Skip to content

Bump the development-dependencies group with 8 updates - #119

Closed
dependabot[bot] wants to merge 1 commit into
layerrail-rebrand-startfrom
dependabot/bundler/development-dependencies-1084e3e623
Closed

Bump the development-dependencies group with 8 updates#119
dependabot[bot] wants to merge 1 commit into
layerrail-rebrand-startfrom
dependabot/bundler/development-dependencies-1084e3e623

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-dependencies group with 8 updates:

Package From To
rubocop-capybara 2.23.0 3.0.0
rubocop-rspec 3.9.0 3.10.2
standard 1.54.0 1.56.0
brakeman 8.0.4 8.0.6
pdf-reader 2.15.1 2.16.0
simplecov 0.22.0 1.1.1
ferrum 0.17.1 0.18.0
herb 0.9.4 0.10.3

Updates rubocop-capybara from 2.23.0 to 3.0.0

Release notes

Sourced from rubocop-capybara's releases.

RuboCop Capybara v3.0.0

  • Enable pending cops by default for the 3.0 release. (@​ydah)
  • Remove the deprecated Capybara/ClickLinkOrButtonStyle cop. (@​ydah)
  • Remove obsolete cop name migration config for the 2.x to 3.0 transition. (@​ydah)
Changelog

Sourced from rubocop-capybara's changelog.

3.0.0 (2026-06-22)

  • Enable pending cops by default for the 3.0 release. ([@​ydah])
  • Remove the deprecated Capybara/ClickLinkOrButtonStyle cop. ([@​ydah])
  • Remove obsolete cop name migration config for the 2.x to 3.0 transition. ([@​ydah])
Commits
  • a9b8f9a Merge pull request #177 from rubocop/v3.0.0
  • 6a4579d release v3.0.0
  • 75e7cda Merge pull request #176 from rubocop/docs/update-specific-matcher-readme
  • f02ff72 Update SpecificMatcher README example
  • ebe10e8 Merge pull request #174 from rubocop/enable-pending-capybara-cops
  • 20a5721 Enable pending Capybara cops
  • fee3774 Merge pull request #173 from rubocop/remove-obsolete-cop-name-migration
  • ea818bd Remove obsolete cop name migration config
  • 989fe3c Merge pull request #172 from rubocop/remove-click-link-or-button-style
  • 5d5a5b8 Merge pull request #175 from rubocop/dependabot/github_actions/actions/checko...
  • Additional commits viewable in compare view

Updates rubocop-rspec from 3.9.0 to 3.10.2

Release notes

Sourced from rubocop-rspec's releases.

RuboCop RSpec v3.10.2

  • Fix false positives for RSpec/SpecFilePathFormat when CustomTransform maps a namespace to an empty string. (@​sakuro)
  • Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with options. (@​bquorning)

RuboCop RSpec v3.10.1

  • Add Strict option to RSpec/SharedContext to flag shared_context whenever it contains examples, even alongside setup code. (@​Darhazer)
  • Add NegatedMatcher configuration option RSpec/ExpectChange. (@​Darhazer)
  • Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with interpolations. (@​bquorning)

RuboCop RSpec v3.10.0

  • Add new cop RSpec/MatchWithSimpleRegex to suggest include matcher when match is used with simple string literals without regex-specific features. (@​bquorning)
  • Add new cop RSpec/DiscardedMatcher to detect matchers in void context (e.g. missing .and between compound matchers). (@​ydakuka)
  • Add support for itblock nodes. (@​Darhazer)
  • RSpec/ScatteredLet now preserves the order of lets during auto-correction. (@​Darhazer)
  • Fix a false negative for RSpec/EmptyLineAfterFinalLet inside shared_examples / include_examples / it_behaves_like blocks. (@​Darhazer)
  • Fix a false positive for RSpec/ContainExactly when contain_exactly has multiple splat arguments. (@​ydah)
  • Add autocorrect support for RSpec/SubjectDeclaration. (@​eugeneius)
  • Fix false negatives for RSpec/SpecFilePathFormat when the expected class path only partially matches a path segment. (@​ydah)
  • Fix a false negative for RSpec/ExpectActual when the matcher takes no arguments (e.g. expect("foo").to be_present, expect(1).to be). (@​cvx)
Changelog

Sourced from rubocop-rspec's changelog.

3.10.2 (2026-06-06)

  • Fix false positives for RSpec/SpecFilePathFormat when CustomTransform maps a namespace to an empty string. ([@​sakuro])
  • Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with options. ([@​bquorning])

3.10.1 (2026-06-05)

  • Add Strict option to RSpec/SharedContext to flag shared_context whenever it contains examples, even alongside setup code. ([@​Darhazer])
  • Add NegatedMatcher configuration option RSpec/ExpectChange. ([@​Darhazer])
  • Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with interpolations. ([@​bquorning])

3.10.0 (2026-06-05)

  • Add new cop RSpec/MatchWithSimpleRegex to suggest include matcher when match is used with simple string literals without regex-specific features. ([@​bquorning])
  • Add new cop RSpec/DiscardedMatcher to detect matchers in void context (e.g. missing .and between compound matchers). ([@​ydakuka])
  • Add support for itblock nodes. ([@​Darhazer])
  • RSpec/ScatteredLet now preserves the order of lets during auto-correction. ([@​Darhazer])
  • Fix a false negative for RSpec/EmptyLineAfterFinalLet inside shared_examples / include_examples / it_behaves_like blocks. ([@​Darhazer])
  • Fix a false positive for RSpec/ContainExactly when contain_exactly has multiple splat arguments. ([@​ydah])
  • Add autocorrect support for RSpec/SubjectDeclaration. ([@​eugeneius])
  • Fix false negatives for RSpec/SpecFilePathFormat when the expected class path only partially matches a path segment. ([@​ydah])
  • Fix a false negative for RSpec/ExpectActual when the matcher takes no arguments (e.g. expect("foo").to be_present, expect(1).to be). ([@​cvx])
Commits
  • 2488441 Merge pull request #2189 from rubocop/release
  • c9e53cf Bump version to 3.10.2
  • 7ae0a42 Merge pull request #2186 from sakuro/fix/spec-file-path-format-empty-custom-t...
  • 8b0b5e9 Merge branch 'master' into fix/spec-file-path-format-empty-custom-transform
  • dc4465c Merge pull request #2188 from rubocop/fix-2185
  • d5de6b2 Consider regexp with options a non-simple regexp
  • bad0cb3 🐛 Fix RSpec/SpecFilePathFormat false positives when CustomTransform maps ...
  • ec3eeab Merge pull request #2183 from rubocop/fix-match-with-simple-regex-with-interp...
  • 16bbf49 Bump version to 3.10.1
  • 2a78abd Ignore interpolation in MatchWithSimpleRegex
  • Additional commits viewable in compare view

Updates standard from 1.54.0 to 1.56.0

Changelog

Sourced from standard's changelog.

1.56.0

1.55.0

Commits
  • d695ba0 🏆⚽️ v1.56.0
  • 86a92fa Merge pull request #823 from standardrb/upgrade-2026-07-15
  • dfcaef8 Fixes Parallel's overzealous update
  • 5e68710 Updates rubocop to 1.88
  • 95f959b Merge pull request #822 from standardrb/dependabot/bundler/ruby-lsp-0.26.10
  • 42c9d35 Bump ruby-lsp from 0.26.9 to 0.26.10
  • 79cd977 Merge pull request #818 from standardrb/dependabot/bundler/language_server-pr...
  • 3011204 Bump language_server-protocol from 3.17.0.5 to 3.17.0.6
  • 505e8e6 Merge pull request #797 from standardrb/dependabot/bundler/ruby-lsp-0.26.9
  • af5498a Merge pull request #816 from standardrb/dependabot/github_actions/step-securi...
  • Additional commits viewable in compare view

Updates brakeman from 8.0.4 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

8.0.5

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

  • Fix EOL date for Rails 8.0 (yeaseul-kim)
  • Add EOL dates for Rails 8.1 and Ruby 4.0
  • Fix command injection false positives (Jacob Evelyn)
  • Fix unused variable warning (viralpraxis)

8.0.5 - 2026-06-12

  • Add quote_schema_name to safe quote method list (Zsolt Kozaroczy)
  • Fix SQL injection false positive for compact_blank/compact on permitted params (Arpit Jain)
  • Fix inline render false positive for local named text (Arpit Jain)
  • Fix HAML crash on .raw calls (Federico Franco)
  • Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr)
  • Fix TemplateAliasProcessor#template_name arity (viralpraxis)
  • Reduce false positives when using shell escaping
Commits
  • fffc483 Bump to 8.0.6
  • b7218fe Update CHANGES
  • c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
  • 4c191dd Fix EOL date for Rails 8.0
  • e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
  • dd4f0b9 Add EOL date for Ruby 4.0
  • 7ca100a Add EOL date for Rails 8.1
  • a53a456 Merge pull request #2022 from JacobEvelyn/main
  • bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
  • 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
  • Additional commits viewable in compare view

Updates pdf-reader from 2.15.1 to 2.16.0

Changelog

Sourced from pdf-reader's changelog.

v2.16.0 (9th August 2026)

Commits
  • fa5147a prepare to release v2.16.0 (#608)
  • 7b32900 prepare to release v2.16.0
  • 35c0951 Vendor RC4 implementation, drop ruby-rc4 dependency (#606)
  • 5e9139e Fix RC4 for Ruby 2.1-2.3 compatibility
  • 0194c7b Fix sorbet strict typing and split rc4 specs per review
  • 87d6f2e Accept any IO-like object that responds to read and seek (#607)
  • 544afd9 Accept any IO-like object that responds to read and seek
  • 9624e37 Guard against an empty RC4 key raising ZeroDivisionError
  • af1d1ce Vendor RC4 implementation, drop ruby-rc4 dependency
  • 578db3d Avoid returning invalid utf8 from Encoding#to_utf8 (#605)
  • Additional commits viewable in compare view

Updates simplecov from 0.22.0 to 1.1.1

Release notes

Sourced from simplecov's releases.

v1.1.1

What's Changed

Full Changelog: simplecov-ruby/simplecov@v1.1.0...v1.1.1

v1.1.0

What's Changed

New Contributors

Full Changelog: simplecov-ruby/simplecov@v1.0.3...v1.1.0

v1.0.3

What's Changed

New Contributors

Full Changelog: simplecov-ruby/simplecov@v1.0.2...v1.0.3

v1.0.2

What's Changed

Full Changelog: simplecov-ruby/simplecov@v1.0.1...v1.0.2

v1.0.1

What's Changed

... (truncated)

Changelog

Sourced from simplecov's changelog.

1.1.1 (2026-08-12)

Enhancements

  • The HTML report remembers how a file list was sorted. The selected column and direction persist in localStorage across the All Files and group tables, so reloading a report restores the order it was left in. The preference stores semantic column keys rather than numeric positions, so a report whose enabled criteria differ from the report that stored it falls back to the primary coverage sort instead of sorting by whatever column now happens to sit in that position. Equal values break by filename so the restored order matches the clicked order exactly, and the covered and total columns now sort by their numeric value rather than their comma-grouped digits, which used to rank 1,250 below 999.
  • The report's top bar is now a proper tab strip. Every group tab is outlined, so an unselected group reads as a tab rather than as loose text floating above the panel, while the selected one fills with the panel's own colour and drops its bottom border to merge into it. The colorblind and theme toggles stay unfilled, which keeps the filled shapes in the bar meaningful: the selected tab, and a toggle that is switched on. With more groups than fit, the strip scrolls and both ends fade instead of guillotining whichever tab straddles an edge.
  • The source file view was polished to match. The colorblind and theme controls sit at the same viewport coordinates as the index toolbar, with the scrollbar gutter reserved so opening the dialog cannot slide them sideways. Each legend key shares a row with its line, branch, or method summary, and the generated-at footer is repeated at the bottom of the source dialog. On paper the header returns to document flow, where the toggles and close button are hidden and the legend reads better at full width.
  • The source view no longer prints a coverage glyph in a left gutter on every line, and the legend swatches are plain chips of the colours the source view paints rather than a key to a symbol set. The glyphs stated each line's status without relying on colour, but they read as noise down the left edge of every file. Line numbers keep their per-status background, and the Colorblind toggle does the accessibility work on its own by swapping covered and missed for blue versus orange, the pairing red/green vision cannot separate.
  • The packaged gem no longer ships the schemas/ directory, dropping 32 KB unpacked from every install. Nothing read it at runtime: the JSON formatter points consumers at the canonical schema URL on GitHub, and the schema specs read from the repository.

Bugfixes

  • Coverage checks no longer get skipped under runners that close a worker's output streams before its at_exit hooks run. rspec-conductor closes each worker's pipes as soon as the worker has sent its run summary, and emitting SimpleCov's status line probes Color.enabled?, whose IO#tty? call raised IOError on the closed stream. That exception aborted the remaining exit tasks, so the HTML and JSON reports were written but the minimum and maximum coverage checks silently never ran, and neither .last_run.json nor the .report_stamp deferral marker was written. A closed stream now counts as not a tty, and the status line and the violation report are dropped rather than cancelling the checks that follow. rspec-conductor is also named in the parallel adapter documentation and covered end to end now, since it follows the TEST_ENV_NUMBER and PARALLEL_TEST_GROUPS convention the generic adapter already recognizes. See #1156.
  • SimpleCov.collate no longer depends on load order for Coverage.line_stub. SimulateCoverage and ResultAdapter both call it without requiring the coverage library. A normal run loads that library while starting tracking, but a collate-only process never starts tracking, so the constant resolved only by luck through a criterion-support check that happened to run first. Any reordering of that path would have turned into a NameError out of SimpleCov.collate, so each file now requires what it uses.

1.1.0 (2026-08-10)

Breaking Changes

  • simplecov report --json now emits {"total": {...}, "groups": {...}} instead of flattening the overall "All Files" entry and configured groups into one object. The old shape silently overwrote the overall totals when a user group was also named All Files; the text report now labels that user section All Files (group) as well.
  • Ungrouped is now reserved for the implicit group of files that match no configured group. Defining an explicit group with that name previously caused SimpleCov to overwrite it during result processing and silently discard its matched files; rename such a group to Other or another distinct label. Group names are also normalized when configured: a Symbol name (group :Models) now means the same group as its String spelling (so group :Ungrouped is rejected like the string form, and a symbol-named group can no longer produce a duplicate JSON key next to a string-named one), and a name that is neither a String nor a Symbol raises SimpleCov::ConfigurationError.
  • The HTML report is now a single self-contained index.html. The viewer's JavaScript and CSS are inlined into the compiled template at build time, and the coverage data is embedded at report time (with < escaped in the payload so embedded source text cannot terminate the surrounding <script> element), so coverage/ contains just index.html and coverage.json. A single file can be mailed, uploaded as a non-zipped GitHub Actions run artifact (actions/upload-artifact with archive: false, viewable directly from the run page), or copied anywhere without sibling files, and the report can no longer be read mid-write in a torn state where index.html, coverage_data.js, and application.js come from different runs — the whole report updates in one atomic rename. The sibling files the formatter previously wrote (coverage_data.js, application.js, application.css, and the three favicon PNGs) are gone; anything scripted against that layout should read coverage.json (the sanctioned data artifact, unchanged) instead of coverage_data.js. Formatting also deletes those six names from the output directory when an earlier version left them there, so an upgraded project's coverage/ doesn't keep a stale coverage_data.js around for simplecov serve to serve. This restores single-file reports to the 1.0 line — the pre-1.0 simplecov-html formatter offered them via the SIMPLECOV_INLINE_ASSETS environment variable, which the 1.0 client-side rendering rewrite dropped — and makes them the default and only mode, with no environment variable or configuration flag. See #1241.

Enhancements

  • The HTML report gains a colorblind-friendly mode. A Colorblind toggle next to the Dark toggle swaps the covered/missed pairing (and the coverage bands) for blue versus orange, the standard colorblind-safe pairing, in both themes; the choice persists in localStorage and is applied before first paint. Both toggles report state via aria-pressed.
  • simplecov serve now handles each connection on its own thread with a read timeout, so a stalled connection (browsers routinely open speculative sockets that send no bytes) no longer blocks every other request. It also works on JRuby and TruffleRuby, answers malformed request lines with a 400 instead of an empty response, and prints a bracketed URL for IPv6 hosts.
  • The README was trimmed from 1,617 lines to under 180, with the full documentation moved into topic guides under a new docs/ directory (Configuration, Parallelism, Formatters, CLI, Troubleshooting) alongside the changelogs, contributing guide, and code of conduct, with the issue template tucked into .github/. This changelog now lives at docs/Changelog.md and the gem's changelog_uri metadata follows it. Nothing under docs/ ships in the gem, which also stops packaging the old doc/* link lists. The alternate formatters catalog was rebuilt against RubyGems: twenty formatters join the twelve that were listed, organized by output type.
  • .resultset.json is now written as compact JSON instead of pretty-printed. It is a machine-read cache that every parallel worker rewrites wholesale, and pretty printing nearly doubled the bytes written, read back, and parsed on each store-merge round trip — on a 100,000-file project the file shrinks from 89MB to 51MB and serialization halves. Any JSON parser reads the compact form; pipe it through jq if you need to inspect it by eye.
  • The favicon (a solid square in the overall coverage band's colour) is now drawn by the viewer from the report's own palette instead of shipping as fixed PNGs, so it matches the report's green/yellow/red exactly and follows the light/dark theme, including the in-page toggle.
  • SimpleCov.collate takes a new processes: argument that fans the resultset merge out across that many forked worker processes. This addresses the wall clock of a large CI matrix's collate step, where the collating process reads, parses and folds hundreds of resultsets in sequence and nearly all the time goes into that fold: merging 160 resultsets covering 1,836 files on a 14-core machine took 4.53s at the default processes: 1 and 1.35s across 8 workers. The report is identical either way, not merely equivalent — each worker folds a contiguous slice of the file list and the collating process folds the slices back in order, so the resultsets are visited in the same order a single-process merge visits them. The fan-out lives in a new SimpleCov::ParallelResultMerger, whose absorb_results mirrors ResultMerger.absorb_results, splitting that fold across workers and unioning the tracked paths each one saw. processes defaults to the SIMPLECOV_CONCURRENCY environment variable (1 when unset), so one rake task can serve CI runners of different sizes without being edited, and an explicit argument wins over the variable. It never forks at 1, so existing collate calls are unaffected; it is deliberately not clamped to the core count nor gated on a minimum number of resultsets — only the caller knows what a collate job is allowed to use — asking for more processes than there are result files just gives one file per process, and anything below 1 is taken as 1. Merging falls back to the collating process, with the same report and no error, when the runtime cannot fork (JRuby, TruffleRuby, Windows), when there is only one resultset, or when a worker dies. A benchmarks/collate.rb harness (PROCESSES=N) measures the phases against a saved baseline.

Bugfixes

  • Two concurrent runners sharing a command name no longer lose the later writer's coverage for files both carried. A live result serializes its criterion tables under Ruby's Symbol keys while entries parsed back from .resultset.json carry Strings, and the combiners read only Strings, so the merge that exists to prevent an empty parent process from clobbering a subprocess's data (#581) silently contributed nothing from the incoming side. Criterion keys are now stringified at serialization time so the stored and live shapes always match.
  • Merging or collating stored resultsets with method coverage enabled no longer crashes on singleton methods defined on instances. def obj.greet records its receiver as the nested inspect form #<Class:#<Object:0x...>>, and the parser that turns JSON-stringified method keys back into tuples stopped at the first closing angle bracket, raising ArgumentError out of the merge. The quoting now handles nested segments.
  • That same clobber-prevention backstop now stands down for failed child runs too. It keyed its freshness check on .last_run.json, which only fully successful runs write, so a Rakefile parent overwrote the child's report exactly when the child's tests or coverage checks had failed and the report mattered most. Formatting now touches a coverage/.report_stamp marker no matter how the run ends, and the backstop accepts either file as evidence of a fresher report.
  • A # simplecov:disable line block around a method no longer silently removes that method from method-coverage totals. The method skip fell back to asking whether all of the method's lines were skipped, so the line-only directive (the README's own example) leaked into the method criterion. Deprecated # :nocov: chunks still exclude methods, now routed explicitly like every other criterion.
  • A directive reason that merely starts with a category name no longer narrows the directive. # simplecov:disable linear algebra reasons parsed as category line with the rest as reason, disabling only line coverage where the documented behavior for unrecognised text is to over-disable everything. The category list now requires a word boundary.
  • Per-group minimums configured with a Symbol group name are enforced again. group :Models normalizes the name to a String but minimum_per_group 95, only: :Models (and the deprecated minimum_coverage_by_group) stored the Symbol untouched, so the check-time lookup missed and warned that group "Models" doesn't exist while listing that very name as available.
  • simplecov diff matches its documentation: --threshold N is inclusive (a file that moved exactly N% is listed), removed files no longer trip --fail-on-drop (deleting a covered file is not a regression), and sub-epsilon float noise no longer fails the gate on a row shown only for its gains.
  • Tracked-but-unloaded files with multi-statement parenthesized conditions no longer synthesize phantom branches. CRuby folds if (1; 2) by its last expression when the compiler can eliminate every leading statement, and the rules differ per version (parse.y eliminates only pure literals, 3.3 also eliminates side-effect-free reads and containers of them, 3.4+ narrows containers to fully static literals). The static extractor now mirrors each compiler exactly, verified against real Coverage output on every supported Ruby.
  • require "simplecov" no longer raises when HOME is set but empty, as some container and CI images do. The global-config loader treats an empty HOME like an unset one.
  • simplecov merge, report, and coverage print one-line errors instead of backtraces on more bad inputs: a directory or unreadable file passed to merge, valid JSON whose total or groups has the wrong type, and a per-file entry that is not an object.
  • An empty or non-numeric PARALLEL_TEST_GROUPS no longer makes the reporting worker expect zero siblings and skip the wait for their results; unusable values now mean one worker, and non-positive values are rejected too.
  • Simulating tracked files became tolerant of unreadable paths: a track_files glob that sweeps up a directory named like a Ruby file or a permission-denied entry now treats it as empty instead of crashing the merge or report step. Resultset files truncated to a single byte now warn like other corruption instead of reading as quietly empty, a hand-edited .last_run.json with a non-numeric percentage no longer raises out of the at_exit hook, and the missing-group notice respects print_errors and survives -W0 like every other enforcement message.
  • coverage :eval, minimum: 100 now explains that thresholds are unsupported for :eval instead of claiming the criterion itself is invalid, and simplecov clean --dry-run counts dotfiles such as .resultset.json in its entry count.
  • Source files containing invalid UTF-8 bytes no longer crash report generation. A file with no encoding magic comment is read as UTF-8, and a stray high-bit byte (a Latin-1 comment, say) previously raised ArgumentError: invalid byte sequence in UTF-8 from the first regex that touched the line — the shebang check or the lines classifier — taking the whole report down. Invalid bytes are now replaced with the Unicode replacement character at load time, so every line leaves the source loader as valid UTF-8 and the rest of the pipeline (classification, JSON embedding, the HTML viewer payload) works from sanitized text.
  • Generated coverage artifacts now share one collision-safe atomic writer. Concurrent threads no longer reuse the same process-ID temporary name, and the JSON formatter and simplecov merge no longer expose partially written documents to readers; existing Unix permission bits and each artifact's historical byte format are preserved.
  • Configuration blocks no longer install temporary method_missing hooks on their caller or copy caller instance variables into SimpleCov. Those hooks leaked DSL commands across threads, broke overlapping and nested evaluations, rejected frozen or immediate-value owners, changed require_relative and binding behavior, and could mask an original exception during cleanup. See the parameterized-block migration under Breaking Changes.
  • Non-final parallel workers now stop after storing their own result instead of reading and caching a partial merge. A single ownership predicate selects the adapter's final process for merging, formatting, threshold checks, and .last_run.json; explicit SimpleCov.collate remains authoritative regardless of worker identity.
  • simplecov serve now builds a missing index.html from coverage.json and fails before binding when neither artifact exists or the JSON is invalid. An existing self-contained report remains usable even if its optional sidecar JSON was later removed or damaged.
  • Coverage JSON consumers now reject malformed syntax, invalid UTF-8, and non-object roots through one shared parser. HTMLFormatter#format_from_json also validates the viewer's required metadata, coverage flags, enabled totals, groups, and source arrays before creating or replacing its output.

... (truncated)

Commits
  • 76a8e4e Bump version to 1.1.1
  • e1bf502 Refresh the report screenshots
  • f33e0bf Drop the coverage glyphs from the source view and its legend
  • 2673f9a Let the tab strip own the report's top bar
  • c6ef10b Report a sandbox command timeout instead of its teardown
  • 0675978 Keep the conductor's merged report from hinging on runner luck
  • 560fae5 Exercise Rails' built-in Minitest integration
  • ab66677 Remember the file-list sort order
  • 6640c1e Polish the source file view
  • e9ba8c3 Build a Rails-style screenshot coverage fixture
  • Additional commits viewable in compare view

Updates ferrum from 0.17.1 to 0.18.0

Release notes

Sourced from ferrum's releases.

0.18.0

Added

  • Ferrum::Browser option :protocol_timeout bounds individual internal CDP bookkeeping calls, e.g. Target.createTarget, Target.attachToTarget. It's a separate setting from :timeout: its default (5s) happens to match :timeout's own default, but passing timeout: to Browser.new does not change it -- set :protocol_timeout (or the FERRUM_PROTOCOL_TIMEOUT env var) explicitly for a different value.
  • Ferrum::Page#pdf/#screenshot accept a timeout: argument (default 60s) for the CDP call itself. Generating a full-page screenshot or a large PDF is a known slow outlier among CDP commands.
  • Ferrum::Frame#loader_id provides a loader id when the frame navigates #583
  • Ferrum::Frame#lifecycle_events provides a list of frame's events like init, networkIdle, firstPaint, etc. #583
  • Ferrum::Frame#idle? whether frame was loaded #583
  • page.accessibility API and Node#axnode for reading the CDP accessibility tree
  • --no-crashpad is now included in the default Chrome flags, fully disabling the crashpad handler process #610
  • Support for dedicated/shared Workers and Service Workers #391, #388:
    • Ferrum::Worker -- a lightweight connection to a Worker's single execution context, with its own #network, #evaluate/#evaluate_async/#execute, and #on(:request)/#on(:auth) for interception.
    • Dedicated and shared workers spawned by a page are discovered and connected to automatically and are reachable through Browser#workers/ Context#workers.
    • Service workers are discovered too, through Browser#service_workers/Context#service_workers, but aren't connected to by default. Attaching to one keeps it alive forever, so that's opt-in via Context#attach_target, then target.worker.
    • Ferrum::Target#worker?, #shared_worker?, #service_worker?, and #parent_id for telling targets apart.

Fixed

  • Ferrum::Client command id generation and Ferrum::Client::WebSocket's driver interactions were not thread-safe, allowing concurrent commands to collide on the same id or corrupt the frame stream; both are now serialized under a mutex #602
  • Ferrum::Network built duplicate Exchange objects for the same request when Network.requestWillBeSent (regular event thread) and Fetch.requestPaused (priority interruption thread) raced to look up/create the exchange for a request id; the find-or-build is now atomic, fixing intermittently nil Exchange#request on blocked/intercepted requests
  • Ferrum::Node#type / Ferrum::Keyboard now trigger the select-all editing shortcut (Ctrl/Cmd+A) by naming the CDP commands field, so selecting and replacing text in inputs and contenteditables works.
  • Ferrum::Network::InterceptedRequest#match? no longer coerces string blacklist/whitelist patterns containing regexp metacharacters (e.g. ?, .) into regexps; string patterns are now compared literally instead. #405, #604
  • Ferrum::Network::AuthRequest#match? and Ferrum::Dialog#match? received the same fix as #604 above for consistency. String patterns now compare literally: exact-match for requests/auth requests, substring-match for dialog messages. #405
  • Target.targetCreated handler for an iframe target reusing an already-connected target raised NoMethodError on Ferrum::Browser#new(flatten: false), since it read session_id off the target's underlying Ferrum::Client, which doesn't expose it in that mode; it now reads Target#session_id directly. #539
  • Ferrum::Node#select_file now uses the stable backendNodeId instead. #568, #611
  • Full-page screenshots no longer resize the window, preventing focus steal on macOS #580
  • DOM.enable is now has includeWhitespace: "all" to keep track of new line nodes, which previously were resolved to 0, and errored with NodeNotFoundError #596
  • DOM.requestNode call is moved to the node class and being done lazily, this reduces the number of intermediate node ids sent by backend to frontend #596
  • Fix context can be nilable in ensure Browser#create_page #582
  • Ferrum::Page#idling? no longer blocks on loading="lazy" iframes that Chrome never starts loading #583

Changed

  • Ferrum::PendingConnectionsError and Ferrum::TimeoutError were swallowed even though it happens when a traffic iterator results in an empty array. #583
  • webrick is no longer a runtime dependency. It is only required by Ferrum::Proxy, so add gem "webrick" to your Gemfile if you use it.
  • Logger output for Runtime.consoleAPICalled now includes the console API type and stack trace call frames, not just the argument values #605
  • Ferrum::Browser option :pending_connection_errors is set to false by default

Removed

  • webrick runtime dependency dropped from the gemspec. Ferrum::Proxy still needs it, so add gem "webrick" to your Gemfile if you use the proxy server.

0.17.2

Added

... (truncated)

Changelog

Sourced from ferrum's changelog.

0.18.0 (August 20, 2026)

Added

  • Ferrum::Browser option :protocol_timeout bounds individual internal CDP bookkeeping calls, e.g. Target.createTarget, Target.attachToTarget. It's a separate setting from :timeout: its default (5s) happens to match :timeout's own default, but passing timeout: to Browser.new does not change it -- set :protocol_timeout (or the FERRUM_PROTOCOL_TIMEOUT env var) explicitly for a different value.
  • Ferrum::Page#pdf/#screenshot accept a timeout: argument (default 60s) for the CDP call itself. Generating a full-page screenshot or a large PDF is a known slow outlier among CDP commands.
  • Ferrum::Frame#loader_id provides a loader id when the frame navigates #583
  • Ferrum::Frame#lifecycle_events provides a list of frame's events like init, networkIdle, firstPaint, etc. #583
  • Ferrum::Frame#idle? whether frame was loaded #583
  • page.accessibility API and Node#axnode for reading the CDP accessibility tree
  • --no-crashpad is now included in the default Chrome flags, fully disabling the crashpad handler process #610
  • Support for dedicated/shared Workers and Service Workers #391, #388:
    • Ferrum::Worker -- a lightweight connection to a Worker's single execution context, with its own #network, #evaluate/#evaluate_async/#execute, and #on(:request)...

      Description has been truncated

@dependabot
Bump the development-dependencies group with 8 updates
f4f21bb 
Bumps the development-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [rubocop-capybara](https://github.com/rubocop/rubocop-capybara) | `2.23.0` | `3.0.0` |
| [rubocop-rspec](https://github.com/rubocop/rubocop-rspec) | `3.9.0` | `3.10.2` |
| [standard](https://github.com/standardrb/standard) | `1.54.0` | `1.56.0` |
| [brakeman](https://github.com/presidentbeef/brakeman) | `8.0.4` | `8.0.6` |
| [pdf-reader](https://github.com/yob/pdf-reader) | `2.15.1` | `2.16.0` |
| [simplecov](https://github.com/simplecov-ruby/simplecov) | `0.22.0` | `1.1.1` |
| [ferrum](https://github.com/rubycdp/ferrum) | `0.17.1` | `0.18.0` |
| [herb](https://github.com/marcoroth/herb) | `0.9.4` | `0.10.3` |


Updates `rubocop-capybara` from 2.23.0 to 3.0.0
- [Release notes](https://github.com/rubocop/rubocop-capybara/releases)
- [Changelog](https://github.com/rubocop/rubocop-capybara/blob/main/CHANGELOG.md)
- [Commits](rubocop/rubocop-capybara@v2.23.0...v3.0.0)

Updates `rubocop-rspec` from 3.9.0 to 3.10.2
- [Release notes](https://github.com/rubocop/rubocop-rspec/releases)
- [Changelog](https://github.com/rubocop/rubocop-rspec/blob/master/CHANGELOG.md)
- [Commits](rubocop/rubocop-rspec@v3.9.0...v3.10.2)

Updates `standard` from 1.54.0 to 1.56.0
- [Release notes](https://github.com/standardrb/standard/releases)
- [Changelog](https://github.com/standardrb/standard/blob/main/CHANGELOG.md)
- [Commits](standardrb/standard@v1.54.0...v1.56.0)

Updates `brakeman` from 8.0.4 to 8.0.6
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](presidentbeef/brakeman@v8.0.4...v8.0.6)

Updates `pdf-reader` from 2.15.1 to 2.16.0
- [Changelog](https://github.com/yob/pdf-reader/blob/main/CHANGELOG)
- [Commits](yob/pdf-reader@v2.15.1...v2.16.0)

Updates `simplecov` from 0.22.0 to 1.1.1
- [Release notes](https://github.com/simplecov-ruby/simplecov/releases)
- [Changelog](https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md)
- [Commits](simplecov-ruby/simplecov@v0.22.0...v1.1.1)

Updates `ferrum` from 0.17.1 to 0.18.0
- [Release notes](https://github.com/rubycdp/ferrum/releases)
- [Changelog](https://github.com/rubycdp/ferrum/blob/main/CHANGELOG.md)
- [Commits](rubycdp/ferrum@v0.17.1...v0.18.0)

Updates `herb` from 0.9.4 to 0.10.3
- [Release notes](https://github.com/marcoroth/herb/releases)
- [Commits](marcoroth/herb@v0.9.4...v0.10.3)

---
updated-dependencies:
- dependency-name: rubocop-capybara
  dependency-version: 3.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: rubocop-rspec
  dependency-version: 3.10.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: standard
  dependency-version: 1.56.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: brakeman
  dependency-version: 8.0.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: pdf-reader
  dependency-version: 2.16.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: simplecov
  dependency-version: 1.1.1
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: development-dependencies
- dependency-name: ferrum
  dependency-version: 0.18.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: herb
  dependency-version: 0.10.3
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Sep 3, 2026
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

Thanks for taking the time to contribute to LayerRail.\n\nPull requests are temporarily closed while we complete core platform work and stabilize the public codebase. This is not a review of your contribution.\n\nPlease watch this repository for the reopening notice.

@github-actions github-actions Bot closed this Sep 3, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/bundler/development-dependencies-1084e3e623 branch September 3, 2026 16:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants