Bump the bundler group across 1 directory with 13 updates

[dependabot]

Bumps the bundler group with 12 updates in the / directory:

Package	From	To
aws-sdk-s3	1.228.1	1.229.0
bootsnap	1.24.6	1.25.0
devise	4.9.4	5.0.4
newrelic_rpm	10.6.0	10.7.1
pagy	43.6.1	43.6.2
brakeman	8.0.5	8.0.6
rubocop	1.88.2	1.90.0
rubocop-performance	1.26.1	1.27.0
rubocop-rails	2.36.0	2.37.0
rspec-openapi	0.31.0	0.33.1
selenium-webdriver	4.46.0	4.47.0
webmock	3.26.2	3.26.3

Updates aws-sdk-s3 from 1.228.1 to 1.229.0

Changelog

Sourced from aws-sdk-s3's changelog.

1.229.0 (2026-08-06)

• Feature - AWS Backup now lets you create read-only access points for Amazon S3 recovery points, enabling you to access backup data using S3 APIs without initiating a restore.

1.228.2 (2026-07-30)

• Issue - S3 Encryption Client, encryptionV2 and encryptionV3, returns a decryption error for a malformed material description.

Commits

• See full diff in compare view

Updates bootsnap from 1.24.6 to 1.25.0

Release notes

Sourced from bootsnap's releases.

v1.25.0

What's Changed

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Full Changelog: rails/bootsnap@v1.24.6...v1.25.0

Changelog

Sourced from bootsnap's changelog.

1.25.0

• Improve YAML parsing cache to more efficiently handle Time, Date and DateTime.

• Don't invalidate the compile cache when YJIT is toggled. YJIT is a runtime JIT and doesn't change the serialized instruction sequences that are cached, but enabling it (via --yjit, RUBYOPT, or RubyVM::YJIT.enable) adds a +YJIT marker to RUBY_DESCRIPTION ( +YJIT <token> on YJIT_SUPPORT builds), which is part of the cache key. This previously discarded the entire compile cache whenever YJIT was enabled at runtime but not at precompile time (or vice versa). The marker is now stripped before hashing.

• Fix CompileCache::Native.fetch and .precompile reading a non-String path argument (e.g. a Pathname) with RSTRING_PTR. Regression from 1.24.0.

Commits

• e099ec7 Release 1.25.0
• b694a11 Merge pull request #563 from stanhu/sh-ignore-yjit-in-compile-cache-key
• 51898f9 Ignore YJIT status in the compile cache key
• 1ad589b Merge pull request #560 from rails/hm-qnqlnylzkqkltqsz
• 21fbd65 Merge pull request #561 from jeremy/fix-path-conversion-entry-points
• 4898853 Convert the path argument in the frame that reads it
• 8ee47c4 Add MessagePack::Bigint type
• 49e3eb7 Replace Date Marshalling with recursive msgpack
• 711fd0b Bump minimum msgpack to 1.5.0
• 160fc10 Merge pull request #558 from viralpraxis/fix-yaml-cache-kwargs-mutation
• Additional commits viewable in compare view

Updates devise from 4.9.4 to 5.0.4

Release notes

Sourced from devise's releases.

v5.0.4

https://github.com/heartcombo/devise/blob/v5.0.4/CHANGELOG.md#504---2026-05-08

v5.0.3

https://github.com/heartcombo/devise/blob/v5.0.3/CHANGELOG.md#503---2026-03-16

v5.0.2

https://github.com/heartcombo/devise/blob/v5.0.2/CHANGELOG.md#502---2026-02-18

v5.0.1

https://github.com/heartcombo/devise/blob/v5.0.1/CHANGELOG.md#501---2026-02-13

v5.0.0

https://github.com/heartcombo/devise/blob/v5.0.0/CHANGELOG.md#500---2026-01-23

v5.0.0.rc

https://github.com/heartcombo/devise/blob/v5.0.0.rc/CHANGELOG.md#500rc---2025-12-31

Changelog

Sourced from devise's changelog.

5.0.4 - 2026-05-08

• security fixes
  • Fix open redirect in FailureApp via unvalidated Referer header on non-GET session timeout. CVE-2026-40295 GHSA-jp94-3292-c3xv

5.0.3 - 2026-03-16

• security fixes
  • Fix race condition vulnerability on confirmable "change email" which would allow confirming an email they don't own CVE-2026-32700 GHSA-57hq-95w6-v4fc #5783 #5784

5.0.2 - 2026-02-18

• enhancements
  • Allow resource class scopes to override the global configuration for sign_in_after_change_password behaviour. #5825
    • Note: some users ran into an issue with this change because RegistrationsController now relies on a setting from the :registerable module. These users were configuring their own routes pointing to the RegistrationsController for resource edit/update actions mostly, without relying on the other registration actions (e.g. user sign up.), so they omitted :registerable from the model declaration. While using just a portion of the controller functionality is a valid use for :registerable (or any module really), the module must still be declared in the model, much like the other modules must be declared if you plan on using just a portion of their behavior. Please check this issue for more info.
  • Add sign_in_after_reset_password? check hook to passwords controller, to allow it to be customized by users. #5826

5.0.1 - 2026-02-13

• bug fixes
  • Fix translation issue with German E-Mail on invalid authentication messages caused by previous fix for incorrect grammar #5822

5.0.0 - 2026-01-23

no changes

5.0.0.rc - 2025-12-31

• breaking changes

  • Drop support to Ruby < 2.7

  • Drop support to Rails < 7.0

  • Remove deprecated :bypass option from sign_in helper, use bypass_sign_in instead. #5803

  • Remove deprecated devise_error_messages! helper, use render "devise/shared/error_messages", resource: resource instead. #5803

  • Remove deprecated scope second argument from sign_in(resource, :admin) controller test helper, use sign_in(resource, scope: :admin) instead. #5803

  • Remove deprecated Devise::TestHelpers, use Devise::Test::ControllerHelpers instead. #5803

  • Remove deprecated Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION #5598

  • Remove deprecated Devise.activerecord51? method.

  • Remove SecretKeyFinder and use app.secret_key_base as the default secret key for Devise.secret_key if a custom Devise.secret_key is not provided.

    This is potentially a breaking change because Devise previously used the following order to find a secret key:

    app.credentials.secret_key_base > app.secrets.secret_key_base > application.config.secret_key_base > application.secret_key_base
    

    Now, it always uses application.secret_key_base. Make sure you're using the same secret key after the upgrade; otherwise, previously generated tokens for recoverable, lockable, and confirmable will be invalid. #5645

  • Change password instructions button label on devise view from Send me reset password instructions to Send me password reset instructions #5515

  • Change <br> tags separating form elements to wrapping them in <p> tags #5494

  • Replace [data-turbo-cache=false] with [data-turbo-temporary] on devise/shared/error_messages partial. This has been deprecated by Turbo since v7.3.0 (released on Mar 1, 2023).

... (truncated)

Commits

• 9ea459d Release v5.0.4 with sec fix for timeoutable
• 025fe21 Merge commit from fork
• 7ca7ed9 Add GHSA link to the v5.0.3 sec fix changelog entry [ci skip]
• 605de86 Update links to https [ci skip]
• 5e3a8bf Bundle update
• 5d20277 Cleanup old Rails.version check for db migration path
• 4ffb0b7 Fix Gemfile for Rails 7.2, incorrectly testing against 7.1
• 2f80920 Release v5.0.3
• 5334707 Add CVE to changelog [ci skip]
• 0252777 Fix race condition vulnerability, by ensuring the unconfirmed_email is alwa...
• Additional commits viewable in compare view

Updates devise_token_auth from 1.2.6 to 1.3.0

Commits

• b02076a Support Rails 8.0 and 8.1 (#1686)
• ec19d94 Fix clean_old_tokens purging freshly-created token at device cap (#1685)
• bcdc3a5 Update devise to 5 (#1675)
• See full diff in compare view

Updates newrelic_rpm from 10.6.0 to 10.7.1

Changelog

Sourced from newrelic_rpm's changelog.

v10.7.1

• Bugfix: Resolve ArgumentError on multi-key operations with Dalli 5.1.0

  This fix updates Dalli instrumentation to accept and forward optional request options arguments in multi and pipelined operations. Our thanks go to @​dbackeus for contributing a fix! PR#3642

• Bugfix: Async::HTTP requests no longer raise NoMethodError when a segment fails to start

  If the agent encountered an internal error while creating the segment for an Async::HTTP request, the instrumentation went on to use that missing segment and could raise a NoMethodError. This is now fixed, thanks to @​ydah. PR#3640

v10.7.0

• Feature: Add transaction_tracer.cap_segment_artifacts configuration option

  Long-running transactions with many segments can cause continuously increasing memory usage for the lifetime of the transaction. The agent now offers an opt-in transaction_tracer.cap_segment_artifacts configuration option (defaults to false). When enabled, once transaction_tracer.limit_segments is reached, the agent also stops recording exclusive time for any segments created afterward in that transaction, reducing memory usage at the cost of less accurate timing data for the transaction.PR#3615

• Feature: Add Puma server-statistics instrumentation

  The agent now samples Puma's cluster-wide server statistics and reports them as Ruby/Puma/* timeslice metrics, including backlog, running, pool_capacity, max_threads, and requests_count. Statistics are sampled in single mode and in clustered mode when preload_app! is enabled. This instrumentation is disabled by default; enable it by setting disable_puma_instrumentation to false. When enabled, the agent starts a reporting thread in the Puma master process to deliver these metrics, which runs an additional agent connection alongside the Puma workers. The sampling interval is configurable via the new puma.sample_rate setting (default 60 seconds). Requires Puma 6.6 or later. See our docs for more information.

  Thanks so much to @​ashleyboehs contributing this new feature. PR#3578

• Feature: Report a unique hostname for Google Cloud Run instances

  The agent now detects Cloud Run and reports the GCP instance id as the hostname so individual instances can be distinguished. Before this change, all Google Cloud Run hostnames were localhost. This feature is controlled by the new utilization.gcp_cloud_run.use_instance_as_host configuration option (default true). Set utilization.gcp_cloud_run.include_revision_in_host (default false) to true to report the hostname as {K_REVISION}-{instance id} instead, where K_REVISION is the Cloud Run revision name. Thank you to @​kawa-onushi for suggesting this improvement. Issue#3295 PR#3609

• Bugfix: Slow SQL no longer recorded after transaction_tracer.limit_segments exceeded

  Once a transaction exceeded transaction_tracer.limit_segments, datastore segments created afterward still could have their slow SQL recorded. The agent now stops recording slow SQL for any segment created after the limit is reached. PR#3615

• Bugfix: Explain plans could target the wrong database in multi-database Rails apps (Rails >= 7.2)

  On Rails 7.2+, the agent gathered explain plans using a connection from the app's default/shared pool rather than a dedicated one. This primarily affected multi-database apps. Explain plans could be generated against the wrong database, and a failed explain could leave a shared connection in a bad state, affecting unrelated requests. The agent now uses its own dedicated connection for explain plans, as it did before Rails 7.2, and resets or discards that connection whenever an explain attempt fails, so a bad connection is never reused. Thank you, @​masiafrest for the detailed report! Issue#3610 PR#3612

• Bugfix: Browser monitoring instrumentation no longer fails with FrozenError

  When a response body's first fragment was a frozen String and there were multiple fragments, browser instrumentation hit a FrozenError and the browser timing header was never injected. This began appearing with ERB 6.0.3+, which started freezing more of its compiled strings. This issue is now fixed. Thank you to @​md5 for reporting this issue! Issue#3624PR#3625

• Bugfix: Normalize boolean configuration values to allow all casing

  In version 9.x, the agent accepted capitalized boolean values, like "FALSE", and mixed-case values like "True". Version 10.0.0 included PR#3341, which unintentionally removed the case-insensitive requirement. This caused users who had any casing besides all lowercase to have their configuration options fall back to the defaults. Now, the agent uses case-insensitive checks again. Our thanks go to @​willie for bringing this to our attention. Issue#3632 PR#3633

Commits

• e5f3218 Merge pull request #3647 from newrelic/prerelease_updates_10.7.1-pre
• 6138bc2 bump version
• 231e090 Merge pull request #3644 from newrelic/safe_nav_http_libs
• 4a3483b Add safe navigation for segments & http libs
• c8a4e42 Merge pull request #3640 from ydah/fix/async-http-segment-safety
• 0fc44fe Guard async HTTP segments
• ffa1252 Merge pull request #3643 from newrelic/changelog-for-dalli-5-1-fix
• 551bfeb Add entry for Dalli 5.1 arg fix
• f8a9b0d Merge pull request #3642 from dbackeus/fix_dalli_5_1_argument_error
• 2facd89 fix ArgumentError on multi-key operations with dalli 5.1.0
• Additional commits viewable in compare view

Updates pagy from 43.6.1 to 43.6.2

Release notes

Sourced from pagy's releases.

Version 43.6.2

Changes in 43.6.2

• Fix nil records returned for Array collections on page overflow (#920) (Fix #919)

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

• New :countish Paginator
  • Faster than OFFSET and supporting the full UI
• New Keynav Pagination
  • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
• New interactive dev-tools
  • New PagyWand to integrate the pagy CSS with your app themes.
  • New Pagy AI available right inside your own app.
• Intelligent automation
  • Configuration requirements reduced by 99%.
  • Simplified JavaScript setup.
  • Automatic I18n loading.
• Simpler API
  • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
  • Methods are autoloaded only if used, and consume no memory otherwise.
  • Methods have narrower scopes and can be overridden without deep knowledge.
• New documentation
  • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

Changelog

Sourced from pagy's changelog.

Version 43.6.2

• Fix nil records returned for Array collections on page overflow (#920) (Fix #919)

Commits

• e854305 Merge branch 'dev'
• 6f0ebbe Version 43.6.2
• 871fb4a 💎 Fix nil records returned for Array collections on page overflow (#920) (Fix...
• 1ad8485 Fix broken links in CHANGELOG.md when displayed on GitHub (close #913)
• 5248145 Update gems and packages
• 4b5f6f9 Update RM run configs
• 44afd3f Improve docs templating
• 2d72e39 Improve Retype config, allowing url override to github actions (#918)
• See full diff in compare view

Updates brakeman from 8.0.5 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

• Fix EOL date for Rails 8.0 (@​yeaseul-kim)
• Fix command injection false positives (@​JacobEvelyn )
• Fix unused variable warning (@​viralpraxis)
• Add EOL dates for Rails 8.1 and Ruby 4.0

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

• Fix EOL date for Rails 8.0 (yeaseul-kim)
• Add EOL dates for Rails 8.1 and Ruby 4.0
• Fix command injection false positives (Jacob Evelyn)
• Fix unused variable warning (viralpraxis)

Commits

• fffc483 Bump to 8.0.6
• b7218fe Update CHANGES
• c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
• 4c191dd Fix EOL date for Rails 8.0
• e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
• dd4f0b9 Add EOL date for Ruby 4.0
• 7ca100a Add EOL date for Rails 8.1
• a53a456 Merge pull request #2022 from JacobEvelyn/main
• bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
• 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
• Additional commits viewable in compare view

Updates rubocop from 1.88.2 to 1.90.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.90.0

New features

• #15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@​bbatsov][])
• #9505: Add disable-next directives scoped to the following statement. ([@​bbatsov][])
• #15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@​bbatsov][])
• #15523: Add new Lint/ArgumentMismatch cop. ([@​bbatsov][])
• #15594: Add new Lint/SuperArgumentMismatch cop. ([@​bbatsov][])
• #15581: Add new Style/TimeNow cop. ([@​Starlexxx][])
• #15111: Add NumberOfEmptyLines option to Layout/EmptyLineAfterMagicComment to configure the minimum number of empty lines required after magic comments. ([@​alejofraga][])
• #13037: Add --report-unused-todo-entries to catch rotting todo files. ([@​bbatsov][])
• #15559: Add new Style/DirectiveScope cop to flag disable/enable pairs and disable-only push/pop scopes that wrap a single statement and can use disable-next instead. ([@​bbatsov][])
• #15547: Make Lint/RedundantCopEnableDirective flag # rubocop:pop directives without a matching # rubocop:push. ([@​bbatsov][])

Bug fixes

• #15584: Fix a crash in Lint/NameTypo and Lint/UnusedPrivateMethod on string literals with invalid encoding. ([@​bbatsov][])
• #15541: Fix a false negative for Lint/OutOfRangeRegexpRef when a preceding element access with a non-string literal argument (e.g. hash[:key]) discarded the tracked capture count. ([@​koic][])
• #7958: Add todo comments for skipped unsafe corrections with --disable-uncorrectable. ([@​bbatsov][])
• #15569: Fix an error for the built-in language server when a workspace/executeCommand request has no document URI in its arguments. ([@​koic][])
• #15410: Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName. ([@​bbatsov][])
• #15576: Fix an incorrect autocorrect for Style/Sample when shuffle is given a random: argument; the offense is still reported but no longer autocorrected, since shuffle and sample consume a seeded generator differently and would select different elements. ([@​koic][])
• #15590: Fix an infinite loop error for Layout/FirstArgumentIndentation when EnforcedStyle: with_fixed_indentation is specified for Layout/ArgumentAlignment and Layout/FirstMethodArgumentLineBreak is enabled with AllowMultilineFinalElement: true. ([@​Starlexxx][])
• #15588: Fix RuboCop::Cop::IgnoredMethods and RuboCop::Cop::IgnoredPattern being unreachable after require 'rubocop'. ([@​SeanLF][])
• #8349: Don't autocorrect away directives for unknown cops. ([@​bbatsov][])
• #7894: Don't flag disables of pending cops as redundant. ([@​bbatsov][])
• #9963: Fix false negatives for Layout/ExtraSpacing. ([@​Starlexxx][])
• #15525: Fix false negatives in Layout/LineLength when a constant path like Http::UploadedFile matches URISchemes case-insensitively. ([@​koic][])
• #13941: Fix false positives for Lint/UselessConstantScoping when assigning with Class.new, Module.new, Struct.new, or Data.define after private. ([@​pdobb][])
• #15526: Fix false positives in Layout/MultilineMethodCallIndentation when a line has multiple single-line blocks before a multiline block. ([@​koic][])
• #15538: Fix false positives in Lint/ConstantReassignment when a constant is assigned in compact-style namespaces (e.g. module A::B). ([@​alex-tan][])
• #15517: Fix false positives in Lint/RedundantSafeNavigation when InferNonNilReceiver is enabled and the receiver name is rebound by a nested block (it or a shadowed block parameter). ([@​koic][])
• #15572: Fix RuboCop::Cop::Registry#freeze to freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@​koic][])
• #15585: Make Lint/DuplicateMethods honor silence_redefinition_of_method and redefine_method as intentional redefinitions. ([@​bbatsov][])
• #15558: Fix --display-suppressed reporting a nil justification when the offense is loaded from the result cache. ([@​corsonknowles][])
• #10449: Fix Layout/ClassStructure autocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@​koic][])
• #15568: Fix Lint/NameTypo registering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@​HoneyryderChuck][])
• #15556: Fix Lint/UnusedPrivateMethod retaining every past project_index object it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such as rubocop --server. ([@​bquorning][])
• #10046: Fix Lint/UselessMethodDefinition false positive for methods with **kwargs. ([@​bbatsov][])
• #15589: Fix --lsp and --mcp being silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@​koic][])
• #11148: Merge department and cop-level Exclude settings. ([@​bbatsov][])
• #15531: Fix a regression in RuboCop 1.89 where the modifier cops could produce lines longer than Layout/LineLength Max when exemptions like AllowedPatterns matched the result. ([@​bbatsov][])
• #15574: Fix an incorrect warning such as AllCops does not support TargetRailsVersion parameter when a plugin declares a custom AllCops key with a nil value and another plugin is loaded after it. ([@​koic][])
• #9543: Preserve escape notation in Style/StringConcatenation autocorrect. ([@​bbatsov][])
• #11119: Preserve persistent cop instances across files. ([@​Eljees][])
• #13022: Fix rubocop . (and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower than rubocop in projects with large ignored trees. ([@​bbatsov][])
• #15561: Fix Lint/RedundantCopDisableDirective and Lint/RedundantCopEnableDirective leaving a directive's -- reason behind when removing the directive. ([@​corsonknowles][])
• #15593: Fix false positives for Lint/UnusedPrivateMethod for private definitions of Ruby runtime hooks like inherited and const_missing. ([@​bbatsov][])
• #15547: Make Lint/MissingCopEnableDirective suggest # rubocop:pop instead of # rubocop:enable for an unclosed # rubocop:push. ([@​bbatsov][])
• #14379: Suppress multi-line offenses with a directive on any of their lines. ([@​bbatsov][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.90.0 (2026-08-24)

New features

• #15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@​bbatsov][])
• #9505: Add disable-next directives scoped to the following statement. ([@​bbatsov][])
• #15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@​bbatsov][])
• #15523: Add new Lint/ArgumentMismatch cop. ([@​bbatsov][])
• #15594: Add new Lint/SuperArgumentMismatch cop. ([@​bbatsov][])
• #15581: Add new Style/TimeNow cop. ([@​Starlexxx][])
• #15111: Add NumberOfEmptyLines option to Layout/EmptyLineAfterMagicComment to configure the minimum number of empty lines required after magic comments. ([@​alejofraga][])
• #13037: Add --report-unused-todo-entries to catch rotting todo files. ([@​bbatsov][])
• #15559: Add new Style/DirectiveScope cop to flag disable/enable pairs and disable-only push/pop scopes that wrap a single statement and can use disable-next instead. ([@​bbatsov][])
• #15547: Make Lint/RedundantCopEnableDirective flag # rubocop:pop directives without a matching # rubocop:push. ([@​bbatsov][])

Bug fixes

• #15584: Fix a crash in Lint/NameTypo and Lint/UnusedPrivateMethod on string literals with invalid encoding. ([@​bbatsov][])
• #15541: Fix a false negative for Lint/OutOfRangeRegexpRef when a preceding element access with a non-string literal argument (e.g. hash[:key]) discarded the tracked capture count. ([@​koic][])
• #7958: Add todo comments for skipped unsafe corrections with --disable-uncorrectable. ([@​bbatsov][])
• #15569: Fix an error for the built-in language server when a workspace/executeCommand request has no document URI in its arguments. ([@​koic][])
• #15410: Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName. ([@​bbatsov][])
• #15576: Fix an incorrect autocorrect for Style/Sample when shuffle is given a random: argument; the offense is still reported but no longer autocorrected, since shuffle and sample consume a seeded generator differently and would select different elements. ([@​koic][])
• #15590: Fix an infinite loop error for Layout/FirstArgumentIndentation when EnforcedStyle: with_fixed_indentation is specified for Layout/ArgumentAlignment and Layout/FirstMethodArgumentLineBreak is enabled with AllowMultilineFinalElement: true. ([@​Starlexxx][])
• #15588: Fix RuboCop::Cop::IgnoredMethods and RuboCop::Cop::IgnoredPattern being unreachable after require 'rubocop'. ([@​SeanLF][])
• #8349: Don't autocorrect away directives for unknown cops. ([@​bbatsov][])
• #7894: Don't flag disables of pending cops as redundant. ([@​bbatsov][])
• #9963: Fix false negatives for Layout/ExtraSpacing. ([@​Starlexxx][])
• #15525: Fix false negatives in Layout/LineLength when a constant path like Http::UploadedFile matches URISchemes case-insensitively. ([@​koic][])
• #13941: Fix false positives for Lint/UselessConstantScoping when assigning with Class.new, Module.new, Struct.new, or Data.define after private. ([@​pdobb][])
• #15526: Fix false positives in Layout/MultilineMethodCallIndentation when a line has multiple single-line blocks before a multiline block. ([@​koic][])
• #15538: Fix false positives in Lint/ConstantReassignment when a constant is assigned in compact-style namespaces (e.g. module A::B). ([@​alex-tan][])
• #15517: Fix false positives in Lint/RedundantSafeNavigation when InferNonNilReceiver is enabled and the receiver name is rebound by a nested block (it or a shadowed block parameter). ([@​koic][])
• #15572: Fix RuboCop::Cop::Registry#freeze to freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@​koic][])
• #15585: Make Lint/DuplicateMethods honor silence_redefinition_of_method and redefine_method as intentional redefinitions. ([@​bbatsov][])
• #15558: Fix --display-suppressed reporting a nil justification when the offense is loaded from the result cache. ([@​corsonknowles][])
• #10449: Fix Layout/ClassStructure autocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@​koic][])
• #15568: Fix Lint/NameTypo registering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@​HoneyryderChuck][])
• #15556: Fix Lint/UnusedPrivateMethod retaining every past project_index object it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such as rubocop --server. ([@​bquorning][])
• #10046: Fix Lint/UselessMethodDefinition false positive for methods with **kwargs. ([@​bbatsov][])
• #15589: Fix --lsp and --mcp being silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@​koic][])
• #11148: Merge department and cop-level Exclude settings. ([@​bbatsov][])
• #15531: Fix a regression in RuboCop 1.89 where the modifier cops could produce lines longer than Layout/LineLength Max when exemptions like AllowedPatterns matched the result. ([@​bbatsov][])
• #15574: Fix an incorrect warning such as AllCops does not support TargetRailsVersion parameter when a plugin declares a custom AllCops key with a nil value and another plugin is loaded after it. ([@​koic][])
• #9543: Preserve escape notation in Style/StringConcatenation autocorrect. ([@​bbatsov][])
• #11119: Preserve persistent cop instances across files. ([@​Eljees][])
• #13022: Fix rubocop . (and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower than rubocop in projects with large ignored trees. ([@​bbatsov][])
• #15561: Fix Lint/RedundantCopDisableDirective and Lint/RedundantCopEnableDirective leaving a directive's -- reason behind when removing the directive. ([@​corsonknowles][])
• #15593: Fix false positives for Lint/UnusedPrivateMethod for private definitions of Ruby runtime hooks like inherited and const_missing. ([@​bbatsov][])
• #15547: Make Lint/MissingCopEnableDirective suggest # rubocop:pop instead of # rubocop:enable for an unclosed # rubocop:push. ([@​bbatsov][])

... (truncated)

Commits

• f1b25e1 Cut 1.90
• 72895f6 Update Changelog
• 7042de6 Move op_method? before the shadowing helpers
• 4b14dd2 Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName
• 5d221ac [Fix #10046] Fix Lint/UselessMethodDefinition false positive for methods wi...
• 5070fc3 [Fix #15111] Add NumberOfEmptyLines option to `Layout/EmptyLineAfterMagicCo...
• 496eb65 [Fix #9543] Preserve escape notation in Style/StringConcatenation autocorrect
• 75b3622 Remove a directive's -- reason along with the directive
• 858d8a8 Merge pull request