Bump the dependencies group across 1 directory with 7 updates

[dependabot]

Bumps the dependencies group with 7 updates in the / directory:

Package	From	To
rails	8.1.3.1	8.1.4
listen	3.10.0	3.10.1
simplecov	1.3.0	1.3.2
tzinfo-data	1.2026.4	1.2026.5
lograge	0.15.0	0.15.1
honeybadger	6.9.2	6.9.3
pg	1.6.3	1.7.0

Updates rails from 8.1.3.1 to 8.1.4

Release notes

Sourced from rails's releases.

8.1.4

Active Support

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

... (truncated)

Commits

• c3466ea Preparing for 8.1.4 release
• 334dc3e Merge pull request #58854 from carlosdanielpohlod/strict-locals-ascii-only-body
• 8df6693 Merge pull request #58827 from rails/backport-alias-fallback-8-1-stable
• 2ed2c88 Define read_attribute_for_validation instead of aliasing send
• 2616145 Merge pull request #56705 from p8/activemodel/fix-read-attr-for-serialization...
• 20abac3 Merge pull request #58817 from yahonda/fix-alias-fallback-to-object-in-attrib...
• 2670772 Merge pull request #58733 from kwestein/create-or-find-by-deadlock
• 8236300 Merge pull request #58806 from Shopify/hm-wnqzpryypymkrxtn
• e6288a8 Update CHANGELOGs for 8-1-stable backports
• 44a7fd4 Merge pull request #58799 from e-akashsaini/fix-tuple-where-key-corrupting-at...
• Additional commits viewable in compare view

Updates listen from 3.10.0 to 3.10.1

Release notes

Sourced from listen's releases.

v3.10.1

What's Changed

• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#597
• CI: Run all tests on Windows in addition by @​larskanis in guard/listen#585
• Preserve independent listener filters across updates by @​OskarEichler in guard/listen#599
• Revert "Fix flaky specs on TruffleRuby" by @​rymai in guard/listen#603
• Remove outdated note about performance by @​quadule in guard/listen#586
• Avoid selecting the filesystem adapter twice by @​OskarEichler in guard/listen#600
• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#605
• [LOW] Bound directory scanning under filesystem churn by @​OskarEichler in guard/listen#601
• [LOW] Pin workflow actions and token permissions by @​OskarEichler in guard/listen#602

New Contributors

• @​andrykonchin made their first contribution in guard/listen#597
• @​OskarEichler made their first contribution in guard/listen#599
• @​quadule made their first contribution in guard/listen#586

Full Changelog: guard/listen@v3.10.0...v3.10.1

Commits

• 6fbde9f Bump VERSION to 3.10.1
• d53f6d9 Merge pull request #602 from OskarEichler/codex/security-pin-workflow-actions
• d6bb203 Merge pull request #601 from OskarEichler/codex/security-bound-directory-scans
• fa07357 Merge pull request #605 from andrykonchin/ak/fix-flaky-specs-on-truffleruby
• b8360fd Refactor and simplify adapter/polling_spec.rb test because now stopping is sy...
• e2173ed Prevent spawning background threads in the Linux adapter unit tests
• a63463f Stop threads synchronously
• c5413b7 Merge pull request #600 from OskarEichler/audit/select-adapter-once
• 751b3f8 Merge pull request #586 from quadule/patch-1
• 309cf5f Merge pull request #603 from guard/revert-597-ak/fix-flaky-specs-on-truffleruby
• Additional commits viewable in compare view

Updates simplecov from 1.3.0 to 1.3.2

Release notes

Sourced from simplecov's releases.

v1.3.2

Bugfixes

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See simplecov-ruby/simplecov#1308.

v1.3.1

Bugfixes

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See simplecov-ruby/simplecov#1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See simplecov-ruby/simplecov#1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

Changelog

Sourced from simplecov's changelog.

1.3.2 (2026-09-30)

Bugfixes

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See simplecov-ruby/simplecov#1308.

1.3.1 (2026-09-24)

Bugfixes

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See simplecov-ruby/simplecov#1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See simplecov-ruby/simplecov#1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

Commits

• 52a8754 Bump version to 1.3.2
• 4fb4ae1 Format a result collected before exit on Rails 8.1.4
• 1476741 bundle update
• 343a933 Stop leaking a flush thread in the forked-child production specs
• e64fcaa Bump ruby/setup-ruby from 1.323.0 to 1.325.0
• cb8bd83 Bump oxlint from 1.83.0 to 1.85.0 in /html_frontend
• 4ee7894 Bump version to 1.3.1
• 486e55e bundle update
• d2a62a8 Resolve paths and wait on runners correctly on JRuby on Windows
• 3a2e08e Load Prism only when the static extractor runs
• Additional commits viewable in compare view

Updates tzinfo-data from 1.2026.4 to 1.2026.5

Release notes

Sourced from tzinfo-data's releases.

v1.2026.5

Based on version 2026e of the IANA Time Zone Database (https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/message/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/).

Commits

• 8df8bad Update to tzdata version 2026e.
• See full diff in compare view

Updates lograge from 0.15.0 to 0.15.1

Changelog

Sourced from lograge's changelog.

0.15.1

• Fully suppress Rails' default Action View logs on Rails 7.1+ by also removing ActionView::LogSubscriber::Start #386
• Declare logger as a runtime dependency in the gemspec, since it is no longer a default gem in newer Rubies #401

Commits

• 106e833 Release 0.15.1 (#406)
• f12d78c Release 0.15.1
• a66e9bf Unsubscribe all Rails built-in subscribers (#386)
• 82a899d Match Rails log subscribers explicitly instead of by namespace
• f3b0e21 Merge branch 'master' into unsubscribe_all_action_view_subscribers_in_rails_71
• d0b1df5 Merge pull request #401 from leoarnold/leoarnold/gemspec
• dd847eb Add 'logger' as dependency in gemspec
• d5b43c6 Merge pull request #405 from roidrage/ci/fix-json3-and-rubocop
• 4939216 ci: run RuboCop once instead of across the whole matrix
• f3b821d ci: fix pre-existing failures from json 3.x and RuboCop 1.91
• Additional commits viewable in compare view

Updates honeybadger from 6.9.2 to 6.9.3

Release notes

Sourced from honeybadger's releases.

v6.9.3

6.9.3 (2026-09-29)

Bug Fixes

• propagate the Rails request ID to notices and Insights events (#848) (23edb08)

Changelog

Sourced from honeybadger's changelog.

6.9.3 (2026-09-29)

Bug Fixes

• propagate the Rails request ID to notices and Insights events (#848) (23edb08)

Commits

• ed14af0 chore(master): release 6.9.3 (#852)
• 23edb08 fix: propagate the Rails request ID to notices and Insights events (#848)
• 7705695 ci: migrate release-please action to googleapis/release-please-action@v5 (#846)
• See full diff in compare view

Updates pg from 1.6.3 to 1.7.0

Changelog

Sourced from pg's changelog.

v1.7.0 [2026-10-02] Lars Kanis lars@greiz-reinsdorf.de

Added:

• Add PG::Connection#embed_params and keyword :typename for its parameter casting. #726 This allows to generate SQL strings with embedded parameters for easier debugging.
• Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #695
• Add PG::Result#each_tuple #675
• Add PG::TypeMap#query_param_encoders to retrieve encoders. #726
• Deduplicate result field name strings for better performance. #750

Removed:

• Remove compatibility to ruby < 3.1 and drops support of ruby-2.7 and ruby-3.0. #749
• Remove GLV unlocking at all functions which process data modifiable in a second thread. #721 This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.
• Remove :static_symbol result field names. #691
• Remove enforced rpath addition when no rpath is configured in rbconfig. #699

Fixes:

• Limit memory allocation on invalid input into PG::BinaryDecoder::Array. #743
• Free COPY buffers when decoders raise to avoid possible memory leak in get_copy_data. #742
• Prevent SQL injection in set_client_encoding. #741
• Add GC_GUARD to temporary ruby objects for conninfo string to avoid it's GC'ed prematurely. #739
• Remove option "quirks_mode" from JSON en/decoder to fix compat with json-3.0 gem. #737
• Respect calendar type of Ruby and PostgreSQL. #725
• Fix broken set_notice_(receiver|processor) callback after GC.compact. #734
• Disable DNS resolution in ruby when a service file is used, so that the priority of parameters is equal to libpq. #635
• Use RARRAY_LENINT to avoid possible overflow. #728
• Fix possible integer overflow at PG::BinaryEncoder::CopyRow and PG::TextEncoder::CopyRow. #714, #715
• Avoid possible integer overflow in query parameter encoding. #719
• Ensure conninfo is a valid C string before closing the connection to avoid a double free of PGconn. #709
• Raise on a too large input string to PG::TextEncoder::Bytea. #717
• Check PG::BinaryEncoder::CopyRow array input size instead of producing an invalid output.
• Remove accidentally copied "static" keyword from Copy and Record encoder. #711
• Avoid possibility to replace typemap while being used in Copy and Record encoders and decoders. #707
• Add GC_GUARD's for encoding converted strings sent to the server. #705
• Fix incomplete transaction commit when thread is shutdown ungracefully. #704
• Assign VALUE after registration per rb_gc_register_address() #703
• Update dependencies for binary gems to PostgreSQL-18.6, OpenSSL-3.6.5, krb5-1.22.2 #752

Commits

• fcf40c5 Add new gem signing certificate
• d41e07a Merge pull request #753 from larskanis/rm-pgsql-10
• 8e1ee8f Remove some conditions for PostgreSQL-10
• 050c56d Fix typo in CHANGELOG and add version note
• 2c4934e Bump VERSION to 1.7.0
• f644ba2 Update release notes once more
• b16542d Merge pull request #752 from larskanis/upd-binaries
• 66b27c6 Update dependencies for binary gems to
• 6a07394 Add CHANGELOG entry for pg-1.7.0
• 5390356 Merge pull request #749 from larskanis/minruby-3.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions