build(deps-dev): bump the bundler group across 1 directory with 2 updates

[dependabot]

Bumps the bundler group with 2 updates in the / directory: simplecov and io-console.

Updates simplecov from 1.2.0 to 1.3.0

Release notes

Sourced from simplecov's releases.

v1.3.0

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Highlights

• Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles Prism, so the static coverage extractor stops probing for it and the emulation of 3.2's constant folding is gone.
• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax or as Ruby comments on a code line.
• --annotate KIND turns simplecov patch and simplecov uncovered into inline CI annotations for GitHub, GitLab, reviewdog, Azure, TeamCity, and Buildkite, so one CI step can both annotate and gate.
• Groups that match no files are omitted from the report instead of padding it at 100%, and the rails profile declares its groups alphabetically.
• cover_views is the only way to measure a template now: a cover glob that matches one warns and leaves it out, and ignore: :eval_generated no longer drops a template's real branches and methods.
• A file with nothing to cover reports the same percentage in the file list as it does in the source view.

Upgrade notes

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Breaking Changes

• Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Enhancements

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See simplecov-ruby/simplecov#1295.
• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See simplecov-ruby/simplecov#1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Bugfixes

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (simplecov-ruby/simplecov#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See simplecov-ruby/simplecov#1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

Changelog

Sourced from simplecov's changelog.

1.3.0 (2026-09-12)

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Highlights

• Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles Prism, so the static coverage extractor stops probing for it and the emulation of 3.2's constant folding is gone.
• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax or as Ruby comments on a code line.
• --annotate KIND turns simplecov patch and simplecov uncovered into inline CI annotations for GitHub, GitLab, reviewdog, Azure, TeamCity, and Buildkite, so one CI step can both annotate and gate.
• Groups that match no files are omitted from the report instead of padding it at 100%, and the rails profile declares its groups alphabetically.
• cover_views is the only way to measure a template now: a cover glob that matches one warns and leaves it out, and ignore: :eval_generated no longer drops a template's real branches and methods.
• A file with nothing to cover reports the same percentage in the file list as it does in the source view.

Upgrade notes

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Breaking Changes

• Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Enhancements

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See simplecov-ruby/simplecov#1295.
• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See simplecov-ruby/simplecov#1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Bugfixes

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (simplecov-ruby/simplecov#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See simplecov-ruby/simplecov#1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

Commits

• 9c9ecd1 Bump version to 1.3.0
• 71bb5ac Name the simulation context by its subject, not by Prism
• b2aec76 Drop support for Ruby 3.2
• 5e869ef Report a file with no branches as fully covered everywhere
• e425d8b Warn and leave out templates a cover glob matches
• 12d7914 Honor the deprecated nocov toggle in template comments
• 7d278ea Exempt templates from the eval_generated filter
• b39506d Honor simplecov directives inside Haml and Slim templates
• c5233a4 Honor simplecov directives inside ERB templates
• 5a8f224 Alphabetize the rails profile's groups by name
• Additional commits viewable in compare view

Updates io-console from 0.9.2 to 0.9.4

Release notes

Sourced from io-console's releases.

v0.9.4

What's Changed

• Conditionally require 'io/wait' for Ruby versions < 3.2 by @​headius in ruby/io-console#172
• Detect the old style ttyname_r return type by @​nobu in ruby/io-console#174

Full Changelog: ruby/io-console@v0.9.3...v0.9.4

v0.9.3

What's Changed

• Avoid timing race in noecho test by @​nobu in ruby/io-console#150
• Move the rules for win32_vk and add generated dependency rules by @​nobu in ruby/io-console#161
• Use ttyname_r return codes for errors by @​OskarEichler in ruby/io-console#153
• Correct ttyname documentation by @​OskarEichler in ruby/io-console#154
• Preserve nil from JRuby getpass at EOF by @​OskarEichler in ruby/io-console#156
• Honor JRuby raw mode options by @​OskarEichler in ruby/io-console#155
• Return nil when JRuby has no console device by @​OskarEichler in ruby/io-console#157
• Reject incomplete JRuby cursor responses by @​OskarEichler in ruby/io-console#158
• Ignore nonpositive console size overrides by @​OskarEichler in ruby/io-console#159
• Generate the version file before Java builds by @​OskarEichler in ruby/io-console#160
• Refine stty backend implementation by @​nobu in ruby/io-console#162
• Fallback to stub even on Windows by @​nobu in ruby/io-console#163
• Add some attributes to Console::Mode by @​nobu in ruby/io-console#164
• Test the getch timeout on an isolated pty with no input by @​nobu in ruby/io-console#166
• Accept mode arguments for tty? in the stty backend by @​nobu in ruby/io-console#167
• Re-enable TestIO_Console#test_intr on FreeBSD by @​hsbt in ruby/io-console#168
• Make IO#tty? enhanced always by @​nobu in ruby/io-console#169
• Now module IO::Console is defined on all platforms by @​nobu in ruby/io-console#170
• Run test_input_pending on JRuby by @​nobu in ruby/io-console#171

New Contributors

• @​OskarEichler made their first contribution in ruby/io-console#153

Full Changelog: ruby/io-console@v0.9.2...v0.9.3

Commits

• a44ab18 bump up to 0.9.4
• 668e5d8 Detect the old style ttyname_r return type
• 8dd28eb Conditionally require 'io/wait' for Ruby versions < 3.2
• fbac53d bump up to 0.9.3
• 3813a43 Skip unavailable win32 virtual key generation rules
• 7a792b4 Run test_input_pending on JRuby
• 647900a Now module IO::Console is defined on all platforms
• f686b83 Make IO#tty? enhanced always
• 2598c88 Run test_input_pending on Windows
• 380550c Re-enable TestIO_Console#test_intr on FreeBSD
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.