Bump the dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the dependencies group with 6 updates in the / directory:

Package	From	To
bootsnap	1.25.0	1.26.0
simplecov	1.1.1	1.3.0
tzinfo-data	1.2026.3	1.2026.4
whenever	1.1.2	1.1.3
honeybadger	6.9.1	6.9.2
faraday	2.14.3	2.14.4

Updates bootsnap from 1.25.0 to 1.26.0

Release notes

Sourced from bootsnap's releases.

v1.26.0

What's Changed

• Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
• Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
• Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

Changelog

Sourced from bootsnap's changelog.

1.26.0

• Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
• Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified without changing its size.
• Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

Commits

• 67a7290 Release 1.26.0
• 1881b9a Merge pull request #573 from byroot/same-size-miscompilation
• 605bbeb Fix precompilation when regenerating an existing cache entry of the same size
• 5fd59da Merge pull request #569 from OskarEichler/codex/accept-tempfile-fd-zero
• 70550c7 Merge pull request #568 from OskarEichler/codex/remove-umask-debug-output
• 8aed2ed Accept tempfile descriptor zero
• f7457ea Remove umask debug output
• 9ee62a2 Merge pull request #567 from byroot/rename-mod
• 7c8178e Handle write(2) being interrupted.
• 3e755ca atomic_write_cache_file: stop leaking FD on error
• Additional commits viewable in compare view

Updates simplecov from 1.1.1 to 1.3.0

Release notes

Sourced from simplecov's releases.

v1.3.0

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Highlights

• Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles Prism, so the static coverage extractor stops probing for it and the emulation of 3.2's constant folding is gone.
• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax or as Ruby comments on a code line.
• --annotate KIND turns simplecov patch and simplecov uncovered into inline CI annotations for GitHub, GitLab, reviewdog, Azure, TeamCity, and Buildkite, so one CI step can both annotate and gate.
• Groups that match no files are omitted from the report instead of padding it at 100%, and the rails profile declares its groups alphabetically.
• cover_views is the only way to measure a template now: a cover glob that matches one warns and leaves it out, and ignore: :eval_generated no longer drops a template's real branches and methods.
• A file with nothing to cover reports the same percentage in the file list as it does in the source view.

Upgrade notes

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Breaking Changes

• Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Enhancements

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See simplecov-ruby/simplecov#1295.
• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See simplecov-ruby/simplecov#1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Bugfixes

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (simplecov-ruby/simplecov#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See simplecov-ruby/simplecov#1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

v1.2.0

SimpleCov 1.2 adds change-focused coverage, per-test attribution, production coverage, and a substantially expanded CLI while keeping the existing configuration API working through deprecation aliases.

Highlights

• track_tests, simplecov tests, and simplecov affected connect covered lines to the tests that exercised them; the HTML report displays the same attribution and simplecov watch uses it for focused reruns.
• simplecov patch, per-file baselines, missed-count caps, and coverage history make coverage gates useful for both new changes and legacy codebases.
• SimpleCov::Production records low-overhead production line coverage, while simplecov dead-code and the bundled reports cross it with test coverage.
• ActionView templates can be measured with cover_views, including ERB, Haml, and Slim source highlighting.
• The CLI gains annotated source, report freshness, history, badges, shell completions, a man page, and richer machine-readable output.

Upgrade notes

• The minimum supported Ruby remains 3.2; JRuby 10 remains supported for line coverage.

... (truncated)

Changelog

Sourced from simplecov's changelog.

1.3.0 (2026-09-12)

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Highlights

• Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles Prism, so the static coverage extractor stops probing for it and the emulation of 3.2's constant folding is gone.
• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax or as Ruby comments on a code line.
• --annotate KIND turns simplecov patch and simplecov uncovered into inline CI annotations for GitHub, GitLab, reviewdog, Azure, TeamCity, and Buildkite, so one CI step can both annotate and gate.
• Groups that match no files are omitted from the report instead of padding it at 100%, and the rails profile declares its groups alphabetically.
• cover_views is the only way to measure a template now: a cover glob that matches one warns and leaves it out, and ignore: :eval_generated no longer drops a template's real branches and methods.
• A file with nothing to cover reports the same percentage in the file list as it does in the source view.

Upgrade notes

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Breaking Changes

• Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Enhancements

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See simplecov-ruby/simplecov#1295.
• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See simplecov-ruby/simplecov#1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Bugfixes

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (simplecov-ruby/simplecov#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See simplecov-ruby/simplecov#1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

1.2.0 (2026-09-04)

SimpleCov 1.2 adds change-focused coverage, per-test attribution, production coverage, and a substantially expanded CLI while keeping the existing configuration API working through deprecation aliases.

Highlights

• track_tests, simplecov tests, and simplecov affected connect covered lines to the tests that exercised them; the HTML report displays the same attribution and simplecov watch uses it for focused reruns.
• simplecov patch, per-file baselines, missed-count caps, and coverage history make coverage gates useful for both new changes and legacy codebases.
• SimpleCov::Production records low-overhead production line coverage, while simplecov dead-code and the bundled reports cross it with test coverage.
• ActionView templates can be measured with cover_views, including ERB, Haml, and Slim source highlighting.

... (truncated)

Commits

• 9c9ecd1 Bump version to 1.3.0
• 71bb5ac Name the simulation context by its subject, not by Prism
• b2aec76 Drop support for Ruby 3.2
• 5e869ef Report a file with no branches as fully covered everywhere
• e425d8b Warn and leave out templates a cover glob matches
• 12d7914 Honor the deprecated nocov toggle in template comments
• 7d278ea Exempt templates from the eval_generated filter
• b39506d Honor simplecov directives inside Haml and Slim templates
• c5233a4 Honor simplecov directives inside ERB templates
• 5a8f224 Alphabetize the rails profile's groups by name
• Additional commits viewable in compare view

Updates tzinfo-data from 1.2026.3 to 1.2026.4

Release notes

Sourced from tzinfo-data's releases.

v1.2026.4

Based on version 2026d of the IANA Time Zone Database (https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/message/L4IGHJRBUQR53F7RTEHM5IS7ZMBR3YXP/).

Commits

• a0803f7 Update to tzdata version 2026d.
• See full diff in compare view

Updates whenever from 1.1.2 to 1.1.3

Release notes

Sourced from whenever's releases.

v1.1.3

What's Changed

Enhancements

• Add support for sequential job definitions by @​njakobsen in javan/whenever#854

Maintenance

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in javan/whenever#876
• CI: Restrict GitHub Actions workflow permissions to contents: read by @​taketo1113 in javan/whenever#875

Full Changelog: javan/whenever@v1.1.2...v1.1.3

Changelog

Sourced from whenever's changelog.

1.1.3 / September 15, 2026

• Add support for sequential job definitions javan/whenever#854

• CI: Bump actions/checkout from 6 to 7 javan/whenever#876

• CI: Restrict GitHub Actions workflow permissions to contents: read javan/whenever#875

Commits

• c9fd8c3 Bump to v1.1.3
• 64bf9fd Merge pull request #854 from combinaut/add-support-for-sequential-job-definit...
• 6c11e2b Allow sequential jobs to continue by default
• 972deb2 Add support for sequential job definitions
• 756163e Merge pull request #876 from javan/dependabot/github_actions/actions/checkout-7
• b4975d3 Bump actions/checkout from 6 to 7
• 75f19b0 Merge pull request #875 from javan/github-actions-permissions
• ab28e88 Restrict GitHub Actions workflow permissions to contents: read
• 9876f97 Fix CHANGELOG date
• See full diff in compare view

Updates honeybadger from 6.9.1 to 6.9.2

Release notes

Sourced from honeybadger's releases.

v6.9.2

6.9.2 (2026-09-15)

Bug Fixes

• truncate very large SQL queries instead of obfuscating them (#841) (c80e046)

Changelog

Sourced from honeybadger's changelog.

6.9.2 (2026-09-15)

Bug Fixes

• truncate very large SQL queries instead of obfuscating them (#841) (c80e046)

Commits

• ed1c8d1 chore(master): release 6.9.2 (#845)
• c730c93 ci: drop Rails main from the JRuby matrix (#844)
• c80e046 fix: truncate very large SQL queries instead of obfuscating them (#841)
• 1d39b14 ci: add Ruby 4.0 to test matrix
• bdf22d3 chore: update Ruby 3.4.10 → 4.0.6
• See full diff in compare view

Updates faraday from 2.14.3 to 2.14.4

Release notes

Sourced from faraday's releases.

v2.14.4

What's Changed

• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in lostisland/faraday#1678
• Update copyright year to 2026 by @​iMacTia with @​Copilot in lostisland/faraday#1683
• Support JSON 3 by @​byroot in lostisland/faraday#1687
• Preserve caller-owned JSON parser options by @​OskarEichler in lostisland/faraday#1689
• Define HTTP verb methods on Faraday so tools can see them by @​mokevnin in lostisland/faraday#1708
• Document Options struct attributes for YARD (Fixes #1490) by @​tachyurgy in lostisland/faraday#1709
• chore: Configure SimpleCov for 1.0, too by @​olleolleolle in lostisland/faraday#1715

New Contributors

• @​byroot made their first contribution in lostisland/faraday#1687
• @​OskarEichler made their first contribution in lostisland/faraday#1689
• @​mokevnin made their first contribution in lostisland/faraday#1708
• @​tachyurgy made their first contribution in lostisland/faraday#1709

Full Changelog: lostisland/faraday@v2.14.3...v2.14.4

Commits

• 3ece9bd v2.14.4
• 6aa82a5 Configure SimpleCov for 1.0, too
• 20d93f8 Document Options struct attributes for YARD
• e7e23ae Define HTTP verb methods on Faraday so tools can see them
• 9458f04 Preserve caller-owned JSON parser options
• b25b1b2 Support JSON 3 (#1687)
• 3725183 Update copyright year to 2026 (#1683)
• 06bc5ad Bump actions/checkout from 6 to 7 (#1678)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions