chore(deps): bump the dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #5448 · github/explore

dependabot · 2026-11-09T09:56:19Z

Bumps the dependencies group with 7 updates in the / directory:

Package	From	To
faraday	`2.14.4`	`2.15.1`
json	`3.0.2`	`3.1.0`
nokogiri	`1.19.4`	`1.19.7`
rubocop	`1.91.0`	`1.92.2`
fastimage	`2.4.1`	`2.4.3`
httparty	`0.24.2`	`0.24.3`
pry	`0.16.0`	`0.16.1`

Updates faraday from 2.14.4 to 2.15.1

Release notes

Sourced from faraday's releases.

v2.15.1

What's Changed

Decode indexed nested arrays in numeric order by @afurm in lostisland/faraday#1723

Make Connection#dup public and rebuild its middleware stack by @JelF in lostisland/faraday#1718

Fix FrozenError when a frozen URI is passed as the base URL by @hikmetba-bit in lostisland/faraday#1717

[LOW] Bound memory retained by remote header names by @OskarEichler in lostisland/faraday#1698

Apply logging filters to exception messages by @OskarEichler in lostisland/faraday#1702

Preserve response state while releasing callbacks by @OskarEichler in lostisland/faraday#1703

Memoize false option values without recomputing by @OskarEichler in lostisland/faraday#1706

Freeze the default allowed status list by @OskarEichler in lostisland/faraday#1707

Default Connection#support_parallel? to the connection's adapter by @ybai08 in lostisland/faraday#1725

Add integration tests for the Options classes by @iMacTia in lostisland/faraday#1724

Ship only the specs external adapters need by @sampokuokkanen in lostisland/faraday#1726

Preserve false request bodies for JSON encoding by @OskarEichler in lostisland/faraday#1691

Add integration tests for JSON literal request bodies by @iMacTia in lostisland/faraday#1728

Keep header index synchronized across Hash mutations by @OskarEichler in lostisland/faraday#1700

fix: honor include_request: false in all errors by @yykamei in lostisland/faraday#1729

Escape params 2x faster with half the allocations, using CGI.escape by @czj in lostisland/faraday#1727

[MEDIUM] Pin actions used for RubyGems publication by @OskarEichler in lostisland/faraday#1710

[MEDIUM] Lock the RubyGems release dependency graph by @OskarEichler in lostisland/faraday#1712

New Contributors

@afurm made their first contribution in lostisland/faraday#1723

@JelF made their first contribution in lostisland/faraday#1718

@hikmetba-bit made their first contribution in lostisland/faraday#1717

@ybai08 made their first contribution in lostisland/faraday#1725

@sampokuokkanen made their first contribution in lostisland/faraday#1726

@czj made their first contribution in lostisland/faraday#1727

Full Changelog: lostisland/faraday@v2.15.0...v2.15.1

v2.15.0

What's Changed

[LOW] Keep Coveralls token out of pull-request code by @OskarEichler in lostisland/faraday#1711

[LOW] Remove vulnerable docs preview dependencies by @OskarEichler in lostisland/faraday#1714

chore: Use Docsify 5, to avoid the dropped 4.x version series by @olleolleolle in lostisland/faraday#1670

Fix typo in Faraday::Connection#options doc by @Bo98 in lostisland/faraday#1674

Preserve request ports for no_proxy matching by @OskarEichler in lostisland/faraday#1705

Preserve parallel manager across nested batches by @OskarEichler in lostisland/faraday#1704

Reject adapter changes after locking the stack by @OskarEichler in lostisland/faraday#1701

Preserve literal plus signs when decoding URI userinfo by @OskarEichler in lostisland/faraday#1694

Preserve explicit proxy settings when duplicating connections by @OskarEichler in lostisland/faraday#1693

Add GitHub Agentic Workflow for new-issue triage by @iMacTia with @Copilot in lostisland/faraday#1720

Remove unused RackBuilder#adapter_set? by @dpep in lostisland/faraday#1719

Fetch current option values after mutation by @OskarEichler in lostisland/faraday#1690

gemspec: Relax faraday-net_http to < 3.6 by @olleolleolle in lostisland/faraday#1722

New Contributors

@Bo98 made their first contribution in lostisland/faraday#1674

... (truncated)

Commits

0cfec3e Version bump to 2.15.1
2dce78b [MEDIUM] Lock the RubyGems release dependency graph (#1712)
340d3a9 Pin GitHub Actions used by CI and releases (#1710)
41666c6 Escape params 2x faster with half the allocations, using CGI.escape (#1727)
573827e fix: honor include_request: false in all errors
670f3a6 Keep header index synchronized across Hash mutations (#1700)
d494fce Add integration tests for JSON literal request bodies (#1728)
2d923f3 Preserve false request bodies for JSON encoding (#1691)
745b0f3 Ship only the specs external adapters need (#1726)
161010c Rely on derived metadata for integration specs
Additional commits viewable in compare view

Updates json from 3.0.2 to 3.1.0

Changelog

Sourced from json's changelog.

2026-10-13 (3.1.0)

Added rfc8785 generator option to canonicalize the output. Replaces the json-canonicalization with numerous correctness fixes.

Use the rb_len_t type introduced in Ruby 4.1 to allow for proper 64bit support on LP64 platforms (Windows).

JRuby: parser errors now include the position (line, column and the message suffix) as well as json_path, matching the C extension.

Improved the accuracy of parser error's line, column and snipets in presence of multibyte characters.

Fix JSON.load to work correctly when provided a Zlib::GzipReader as IO source.

Reject non-ASCII BINARY strings during JSON generation. This was deprecated since a long time and scheduled to be removed for 3.0.

Commits

a15b2ba Release 3.1.0
d09e383 Refactor rfc8785_sort_keys_proc
e19f7d7 Handle invalid encoding in JSON path keys
78d6a83 parser.c: only update the stack once fully spilled
6ea6201 Fix parsing of number with out of range negative exponents
1b67eb3 Fix parsing of unescaped NULL bytes in strings
c1a4372 ResumableParser: fix handling of incomplete unicode escape
429c109 More hardening against adversarial encode methods
8df32ab Index the generated JSON array by rb_len_t
21193d0 Match rb_hash_bulk_insert fallback to Ruby's declaration
Additional commits viewable in compare view

Updates nokogiri from 1.19.4 to 1.19.7

Release notes

Sourced from nokogiri's releases.

v1.19.7 / 2026-11-02

Fixed

[CRuby] Compile against Ruby 4.1.0-preview1, which defines HAVE_RB_LEN_T but not RB_FIX2LEN. (#3755) @andrewfader

8f5e15d299602456406e1f03a9f3456cceb33a0722811e818d2ee2214eb4c84a  nokogiri-1.19.7-aarch64-linux-gnu.gem
efe0c3602e6e54521bc21c681930ce5568e2d11203de17400710b2b3ca2e4cb4  nokogiri-1.19.7-aarch64-linux-musl.gem
7fd1907125691aa89e838cc91161761c758b4e17bb32f0dd9b5515a82cc759af  nokogiri-1.19.7-arm-linux-gnu.gem
28d0ff0c87b6bb2e56580323a6fb049d5d4a02b94f0958fdd47e9ac146991c77  nokogiri-1.19.7-arm-linux-musl.gem
f27d7f25f4873fbc3aa35a2cc2fb680c98555fec1925348da439d0869d541142  nokogiri-1.19.7-arm64-darwin.gem
3c97c2874993b890386ac487c41578d173e10621d80c2063830d032839487c3b  nokogiri-1.19.7-java.gem
9ab6ea96ab479a5ff391196de73b5abf660926ea7e4c57cb1f35adf754f1d066  nokogiri-1.19.7-x64-mingw-ucrt.gem
508e81e8c5f84aaa240dce981bf1c43faae60808726f0ce7024ee92effc5cafe  nokogiri-1.19.7-x86_64-darwin.gem
25865ccb462f714e712fdf8906fde07849cb6704a808e3d629d75baa5af5dd3b  nokogiri-1.19.7-x86_64-linux-gnu.gem
464d1f3dfb0d53cf54c0c6a7e23e8e91cf68ec3cafc2b27dc4a7682f2d9bf546  nokogiri-1.19.7-x86_64-linux-musl.gem
abe94507c54cb18f872777b16bdca4aad32b1abdc4c52fe843f1c80fbdf992b8  nokogiri-1.19.7.gem

Full Changelog: sparklemotion/nokogiri@v1.19.6...v1.19.7

v1.19.6 / 2026-11-02

Fixed

[JRuby] Parsing or reparenting an HTML4 element that has an xmlns attribute and a child element no longer raises NullPointerException. This was a regression in v1.19.5. (#3753) @flavorjones

746fca23be3cd3f121cabab65cb44c52049e4cf9f0d36e7e8c3c0eb6cc298c57  nokogiri-1.19.6-aarch64-linux-gnu.gem
4a5620da1c52150e0343bd2bba7dbd9b3899b5eb41687dc1942c9092d81e52a3  nokogiri-1.19.6-aarch64-linux-musl.gem
574e50ddd99ed71aaa868027d84eb3b9f051e55fe07ddc844e4fdd654be953fc  nokogiri-1.19.6-arm-linux-gnu.gem
c20ea8d8c92cbaa475f0952f755dea88cf6e3ace8b49d634a0a5385a1feaea10  nokogiri-1.19.6-arm-linux-musl.gem
0a89005ba8cf40c7bd580f4c0873f5f11e5866a99e364764fb59ac6516f560d0  nokogiri-1.19.6-arm64-darwin.gem
4068744c2afb9c2596666a5b02fe633be1c58abb3bf2c9d06c962ede95c55fba  nokogiri-1.19.6-java.gem
b5768c5dab09abe39e6e1329f692db191688398964f7d2c18caaa19aa00f5421  nokogiri-1.19.6-x64-mingw-ucrt.gem
8f15f820fa1373d8685ae48cdd8020d923b4104db74d149d1235ddae956469a6  nokogiri-1.19.6-x86_64-darwin.gem
ad1e228c3bc873e4f4fc4f845d7e37b4d3648af537acd7b5e8463cce5693065b  nokogiri-1.19.6-x86_64-linux-gnu.gem
c92b29e897f4ddc19bea67188695aab667f695e74592a5c8741642ecb25d34d9  nokogiri-1.19.6-x86_64-linux-musl.gem
a61e7192fc2691c23bc0241907c4dbcb70ada6ab904796ce2426a57171022c8f  nokogiri-1.19.6.gem
</tr></table>

... (truncated)

Changelog

Sourced from nokogiri's changelog.

v1.19.7 / 2026-11-02

Fixed

[CRuby] Compile against Ruby 4.1.0-preview1, which defines HAVE_RB_LEN_T but not RB_FIX2LEN. (#3755) @andrewfader

v1.19.6 / 2026-11-02

Fixed

[JRuby] Parsing or reparenting an HTML4 element that has an xmlns attribute and a child element no longer raises NullPointerException. This was a regression in v1.19.5. (#3753) @flavorjones

v1.19.5 / 2026-11-01

Security

[CRuby] (Low) Fixed a possible use-after-free when an attribute value is replaced via Node#[]= or Node#lang= while Ruby objects still reference the attribute's children. See GHSA-3w22-6jfg-527w for more information.

[CRuby] (Low) The HTML5 serializer now escapes text inside noscript unless the document was parsed with parse_noscript_content_as_text: true, preventing a mutation XSS in applications that allow noscript in sanitized HTML. A fragment now parses noscript content the same way as its document, and raises ArgumentError if given a conflicting parse_noscript_content_as_text: value. Comments and raw-text elements inside noscript are still serialized unchanged, as the HTML standard requires, so applications that sanitize HTML and allow noscript should parse with parse_noscript_content_as_text: true or remove noscript elements. See GHSA-4p39-36wj-23h4 for more information.

[JRuby] (Low) NONET now blocks external DTDs and entities whose systemId uses a short-form IPv4 host such as 127.1, or is an absolute path in a document parsed from a network URL. Previously Nokogiri fetched them over the network during a parse with DTDLOAD or NOENT, potentially enabling SSRF. See GHSA-v995-44v6-5fqm for more information.

Improved

[CRuby] The HTML5 parser now has linear performance when parsing many attributes. Previously performance was quadratic due to two hotspots, one in detecting duplicate attributes and one in constructing the libxml2 data structures. (#3393) @flavorjones

[CRuby] Improved XPath argument marshalling performance by using ALLOCV_N instead of rb_gc_register_address. (#3648) @jhawthorn

Fixed

Node#namespace= now declares the namespace on the node when no declaration of its prefix is in scope there. Previously, on CRuby, a node given a namespace and then moved under an element that binds the same prefix, or the default namespace, to a different URI was serialized in that other namespace. On JRuby, the namespace was missing from Node#namespace_definitions. (#3459, #3462) @flavorjones

XML::Reader is no longer affected by changes made to its source String after the reader is created. Previously, such a change could make the reader parse the changed String on JRuby, or changed or freed memory on CRuby with libxml2 < 2.11. (#3694) @flavorjones

Node#namespace = false now raises TypeError. Previously it crashed the process on CRuby and raised ClassCastException on JRuby. (#3719) @flavorjones

XML::XPathContext.new and XML::XPathContext#node= raise TypeError when the argument is not a Node. Previously, on CRuby, most such arguments crashed the process. (#3720) @flavorjones

CSS an+b selectors with a zero or negative step now follow the Selectors spec: :nth-child(0n+3) matches only the third element (previously nothing), 0n-1 matches nothing instead of raising ZeroDivisionError, and -n+0 / -2n match nothing instead of every (or every other) element. @afurm

CSS #id, .class and attribute selectors whose value contains a quote character, such as #it\'s or [a=\'b\'], now match that value. Previously they raised Nokogiri::XML::XPath::SyntaxError or generated an XPath query with a different meaning. An #id selector containing an escaped newline no longer drops the text after it. (#3724, #3727) @flavorjones

CSS :contains() arguments, custom pseudo-class string arguments, and element names containing a CSS escape, such as p:contains('it\'s') or a\-b, now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An element name that is not an XML name after unescaping, such as a\!b, raises Nokogiri::CSS::SyntaxError, except as an unprefixed name in an HTML5 document, where it matches by local name. In ids, classes, attribute values, element names and string arguments, an escape for U+0000, a surrogate, or a code point above U+10FFFF now decodes to U+FFFD, and a vertical tab after a hexadecimal escape is no longer dropped, as CSS Syntax Level 3 requires. (#3728, #3729) @flavorjones

CSS attribute names containing a CSS escape, such as [a\-b], now match. Previously they raised Nokogiri::XML::XPath::SyntaxError. An unprefixed attribute name that cannot be written as an XPath name test after unescaping, such as [\@click] or [\:class], matches an attribute with that exact name in no namespace. The HTML parsers create such attributes. A prefixed one, such as [x|a\!b], raises Nokogiri::CSS::SyntaxError. (#3732, #3735) @flavorjones

[CRuby] The HTML5 serializer escapes < and > in attribute values as < and >, following whatwg/html#6362. Previously they were written literally. (#3529, #3741) @flavorjones

[CRuby] Reparenting removes a node's declaration of a prefix that the new parent binds to the same URI. (#3462) @flavorjones

[CRuby] Builder now correctly builds namespaced nodes that define their own namespace when that ns prefix collides with one defined by the parent (or another ancestor). (#3458, #3461) @flavorjones

[CRuby] Reader.outer_xml and .inner_xml properly capture syntax errors. (#3558) @flavorjones

[CRuby] XML::SAX::PushParser and HTML4::SAX::PushParser keep parsing correctly after GC compaction relocates their SAX parser. (#3665) @zanker

[CRuby] XML::Reader keeps reading correctly when GC compaction runs. Previously, compaction could move the IO or String the reader was created from, and the reader then crashed or parsed the wrong bytes. (#3666, #3668) @zanker

[CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs. Previously, after compaction moved a stylesheet that uses an extension module, a later transform raised an exception or crashed. (#3667) @jeremy

[CRuby] XSLT::Stylesheet#transform passes the correct params when GC compaction runs while it converts a param with #to_str. Previously, compaction could move the bytes of earlier short params, and the transform raised RuntimeError or silently left a param empty. (#3670) @flavorjones

[CRuby] XML::SAX::ParserContext.io and HTML4::SAX::ParserContext.io keep parsing correctly after GC compaction relocates the IO. (#3669) @zanker

[CRuby] Document#canonicalize passes the correct inclusive namespace prefixes when it converts a prefix with #to_str, and when GC compaction runs during canonicalization. Previously, libxml2 could read freed or moved memory, and the output lost namespaces or Ruby crashed. Raising on a prefix with a null byte also no longer leaks memory. (#3714, #3750) @Priyank-gouda678 @flavorjones

[CRuby] XSLT::Stylesheet#transform calls custom XSLT extension functions correctly when GC compaction runs during the transform. Previously, compaction could move an extension handler instance, and a later call to one of its functions raised an exception or crashed. (#3748) @flavorjones

... (truncated)

Commits

cb8cd03 version bump to v1.19.7
51ffdd7 Merge pull request #3756 from sparklemotion/card-940-rb-fix2len-preview1-v1-19-x
0ad11d1 doc: say Ruby 4.1.0-preview1 lacks only RB_FIX2LEN
d884dcf Define RB_NUM2LEN and RB_FIX2LEN independently of HAVE_RB_LEN_T
b0702e6 version bump to v1.19.6
9d2cf65 Merge pull request #3754 from sparklemotion/card-936-jruby-relink-namespace-n...
cbb5855 fix(jruby): avoid NPE on HTML4 elements with an xmlns attribute
724ef47 version bump to v1.19.5
60e801b Merge pull request #3752 from sparklemotion/card-931-v1-19-5-backport
ce1a138 ci: bump ruby/setup-ruby to v1.335.0
Additional commits viewable in compare view

Updates rubocop from 1.91.0 to 1.92.2

Release notes

Sourced from rubocop's releases.

RuboCop v1.92.2

Bug fixes

#16147: Fix a false negative for Lint/RedundantCopDisableDirective when autocorrection shifts lines. ([@koic][])

#16104: Fix a false negative for Style/FloatDivision with a trailing comment. ([@a-lavis][])

#16146: Fix a false positive for Lint/RedundantCopDisableDirective with a repeated disable. ([@koic][])

#16176: Fix a false positive for Style/RaiseArgs with EnforcedStyle: compact and constructor arguments. ([@bbatsov][])

#16183: Fix an error for Layout/RescueEnsureAlignment with index or-assignment. ([@koic][])

#16158: Fix an error for Style/NumericPredicate with a predicate nested in the receiver of another. ([@Starlexxx][])

#16125: Fix an error for Style/RedundantCondition with a nested modifier if. ([@koic][])

#16175: Fix an incorrect autocorrect for Layout/HashAlignment with multiple styles and pairs on one line. ([@bbatsov][])

#16139: Fix an incorrect autocorrect for Layout/LineLength with code after a heredoc opener. ([@koic][])

#16160: Fix an incorrect autocorrect for Layout/SingleLineBlockChain with Style/MapToSet. ([@koic][])

#16002: Fix an incorrect autocorrect for Layout/SpaceBeforeBlockBraces with a brace after a line continuation. ([@Starlexxx][])

#16175: Fix an incorrect autocorrect for Layout/SpaceBeforeBlockBraces with a brace after a heredoc body. ([@bbatsov][])

#16180: Fix an incorrect autocorrect for Lint/InterpolationCheck in a split string. ([@Starlexxx][])

#16143: Fix an incorrect autocorrect for Lint/ParenthesesAsGroupedExpression with a command call operand. ([@koic][])

#16170: Fix an incorrect autocorrect for Lint/RedundantSplatExpansion with Array.new as a method argument. ([@wleeaf][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a binary operator method operand. ([@bbatsov][])

#16150: Fix an incorrect autocorrect for Style/AndOr with a command call that takes a do block. ([@Starlexxx][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a method chained onto a command call's do block. ([@bbatsov][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a negated command call that takes a do block. ([@bbatsov][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a pattern matching, ternary, range or defined? operand. ([@bbatsov][])

#16178: Fix an incorrect autocorrect for Style/AndOr with super called with arguments. ([@bbatsov][])

#16171: Fix an incorrect autocorrect for Style/CaseEquality with a non-numeric range. ([@wleeaf][])

#16127: Fix an incorrect autocorrect for Style/ClassAndModuleChildren with Style/DataInheritance. ([@koic][])

#16154: Fix an incorrect autocorrect for Style/EndlessMethod with modifier cops. ([@koic][])

#16167: Fix an incorrect autocorrect for Style/HashAsLastArrayItem with Layout/MultilineArrayBraceLayout. ([@Starlexxx][])

#16126: Fix an incorrect autocorrect for Style/HashLookupMethod with forwarded or splatted arguments. ([@koic][])

#16163: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with Layout/HeredocArgumentClosingParenthesis. ([@koic][])

#16124: Fix an incorrect autocorrect for Style/MethodDefParentheses with a line continuation. ([@koic][])

#16159: Fix an incorrect autocorrect for Style/ParenthesesAroundCondition with a command call assignment. ([@koic][])

#16137: Fix an incorrect autocorrect for Style/QuotedSymbols with a trailing backslash. ([@koic][])

#16176: Fix an incorrect autocorrect for Style/RaiseArgs compact style with e.class as the exception. ([@bbatsov][])

#16169: Fix an incorrect autocorrect for Style/RaiseArgs with a heredoc message. ([@Starlexxx][])

#16132: Fix an incorrect autocorrect for Style/RaiseArgs with a parenthesized raise. ([@koic][])

#16136: Fix an incorrect autocorrect for Style/ReduceToHash with a heredoc. ([@koic][])

#16162: Fix an incorrect autocorrect for Style/RedundantBegin with a ternary branch. ([@koic][])

#16176: Fix an incorrect autocorrect for Style/RedundantException with a heredoc in a multiline call. ([@bbatsov][])

#16177: Fix an incorrect autocorrect for Style/SingleLineMethods with code after the method's end. ([@bbatsov][])

#16157: Fix an incorrect autocorrect for Style/StringConcatenation when joining parts forms an interpolation. ([@Starlexxx][])

#16161: Fix an incorrect autocorrect for Style/TrailingCommaInArguments with argument forwarding. ([@koic][])

#16182: Fix an infinite loop for Layout/EmptyLinesAfterModuleInclusion with a logical operator. ([@Starlexxx][])

#16138: Fix an infinite loop for Layout/EmptyLinesAroundClassBody with Layout/IndentationWidth. ([@koic][])

#16142: Fix an infinite loop for Layout/EndAlignment with a class or module assigned to a constant. ([@Starlexxx][])

#16128: Fix an infinite loop for Layout/ExtraSpacing with Layout/LineLength. ([@koic][])

#16148: Fix an infinite loop for Layout/SpaceAroundOperators with Layout/LineContinuationSpacing. ([@Starlexxx][])

#16123: Fix an infinite loop for Layout/SpaceAroundOperators with hash rockets aligned on non-adjacent lines. ([@koic][])

#16144: Fix an infinite loop for Layout/SpaceInsideBlockBraces with Layout/BlockAlignment. ([@koic][])

#16145: Fix an infinite loop for Layout/SpaceInsideRangeLiteral with a nested endless range. ([@koic][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.92.2 (2026-10-29)

Bug fixes

#16147: Fix a false negative for Lint/RedundantCopDisableDirective when autocorrection shifts lines. ([@koic][])

#16104: Fix a false negative for Style/FloatDivision with a trailing comment. ([@a-lavis][])

#16146: Fix a false positive for Lint/RedundantCopDisableDirective with a repeated disable. ([@koic][])

#16176: Fix a false positive for Style/RaiseArgs with EnforcedStyle: compact and constructor arguments. ([@bbatsov][])

#16183: Fix an error for Layout/RescueEnsureAlignment with index or-assignment. ([@koic][])

#16158: Fix an error for Style/NumericPredicate with a predicate nested in the receiver of another. ([@Starlexxx][])

#16125: Fix an error for Style/RedundantCondition with a nested modifier if. ([@koic][])

#16175: Fix an incorrect autocorrect for Layout/HashAlignment with multiple styles and pairs on one line. ([@bbatsov][])

#16139: Fix an incorrect autocorrect for Layout/LineLength with code after a heredoc opener. ([@koic][])

#16160: Fix an incorrect autocorrect for Layout/SingleLineBlockChain with Style/MapToSet. ([@koic][])

#16002: Fix an incorrect autocorrect for Layout/SpaceBeforeBlockBraces with a brace after a line continuation. ([@Starlexxx][])

#16175: Fix an incorrect autocorrect for Layout/SpaceBeforeBlockBraces with a brace after a heredoc body. ([@bbatsov][])

#16180: Fix an incorrect autocorrect for Lint/InterpolationCheck in a split string. ([@Starlexxx][])

#16143: Fix an incorrect autocorrect for Lint/ParenthesesAsGroupedExpression with a command call operand. ([@koic][])

#16170: Fix an incorrect autocorrect for Lint/RedundantSplatExpansion with Array.new as a method argument. ([@wleeaf][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a binary operator method operand. ([@bbatsov][])

#16150: Fix an incorrect autocorrect for Style/AndOr with a command call that takes a do block. ([@Starlexxx][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a method chained onto a command call's do block. ([@bbatsov][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a negated command call that takes a do block. ([@bbatsov][])

#16178: Fix an incorrect autocorrect for Style/AndOr with a pattern matching, ternary, range or defined? operand. ([@bbatsov][])

#16178: Fix an incorrect autocorrect for Style/AndOr with super called with arguments. ([@bbatsov][])

#16171: Fix an incorrect autocorrect for Style/CaseEquality with a non-numeric range. ([@wleeaf][])

#16127: Fix an incorrect autocorrect for Style/ClassAndModuleChildren with Style/DataInheritance. ([@koic][])

#16154: Fix an incorrect autocorrect for Style/EndlessMethod with modifier cops. ([@koic][])

#16167: Fix an incorrect autocorrect for Style/HashAsLastArrayItem with Layout/MultilineArrayBraceLayout. ([@Starlexxx][])

#16126: Fix an incorrect autocorrect for Style/HashLookupMethod with forwarded or splatted arguments. ([@koic][])

#16163: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses with Layout/HeredocArgumentClosingParenthesis. ([@koic][])

#16124: Fix an incorrect autocorrect for Style/MethodDefParentheses with a line continuation. ([@koic][])

#16159: Fix an incorrect autocorrect for Style/ParenthesesAroundCondition with a command call assignment. ([@koic][])

#16137: Fix an incorrect autocorrect for Style/QuotedSymbols with a trailing backslash. ([@koic][])

#16176: Fix an incorrect autocorrect for Style/RaiseArgs compact style with e.class as the exception. ([@bbatsov][])

#16169: Fix an incorrect autocorrect for Style/RaiseArgs with a heredoc message. ([@Starlexxx][])

#16132: Fix an incorrect autocorrect for Style/RaiseArgs with a parenthesized raise. ([@koic][])

#16136: Fix an incorrect autocorrect for Style/ReduceToHash with a heredoc. ([@koic][])

#16162: Fix an incorrect autocorrect for Style/RedundantBegin with a ternary branch. ([@koic][])

#16176: Fix an incorrect autocorrect for Style/RedundantException with a heredoc in a multiline call. ([@bbatsov][])

#16177: Fix an incorrect autocorrect for Style/SingleLineMethods with code after the method's end. ([@bbatsov][])

#16157: Fix an incorrect autocorrect for Style/StringConcatenation when joining parts forms an interpolation. ([@Starlexxx][])

#16161: Fix an incorrect autocorrect for Style/TrailingCommaInArguments with argument forwarding. ([@koic][])

#16182: Fix an infinite loop for Layout/EmptyLinesAfterModuleInclusion with a logical operator. ([@Starlexxx][])

#16138: Fix an infinite loop for Layout/EmptyLinesAroundClassBody with Layout/IndentationWidth. ([@koic][])

#16142: Fix an infinite loop for Layout/EndAlignment with a class or module assigned to a constant. ([@Starlexxx][])

#16128: Fix an infinite loop for Layout/ExtraSpacing with Layout/LineLength. ([@koic][])

#16148: Fix an infinite loop for Layout/SpaceAroundOperators with Layout/LineContinuationSpacing. ([@Starlexxx][])

#16123: Fix an infinite loop for Layout/SpaceAroundOperators with hash rockets aligned on non-adjacent lines. ([@koic][])

#16144: Fix an infinite loop for Layout/SpaceInsideBlockBraces with Layout/BlockAlignment. ([@koic][])

... (truncated)

Commits

d6ef1f9 Cut 1.92.2
01d4e47 Update Changelog
75b6eb7 Fix an incorrect autocorrect for Style/RaiseArgs with a heredoc message
00b9402 Fix an incorrect autocorrect for Lint/InterpolationCheck in a split string
3677424 Fix an infinite loop for Layout/SpaceAroundOperators with Layout/LineContinua...
cd52175 Fix a false negative for Style/FloatDivision with a trailing comment
5cf8ab0 [Fix #16168] Fix false positives for Lint/NestedPercentLiteral with format se...
5cd5d75 Fix an infinite loop for Layout/EmptyLinesAfterModuleInclusion with a logic...
ac10ccf Merge pull request #16183 from koic/fix_an_error_for_layout_rescue_ensure_ali...
5c851c2 Fix an error for Layout/RescueEnsureAlignment with index or-assignment
Additional commits viewable in compare view

Updates fastimage from 2.4.1 to 2.4.3

Changelog

Sourced from fastimage's changelog.

Version 2.4.3

24-Oct-2026

FIX: Return nil instead of [nil, nil] for JXL files with no size information

FIX: Reject negative read/skip lengths in the stream reader, fixing a TypeError on JPEGs with a zero-length APP1 segment

Version 2.4.2

24-Oct-2026

FIX: Fix infinite loop when parsing a zero-sized HEIC/AVIF box (#167)

FIX: Fix NoMethodError on rotated HEIC/AVIF files with no size information (#169)

Version 2.4.1

07-Mar-2026

IMPROVED: Improved handling of SVG files

IMPROVED: Fix CI for older Ruby versions

IMPROVED: Add Ruby 4.0 to CI test matrix

IMPROVED: Add compatibility section to README

Version 2.4.0

03-Jan-2025

IMPROVED: Refactor code into multiple files

FIX: error rising from redirects to unknown url scheme

FIX: Handle tiff format with long dimensions values

FIX: Remove problematic dependency on base64 gem

IMPROVED: properties including content_length are fetched more lazily improving performance

Version 2.3.1

01-Apr-2024

FIX: avoid bug where a NoMethodError exception is raised on faulty images

Version 2.3.0

24-Dec-2023

FIX: replace test tiff that triggers Clam-AV

FIX: certain heif files could not be parsed

FEATURE: Adds animated support for png

Version 2.2.7

23-May-2023

... (truncated)

Commits

See full diff in compare view

Updates httparty from 0.24.2 to 0.24.3

Release notes

Sourced from httparty's releases.

v0.24.3

Full Changelog: jnunemaker/httparty@v0.24.2...v0.24.3

Bug Fixes

Support the json gem 3.x, which removed the quirks_mode parser option. (#846)

Fix the MultiXml deprecation warning with multi_xml 0.9+. (#838, thanks @robzolkos)

A UTF-8 byte order mark (BOM) is now stripped from responses that don't declare a charset. Before, a BOM-prefixed JSON response without a charset raised JSON::ParserError. (#852)

A response body that is only a BOM, or a BOM followed by whitespace, now parses to nil like any other blank body, instead of raising or returning the whitespace. (#851, thanks @januththedev)

parsed_response and response.body are separate strings for UTF-8 text responses, as in 0.24.2. (#854)

Performance

raise_on with a Range (e.g. 500..599) checks the range directly instead of building a regex for every code in it. (#843, thanks @MaxLap)

Parsing allocates fewer objects per response. (#854)

Behavi...
Description has been truncated

…dates Bumps the dependencies group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [faraday](https://github.com/lostisland/faraday) | `2.14.4` | `2.15.1` | | [json](https://github.com/ruby/json) | `3.0.2` | `3.1.0` | | [nokogiri](https://github.com/sparklemotion/nokogiri) | `1.19.4` | `1.19.7` | | [rubocop](https://github.com/rubocop/rubocop) | `1.91.0` | `1.92.2` | | [fastimage](https://github.com/sdsykes/fastimage) | `2.4.1` | `2.4.3` | | [httparty](https://github.com/jnunemaker/httparty) | `0.24.2` | `0.24.3` | | [pry](https://github.com/pry/pry) | `0.16.0` | `0.16.1` | Updates `faraday` from 2.14.4 to 2.15.1 - [Release notes](https://github.com/lostisland/faraday/releases) - [Changelog](https://github.com/lostisland/faraday/blob/main/CHANGELOG.md) - [Commits](lostisland/faraday@v2.14.4...v2.15.1) Updates `json` from 3.0.2 to 3.1.0 - [Release notes](https://github.com/ruby/json/releases) - [Changelog](https://github.com/ruby/json/blob/master/CHANGES.md) - [Commits](ruby/json@v3.0.2...v3.1.0) Updates `nokogiri` from 1.19.4 to 1.19.7 - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](sparklemotion/nokogiri@v1.19.4...v1.19.7) Updates `rubocop` from 1.91.0 to 1.92.2 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.91.0...v1.92.2) Updates `fastimage` from 2.4.1 to 2.4.3 - [Changelog](https://github.com/sdsykes/fastimage/blob/master/CHANGELOG) - [Commits](https://github.com/sdsykes/fastimage/commits) Updates `httparty` from 0.24.2 to 0.24.3 - [Release notes](https://github.com/jnunemaker/httparty/releases) - [Changelog](https://github.com/jnunemaker/httparty/blob/main/Changelog.md) - [Commits](jnunemaker/httparty@v0.24.2...v0.24.3) Updates `pry` from 0.16.0 to 0.16.1 - [Release notes](https://github.com/pry/pry/releases) - [Changelog](https://github.com/pry/pry/blob/master/CHANGELOG.md) - [Commits](pry/pry@v0.16.0...v0.16.1) --- updated-dependencies: - dependency-name: faraday dependency-version: 2.15.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: json dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: nokogiri dependency-version: 1.19.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: rubocop dependency-version: 1.92.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: fastimage dependency-version: 2.4.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: httparty dependency-version: 0.24.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: pry dependency-version: 0.16.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

🟢 Approval recommended

No outstanding review issues are identified for the dependency updates confined to the Gemfile and resolved lockfile.

No open issues 🎉

What changed in this PR

Updates the Ruby dependency set with seven newer releases, preserving compatibility with Ruby 3.4.1 and the existing tooling.

Changes:

Bumps Faraday, JSON, Nokogiri, RuboCop, FastImage, HTTParty, and Pry.
Refreshes related transitive and platform-specific dependencies.
Updates dependency declarations and the resolved lockfile graph.

File	Summary
`Gemfile`	Updates direct dependency versions and constraints.
`Gemfile.lock`	Records the resolved direct, transitive, and platform-specific dependency updates.

_{Review effort: Lite (auto)}

dependabot Bot requested a review from a team as a code owner November 9, 2026 09:56

dependabot Bot added bundler dependabot labels Nov 9, 2026

Copilot AI auto review requested due to automatic review settings November 9, 2026 09:56

dependabot Bot added the dependencies label Nov 9, 2026

Copilot started reviewing November 9, 2026 09:56

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore(deps): bump the dependencies group across 1 directory with 7 updates - #5448

chore(deps): bump the dependencies group across 1 directory with 7 updates#5448
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/dependencies-1e3c7a1bc2

dependabot Bot commented on behalf of github Nov 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Nov 9, 2026

v2.15.1

What's Changed

New Contributors

v2.15.0

What's Changed

New Contributors

2026-10-13 (3.1.0)

v1.19.7 / 2026-11-02

Fixed

v1.19.6 / 2026-11-02

Fixed

v1.19.7 / 2026-11-02

Fixed

v1.19.6 / 2026-11-02

Fixed

v1.19.5 / 2026-11-01

Security

Improved

Fixed

RuboCop v1.92.2

Bug fixes

1.92.2 (2026-10-29)

Bug fixes

v0.24.3

Bug Fixes

Performance

Behavi... Description has been truncated

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Behavi...
Description has been truncated