[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
annotaterb (changelog)	4.24.0 → 4.26.0
bootsnap (changelog)	1.24.6 → 1.26.1
cancancan (changelog)	3.6.1 → 3.7.0
csv (changelog)	3.3.6 → 3.3.7
graphql (source, changelog)	2.6.7 → 2.6.15
minitest (source, changelog)	6.0.6 → 6.1.0
pagy (source, changelog)	43.6.1 → 43.8.2
parser (changelog)	3.3.12.0 → 3.3.13.0
pg (changelog)	1.6.3 → 1.7.0
puma (source, changelog)	8.0.2 → 8.0.3
rubocop (source, changelog)	1.89.0 → 1.92.2
rubocop-capybara (changelog)	3.0.0 → 3.1.0
rubocop-graphql (changelog)	1.7.0 → 1.9.0
rubocop-minitest (source, changelog)	0.40.0 → 0.41.0
rubocop-performance (source, changelog)	1.26.1 → 1.27.0
rubocop-rails (source, changelog)	2.36.0 → 2.38.0
scout_apm (source, changelog)	6.2.1 → 6.3.3
selenium-webdriver (source, changelog)	4.46.0 → 4.52.0
simplecov (changelog)	1.0.3 → 1.3.2
vcr (source, changelog)	6.4.0 → 6.4.1
webmock (changelog)	3.26.2 → 3.34.0

---

Release Notes

drwl/annotaterb (annotaterb)

v4.26.0

Compare Source

Full Changelog

Implemented enhancements:

• Fix missing annotation for Active Record ignored columns #​286
• Compatibility with activerecord-tenanted #​276

Fixed bugs:

• additional_file_patterns no longer matches files outside empty root_dir #​406
• v4.25.0: Incorrect default(NULL) annotation for enumerize-backed columns when DB default is not in enum values #​402

Closed issues:

• v4.25.0: enum columns declared with a Rails-side default: still annotate the raw value instead of the label #​408

Merged pull requests:

• Release v4.26.0 #​419 (drwl)
• Bump ruby/setup-ruby from 1.331.0 to 1.335.0 #​418 (dependabot[bot])
• Bump the codeql-action group with 2 updates #​417 (dependabot[bot])
• Optimize CI runs #​416 (drwl)
• Bump ruby/setup-ruby from 1.329.0 to 1.331.0 #​415 (dependabot[bot])
• Bump the codeql-action group with 2 updates #​414 (dependabot[bot])
• [FIX] Set default tenant for activerecord-tenanted models #​413 (Bat0oo)
• Bump ruby/setup-ruby from 1.327.0 to 1.329.0 #​412 (dependabot[bot])
• Bump the codeql-action group with 2 updates #​411 (dependabot[bot])
• Fix TypeError when model table_name is a Symbol #​410 (braindeaf)
• Annotate enum columns declared with a Rails-side default using their label #​409 (xanagi)
• Keep project-root matches for additional_file_patterns #​407 (Shaisolaris)
• Fix enumerize-backed column default annotations #​405 (OdenTakashi)
• Bump ruby/setup-ruby from 1.325.0 to 1.327.0 #​404 (dependabot[bot])
• Bump the codeql-action group with 2 updates #​403 (dependabot[bot])
• Bump ruby/setup-ruby from 1.324.0 to 1.325.0 #​401 (dependabot[bot])
• Group codeql-action updates in the Dependabot config. #​400 (OdenTakashi)
• Bump github/codeql-action/analyze from 4.38.0 to 4.38.1 #​399 (dependabot[bot])
• Bump ruby/setup-ruby from 1.321.0 to 1.324.0 #​398 (dependabot[bot])
• Generate changelog for v4.25.0 #​396 (drwl)
• [LOW] Pin workflow actions and restrict CI permissions #​392 (OskarEichler)
• [MEDIUM] Reject executable lines in generated annotations #​391 (OskarEichler)
• Resolve globbed model directories before class lookup #​388 (OskarEichler)
• Load columns from schema to avoid AR ignored/only column configuration #​287 (bensheldon)

v4.25.0

Compare Source

Full Changelog

Fixed bugs:

• Missing unique indexes in annotations #​390
• Related files are matched globally by unqualified model name, so models with the same basename in different packs overwrite each other's annotations (breaks --frozen) #​367
• When format_markdown: true, annotations get written duplicated into models that already have annotations. #​355

Closed issues:

• Foreign-key annotation crashes with ArgumentError when unnamed FKs mix with a composite FK #​377
• 4.24.0: enum-backed integer columns annotate raw default(0) instead of default("label") #​373

Merged pull requests:

• Release v4.25.0 #​395 (drwl)
• Bump github/codeql-action from 4.37.9 to 4.38.0 #​394 (dependabot[bot])
• Remove unused routes option #​393 (OdenTakashi)
• Bump github/codeql-action from 4.37.4 to 4.37.9 #​389 (dependabot[bot])
• Use native prefix predicate in YAML parser #​387 (OskarEichler)
• Fix multi-database annotation removal fixture targeting #​386 (OskarEichler)
• Update annotated model in README #​385 (koeda-ta)
• Show index operator classes in annotations #​382 (kamipo)
• Fix enum-backed integer columns annotations #​380 (dmke)
• Fix ArgumentError sorting unnamed foreign keys when one is composite #​378 (6temes)
• Bump github/codeql-action from 4 to 4.37.4 #​376 (dependabot[bot])
• docs: fix mistake in changelog #​375 (G-Rath)
• Stop same-named models in different packs from annotating each others related files by matching on owning root_dir. #​374 (OdenTakashi)
• Generate changelog for v4.24.0 #​372 (drwl)

rails/bootsnap (bootsnap)

v1.26.1

Compare Source

• Fix Bootsnap.enable_frozen_string_literal(app_only: true) raising NameError when the compile cache is disabled.
  App files are now compiled with frozen string literals on every load, without caching.

• Avoid transcoding Ruby source when the Prism workaround runs with a default internal encoding.

• Better detect support for fast path scanning. Fix compilation on Illumos.

v1.26.0

Compare Source

• Handle top level Coverage constant being defined, but without it being the true stdlib coverage module.
• Fix bootsnap precompile that could generate a corrupted cache entry if an already cached YAML file was modified
  without changing its size.
• Workaround a potential Ruby SEGV if Bootsnap.instrumentation raised an error.

v1.25.0

Compare Source

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the
  serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or
  RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT
  builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT
  was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname)
  with RSTRING_PTR. Regression from 1.24.0.

CanCanCommunity/cancancan (cancancan)

v3.7.0

Compare Source

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. ([@​coorasse][])
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). ([@​coorasse][])
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. ([@​coorasse][])
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. ([@​coorasse][])
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. ([@​coorasse][])
• #​927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. ([@​coorasse][])
• #​913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. ([@​bruno-costanzo][])
• #​905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. ([@​bruno-costanzo][])
• #​848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. ([@​coorasse][])
• #​861, #​846, #​690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. ([@​coorasse][])
• #​911: Load the resource when the id is only whitespace: a request like /books/%20 ran the action with a nil resource, authorized only against the class, instead of raising ActiveRecord::RecordNotFound. ([@​bruno-costanzo][])
• #​833: Match nil in an array of enum values in can?, as accessible_by already did: can :read, Post, status: [nil, :published] now allows a post without a status. ([@​jtagle2][], [@​coorasse][])
• #​910: Accept a subclass of CanCan::ModelAdapters::Strategies::Base as accessible_by_strategy, so the SQL generated by accessible_by can be customized with your own strategy. ([@​cb341][], [@​coorasse][])
• #​909: Make can? and accessible_by consistent for cannot rules and single table inheritance: a cannot rule on a subclass keeps its precedence in accessible_by, records with NULL in a column of a cannot condition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING: accessible_by returns more records when a cannot rule has conditions on a nullable column, and can? on an STI base class no longer fails because a subclass is forbidden. ([@​coorasse][], [@​0llirocks][], [@​kevinluo201][])
• #​880: Fix accessible_by with rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. ([@​takayamaki][], [@​sjoulbak][])
• #​890: Support an Active Record relation as the value of a condition in can?: the selected column, or the primary key, is checked with a query, as accessible_by already did. ([@​olistik][])
• #​908: Join consecutive can rules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. ([@​coorasse][])
• #​907: Make with_accessible_by_strategy thread safe: the strategy chosen in the block no longer leaks into concurrent requests. ([@​NikosVlagoidis][], [@​coorasse][])
• #​906: Keep the conditions of an association when a rule is a scope: group.posts.accessible_by(ability) returned the posts of every group matched by the scope. WARNING: accessible_by called on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped by merge are applied again, so a condition on a subquery like where(category: Category.where(...)) is not turned into IS NULL, and the conditions of a default scope removed by unscope in the rule stay removed. ([@​coorasse][])
• #​694: Document that cannot supports the :all subject. ([@​jaredbeck][])
• #​852: Add changelog_uri to the gemspec, so rubygems.org links to the changelog. ([@​mark-young-atg][])
• #​842: Add disallowed_attributes to retrieve the attributes forbidden by cannot rules. ([@​mswiszcz][])
• #​904: Assign the parent of a singleton resource through the inverse of the association when the resource has no setter named after the through option. ([@​coorasse][])
• #​878: Support through_association together with singleton when loading a resource. ([@​cgunther][])
• #​786: Fix the table aliases generated by accessible_by when the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. ([@​daveallie][])
• #​902: Do not change the rules of the ability in accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. ([@​bruno-costanzo][])
• #​901: Keep the scope of a has_many :through association in accessible_by: the association was rewritten into its through and source associations and its scope was dropped, so accessible_by returned records that can? denies. WARNING: accessible_by returns fewer records for a rule on a has_many :through association with a scope. ([@​bruno-costanzo][])
• Remove the VitePress documentation website: the documentation lives in the docs folder as plain Markdown. ([@​coorasse][])

v3.6.2

Compare Source

• #​898: Do not share cancan_skipper between controller subclasses: skip_authorize_resource and skip_load_resource in a subclass no longer apply to the superclass or sibling controllers. ([@​bruno-costanzo][])
• #​894: Use lease_connection instead of the deprecated connection on Rails 7.2+. ([@​benaitcheson][])

ruby/csv (csv)

v3.3.7: csv 3.3.7 - 2026-10-28

Compare Source

Improvements

• Improved documents.

  • GH-376
  • Patch by Oskar Eichler

• Improved error handling.

  • GH-378
  • GH-379
  • Reported by sswander

Thanks

• Oskar Eichler

• sswander

rmosolgo/graphql-ruby (graphql)

v2.6.15

Compare Source

Security

This release includes security patches for the following:

• Analysis: GHSA-8wfw-p943-3jjp
• Parsing, analysis, execution: GHSA-qv9r-jc8m-v7ph
• Complexity: GHSA-wc34-88mf-j95m
• Parser: GHSA-pjx7-wx97-6wf8
• Authorization, Execution::Next: GHSA-rf3p-x6p2-rr4g

New features

• Continue Sorbet adoption #​5867 #​5872
• Analysis: also support GraphQL::ExecutionError #​5870

Bug fixes

• Directives: don't drop repeated instances of repeatable directives on interfaces or on subclasses with inherited directives #​5823
• Parser: improve stack overflow error message #​5857
• Parser: reject variables in default values #​5864
• Parser: improve handling of CR line endings #​5848 #​5847
• Generator: improve generated controller for @defer handling #​5855
• Parser: improve numeric lexical boudaries #​5856
• ActionCable: improve memory cleanup #​5860
• Parser: preserve newlines after escaped backslashes #​5858
• Execution::Next: remove duplicate input coercion
• Validation: fix NoMethodError #​5876
• Validation: update callers to types #​5868
• Lexer: speedup #​5880 , documentation #​5883
• Parser: fix column count with BOM #​5886
• Parser: improve token limit handling #​5887
• Execution::Next: improve rescue_from compatibility

v2.6.14

Compare Source

Security

Two patches relating to loopholes in authorization edge cases (legacy and next runtimes):

• GHSA-q3cc-p5hm-55wj
• GHSA-4rw8-495r-pf6j

New Features

• Schema.from_definition: speed up #​5832
• Execution::Next: improve dataloader batching in .authorized?
• Sorbet adoption #​5825 #​5852

Bug Fixes

• Connections: #​5838 #​5840 #​5845 #​5846
• Complexity: use legacy mode when enforcing limits #​5839
• rescue_from: prevent leaking into arguments #​5837
• Parser: Correctly ignore BOM in documents #​5849

v2.6.13

Compare Source

New features

• Move documentation to RDoc #​5689 #​5782
• Begin type-checking the project with Sorbet #​5746 #​5801 #​5800
• Improve CI #​5781 #​5783 #​5785
• Language::Nodes: flatten class definitions and add RBS types #​5790
• rake graphql:pro:validate: harden against misuse #​5795

Bug fixes

• FieldsHaveAppropriateSelections: don't crash on inline fragments without type conditions inside leaf selections #​5791
• Execution::Next: propagate nulls in nested lists #​5779
• Lexer: handle more comments than max_tokens #​5795
• Schema.from_definition: support directive with cyclic argument types #​5802
• Execution::Next: fix field alignment for legacy fields with authorization #​5738
• Connections: paginate duplicate items #​5755
• RelationConnection: peek an extra row to avoid hasNextPage query #​5775
• Complexity: fix __typename with count_introspection_fields: false
• Legacy interpreter: fix TypeError in nested lists #​5777
• Schema.from_definition: correctly handle interface possible types when defined later in the document #​5827
• Validation: improve detection of unused variables with legacy compatibility support #​5796
• Validation: improve detection of conflicting fields with legacy compatibility support #​5797

v2.6.12

Compare Source

Security: This version contains a patch for GHSA-965v-9v76-5hg2

Bug fixes

• Visibility::Profile#preload: preload more type information #​5748 #​5758
• Variables: use defaults for omitted non-null variables #​5754
• Visibility::Profile: freeze hashes when fully loaded #​5750
• Dataloader: give nested dataloader calls their own state #​5760
• RelationConnection: reject invalid cursors #​5752
• Legacy execution: Set current_field and current_arguments for list item dataloader fibers #​5759
• Propagate list errors through non-null items #​5756
• Fix error paths and performance on input objects in lists #​5751
• Execution::Next: Don't call .size on non-Array list results #​5765
• Subscriptions: reject multiple root selections and introspection root selections #​5770
• Parser: fix source locations after multibyte input #​5771
• RelationConnection: fix detection of AsyncDataloader to avoid duplicate queries #​5773

v2.6.11

Compare Source

Bug fixes

• AsyncDataloader: call fiber cleanup hooks after errors #​5718
• RelationConnection: support initialization without context #​5716
• CParser: support exponent-only floats #​5719
• CParser: fix compiler warnings #​5721
• ArrayConnection: reject cursors pointing to malformed, zero, or negative indexes
• AsyncDataloader: prevent duplicate count queries #​5717
• Subscriptions: improve serializer #​5722, #​5723
• Sentry: support data_collection configuration
• Execution::Next: preserve multiplex results after setup errors #​5728
• Execution::Next: use it for Query#result when as_default: true #​5742
• Execution::Next: skip lazy? check when schema doesn't use resolve_lazy for Partials on scalars #​5740
• Execution::Next: treat unimplemented directive hooks as no-ops #​5739
• Schema::Visibility: improve profile preloading #​5743
• Execution::Next: fix Query#result_values when an error is raised #​5744
• loads:: correctly type-check loaded objects when loads: is a loads:-only Object type #​5745

v2.6.10

Compare Source

New features

• Execution::Next: Add dataload: { ..., method: } shorthand #​5706

Bug fixes

• AsyncDataloader: Avoid ClosedError race in old fibers #​5702
• AsyncDataloader: fix nested dataloader runs #​5703
• Validation: speed up FieldsWillMerge #​5704
• AsyncDataloader: Fix ActiveRecord relation loads in connections #​5708
• Execution::Next: handle SystemStackErrors #​5705
• Restore current multiplex after nested execution #​5714
• Parser: handle out-of-range Unicode escapes as parse errors #​5710
• Lexer: re-raise unexpected ArgumentErrors #​5711
• Parser: support short braced unicode escapes #​5712
• Float: reject non-finite values #​5713

v2.6.9

Compare Source

Security

• Parser cache: validate payloads before loading them (GHSA-rmxg-5p3r-j6hh)

v2.6.8

Compare Source

New features

• Support JSON 3 (remove quirks_mode: true) #​5699

Bug fixes

• Handle SystemStackError during execution #​5683
• Restrict dashboard schema selection #​5688
• Reduce allocations in block string parsing #​5695
• Fix lexer position in multibyte input #​5692 #​5697
• Execution::Next: fix no-method error in mutations #​5698
• SDL: reduce memory use in description strings #​5701

minitest/minitest (minitest)

v6.1.0

Compare Source

whitequark/parser (parser)

v3.3.13.0

Compare Source

API modifications:

• Bump maintenance branches to 3.3.13 (#​1096) (Koichi ITO)

ged/ruby-pg (pg)

v1.7.0

Compare Source

Added:

• Add PG::Connection#embed_params and keyword :typename for its parameter casting. #​726
  This allows to generate SQL strings with embedded parameters for easier debugging.
• Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #​695
• Add PG::Result#each_tuple #​675
• Add PG::TypeMap#query_par

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.