Bump avo from 4.1.15 to 4.2.0

[dependabot]

Bumps avo from 4.1.15 to 4.2.0.

Release notes

Sourced from avo's releases.

v4.2.0

🎸 Features

• feat: render maps with OpenFreeMap so they work without a Mapbox account @​adrianthedev (avo v.4.1.13 #4746)
• Hover flyout for sidebar items whose sub-items aren't listed inline @​adrianthedev (avo v.4.1.13 #4744)
• feat(skills): allowlist avo-ai in the skills package map @​adrianthedev (avo v.4.1.13 #4726)
• Add display formats for number fields @​adrianthedev (avo v.4.1.13 #4739)
• Unify WYSIWYG and code fields behind a collapsable show wrapper @​adrianthedev (avo v.4.1.10 #4724)
• feat(home): redesign the getting started welcome screen @​adrianthedev (avo v.4.1.8 #4659)
• Teach avo-i18n the namespace shape contract, and guard core's locale files (AVO-1464) @​Paul-Bob (avo v.4.1.7 #4711)
• Add a resource color option that tints the sidebar menu icon @​adrianthedev (avo v.4.1.6 #4702)
• Render server-side dates/times in the visitor's browser time zone via config.use_browser_timezone @​adrianthedev (avo v.4.1.4 #4703)
• Teach the shipped skills about the lexxy field (AVO-1236) @​adrianthedev (avo v.4.1.4 #4700)
• feat(skills): version-pinned Avo skills shipped inside the gem @​Paul-Bob (avo v.4.1.1 #4689)
• Menu items and resources can color their sidebar icons @​adrianthedev (avo-advanced_search v.4.1.2, avo-menu v.4.1.2 #170)
• feat(avo-api): API tokens and per-token scopes for the REST API (AVO-1650) @​Paul-Bob (avo-api v.4.2.0, avo-custom_controls v.4.2.0, avo-forms v.4.2.0 #212)
• Resolve scope, card and dashboard labels via translation keys (AVO-1444) @​Paul-Bob (avo-dashboards v.4.1.2, avo-scopes v.4.1.2 #182)
• Localize scope and dashboard card display strings (AVO-1444) @​Paul-Bob (avo-dashboards v.4.1.2, avo-scopes v.4.1.2 #178)
• feat(avo-forms): set the container width on pages and forms @​adrianthedev (avo-forms v.4.1.2 #240)
• feat(avo-menu): link_to takes a block for sub-items @​adrianthedev (avo-menu v.4.1.2 #229)

✨ Enhancements

• Memoize visibility detection for performance speedup @​rynonl (avo v.4.2.0 #4762)

🐛 Bug Fixes

• fix(buttons): save in Safari when the click lands on the button text @​Paul-Bob (avo v.4.1.16 #4761)
• Stop 500ing when a save fails with a new upload, and show HEIC as PNG @​adrianthedev (avo v.4.1.13 #4738)
• Show the translated default empty message on boolean filters without options @​adrianthedev (avo v.4.1.12 #4734)
• Fix clearing the last applied filter when session persistence is enabled @​adrianthedev (avo v.4.1.12 #4733)
• fix: let stacked: false win over sidebar and width defaults @​Paul-Bob (avo v.4.1.11 #4727)
• Don't treat globally-mixed-in methods as config namespace collisions @​adrianthedev (avo v.4.1.9 #4721)
• Define the global search keys avo-advanced_search renders on defaults alone @​Paul-Bob (avo v.4.1.7 #4715)
• Invert the back to top enter/exit transition @​adrianthedev (avo v.4.1.6 #4707)
• Spin the refreshable icon in the direction its arrows point @​adrianthedev (avo v.4.1.6 #4706)
• Show the disabled state visually on select inputs @​adrianthedev (avo v.4.1.4 #4704)
• Pass a menu item's data attributes to the section/group root element @​adrianthedev (avo v.4.1.4 #4701)
• Fix Grid View so that Action is populated when item is selected. @​rctneil (avo v.4.1.4 #4595)
• fix(avo-advanced_search): compare the rendered name in the global search authorization spec @​adrianthedev (avo-advanced_search v.4.1.2 #222)
• Guard resource color lookups and fix the avo-intelligence dummy app @​adrianthedev (avo-advanced_search v.4.1.2, avo-menu v.4.1.2 #180)
• fix: reject symlinks from spec.files in every gemspec @​adrianthedev (avo-api v.4.1.2, avo-audit_logging v.4.2.0, avo-collaboration v.4.2.0, avo-http_resource v.4.1.8, avo-licensing v.4.2.0, avo-menu v.4.1.2, avo-nested v.4.2.0, avo-notifications v.4.2.0, avo-reactive_fields v.4.2.0 #210)
• fix(avo-api): separate the two authorization failure modes in the skill @​Paul-Bob (avo-api v.4.1.2 #201)
• fix(avo-api): rewrite the REST API skill to describe the gem that ships @​Paul-Bob (avo-api v.4.1.2 #200)
• fix(avo-dashboards): spin card refresh icon counterclockwise (AVO-1736) @​adrianthedev (avo-dashboards v.4.1.3 #216)
• fix(avo-dynamic_filters): render filter partials as HTML inside the turbo_stream response @​Paul-Bob (avo-dynamic_filters v.4.1.3 #241)
• Localize the dynamic filters bar per request (AVO-1465) @​Paul-Bob (avo-dynamic_filters v.4.1.2 #168)
• fix(avo-http_resource): refuse requests to an endpoint with no host @​adrianthedev (avo-http_resource v.4.1.8 #219)
• feat(avo-ai): records the assistant names render as chips @​adrianthedev (avo-menu v.4.1.2 #226)

... (truncated)

Commits

• 2c3cbfa Bump avo to v4.2.0
• cffcf17 Sync shipped skills with docs through ee0277f (2026-08-31) (#4763)
• 3c0e5e6 Memoize visibility detection for performance speedup (#4762)
• 81a1c59 Bump avo to v4.1.16
• 5830b05 fix(buttons): save in Safari when the click lands on the button text (#4761)
• 28ced06 [js] Update all Yarn dependencies (2026-08-27) (#4754)
• 836837d [ruby] Update all Bundler dependencies (2026-08-27) (#4755)
• fc9922e Sync shipped skills with docs through 70f1de9 (2026-08-20) (#4760)
• 12afda0 Update all Bundler dependencies (2026-08-20) (#4742)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #148.