[dependabot]

Bumps the ruby-deps group with 7 updates:

Package	From	To
csv	3.3.6	3.3.7
tzinfo-data	1.2026.5	1.2026.6
faraday	2.15.0	2.15.1
msgpack	1.8.5	1.8.6
view_component	4.19.0	4.20.0
bullet	8.3.0	8.3.1
capybara-playwright-driver	0.5.13	0.5.14

Updates csv from 3.3.6 to 3.3.7

Release notes

Sourced from csv's releases.

csv 3.3.7 - 2026-10-28

Improvements

• Improved documents.

  • GH-376
  • Patch by Oskar Eichler

• Improved error handling.

  • GH-378
  • GH-379
  • Reported by sswander

Thanks

• Oskar Eichler

• sswander

Changelog

Sourced from csv's changelog.

3.3.7 - 2026-10-28

Improvements

• Improved documents.

  • GH-376
  • Patch by Oskar Eichler

• Improved error handling.

  • GH-378
  • GH-379
  • Reported by sswander

Thanks

• Oskar Eichler

• sswander

Commits

• f77f871 Add 3.3.7 entry
• 079bf0c Bump version
• c85db27 Don't leak kept scanner state in loose parser (#379)
• 9255c5e Correct CSV option and recipe documentation (#376)
• See full diff in compare view

Updates tzinfo-data from 1.2026.5 to 1.2026.6

Release notes

Sourced from tzinfo-data's releases.

v1.2026.6

Based on version 2026f of the IANA Time Zone Database.

Commits

• 2726762 Update to tzdata version 2026f.
• 496785a Update actions/cache to v6 and actions/checkout to v7.
• See full diff in compare view

Updates faraday from 2.15.0 to 2.15.1

Release notes

Sourced from faraday's releases.

v2.15.1

What's Changed

• Decode indexed nested arrays in numeric order by @​afurm in lostisland/faraday#1723
• Make Connection#dup public and rebuild its middleware stack by @​JelF in lostisland/faraday#1718
• Fix FrozenError when a frozen URI is passed as the base URL by @​hikmetba-bit in lostisland/faraday#1717
• [LOW] Bound memory retained by remote header names by @​OskarEichler in lostisland/faraday#1698
• Apply logging filters to exception messages by @​OskarEichler in lostisland/faraday#1702
• Preserve response state while releasing callbacks by @​OskarEichler in lostisland/faraday#1703
• Memoize false option values without recomputing by @​OskarEichler in lostisland/faraday#1706
• Freeze the default allowed status list by @​OskarEichler in lostisland/faraday#1707
• Default Connection#support_parallel? to the connection's adapter by @​ybai08 in lostisland/faraday#1725
• Add integration tests for the Options classes by @​iMacTia in lostisland/faraday#1724
• Ship only the specs external adapters need by @​sampokuokkanen in lostisland/faraday#1726
• Preserve false request bodies for JSON encoding by @​OskarEichler in lostisland/faraday#1691
• Add integration tests for JSON literal request bodies by @​iMacTia in lostisland/faraday#1728
• Keep header index synchronized across Hash mutations by @​OskarEichler in lostisland/faraday#1700
• fix: honor include_request: false in all errors by @​yykamei in lostisland/faraday#1729
• Escape params 2x faster with half the allocations, using CGI.escape by @​czj in lostisland/faraday#1727
• [MEDIUM] Pin actions used for RubyGems publication by @​OskarEichler in lostisland/faraday#1710
• [MEDIUM] Lock the RubyGems release dependency graph by @​OskarEichler in lostisland/faraday#1712

New Contributors

• @​afurm made their first contribution in lostisland/faraday#1723
• @​JelF made their first contribution in lostisland/faraday#1718
• @​hikmetba-bit made their first contribution in lostisland/faraday#1717
• @​ybai08 made their first contribution in lostisland/faraday#1725
• @​sampokuokkanen made their first contribution in lostisland/faraday#1726
• @​czj made their first contribution in lostisland/faraday#1727

Full Changelog: lostisland/faraday@v2.15.0...v2.15.1

Commits

• 0cfec3e Version bump to 2.15.1
• 2dce78b [MEDIUM] Lock the RubyGems release dependency graph (#1712)
• 340d3a9 Pin GitHub Actions used by CI and releases (#1710)
• 41666c6 Escape params 2x faster with half the allocations, using CGI.escape (#1727)
• 573827e fix: honor include_request: false in all errors
• 670f3a6 Keep header index synchronized across Hash mutations (#1700)
• d494fce Add integration tests for JSON literal request bodies (#1728)
• 2d923f3 Preserve false request bodies for JSON encoding (#1691)
• 745b0f3 Ship only the specs external adapters need (#1726)
• 161010c Rely on derived metadata for integration specs
• Additional commits viewable in compare view

Updates msgpack from 1.8.5 to 1.8.6

Changelog

Sourced from msgpack's changelog.

2026-10-27 1.8.6

• Fix use-after-free when a recursive extension proc rescues, skips or resets.
• Speed up decoding of oversized integers.
• Avoid excessive memory allocation from crafted container headers.

Commits

• 2c34bb7 Release 1.8.6
• e89b5bc Merge pull request #410 from Watson1978/fix/buffer-append-string-uaf
• 8731b86 Fix use-after-free when packing a string into an IO
• 314d65d Merge pull request #408 from Watson1978/speedup/bigint-decode
• 1a9f0e3 Merge pull request #409 from Watson1978/fix/unpacker-container-prealloc
• c8d42d8 Fix excessive memory allocation from crafted container headers
• 6bf285b Speed up decoding of oversized integers
• 4aa8bb9 Merge pull request #407 from Watson1978/fix/recursive-ext-stack-floor
• 8cada9f Fix use-after-free when a recursive extension proc rescues, skips or resets
• See full diff in compare view

Updates view_component from 4.19.0 to 4.20.0

Release notes

Sourced from view_component's releases.

4.20.0

• Fix invalid byte sequence in UTF-8 errors when precomputing cache digests for components loaded from encrypted or binary source files.

  Joel Junström

• Fix cache digests missing components rendered through a slot declared with the component's class, through a method or variable that holds the component, or through a module the component includes. Any constant naming a component in a component's Ruby or templates now counts as a dependency, and included modules are digested like superclasses.

  Erik Axel Nielsen

• Add an informational CI check that runs added and modified tests without a pull request's implementation changes to identify regression coverage.

  Joel Hawksley

• Speed up rendering with direct compiled-template calls and avoid intermediate method allocations when invoking lambda-backed slots.

  Joel Hawksley

• Fix Couldn't find template for digesting errors when computing cache digests for templates that render components. Action View inferred a partial from render SomeComponent.new, so partials inferred from component renders are now discarded. Component renders are found with Prism rather than a regular expression, adding a dependency on the prism gem.

  Joel Hawksley

• Fix components rendering the template for the first format a lookup context rendered in, instead of the current one. An Action Mailer email that declares format.text before format.html rendered the text template of each component into its HTML part. Components now reuse the details key Action View memoizes, which Action View resets whenever a detail such as formats changes. Regression from 4.16.0.

  Jan Schilbach

• Look up each component's sidecar templates and translations once while eager loading, instead of again when it compiles, loads its translations, and computes its cache digest, and for each of its subclasses. Time spent in ViewComponent during the boot benchmark drops by about a quarter.

  Clément Joubert

• Measure cache digest precomputation in the boot benchmark by disabling class reloading in the benchmark app and having each generated component render another.

  Joel Hawksley

• Add a CI performance check that fails a pull request when any benchmark scenario's component/partial render-time ratio, or ViewComponent's share of app boot time, regresses by more than 5% against the base branch on Rails 8.1 or Rails main.

  Joel Hawksley

• Fail the test suite when a gem in the Gemfile or gemspec isn't loaded.

  Joel Hawksley

• Remove the unused selenium-webdriver and tailwindcss-rails development dependencies.

  Joel Hawksley

• Speed up sidecar_files, which 4.18's cache digest precomputation calls for every component and superclass at boot, by globbing each directory once instead of once per extension. On an app with 302 components, compile.view_component drops from 2.3 s to 1.2 s.

  Clément Joubert

Changelog

Sourced from view_component's changelog.

4.20.0

• Fix invalid byte sequence in UTF-8 errors when precomputing cache digests for components loaded from encrypted or binary source files.

  Joel Junström

• Fix cache digests missing components rendered through a slot declared with the component's class, through a method or variable that holds the component, or through a module the component includes. Any constant naming a component in a component's Ruby or templates now counts as a dependency, and included modules are digested like superclasses.

  Erik Axel Nielsen

• Add an informational CI check that runs added and modified tests without a pull request's implementation changes to identify regression coverage.

  Joel Hawksley

• Speed up rendering with direct compiled-template calls and avoid intermediate method allocations when invoking lambda-backed slots.

  Joel Hawksley

• Fix Couldn't find template for digesting errors when computing cache digests for templates that render components. Action View inferred a partial from render SomeComponent.new, so partials inferred from component renders are now discarded. Component renders are found with Prism rather than a regular expression, adding a dependency on the prism gem.

  Joel Hawksley

• Fix components rendering the template for the first format a lookup context rendered in, instead of the current one. An Action Mailer email that declares format.text before format.html rendered the text template of each component into its HTML part. Components now reuse the details key Action View memoizes, which Action View resets whenever a detail such as formats changes. Regression from 4.16.0.

  Jan Schilbach

• Look up each component's sidecar templates and translations once while eager loading, instead of again when it compiles, loads its translations, and computes its cache digest, and for each of its subclasses. Time spent in ViewComponent during the boot benchmark drops by about a quarter.

  Clément Joubert

• Measure cache digest precomputation in the boot benchmark by disabling class reloading in the benchmark app and having each generated component render another.

  Joel Hawksley

• Add a CI performance check that fails a pull request when any benchmark scenario's component/partial render-time ratio, or ViewComponent's share of app boot time, regresses by more than 5% against the base branch on Rails 8.1 or Rails main.

  Joel Hawksley

• Fail the test suite when a gem in the Gemfile or gemspec isn't loaded.

  Joel Hawksley

• Remove the unused selenium-webdriver and tailwindcss-rails development dependencies.

  Joel Hawksley

• Speed up sidecar_files, which 4.18's cache digest precomputation calls for every component and superclass at boot, by globbing each directory once instead of once per extension. On an app with 302 components, compile.view_component drops from 2.3 s to 1.2 s.

  Clément Joubert

Commits

• efd8548 Merge pull request #2753 from ViewComponent/release-4-20-0
• 85ab9ed release 4.20.0
• 46982b8 Rename workflow from 'Release' to 'Build Release PR'
• eff8252 Merge pull request #2751 from joeljunstrom/fix-cache-digest-binary-sources
• 3a75fd5 Merge main into fix-cache-digest-binary-sources
• a345279 Merge pull request #2752 from erikaxel/vc-digest-slots-helpers
• 9bb1708 Simplify cache digest dependency analysis
• f6cad28 Merge branch 'main' into vc-digest-slots-helpers
• 5b6464a Merge branch 'main' into fix-cache-digest-binary-sources
• 48894d4 Merge pull request #2748 from ViewComponent/joelhawksley-regression-test-ci
• Additional commits viewable in compare view

Updates bullet from 8.3.0 to 8.3.1

Changelog

Sourced from bullet's changelog.

8.3.1 (10/24/2026)

• Avoid redefining the footer_position getter
• Avoid the CGI loading warning on Ruby 4
• Keep request state separate for sibling fibers on one thread

Commits

• c478651 Bump version to 8.3.1
• b9cb926 Merge pull request #785 from andrewfader/fiber-request-state
• 47c3a3f Give each request its own counter cache registries
• 6af866d Merge pull request #784 from milkcocoa/fix/cgi-require-ruby4
• 5c74691 Merge pull request #783 from milkcocoa/fix/footer-position-redefinition
• a9c71e1 Keep request state separate for sibling fibers
• 378a0fc Avoid the CGI loading warning on Ruby 4
• 30e43e9 Avoid redefining the footer_position getter
• See full diff in compare view

Updates capybara-playwright-driver from 0.5.13 to 0.5.14

Commits

• 4d8dde7 0.5.14
• f8714b2 Merge pull request #175 from YusukeIwaki/codex/unify-text-input-compatibility
• ea7171f Remove duplicate tagged compatibility runs from RSpec workflow
• ecef16f Preserve input action waits and pre-dispatch stale retries
• 58979d6 Document upstream references for keyboard focus preparation
• 5502394 Handle legacy keyword forwarding and explicit cross-browser caret setup
• c31a93d Retain default long text event coverage after moving specs
• b878bc0 Unify text input focus and keyboard handling with compatibility coverage
• d4543c6 Document visibility differences from Selenium
• a69e9c8 Merge pull request #172 from YusukeIwaki/codex/fix-issue-170-label-resolution
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head 9cb13e8dc2c5f3e6a20686ba6d775efb376cca1c) · Confidence: High

Seven Ruby gem bumps (six patch-level, one minor: view_component 4.19.0 → 4.20.0, which adds a prism runtime dependency already satisfied by the locked prism 1.9.0); all hit stable APIs at the repo's call sites and both suites plus the round-trip probe passed. The upgrade is safe: csv/faraday/msgpack/view_component/bullet/capybara-playwright-driver/tzinfo-data changes are confined to paths the passing planner-suite, auth-suite, and probe cover.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
Flodesk client HTTP contract (Faraday json/raise_error/logger/authorization middleware, error flagging)	Verified	planner-suite (incl. spec/lib/services/flodesk_spec with WebMock) passed on the bumped faraday.
CSV attendee/export output shape	Verified	admin/stats_controller_spec and admin/stats_page_spec in planner-suite passed.
ViewComponent rendering (ViewComponent::Base subclasses)	Partially verified	Component and system (playwright) specs exercised planner-suite-covered code paths; core ViewComponent::Base API unchanged in 4.20.
Playwright system-spec driver behavior (headless shell, JS driver)	Verified	Specs run with the upgraded driver (spec/spec_helper.rb ties failures to Capybara.current_driver == :playwright).
Timezone data correctness for 'London' zone	Unverified	Round-trip probe passed; tzinfo-data is tz data only and Rails zone config is unchanged.

Compatibility analysis — 8 packages

• tzinfo-data 1.2026.5 → 1.2026.6: Data-only update to tz database used by config.time_zone = 'London' (config/application.rb); no API surface change expected.
• csv 3.3.6 → 3.3.7: Patch bump; unchanged API. Repo uses CSV.generate/data-row appends only.
• faraday 2.15.0 → 2.15.1: Patch bump; unchanged middleware/client API. Repo only builds Faraday connections with request/response middleware and handles Faraday::Error via e.response_body/response_status/message — all stable in 2.x patches.
• mime-types-data 3.2026.1020 → 3.2026.1103: Transitive data update pulled by the faraday bump; no impact, the repo's mime_types.rb initializer is fully commented out.
• msgpack 1.8.5 → 1.8.6: Patch bump of the native gem; no direct Ruby usage found in the codebase (declared in Gemfile with no call sites).
• view_component 4.19.0 → 4.20.0: Minor bump; new runtime dependency prism (>= 1.0) resolved against existing prism 1.9.0 in the lockfile. All component classes subclass ViewComponent::Base, whose core API is stable in minors.
• bullet 8.3.0 → 8.3.1: Patch/flag-bump to the N+1 checker configured via Bullet.enable/raise/logger in config/environments; config API unchanged in patch releases.
• capybara-playwright-driver 0.5.13 → 0.5.14: Patch bump; repo registers Capybara::Playwright::Driver with headless/browser_type/executablePath options in spec/support/capybara.rb — driver API unchanged in this patch branch, and system/features suites passed.

Usage of 7 dependencies

• csv: app/models/meeting.rb, app/presenters/event_presenter.rb, app/controllers/admin/stats_controller.rb – CSV.generate / csv << row
• faraday: lib/flodesk.rb – Faraday.new with request :json/:authorization and response :raise_error/:logger/:json, run_request/public_send, Faraday::Error rescue
• msgpack: no direct Ruby usage; Gemfile-only declaration
• view_component: app/components/** (chapter_picker, chapters_sidebar, event_card, admin/dashboard/health_card + workshop_timeline, admin/chapter_status, admin/stats/table, admin/members/activity_strip) – ViewComponent::Base subclasses
• tzinfo-data: config/application.rb – config.time_zone = 'London'
• bullet: config/environments/development.rb, config/environments/test.rb – Bullet.enable/bullet_logger/raise/console/rails_logger
• capybara-playwright-driver: spec/support/capybara.rb – Capybara::Playwright::Driver.new(headless:, browser_type:, executablePath:)

Test coverage

• Strong – planner-suite and auth-suite both pass, covering component specs, CSV export specs, and Flodesk/WebMock specs.
• Thin – tzinfo-data correctness is not directly tested; time-zone behavior is only observed via the passing suites.
• Gap: msgpack has no direct usage or test in the repo, so nothing exercises it beyond startup.

Calibration and confidence

Confidence: High — All changes are patch/minor bumps with no removed API on the paths the repo exercises, both suites and the round-trip probe passed, and the new prism dependency resolved against an already-locked compatible version.

1. Weakest claim: tzinfo-data and msgpack are not directly exercised: tz data is only indirectly observed through the passing suites, and msgpack has no call sites at all.
2. Relied on but unverified: view_component 4.20's minor changes beyond the component specs' surface, and msgpack behavior (unused directly, untested).
3. Falsifier: A runtime or probe failure would falsify this if view_component 4.20 changed component lifecycle behavior not exercised by the component/system specs, or if faraday's patched middleware stack changed error flagging in Flodesk.