merge remote-tracking branch 'origin/main' into pr-2736
• 2836785 Merge pull request #2734 from anthony0030/fix-pathname-autoload-paths
• 1977d64 Merge branch 'main' into fix-pathname-autoload-paths
• b7828ab Merge pull request #2735 from anthony0030/fix-annotations-test-order
• 0a11d64 Remove unused concurrent-ruby dependency
• ecb933a Add changelog entry for the with_new_cache fix
• a782d17 Recompile components compiled inside with_new_cache
• Additional commits viewable in compare view

Updates rubocop from 1.92.0 to 1.92.1

Release notes

Sourced from rubocop's releases.

RuboCop v1.92.1

Bug fixes

• #16063: Fix an error for Layout/HashAlignment with a key spanning multiple lines. ([@​koic][])
• #15776: Fix an error in server mode when the configuration file is missing or empty. ([@​MIbtehajNasar][])
• #15939: Fix an error for Style/ClassAndModuleChildren when compacting a namespace that contains another compactable one. ([@​Starlexxx][])
• #16047: Fix an error for Style/ClassMethodsDefinitions with a nested class << self. ([@​Starlexxx][])
• #16041: Fix an error for Style/EmptyStringInsideInterpolation with nested conditionals. ([@​koic][])
• #16067: Fix an error for Style/RedundantInterpolationUnfreeze with an unfrozen string interpolated into another one. ([@​Starlexxx][])
• #16055: Fix an error for Style/RescueModifier with a rescue modifier in the rescue body of another one. ([@​Starlexxx][])
• #15968: Fix an error when the target Ruby version lookup cannot list a directory for a gemspec or read a version file or lockfile, and stop the gemspec search at the project root. ([@​koic][])
• #16073: Fix an incorrect autocorrect for Layout/ClassStructure with code after a heredoc. ([@​koic][])
• #16026: Fix an incorrect autocorrect for Layout/DotPosition with a dot removed by another cop. ([@​koic][])
• #16107: Fix an incorrect autocorrect for Layout/HeredocArgumentClosingParenthesis with Layout/MultilineMethodCallBraceLayout. ([@​koic][])
• #16117: Fix an incorrect autocorrect for Layout/LineLength with an unparenthesized method definition. ([@​koic][])
• #16061: Fix an incorrect autocorrect for Layout/MultilineHashBraceLayout with a nested literal. ([@​koic][])
• #16033: Fix an incorrect autocorrect for Layout/MultilineMethodCallIndentation with a single-line block. ([@​koic][])
• #16077: Fix an incorrect autocorrect for Layout/SingleLineBlockChain with Style/RedundantSort. ([@​koic][])
• #16098: Fix an incorrect autocorrect for Lint/AmbiguousRegexpLiteral with a regexp hash key. ([@​koic][])
• #16086: Fix an incorrect autocorrect for Lint/SymbolConversion with hash value omission. ([@​koic][])
• #16099: Fix an incorrect autocorrect for Naming/RescuedExceptionsVariableName with Style/HashSyntax. ([@​koic][])
• #16023: Fix an incorrect autocorrect for Style/AccessModifierDeclarations with Style/EndlessMethod. ([@​Starlexxx][])
• #16024: Fix an incorrect autocorrect for Style/AccessModifierDeclarations with an endless method command body. ([@​Starlexxx][])
• #16111: Fix an incorrect autocorrect for Style/AccessModifierDeclarations with an endless method with a do...end block body. ([@​koic][])
• #16056: Fix an incorrect autocorrect for Style/AndOr with a safe navigation command call. ([@​Starlexxx][])
• #16043: Fix an incorrect autocorrect for Style/AndOr with Style/ReturnNil. ([@​koic][])
• #16020: Fix an incorrect autocorrect for Style/ArgumentsForwarding when another call forwards anonymous arguments without the block. ([@​Starlexxx][])
• #16038: Fix an incorrect autocorrect for Style/ArgumentsForwarding with index assignment and setter methods. ([@​koic][])
• #15067: Fix an incorrect autocorrect for Style/CollectionQuerying when count is used without a block. ([@​Starlexxx][], [@​wwenrr][])
• #16032: Fix an incorrect autocorrect for Style/CombinableLoops with Layout/BlockEndNewline. ([@​Starlexxx][])
• #16072: Fix an incorrect autocorrect for Style/CombinableLoops with Layout/RedundantLineBreak. ([@​koic][])
• #16036: Fix an incorrect autocorrect for Style/ConcatArrayLiterals with a multiline call without parentheses. ([@​koic][])
• #16100: Fix an incorrect autocorrect for Style/EmptyStringInsideInterpolation with a command call. ([@​koic][])
• #16023: Fix an incorrect autocorrect for Style/EndlessMethod with a command body in a method definition passed as an argument. ([@​Starlexxx][])
• #16110: Fix an incorrect autocorrect for Style/EndlessMethod with a do...end block body in a method definition passed as an argument. ([@​koic][])
• #16042: Fix an incorrect autocorrect for Style/EndlessMethod with a negated command call. ([@​koic][])
• #16029: Fix an incorrect autocorrect for Style/EndlessMethod with Style/GuardClause. ([@​koic][])
• #16058: Fix an incorrect autocorrect for Style/EndlessMethod with Style/RaiseArgs. ([@​Starlexxx][])
• #16045: Fix an incorrect autocorrect for Style/For with a numbered or it block. ([@​koic][])
• #16046: Fix an incorrect autocorrect for Style/For with block parameters invalid as loop variables. ([@​koic][])
• #16044: Fix an incorrect autocorrect for Style/For with Style/ItBlockParameter. ([@​koic][])
• #16031: Fix an incorrect autocorrect for Style/GuardClause with a heredoc in a multiline guard clause. ([@​Starlexxx][])
• #16031: Fix an incorrect autocorrect for Style/GuardClause with a heredoc in the kept branch. ([@​Starlexxx][])
• #16021: Fix an incorrect autocorrect for Style/HashAsLastArrayItem with Style/TrailingCommaInArrayLiteral. ([@​Starlexxx][])
• #16027: Fix an incorrect autocorrect for Style/IfUnlessModifier with a heredoc in the condition. ([@​koic][])
• #16025: Fix an incorrect autocorrect for Style/Lambda with extra spacing before the block. ([@​koic][])
• #16054: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with a trailing comma. ([@​koic][])
• #16080: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with a parenthesized argument. ([@​koic][])
• #16074: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with an assignment used as an argument. ([@​koic][])
• #16118: Fix an incorrect autocorrect for Style/MethodDefParentheses with Layout/LineLength. ([@​koic][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.92.1 (2026-10-22)

Bug fixes

• #16063: Fix an error for Layout/HashAlignment with a key spanning multiple lines. ([@​koic][])
• #15776: Fix an error in server mode when the configuration file is missing or empty. ([@​MIbtehajNasar][])
• #15939: Fix an error for Style/ClassAndModuleChildren when compacting a namespace that contains another compactable one. ([@​Starlexxx][])
• #16047: Fix an error for Style/ClassMethodsDefinitions with a nested class << self. ([@​Starlexxx][])
• #16041: Fix an error for Style/EmptyStringInsideInterpolation with nested conditionals. ([@​koic][])
• #16067: Fix an error for Style/RedundantInterpolationUnfreeze with an unfrozen string interpolated into another one. ([@​Starlexxx][])
• #16055: Fix an error for Style/RescueModifier with a rescue modifier in the rescue body of another one. ([@​Starlexxx][])
• #15968: Fix an error when the target Ruby version lookup cannot list a directory for a gemspec or read a version file or lockfile, and stop the gemspec search at the project root. ([@​koic][])
• #16073: Fix an incorrect autocorrect for Layout/ClassStructure with code after a heredoc. ([@​koic][])
• #16026: Fix an incorrect autocorrect for Layout/DotPosition with a dot removed by another cop. ([@​koic][])
• #16107: Fix an incorrect autocorrect for Layout/HeredocArgumentClosingParenthesis with Layout/MultilineMethodCallBraceLayout. ([@​koic][])
• #16117: Fix an incorrect autocorrect for Layout/LineLength with an unparenthesized method definition. ([@​koic][])
• #16061: Fix an incorrect autocorrect for Layout/MultilineHashBraceLayout with a nested literal. ([@​koic][])
• #16033: Fix an incorrect autocorrect for Layout/MultilineMethodCallIndentation with a single-line block. ([@​koic][])
• #16077: Fix an incorrect autocorrect for Layout/SingleLineBlockChain with Style/RedundantSort. ([@​koic][])
• #16098: Fix an incorrect autocorrect for Lint/AmbiguousRegexpLiteral with a regexp hash key. ([@​koic][])
• #16086: Fix an incorrect autocorrect for Lint/SymbolConversion with hash value omission. ([@​koic][])
• #16099: Fix an incorrect autocorrect for Naming/RescuedExceptionsVariableName with Style/HashSyntax. ([@​koic][])
• #16023: Fix an incorrect autocorrect for Style/AccessModifierDeclarations with Style/EndlessMethod. ([@​Starlexxx][])
• #16024: Fix an incorrect autocorrect for Style/AccessModifierDeclarations with an endless method command body. ([@​Starlexxx][])
• #16111: Fix an incorrect autocorrect for Style/AccessModifierDeclarations with an endless method with a do...end block body. ([@​koic][])
• #16056: Fix an incorrect autocorrect for Style/AndOr with a safe navigation command call. ([@​Starlexxx][])
• #16043: Fix an incorrect autocorrect for Style/AndOr with Style/ReturnNil. ([@​koic][])
• #16020: Fix an incorrect autocorrect for Style/ArgumentsForwarding when another call forwards anonymous arguments without the block. ([@​Starlexxx][])
• #16038: Fix an incorrect autocorrect for Style/ArgumentsForwarding with index assignment and setter methods. ([@​koic][])
• #15067: Fix an incorrect autocorrect for Style/CollectionQuerying when count is used without a block. ([@​Starlexxx][], [@​wwenrr][])
• #16032: Fix an incorrect autocorrect for Style/CombinableLoops with Layout/BlockEndNewline. ([@​Starlexxx][])
• #16072: Fix an incorrect autocorrect for Style/CombinableLoops with Layout/RedundantLineBreak. ([@​koic][])
• #16036: Fix an incorrect autocorrect for Style/ConcatArrayLiterals with a multiline call without parentheses. ([@​koic][])
• #16100: Fix an incorrect autocorrect for Style/EmptyStringInsideInterpolation with a command call. ([@​koic][])
• #16023: Fix an incorrect autocorrect for Style/EndlessMethod with a command body in a method definition passed as an argument. ([@​Starlexxx][])
• #16110: Fix an incorrect autocorrect for Style/EndlessMethod with a do...end block body in a method definition passed as an argument. ([@​koic][])
• #16042: Fix an incorrect autocorrect for Style/EndlessMethod with a negated command call. ([@​koic][])
• #16029: Fix an incorrect autocorrect for Style/EndlessMethod with Style/GuardClause. ([@​koic][])
• #16058: Fix an incorrect autocorrect for Style/EndlessMethod with Style/RaiseArgs. ([@​Starlexxx][])
• #16045: Fix an incorrect autocorrect for Style/For with a numbered or it block. ([@​koic][])
• #16046: Fix an incorrect autocorrect for Style/For with block parameters invalid as loop variables. ([@​koic][])
• #16044: Fix an incorrect autocorrect for Style/For with Style/ItBlockParameter. ([@​koic][])
• #16031: Fix an incorrect autocorrect for Style/GuardClause with a heredoc in a multiline guard clause. ([@​Starlexxx][])
• #16031: Fix an incorrect autocorrect for Style/GuardClause with a heredoc in the kept branch. ([@​Starlexxx][])
• #16021: Fix an incorrect autocorrect for Style/HashAsLastArrayItem with Style/TrailingCommaInArrayLiteral. ([@​Starlexxx][])
• #16027: Fix an incorrect autocorrect for Style/IfUnlessModifier with a heredoc in the condition. ([@​koic][])
• #16025: Fix an incorrect autocorrect for Style/Lambda with extra spacing before the block. ([@​koic][])
• #16054: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with a trailing comma. ([@​koic][])
• #16080: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with a parenthesized argument. ([@​koic][])
• #16074: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with an assignment used as an argument. ([@​koic][])

... (truncated)

Commits

• aa228eb Cut 1.92.1
• 32be1f5 Update Changelog
• 3b48d7f Merge pull request #16122 from koic/fix_false_positives_in_style_it_block_par...
• b40eece Merge pull request #16131 from koic/fix_badge_equality_hash_collision
• 652f167 Fix Badge equality treating hash collisions as equal badges
• 45bc56c Merge pull request #16121 from koic/fix_false_positives_in_style_it_block_par...
• 88a4008 Merge pull request #16118 from koic/fix_an_incorrect_autocorrect_for_style_me...
• e8026a4 Merge pull request #16117 from koic/fix_an_incorrect_autocorrect_for_layout_l...
• 57e64d0 Merge pull request #16109 from Starlexxx/fix-parentheses-around-condition-masgn
• 68f505e [Fix #16119] Fix false positives in Style/ItBlockParameter when a local var...
• Additional commits viewable in compare view

Updates rubocop-capybara from 3.0.0 to 3.1.0

Release notes

Sourced from rubocop-capybara's releases.

RuboCop Capybara v3.1.0

• Add new Capybara/UnorderedWindowAccess cop. (@​ydah)
• Add new Capybara/AbsoluteXPathInElementScope cop. (@​ydah)
• Add new Capybara/AlwaysTrueCountQuery cop. (@​ydah)
• Add new Capybara/RSpec/CurrentUrlExpectation cop. (@​ydah)
• Add new Capybara/ModalMethodWithoutBlock cop. (@​ydah)
• Add new Capybara/NativeAttribute cop...

  Description has been truncated

[mroderick]

Dependency Upgrade Review

Verdict: Likely Compatible (head 2b46152ed379a1c6bad535cf4898c864a98e9830) · Confidence: Medium

Dependency-only bump (Gemfile + Gemfile.lock) of 7 direct gems plus 5 transitive patches, no code changes. Main risk is omniauth's internal strategy rewrite, which I verified at the v2.3.1 source against every surface this repo uses; all named verification suites and the round-trip probe pass, so the upgrade is safe to merge.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
omniauth.auth hash consumed by AuthServicesController (provider, uid, info.email/name, credentials)	Verified	fail!/env keys line-traced in v2.3.1 source; codebar_strategy_spec, auth request specs, auth-suite and round-trip probe pass
Outbound Flodesk JSON request (json body, Basic auth, raise_error, timeouts)	Partially verified	faraday lib diff line-traced: repo call path unchanged; flodesk_spec exercises the path with test adapter and passes
Server-rendered markdown HTML from dot_markdown (html_safe, sanitised)	Partially verified	commonmarker diff shows comrak minor bumps; rendering not line-traced; helper spec assertions pass in planner-suite
OAuth session keys omniauth.codebar.* state/PKCE in Rack session	Verified	Current omniauth runtime config read at v2.3.1; allowed_hosts checked in strategy/hosts.rb

Compatibility analysis — 13 packages

• omniauth 2.1.4 → 2.3.1: strategy.rb split into six modules (-361/+149) is internal: fail! env keys, on_failure dispatch, OmniAuth::Builder and custom-strategy include path all verified unchanged at v2.3.1. New allowed_hosts config defaults to nil (permissive); a new warn logs when callback URLs derive from the request host.
• pagy 43.7.1 → 43.8.1: lib/ diff is the version constant plus a Romanian locale; the keyset ActiveRecord fix does not touch this repo's Pagy::Offset/Pagy::Request usage. Runtime no-op here.
• commonmarker 2.10.0 → 2.10.1: Patch release driven by comrak 0.54→0.56 in the Rust core; to_html API unchanged, but rendered markdown HTML may shift subtly and is only thinly tested.
• faraday 2.14.4 → 2.15.0: Line-traced diff: parallel-manager nesting, Options#fetch, proxy URI escaping, adapter locking — none on this repo's Faraday.new + middleware + run_request path.
• view_component 4.15.0 → 4.19.0: Perf/ERB-newline fixes and cache-digest error raising; repo uses no digest caching. Only whitespace-level change to rendered components possible.
• rubocop 1.92.0 → 1.92.1: Patch, bug fixes; dev lint tooling only.
• rubocop-capybara 3.0.0 → 3.1.0: Fixes to existing capybara cops, no new cops; dev lint tooling only.
• hashie 5.1.0 → 5.2.0 (transitive): Transitive bump reserved not to affect AuthHash (plain Hashie::Hash): Trash/Mash fixes and exception-message changes do not touch omniauth's usage.
• rack 3.2.7 → 3.2.8 (transitive): Transitive; CVE-style patch, no API change relevant here.
• net-http 0.9.1 → 0.10.0 (transitive): Transitive; gains net-protocol dependency, only line-level change relevant to repo's Net::HTTP users is none.
• parser 3.3.12.0 → 3.3.13.0 (transitive): Transitive dev dependency of rubocop-ast; lint tooling only.
• faraday-net_http 3.4.4 → 3.5.0 (transitive): Transitive with faraday 2.15.0 (relaxed to < 3.6); net-http adapter API unchanged.
• icalendar (unchanged emitter): Emits the workshop calendar feeds; unchanged in this diff, so the iCal output contract is untouched by the upgrade.

Usage of 6 dependencies

• omniauth: config/initializers/omniauth.rb (OmniAuth::Builder middleware, allowed_request_methods, silence_get_warning; omniauth-github + omniauth-rails_csrf_protection); lib/omniauth/strategies/codebar.rb (custom strategy: include OmniAuth::Strategy, option, request_phase/callback_phase, fail!, AuthHash); app/controllers/auth_services_controller.rb (env['omniauth.auth'], OmniAuth::Strategies.local_constants); config/environments/test.rb (test_mode, failure_raise_out_environments = [])
• pagy: app/queries/events_feed_query.rb (require 'pagy/classes/request', Pagy::Request.new, Pagy::Offset.new); app/views/shared/_pagination.html.haml + many partials (info_tag, series_nav)
• commonmarker: app/helpers/application_helper.rb dot_markdown → Commonmarker.to_html(text).html_safe; config/initializers/commonmarker.rb
• faraday: lib/flodesk.rb (Faraday.new(url), request :json / response :raise_error :logger :json / Basic authorization, run_request, rescue Faraday::Error); spec/lib/services/flodesk_spec.rb (Adapter::Test::Stubs, TimeoutError)
• view_component: ~dozens of app/components/* classes subclassing ViewComponent, rendered from HAML views
• rubocop / rubocop-capybara: .rubocop.yml lint config and feature-spec matcher style; lint only, not under CI test suites

Test coverage

• Strong: omniauth round trip — dedicated spec/lib/omniauth/strategies/codebar_spec.rb, auth_services request specs, omniauth_error_callback_spec (real middleware, test_mode off/on), plus auth-suite and the round-trip probe both pass.
• Strong: pagy — admin/events request and feature specs exercise Offset pagination and series_nav in planner-suite (pass).
• Thin: commonmarker output — only two include assertions on dot_markdown in application_helper_spec; underlying comrak 0.54→0.56 rendering changes are not covered line by line.
• Thin: view_component rendering — covered by planner-suite feature/request specs, but the ERB-newline compensation change is whitespace-level.
• Gap: rubocop and rubocop-capybara are lint-only and were not run in verification; a cop fix could flip existing offenses.
• Gap: no test asserts the outbound Flodesk request against the live net-http adapter (specs stub with the Faraday test adapter).

Calibration and confidence

Confidence: Medium — All used omniauth, pagy, and faraday surfaces were verified directly against the new versions, and all three verification suites plus the probe pass; Medium because the commonmarker rendering contract and the outbound Flodesk call are only partially verified, as the emitted markdown HTML and the live-adapter request were not traced end to end, leaving some residual uncertainty.

1. Weakest claim: Assumption that commonmarker's comrak 0.54→0.56 bump leaves rendered signature markdown identical; shoring it up means rendering fixture docs under both versions and diffing the HTML.
2. Relied on but unverified: That comrak 0.55/0.56 did not change dot_markdown's sanitised HTML for real comment content, that omniauth's new built-once middleware cache does not interact badly with Rails code reloading in development, and that view_component's whitespace compensation does not shift server-rendered pages.
3. Falsifier: A full CI auth feature spec or the probe failing after merge, or a dot_markdown snapshot diff between commonmarker 2.10.0 and 2.10.1 on real comment content, would overturn this verdict.

[mroderick]

@dependabot rebase