build(deps): bump the bundler group with 9 updates by dependabot[bot] · Pull Request #1064 · MikeMcQuaid/strap

dependabot · 2026-09-04T08:06:54Z

Bumps the bundler group with 9 updates:

Package	From	To
sorbet-runtime	`0.6.13433`	`0.6.13454`
rubocop	`1.89.0`	`1.90.0`
rubocop-sorbet	`0.14.0`	`0.15.0`
sorbet	`0.6.13433`	`0.6.13454`
sorbet-static-and-runtime	`0.6.13433`	`0.6.13454`
net-protocol	`0.2.2`	`0.3.0`
rbs	`4.1.3`	`4.2.0`
require-hooks	`0.4.1`	`0.5.1`
sorbet-static	`0.6.13433`	`0.6.13454`

Updates sorbet-runtime from 0.6.13433 to 0.6.13454

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.6.13453.20260827153016-8b0a71ff8

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13453', :group => :development
gem 'sorbet-runtime', '0.6.13453'
sorbet 0.6.13452.20260827121448-b0e749cd0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13452', :group => :development
gem 'sorbet-runtime', '0.6.13452'
sorbet 0.6.13451.20260827114157-c8a7b977e

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13451', :group => :development
gem 'sorbet-runtime', '0.6.13451'
sorbet 0.6.13450.20260827112108-257c924ba

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13450', :group => :development
gem 'sorbet-runtime', '0.6.13450'
sorbet 0.6.13449.20260826113755-1b9d41e16

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13449', :group => :development
gem 'sorbet-runtime', '0.6.13449'
sorbet 0.6.13448.20260826140853-26a713681

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13448', :group => :development
gem 'sorbet-runtime', '0.6.13448'
sorbet 0.6.13447.20260826102833-3f35a9cc3

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13447', :group => :development
gem 'sorbet-runtime', '0.6.13447'
sorbet 0.6.13446.20260826092600-a46765e7c

... (truncated)

Commits

See full diff in compare view

Updates rubocop from 1.89.0 to 1.90.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.90.0

New features

#15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@bbatsov][])

#9505: Add disable-next directives scoped to the following statement. ([@bbatsov][])

#15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@bbatsov][])

#15523: Add new Lint/ArgumentMismatch cop. ([@bbatsov][])

#15594: Add new Lint/SuperArgumentMismatch cop. ([@bbatsov][])

#15581: Add new Style/TimeNow cop. ([@Starlexxx][])

#15111: Add NumberOfEmptyLines option to Layout/EmptyLineAfterMagicComment to configure the minimum number of empty lines required after magic comments. ([@alejofraga][])

#13037: Add --report-unused-todo-entries to catch rotting todo files. ([@bbatsov][])

#15559: Add new Style/DirectiveScope cop to flag disable/enable pairs and disable-only push/pop scopes that wrap a single statement and can use disable-next instead. ([@bbatsov][])

#15547: Make Lint/RedundantCopEnableDirective flag # rubocop:pop directives without a matching # rubocop:push. ([@bbatsov][])

Bug fixes

#15584: Fix a crash in Lint/NameTypo and Lint/UnusedPrivateMethod on string literals with invalid encoding. ([@bbatsov][])

#15541: Fix a false negative for Lint/OutOfRangeRegexpRef when a preceding element access with a non-string literal argument (e.g. hash[:key]) discarded the tracked capture count. ([@koic][])

#7958: Add todo comments for skipped unsafe corrections with --disable-uncorrectable. ([@bbatsov][])

#15569: Fix an error for the built-in language server when a workspace/executeCommand request has no document URI in its arguments. ([@koic][])

#15410: Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName. ([@bbatsov][])

#15576: Fix an incorrect autocorrect for Style/Sample when shuffle is given a random: argument; the offense is still reported but no longer autocorrected, since shuffle and sample consume a seeded generator differently and would select different elements. ([@koic][])

#15590: Fix an infinite loop error for Layout/FirstArgumentIndentation when EnforcedStyle: with_fixed_indentation is specified for Layout/ArgumentAlignment and Layout/FirstMethodArgumentLineBreak is enabled with AllowMultilineFinalElement: true. ([@Starlexxx][])

#15588: Fix RuboCop::Cop::IgnoredMethods and RuboCop::Cop::IgnoredPattern being unreachable after require 'rubocop'. ([@SeanLF][])

#8349: Don't autocorrect away directives for unknown cops. ([@bbatsov][])

#7894: Don't flag disables of pending cops as redundant. ([@bbatsov][])

#9963: Fix false negatives for Layout/ExtraSpacing. ([@Starlexxx][])

#15525: Fix false negatives in Layout/LineLength when a constant path like Http::UploadedFile matches URISchemes case-insensitively. ([@koic][])

#13941: Fix false positives for Lint/UselessConstantScoping when assigning with Class.new, Module.new, Struct.new, or Data.define after private. ([@pdobb][])

#15526: Fix false positives in Layout/MultilineMethodCallIndentation when a line has multiple single-line blocks before a multiline block. ([@koic][])

#15538: Fix false positives in Lint/ConstantReassignment when a constant is assigned in compact-style namespaces (e.g. module A::B). ([@alex-tan][])

#15517: Fix false positives in Lint/RedundantSafeNavigation when InferNonNilReceiver is enabled and the receiver name is rebound by a nested block (it or a shadowed block parameter). ([@koic][])

#15572: Fix RuboCop::Cop::Registry#freeze to freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@koic][])

#15585: Make Lint/DuplicateMethods honor silence_redefinition_of_method and redefine_method as intentional redefinitions. ([@bbatsov][])

#15558: Fix --display-suppressed reporting a nil justification when the offense is loaded from the result cache. ([@corsonknowles][])

#10449: Fix Layout/ClassStructure autocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@koic][])

#15568: Fix Lint/NameTypo registering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@HoneyryderChuck][])

#15556: Fix Lint/UnusedPrivateMethod retaining every past project_index object it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such as rubocop --server. ([@bquorning][])

#10046: Fix Lint/UselessMethodDefinition false positive for methods with **kwargs. ([@bbatsov][])

#15589: Fix --lsp and --mcp being silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@koic][])

#11148: Merge department and cop-level Exclude settings. ([@bbatsov][])

#15531: Fix a regression in RuboCop 1.89 where the modifier cops could produce lines longer than Layout/LineLength Max when exemptions like AllowedPatterns matched the result. ([@bbatsov][])

#15574: Fix an incorrect warning such as AllCops does not support TargetRailsVersion parameter when a plugin declares a custom AllCops key with a nil value and another plugin is loaded after it. ([@koic][])

#9543: Preserve escape notation in Style/StringConcatenation autocorrect. ([@bbatsov][])

#11119: Preserve persistent cop instances across files. ([@Eljees][])

#13022: Fix rubocop . (and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower than rubocop in projects with large ignored trees. ([@bbatsov][])

#15561: Fix Lint/RedundantCopDisableDirective and Lint/RedundantCopEnableDirective leaving a directive's -- reason behind when removing the directive. ([@corsonknowles][])

#15593: Fix false positives for Lint/UnusedPrivateMethod for private definitions of Ruby runtime hooks like inherited and const_missing. ([@bbatsov][])

#15547: Make Lint/MissingCopEnableDirective suggest # rubocop:pop instead of # rubocop:enable for an unclosed # rubocop:push. ([@bbatsov][])

#14379: Suppress multi-line offenses with a directive on any of their lines. ([@bbatsov][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.90.0 (2026-08-24)

New features

#15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@bbatsov][])

#9505: Add disable-next directives scoped to the following statement. ([@bbatsov][])

#15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@bbatsov][])

#15523: Add new Lint/ArgumentMismatch cop. ([@bbatsov][])

#15594: Add new Lint/SuperArgumentMismatch cop. ([@bbatsov][])

#15581: Add new Style/TimeNow cop. ([@Starlexxx][])

#15111: Add NumberOfEmptyLines option to Layout/EmptyLineAfterMagicComment to configure the minimum number of empty lines required after magic comments. ([@alejofraga][])

#13037: Add --report-unused-todo-entries to catch rotting todo files. ([@bbatsov][])

#15559: Add new Style/DirectiveScope cop to flag disable/enable pairs and disable-only push/pop scopes that wrap a single statement and can use disable-next instead. ([@bbatsov][])

#15547: Make Lint/RedundantCopEnableDirective flag # rubocop:pop directives without a matching # rubocop:push. ([@bbatsov][])

Bug fixes

#15584: Fix a crash in Lint/NameTypo and Lint/UnusedPrivateMethod on string literals with invalid encoding. ([@bbatsov][])

#15541: Fix a false negative for Lint/OutOfRangeRegexpRef when a preceding element access with a non-string literal argument (e.g. hash[:key]) discarded the tracked capture count. ([@koic][])

#7958: Add todo comments for skipped unsafe corrections with --disable-uncorrectable. ([@bbatsov][])

#15569: Fix an error for the built-in language server when a workspace/executeCommand request has no document URI in its arguments. ([@koic][])

#15410: Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName. ([@bbatsov][])

#15576: Fix an incorrect autocorrect for Style/Sample when shuffle is given a random: argument; the offense is still reported but no longer autocorrected, since shuffle and sample consume a seeded generator differently and would select different elements. ([@koic][])

#15590: Fix an infinite loop error for Layout/FirstArgumentIndentation when EnforcedStyle: with_fixed_indentation is specified for Layout/ArgumentAlignment and Layout/FirstMethodArgumentLineBreak is enabled with AllowMultilineFinalElement: true. ([@Starlexxx][])

#15588: Fix RuboCop::Cop::IgnoredMethods and RuboCop::Cop::IgnoredPattern being unreachable after require 'rubocop'. ([@SeanLF][])

#8349: Don't autocorrect away directives for unknown cops. ([@bbatsov][])

#7894: Don't flag disables of pending cops as redundant. ([@bbatsov][])

#9963: Fix false negatives for Layout/ExtraSpacing. ([@Starlexxx][])

#15525: Fix false negatives in Layout/LineLength when a constant path like Http::UploadedFile matches URISchemes case-insensitively. ([@koic][])

#13941: Fix false positives for Lint/UselessConstantScoping when assigning with Class.new, Module.new, Struct.new, or Data.define after private. ([@pdobb][])

#15526: Fix false positives in Layout/MultilineMethodCallIndentation when a line has multiple single-line blocks before a multiline block. ([@koic][])

#15538: Fix false positives in Lint/ConstantReassignment when a constant is assigned in compact-style namespaces (e.g. module A::B). ([@alex-tan][])

#15517: Fix false positives in Lint/RedundantSafeNavigation when InferNonNilReceiver is enabled and the receiver name is rebound by a nested block (it or a shadowed block parameter). ([@koic][])

#15572: Fix RuboCop::Cop::Registry#freeze to freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@koic][])

#15585: Make Lint/DuplicateMethods honor silence_redefinition_of_method and redefine_method as intentional redefinitions. ([@bbatsov][])

#15558: Fix --display-suppressed reporting a nil justification when the offense is loaded from the result cache. ([@corsonknowles][])

#10449: Fix Layout/ClassStructure autocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@koic][])

#15568: Fix Lint/NameTypo registering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@HoneyryderChuck][])

#15556: Fix Lint/UnusedPrivateMethod retaining every past project_index object it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such as rubocop --server. ([@bquorning][])

#10046: Fix Lint/UselessMethodDefinition false positive for methods with **kwargs. ([@bbatsov][])

#15589: Fix --lsp and --mcp being silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@koic][])

#11148: Merge department and cop-level Exclude settings. ([@bbatsov][])

#15531: Fix a regression in RuboCop 1.89 where the modifier cops could produce lines longer than Layout/LineLength Max when exemptions like AllowedPatterns matched the result. ([@bbatsov][])

#15574: Fix an incorrect warning such as AllCops does not support TargetRailsVersion parameter when a plugin declares a custom AllCops key with a nil value and another plugin is loaded after it. ([@koic][])

#9543: Preserve escape notation in Style/StringConcatenation autocorrect. ([@bbatsov][])

#11119: Preserve persistent cop instances across files. ([@Eljees][])

#13022: Fix rubocop . (and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower than rubocop in projects with large ignored trees. ([@bbatsov][])

#15561: Fix Lint/RedundantCopDisableDirective and Lint/RedundantCopEnableDirective leaving a directive's -- reason behind when removing the directive. ([@corsonknowles][])

#15593: Fix false positives for Lint/UnusedPrivateMethod for private definitions of Ruby runtime hooks like inherited and const_missing. ([@bbatsov][])

#15547: Make Lint/MissingCopEnableDirective suggest # rubocop:pop instead of # rubocop:enable for an unclosed # rubocop:push. ([@bbatsov][])

... (truncated)

Commits

f1b25e1 Cut 1.90
72895f6 Update Changelog
7042de6 Move op_method? before the shadowing helpers
4b14dd2 Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName
5d221ac [Fix #10046] Fix Lint/UselessMethodDefinition false positive for methods wi...
5070fc3 [Fix #15111] Add NumberOfEmptyLines option to `Layout/EmptyLineAfterMagicCo...
496eb65 [Fix #9543] Preserve escape notation in Style/StringConcatenation autocorrect
75b3622 Remove a directive's -- reason along with the directive
858d8a8 Merge pull request #15596 from koic/add_real_last_column_to_offense
15557b0 Add Offense#real_last_column and use it in JSONFormatter
Additional commits viewable in compare view

Updates rubocop-sorbet from 0.14.0 to 0.15.0

Release notes

Sourced from rubocop-sorbet's releases.

v0.15.0

What's Changed

🛠 Other Changes

Add Sorbet/StructPropName cop by @Guflly in Shopify/rubocop-sorbet#393

Add autocorrect for RBS comments ↔ sig blocks signatures by @Morriar in Shopify/rubocop-sorbet#397

Add Sorbet/ForbidTBindInAssignment by @Morriar in Shopify/rubocop-sorbet#398

Support root-scoped T.bind calls by @Morriar in Shopify/rubocop-sorbet#399

Reject spaced RBS comment markers by @Morriar in Shopify/rubocop-sorbet#402

Add AutocorrectStyle: rbs to Sorbet/ForbidTStruct by @rafaelfranca in Shopify/rubocop-sorbet#395

Extend RedundantTLetForLiteral to trailing RBS annotations by @Morriar in Shopify/rubocop-sorbet#401

Autocorrect T.bind to RBS self assertions by @Morriar in Shopify/rubocop-sorbet#400

Remove obsolete RBS marker spacing test by @Morriar in Shopify/rubocop-sorbet#408

Autocorrect T.absurd to RBS assertions by @Morriar in Shopify/rubocop-sorbet#403

Autocorrect T.cast to RBS assertions by @Morriar in Shopify/rubocop-sorbet#406

Autocorrect T.let to RBS annotations by @Morriar in Shopify/rubocop-sorbet#407

Autocorrect T.unsafe to RBS assertions by @Morriar in Shopify/rubocop-sorbet#404

Autocorrect inline else T.absurd calls by @Morriar in Shopify/rubocop-sorbet#409

Autocorrect T.must to RBS assertions by @Morriar in Shopify/rubocop-sorbet#405

New Contributors

@Guflly made their first contribution in Shopify/rubocop-sorbet#393

Full Changelog: Shopify/rubocop-sorbet@v0.14.0...v0.15.0

Commits

a88afd4 Release v0.15.0
c3e4550 Merge pull request #405 from Shopify/t-must-rbs-autocorrection
946e63b Add trailing comment autocorrection test
673b342 Merge pull request #409 from Shopify/t-absurd-inline-else
0dac722 Test inline unless absurd autocorrection
6979d2e Handle inline if else T.absurd autocorrection
0ce61e7 Autocorrect inline else T.absurd calls
6468538 Merge pull request #404 from Shopify/t-unsafe-rbs-autocorrection
5a5dc70 Merge pull request #407 from Shopify/t-let-rbs-autocorrection
9cf7734 Merge pull request #406 from Shopify/t-cast-rbs-autocorrection
Additional commits viewable in compare view

Updates sorbet from 0.6.13433 to 0.6.13454

Release notes

Sourced from sorbet's releases.

sorbet 0.6.13453.20260827153016-8b0a71ff8

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13453', :group => :development
gem 'sorbet-runtime', '0.6.13453'
sorbet 0.6.13452.20260827121448-b0e749cd0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13452', :group => :development
gem 'sorbet-runtime', '0.6.13452'
sorbet 0.6.13451.20260827114157-c8a7b977e

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13451', :group => :development
gem 'sorbet-runtime', '0.6.13451'
sorbet 0.6.13450.20260827112108-257c924ba

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13450', :group => :development
gem 'sorbet-runtime', '0.6.13450'
sorbet 0.6.13449.20260826113755-1b9d41e16

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13449', :group => :development
gem 'sorbet-runtime', '0.6.13449'
sorbet 0.6.13448.20260826140853-26a713681

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13448', :group => :development
gem 'sorbet-runtime', '0.6.13448'
sorbet 0.6.13447.20260826102833-3f35a9cc3

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13447', :group => :development
gem 'sorbet-runtime', '0.6.13447'
sorbet 0.6.13446.20260826092600-a46765e7c

... (truncated)

Commits

See full diff in compare view

Updates sorbet-static-and-runtime from 0.6.13433 to 0.6.13454

Release notes

Sourced from sorbet-static-and-runtime's releases.

sorbet 0.6.13453.20260827153016-8b0a71ff8

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13453', :group => :development
gem 'sorbet-runtime', '0.6.13453'
sorbet 0.6.13452.20260827121448-b0e749cd0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13452', :group => :development
gem 'sorbet-runtime', '0.6.13452'
sorbet 0.6.13451.20260827114157-c8a7b977e

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13451', :group => :development
gem 'sorbet-runtime', '0.6.13451'
sorbet 0.6.13450.20260827112108-257c924ba

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13450', :group => :development
gem 'sorbet-runtime', '0.6.13450'
sorbet 0.6.13449.20260826113755-1b9d41e16

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13449', :group => :development
gem 'sorbet-runtime', '0.6.13449'
sorbet 0.6.13448.20260826140853-26a713681

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13448', :group => :development
gem 'sorbet-runtime', '0.6.13448'
sorbet 0.6.13447.20260826102833-3f35a9cc3

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13447', :group => :development
gem 'sorbet-runtime', '0.6.13447'
sorbet 0.6.13446.20260826092600-a46765e7c

... (truncated)

Commits

See full diff in compare view

Updates net-protocol from 0.2.2 to 0.3.0

Release notes

Sourced from net-protocol's releases.

v0.3.0

What's Changed

Provide a 'Changelog' link on rubygems.org/gems/net-protocol by @mark-young-atg in ruby/net-protocol#29

Enabled trusted publisher for rubygems.org by @hsbt in ruby/net-protocol#33

Add a workflow to sync commits to ruby/ruby by @hsbt in ruby/net-protocol#39

Add Net::Protocol::TCP_SOCKET_NEW_HAS_OPEN_TIMEOUT by @eregon in ruby/net-protocol#43

Fix readuntil missing a terminator that spans two reads by @hsbt in ruby/net-protocol#66

Add limit option to Net::BufferedIO#readuntil by @hsbt in ruby/net-protocol#67

New Contributors

@mark-young-atg made their first contribution in ruby/net-protocol#29

@eregon made their first contribution in ruby/net-protocol#43

Full Changelog: ruby/net-protocol@v0.2.2...v0.3.0

Commits

fb347d5 v0.3.0
74c2348 Merge pull request #67 from ruby/readuntil-limit
6ffd258 Trim the comments added with the readuntil rewind
e1b38d9 Add limit option to Net::BufferedIO#readuntil
716719e Merge pull request #66 from ruby/readuntil-chunk-boundary
0dbbaea Ignore Gemfile.lock
215cc35 Add regression tests for the readuntil rewind
84ef3ab Fix readuntil missing a terminator that spans two reads
c1d4563 Merge pull request #65 from ruby/dependabot/github_actions/rubygems/release-g...
0c9e23b Bump rubygems/release-gem from 1.4.0 to 1.4.1
Additional commits viewable in compare view

Updates rbs from 4.1.3 to 4.2.0

Release notes

Sourced from rbs's releases.

4.2.0

Release note

RBS 4.2 accepts non-ASCII characters in identifiers. Method names, instance variable names and parameter names can be written in any script, and other names may contain non-ASCII characters as long as they start with an ASCII letter, which is what tells a constant from a method name.
class Greeter
  @挨拶: String
def こんにちは: () -> String
end
The parser and the AST support Ruby-style ... forwarding parameters in method types, but the layers built on top of the parser do not yet. The syntax is disabled by default in 4.2 and is not enabled by the public RBS::Parser API, so it cannot be used in regular RBS signatures yet.

Ruby 3.2 reached EOL on 2026-04-01, and this release requires Ruby 3.3 or later. Applications on 3.2 stay on the 4.1 line.

Signature updates

Updated classes/modules/methods: ERB, ERB::DefMethod, IO, Monitor, MonitorMixin::ConditionVariable, Singleton, StringIO, Zlib::GzipFile, Zlib::GzipWriter

Replace deterministic untyped return types with concrete types (#2966)

Declare Singleton::SingletonInstanceMethods (#3037)

Language updates

Gate forwarding parameter syntax behind parser option (#3087)

Support non-ASCII identifiers (#3082)

Support forwarding parameters in method types (#3042)

Library changes

Drop runtime support for Ruby 3.2 (#3095)

Stop the lexer reading past the end of a byte_range (#3040)

Exclude CR from comment tokens to fix an off-by-one Location#end_line on CRLF files (#3069)

Handle the NULL parser in the WebAssembly shim (#3085)

Reject a byte position the lexer cannot start on (#3083)

Don't use Clang nullability qualifiers in strict ISO C mode (#3074)

Avoid eagerly inspecting call traces in type assertions (#3073)

Fix TypeParam.rename to substitute variables in bounds and default types (#3068)

Extract per-declaration type param alignment into entry-level align_params (#3070)

Align type params across declarations in module-self types and superclass validation (#3067)

Build the wasm module with -DNDEBUG (#3066)

Rename NODISCARD macro to RBS_NODISCARD (#3065)

Miscellaneous

Omit forwarding parameter tests on JRuby (#3092)

Skip JSON 2-only tests with JSON 3 (#3084)

Pin GitHub Actions to commit hashes (#3020)

... (truncated)

Changelog

Sourced from rbs's changelog.

4.2.0 (2026-08-23)

RBS 4.2 accepts non-ASCII characters in identifiers. Method names, instance variable names and parameter names can be written in any script, and other names may contain non-ASCII characters as long as they start with an ASCII letter, which is what tells a constant from a method name.
class Greeter
  @挨拶: String
def こんにちは: () -> String
end
The parser and the AST support Ruby-style ... forwarding parameters in method types, but the layers built on top of the parser do not yet. The syntax is disabled by default in 4.2 and is not enabled by the public RBS::Parser API, so it cannot be used in regular RBS signatures yet.

Ruby 3.2 reached EOL on 2026-04-01, and this release requires Ruby 3.3 or later. Applications on 3.2 stay on the 4.1 line.

Signature updates

Updated classes/modules/methods: ERB, ERB::DefMethod, IO, Monitor, MonitorMixin::ConditionVariable, Singleton, StringIO, Zlib::GzipFile, Zlib::GzipWriter

Replace deterministic untyped return types with concrete types (#2966)

Declare Singleton::SingletonInstanceMethods (#3037)

Language updates

Gate forwarding parameter syntax behind parser option (#3087)

Support non-ASCII identifiers (#3082)

Support forwarding parameters in method types (#3042)

Library changes

Drop runtime support for Ruby 3.2 (#3095)

Stop the lexer reading past the end of a byte_range (#3040)

Exclude CR from comment tokens to fix an off-by-one Location#end_line on CRLF files (#3069)

Handle the NULL parser in the WebAssembly shim (#3085)

Reject a byte position the lexer cannot start on (#3083)

Don't use Clang nullability qualifiers in strict ISO C mode (#3074)

Avoid eagerly inspecting call traces in type assertions (#3073)

Fix TypeParam.rename to substitute variables in bounds and default types (#3068)

Extract per-declaration type param alignment into entry-level align_params (#3070)

Align type params across declarations in module-self types and superclass validation (#3067)

Build the wasm module with -DNDEBUG (#3066)

Rename NODISCARD macro to RBS_NODISCARD (#3065)

Miscellaneous

Omit forwarding parameter tests on JRuby (#3092)

Skip JSON 2-only tests with JSON 3 (#3084)

Pin GitHub Actions to commit hashes (#3020)

Commits

8aee3b6 Merge pull request #3096 from ruby/claude/4-2-release-tasks-h6thzx
6f97c87 Version 4.2.0
03d4281 Merge pull request #2966 from zonuexe/fix/concrete-untyped-returns
bdecacf Make putc signatures type-preserving overloads
69539d6 Replace deterministic untyped return types with concrete types
c9957e4 Merge pull request #3037 from infiton/rxc/declare-singleton-instance-methods
1f40487 Merge pull request #3095 from ruby/claude/4-2-release-tasks-h6thzx
e721ad1 Drop runtime support for Ruby 3.2
584b4cf Merge pull request #3092 from ruby/claude/rbs-ci-failure-sinnfd
e709673 Merge pull request #3090 from ruby/claude/release-4-2-0-pre-1-vyzb7g
Additional commits viewable in compare view

Updates require-hooks from 0.4.1 to 0.5.1

Changelog

Sourced from require-hooks's changelog.

0.5.1 (2026-08-26)

Add RequireHooks::Bootsnap.add_version_hash for external cache inputs.

0.5.0 (2026-08-26)

Use Bootsnap compiler namespaces for cache invalidation without changing Bootsnap's cache directory.

Commits

602f718 Bump 0.5.1
493070b + bootsnap: external Bootsnap cache inputs (#6)
d82daa8 Bump 0.5.0
483e617 Use Bootsnap compiler namespaces for hook caches (#5)
9238cda Fix Bootsnap version hash override
See full diff in compare view

Updates sorbet-static from 0.6.13433 to 0.6.13454

Release notes

Sourced from sorbet-static's releases.

sorbet 0.6.13453.20260827153016-8b0a71ff8

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13453', :group => :development
gem 'sorbet-runtime', '0.6.13453'
sorbet 0.6.13452.20260827121448-b0e749cd0

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13452', :group => :development
gem 'sorbet-runtime', '0.6.13452'
sorbet 0.6.13451.20260827114157-c8a7b977e

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13451', :group => :development
gem 'sorbet-runtime', '0.6.13451'
sorbet 0.6.13450.20260827112108-257c924ba

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13450', :group => :development
gem 'sorbet-runtime', '0.6.13450'
sorbet 0.6.13449.20260826113755-1b9d41e16

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13449', :group => :development
gem 'sorbet-runtime', '0.6.13449'
sorbet 0.6.13448.20260826140853-26a713681

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13448', :group => :development
gem 'sorbet-runtime', '0.6.13448'
sorbet 0.6.13447.20260826102833-3f35a9cc3

To use Sorbet add this line to your Gemfile:
gem 'sorbet', '0.6.13447', :group => :development
gem 'sorbet-runtime', '0.6.13447'
sorbet 0.6.13446.20260826092600-a46765e7c

... (truncated)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the bundler group with 9 updates: | Package | From | To | | --- | --- | --- | | [sorbet-runtime](https://github.com/sorbet/sorbet) | `0.6.13433` | `0.6.13454` | | [rubocop](https://github.com/rubocop/rubocop) | `1.89.0` | `1.90.0` | | [rubocop-sorbet](https://github.com/shopify/rubocop-sorbet) | `0.14.0` | `0.15.0` | | [sorbet](https://github.com/sorbet/sorbet) | `0.6.13433` | `0.6.13454` | | [sorbet-static-and-runtime](https://github.com/sorbet/sorbet) | `0.6.13433` | `0.6.13454` | | [net-protocol](https://github.com/ruby/net-protocol) | `0.2.2` | `0.3.0` | | [rbs](https://github.com/ruby/rbs) | `4.1.3` | `4.2.0` | | [require-hooks](https://github.com/ruby-next/require-hooks) | `0.4.1` | `0.5.1` | | [sorbet-static](https://github.com/sorbet/sorbet) | `0.6.13433` | `0.6.13454` | Updates `sorbet-runtime` from 0.6.13433 to 0.6.13454 - [Release notes](https://github.com/sorbet/sorbet/releases) - [Commits](https://github.com/sorbet/sorbet/commits) Updates `rubocop` from 1.89.0 to 1.90.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.89.0...v1.90.0) Updates `rubocop-sorbet` from 0.14.0 to 0.15.0 - [Release notes](https://github.com/shopify/rubocop-sorbet/releases) - [Commits](Shopify/rubocop-sorbet@v0.14.0...v0.15.0) Updates `sorbet` from 0.6.13433 to 0.6.13454 - [Release notes](https://github.com/sorbet/sorbet/releases) - [Commits](https://github.com/sorbet/sorbet/commits) Updates `sorbet-static-and-runtime` from 0.6.13433 to 0.6.13454 - [Release notes](https://github.com/sorbet/sorbet/releases) - [Commits](https://github.com/sorbet/sorbet/commits) Updates `net-protocol` from 0.2.2 to 0.3.0 - [Release notes](https://github.com/ruby/net-protocol/releases) - [Commits](ruby/net-protocol@v0.2.2...v0.3.0) Updates `rbs` from 4.1.3 to 4.2.0 - [Release notes](https://github.com/ruby/rbs/releases) - [Changelog](https://github.com/ruby/rbs/blob/master/CHANGELOG.md) - [Commits](ruby/rbs@v4.1.3...v4.2.0) Updates `require-hooks` from 0.4.1 to 0.5.1 - [Changelog](https://github.com/ruby-next/require-hooks/blob/master/CHANGELOG.md) - [Commits](ruby-next/require-hooks@v0.4.1...v0.5.1) Updates `sorbet-static` from 0.6.13433 to 0.6.13454 - [Release notes](https://github.com/sorbet/sorbet/releases) - [Commits](https://github.com/sorbet/sorbet/commits) --- updated-dependencies: - dependency-name: sorbet-runtime dependency-version: 0.6.13454 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: bundler - dependency-name: rubocop dependency-version: 1.90.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler - dependency-name: rubocop-sorbet dependency-version: 0.15.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler - dependency-name: sorbet dependency-version: 0.6.13454 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bundler - dependency-name: sorbet-static-and-runtime dependency-version: 0.6.13454 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: bundler - dependency-name: net-protocol dependency-version: 0.3.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: bundler - dependency-name: rbs dependency-version: 4.2.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: bundler - dependency-name: require-hooks dependency-version: 0.5.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: bundler - dependency-name: sorbet-static dependency-version: 0.6.13454 dependency-type: indirect update-type: version-update:semver-patch dependency-group: bundler ... Signed-off-by: dependabot[bot] <support@github.com>

- `Rails/OutputSafety`: build markup with `safe_join` so every interpolated fragment is escaped rather than trusted - `Style/StringHashKeys`: OmniAuth test mode already injects `omniauth.auth`, so the string-keyed `env` hash was unused, and `OmniAuth::AuthHash` stringifies symbol keys itself - `RSpec/MultipleExpectations`: `include` takes several values - enable `Style/DisableCopsWithinSourceCodeDirective` to keep it that way, which also fixes the new RuboCop 1.90 `Style/DirectiveScope` failure

dependabot Bot added dependencies ruby Pull requests that update Ruby code labels Sep 4, 2026

dependabot Bot and others added 2 commits September 4, 2026 13:23

MikeMcQuaid force-pushed the dependabot/bundler/bundler-bdc314317b branch from 8de760f to 967e5ec Compare September 4, 2026 12:23

MikeMcQuaid merged commit 971e7a2 into main Sep 4, 2026
7 checks passed

MikeMcQuaid deleted the dependabot/bundler/bundler-bdc314317b branch September 4, 2026 12:30

Navigation Menu

Uh oh!

build(deps): bump the bundler group with 9 updates - #1064

build(deps): bump the bundler group with 9 updates#1064
MikeMcQuaid merged 2 commits into
mainfrom
dependabot/bundler/bundler-bdc314317b

dependabot Bot commented on behalf of github Sep 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 4, 2026

sorbet 0.6.13453.20260827153016-8b0a71ff8

sorbet 0.6.13452.20260827121448-b0e749cd0

sorbet 0.6.13451.20260827114157-c8a7b977e

sorbet 0.6.13450.20260827112108-257c924ba

sorbet 0.6.13449.20260826113755-1b9d41e16

sorbet 0.6.13448.20260826140853-26a713681

sorbet 0.6.13447.20260826102833-3f35a9cc3

sorbet 0.6.13446.20260826092600-a46765e7c

RuboCop v1.90.0

New features

Bug fixes

1.90.0 (2026-08-24)

New features

Bug fixes

v0.15.0

What's Changed

🛠 Other Changes

New Contributors

sorbet 0.6.13453.20260827153016-8b0a71ff8

sorbet 0.6.13452.20260827121448-b0e749cd0

sorbet 0.6.13451.20260827114157-c8a7b977e

sorbet 0.6.13450.20260827112108-257c924ba

sorbet 0.6.13449.20260826113755-1b9d41e16

sorbet 0.6.13448.20260826140853-26a713681

sorbet 0.6.13447.20260826102833-3f35a9cc3

sorbet 0.6.13446.20260826092600-a46765e7c

sorbet 0.6.13453.20260827153016-8b0a71ff8

sorbet 0.6.13452.20260827121448-b0e749cd0

sorbet 0.6.13451.20260827114157-c8a7b977e

sorbet 0.6.13450.20260827112108-257c924ba

sorbet 0.6.13449.20260826113755-1b9d41e16

sorbet 0.6.13448.20260826140853-26a713681

sorbet 0.6.13447.20260826102833-3f35a9cc3

sorbet 0.6.13446.20260826092600-a46765e7c

v0.3.0

What's Changed

New Contributors

4.2.0

Signature updates

Language updates

Library changes

Miscellaneous

4.2.0 (2026-08-23)

Signature updates

Language updates

Library changes

Miscellaneous

0.5.1 (2026-08-26)

0.5.0 (2026-08-26)

sorbet 0.6.13453.20260827153016-8b0a71ff8

sorbet 0.6.13452.20260827121448-b0e749cd0

sorbet 0.6.13451.20260827114157-c8a7b977e

sorbet 0.6.13450.20260827112108-257c924ba

sorbet 0.6.13449.20260826113755-1b9d41e16

sorbet 0.6.13448.20260826140853-26a713681

sorbet 0.6.13447.20260826102833-3f35a9cc3

sorbet 0.6.13446.20260826092600-a46765e7c

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant