Bump the development-dependencies group with 9 updates

[dependabot]

Bumps the development-dependencies group with 9 updates:

Package	From	To
cuprite	0.17	0.18
rubocop-capybara	2.23.0	3.0.0
rubocop-rspec	3.9.0	3.10.2
standard	1.54.0	1.57.0
brakeman	8.0.4	8.0.6
pdf-reader	2.15.1	2.16.0
simplecov	0.22.0	1.3.0
webmock	3.26.2	3.26.4
herb	0.9.4	0.11.0

Updates cuprite from 0.17 to 0.18

Release notes

Sourced from cuprite's releases.

0.18

Added

• Support time inputs #245
• Add initial support for shadow_root #234
• Support Capybara::Cuprite::Node#rect #276
• Extend Node#set with the datetime-local input type #295
• Support HTML5 drag-and-drop and drag modifier keys in Node#drag_to #315
• Support Element#drop for files and strings #316
• Add :raise_on_unhandled_modal browser option to raise instead of warn on an unhandled modal #320

Changed

• Bump Ferrum dependency to ~> 0.18.0

Fixed

• Ensure the node has focus before setting value #280
• Raise ObsoleteNode instead of silently acting on a node that got disconnected from the DOM between being found and being used #239
• Capybara::Cuprite::Node#send_keys ignores empty or nil keys instead of raising, matching the Selenium and rack_test drivers #313
• Driver#switch_to_frame accepts a Capybara::Cuprite::Node instead of only a wrapped Capybara::Node::Element #312
• Report tag_name as "ShadowRoot" for shadow root nodes #318
• Treat non-summary descendants of a closed <details> element as non-visible #317
• switch_to_window sends Target.activateTarget so Chrome reactivates the window's renderer immediately instead of leaving it backgrounded, which could stall the next input command for several seconds #321
• Node#set fires input and change events for a color input, since its value can only be set via JavaScript and never gets them naturally #229
• Generate a FocusEvent (not a generic Event) for focus-related events (blur, focus, focusin, focusout), matching real browser behavior #272

Changelog

Sourced from cuprite's changelog.

0.18

Added

• Support time inputs #245
• Add initial support for shadow_root #234
• Support Capybara::Cuprite::Node#rect #276
• Extend Node#set with the datetime-local input type #295
• Support HTML5 drag-and-drop and drag modifier keys in Node#drag_to #315
• Support Element#drop for files and strings #316
• Add :raise_on_unhandled_modal browser option to raise instead of warn on an unhandled modal #320

Changed

• Bump Ferrum dependency to ~> 0.18.0

Fixed

• Ensure the node has focus before setting value #280
• Raise ObsoleteNode instead of silently acting on a node that got disconnected from the DOM between being found and being used #239
• Capybara::Cuprite::Node#send_keys ignores empty or nil keys instead of raising, matching the Selenium and rack_test drivers #313
• Driver#switch_to_frame accepts a Capybara::Cuprite::Node instead of only a wrapped Capybara::Node::Element #312
• Report tag_name as "ShadowRoot" for shadow root nodes #318
• Treat non-summary descendants of a closed <details> element as non-visible #317
• switch_to_window sends Target.activateTarget so Chrome reactivates the window's renderer immediately instead of leaving it backgrounded, which could stall the next input command for several seconds #321
• Node#set fires input and change events for a color input, since its value can only be set via JavaScript and never gets them naturally #229
• Generate a FocusEvent (not a generic Event) for focus-related events (blur, focus, focusin, focusout), matching real browser behavior #272

Removed

Commits

• ffdc57d bump up
• 8677fe1 chore: update CHANGELOG.md with updated repository links
• bfddb1f Introduce raise_on_unhandled_modal browser configuration (#324)
• 171c42c Generate a FocusEvent (not Event) for focus-related events (#272)
• 050cb4f chore: add missing changelog entries
• 41dbd80 Fire input and change event on set for color input (#230)
• bf5d1c5 fix: lint
• 8bc6442 fix: ensure switch_to_window activates the target to avoid delays in input ...
• a1e9fc9 Document Ferrum's Docker container mode (#323)
• df27e61 chore: move spec as it's skipped in selenium capybara as well
• Additional commits viewable in compare view

Updates rubocop-capybara from 2.23.0 to 3.0.0

Release notes

Sourced from rubocop-capybara's releases.

RuboCop Capybara v3.0.0

• Enable pending cops by default for the 3.0 release. (@​ydah)
• Remove the deprecated Capybara/ClickLinkOrButtonStyle cop. (@​ydah)
• Remove obsolete cop name migration config for the 2.x to 3.0 transition. (@​ydah)

Changelog

Sourced from rubocop-capybara's changelog.

3.0.0 (2026-06-22)

• Enable pending cops by default for the 3.0 release. ([@​ydah])
• Remove the deprecated Capybara/ClickLinkOrButtonStyle cop. ([@​ydah])
• Remove obsolete cop name migration config for the 2.x to 3.0 transition. ([@​ydah])

Commits

• a9b8f9a Merge pull request #177 from rubocop/v3.0.0
• 6a4579d release v3.0.0
• 75e7cda Merge pull request #176 from rubocop/docs/update-specific-matcher-readme
• f02ff72 Update SpecificMatcher README example
• ebe10e8 Merge pull request #174 from rubocop/enable-pending-capybara-cops
• 20a5721 Enable pending Capybara cops
• fee3774 Merge pull request #173 from rubocop/remove-obsolete-cop-name-migration
• ea818bd Remove obsolete cop name migration config
• 989fe3c Merge pull request #172 from rubocop/remove-click-link-or-button-style
• 5d5a5b8 Merge pull request #175 from rubocop/dependabot/github_actions/actions/checko...
• Additional commits viewable in compare view

Updates rubocop-rspec from 3.9.0 to 3.10.2

Release notes

Sourced from rubocop-rspec's releases.

RuboCop RSpec v3.10.2

• Fix false positives for RSpec/SpecFilePathFormat when CustomTransform maps a namespace to an empty string. (@​sakuro)
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with options. (@​bquorning)

RuboCop RSpec v3.10.1

• Add Strict option to RSpec/SharedContext to flag shared_context whenever it contains examples, even alongside setup code. (@​Darhazer)
• Add NegatedMatcher configuration option RSpec/ExpectChange. (@​Darhazer)
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with interpolations. (@​bquorning)

RuboCop RSpec v3.10.0

• Add new cop RSpec/MatchWithSimpleRegex to suggest include matcher when match is used with simple string literals without regex-specific features. (@​bquorning)
• Add new cop RSpec/DiscardedMatcher to detect matchers in void context (e.g. missing .and between compound matchers). (@​ydakuka)
• Add support for itblock nodes. (@​Darhazer)
• RSpec/ScatteredLet now preserves the order of lets during auto-correction. (@​Darhazer)
• Fix a false negative for RSpec/EmptyLineAfterFinalLet inside shared_examples / include_examples / it_behaves_like blocks. (@​Darhazer)
• Fix a false positive for RSpec/ContainExactly when contain_exactly has multiple splat arguments. (@​ydah)
• Add autocorrect support for RSpec/SubjectDeclaration. (@​eugeneius)
• Fix false negatives for RSpec/SpecFilePathFormat when the expected class path only partially matches a path segment. (@​ydah)
• Fix a false negative for RSpec/ExpectActual when the matcher takes no arguments (e.g. expect("foo").to be_present, expect(1).to be). (@​cvx)

Changelog

Sourced from rubocop-rspec's changelog.

3.10.2 (2026-06-06)

• Fix false positives for RSpec/SpecFilePathFormat when CustomTransform maps a namespace to an empty string. ([@​sakuro])
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with options. ([@​bquorning])

3.10.1 (2026-06-05)

• Add Strict option to RSpec/SharedContext to flag shared_context whenever it contains examples, even alongside setup code. ([@​Darhazer])
• Add NegatedMatcher configuration option RSpec/ExpectChange. ([@​Darhazer])
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with interpolations. ([@​bquorning])

3.10.0 (2026-06-05)

• Add new cop RSpec/MatchWithSimpleRegex to suggest include matcher when match is used with simple string literals without regex-specific features. ([@​bquorning])
• Add new cop RSpec/DiscardedMatcher to detect matchers in void context (e.g. missing .and between compound matchers). ([@​ydakuka])
• Add support for itblock nodes. ([@​Darhazer])
• RSpec/ScatteredLet now preserves the order of lets during auto-correction. ([@​Darhazer])
• Fix a false negative for RSpec/EmptyLineAfterFinalLet inside shared_examples / include_examples / it_behaves_like blocks. ([@​Darhazer])
• Fix a false positive for RSpec/ContainExactly when contain_exactly has multiple splat arguments. ([@​ydah])
• Add autocorrect support for RSpec/SubjectDeclaration. ([@​eugeneius])
• Fix false negatives for RSpec/SpecFilePathFormat when the expected class path only partially matches a path segment. ([@​ydah])
• Fix a false negative for RSpec/ExpectActual when the matcher takes no arguments (e.g. expect("foo").to be_present, expect(1).to be). ([@​cvx])

Commits

• 2488441 Merge pull request #2189 from rubocop/release
• c9e53cf Bump version to 3.10.2
• 7ae0a42 Merge pull request #2186 from sakuro/fix/spec-file-path-format-empty-custom-t...
• 8b0b5e9 Merge branch 'master' into fix/spec-file-path-format-empty-custom-transform
• dc4465c Merge pull request #2188 from rubocop/fix-2185
• d5de6b2 Consider regexp with options a non-simple regexp
• bad0cb3 🐛 Fix RSpec/SpecFilePathFormat false positives when CustomTransform maps ...
• ec3eeab Merge pull request #2183 from rubocop/fix-match-with-simple-regex-with-interp...
• 16bbf49 Bump version to 3.10.1
• 2a78abd Ignore interpolation in MatchWithSimpleRegex
• Additional commits viewable in compare view

Updates standard from 1.54.0 to 1.57.0

Changelog

Sourced from standard's changelog.

1.57.0

• Updates rubocop to 1.91.0

1.56.0

• Updates rubocop to 1.88.0

1.55.0

• Updates rubocop to 1.87.0

Commits

• 9b457c4 ❤️ v1.57.0
• 1b0cf75 Merge pull request #836 from standardrb/dependabot/github_actions/step-securi...
• a67a061 Bump step-security/harden-runner from 2.21.0 to 2.21.1
• ec152fa Merge pull request #832 from standardrb/rubocop-1-90-upgrade
• 79509c3 Updates rubocop to 1.91
• a743b7f Updates rubocop to 1.90
• c278703 Merge pull request #831 from standardrb/dependabot/github_actions/step-securi...
• dc2b6be Bump step-security/harden-runner from 2.20.0 to 2.21.0
• 521d3bf Merge pull request #827 from standardrb/dependabot/bundler/ruby-lsp-0.26.11
• 8986a51 Bump ruby-lsp from 0.26.10 to 0.26.11
• Additional commits viewable in compare view

Updates brakeman from 8.0.4 to 8.0.6

Release notes

Sourced from brakeman's releases.

8.0.6 - EOL Dates

• Fix EOL date for Rails 8.0 (@​yeaseul-kim)
• Fix command injection false positives (@​JacobEvelyn )
• Fix unused variable warning (@​viralpraxis)
• Add EOL dates for Rails 8.1 and Ruby 4.0

8.0.5

• Add quote_schema_name to safe quote method list (changes by Zsolt Kozaroczy)
• Fix SQL injection false positive for compact_blank/compact on permitted params (changes by Arpit Jain)
• Fix inline render false positive for local named text (changes by Arpit Jain)
• Fix HAML crash on .raw calls (changes by Federico Franco)
• Fix Ruby version parsing - especially for non-CRuby versions (changes by Chris Southerland Jr)
• Fix TemplateAliasProcessor#template_name arity (changes by viralpraxis)
• Reduce false positives when using shell escaping (changes)

Changelog

Sourced from brakeman's changelog.

8.0.6 - 2026-08-13

• Fix EOL date for Rails 8.0 (yeaseul-kim)
• Add EOL dates for Rails 8.1 and Ruby 4.0
• Fix command injection false positives (Jacob Evelyn)
• Fix unused variable warning (viralpraxis)

8.0.5 - 2026-06-12

• Add quote_schema_name to safe quote method list (Zsolt Kozaroczy)
• Fix SQL injection false positive for compact_blank/compact on permitted params (Arpit Jain)
• Fix inline render false positive for local named text (Arpit Jain)
• Fix HAML crash on .raw calls (Federico Franco)
• Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr)
• Fix TemplateAliasProcessor#template_name arity (viralpraxis)
• Reduce false positives when using shell escaping

Commits

• fffc483 Bump to 8.0.6
• b7218fe Update CHANGES
• c6be6cc Merge pull request #2034 from yeaseul-kim/fix-rails-8-0-eol-date
• 4c191dd Fix EOL date for Rails 8.0
• e7bda16 Merge pull request #2033 from presidentbeef/add-ruby-rails-eol-dates
• dd4f0b9 Add EOL date for Ruby 4.0
• 7ca100a Add EOL date for Rails 8.1
• a53a456 Merge pull request #2022 from JacobEvelyn/main
• bf3fdc9 Merge pull request #2030 from viralpraxis/fix-unusued-gem-release-date
• 20f74ac Brakeman.ensure_latest: fix unsued release_date variable
• Additional commits viewable in compare view

Updates pdf-reader from 2.15.1 to 2.16.0

Changelog

Sourced from pdf-reader's changelog.

v2.16.0 (9th August 2026)

• Add new method that use Point(x, y) instead of Array[Integer], for improved typing with sorbet (yob/pdf-reader#578)
• Support extracting text via ActualText annotations (yob/pdf-reader#587)
• Accept any IO-like object in PDF::Reader.new() (yob/pdf-reader#607)
• Drop dependency on ruby-rc4 gem (yob/pdf-reader#606)
• Expanded type annotations
• Add dynamically generated RBS type signaturesd to published gem (yob/pdf-reader#580)
• A few bug fixes to CMap parsing and Unicode extraction
  • yob/pdf-reader#582
  • yob/pdf-reader#593
• Fix occasional exception when parsing PDFDoc strings with invalid bytes (yob/pdf-reader#590)
• Fox occasional exception parsing differnce tables with an unmatched surrgate pair
  • yob/pdf-reader#604
  • yob/pdf-reader#605
• Reduce object allocations when parsing many PDFs
  • yob/pdf-reader#595
  • yob/pdf-reader#596
  • yob/pdf-reader#598
  • yob/pdf-reader#599
  • yob/pdf-reader#600
  • yob/pdf-reader#601
• Add truffleruby to the test matrix in CI (yob/pdf-reader#583)
• Add JRuby 10.1 to the test matrix (yob/pdf-reader#597)

Commits

• fa5147a prepare to release v2.16.0 (#608)
• 7b32900 prepare to release v2.16.0
• 35c0951 Vendor RC4 implementation, drop ruby-rc4 dependency (#606)
• 5e9139e Fix RC4 for Ruby 2.1-2.3 compatibility
• 0194c7b Fix sorbet strict typing and split rc4 specs per review
• 87d6f2e Accept any IO-like object that responds to read and seek (#607)
• 544afd9 Accept any IO-like object that responds to read and seek
• 9624e37 Guard against an empty RC4 key raising ZeroDivisionError
• af1d1ce Vendor RC4 implementation, drop ruby-rc4 dependency
• 578db3d Avoid returning invalid utf8 from Encoding#to_utf8 (#605)
• Additional commits viewable in compare view

Updates simplecov from 0.22.0 to 1.3.0

Release notes

Sourced from simplecov's releases.

v1.3.0

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Highlights

• Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles Prism, so the static coverage extractor stops probing for it and the emulation of 3.2's constant folding is gone.
• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax or as Ruby comments on a code line.
• --annotate KIND turns simplecov patch and simplecov uncovered into inline CI annotations for GitHub, GitLab, reviewdog, Azure, TeamCity, and Buildkite, so one CI step can both annotate and gate.
• Groups that match no files are omitted from the report instead of padding it at 100%, and the rails profile declares its groups alphabetically.
• cover_views is the only way to measure a template now: a cover glob that matches one warns and leaves it out, and ignore: :eval_generated no longer drops a template's real branches and methods.
• A file with nothing to cover reports the same percentage in the file list as it does in the source view.

Upgrade notes

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Breaking Changes

• Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Enhancements

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See simplecov-ruby/simplecov#1295.
• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See simplecov-ruby/simplecov#1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Bugfixes

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (simplecov-ruby/simplecov#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See simplecov-ruby/simplecov#1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

v1.2.0

SimpleCov 1.2 adds change-focused coverage, per-test attribution, production coverage, and a substantially expanded CLI while keeping the existing configuration API working through deprecation aliases.

Highlights

• track_tests, simplecov tests, and simplecov affected connect covered lines to the tests that exercised them; the HTML report displays the same attribution and simplecov watch uses it for focused reruns.
• simplecov patch, per-file baselines, missed-count caps, and coverage history make coverage gates useful for both new changes and legacy codebases.
• SimpleCov::Production records low-overhead production line coverage, while simplecov dead-code and the bundled reports cross it with test coverage.
• ActionView templates can be measured with cover_views, including ERB, Haml, and Slim source highlighting.
• The CLI gains annotated source, report freshness, history, badges, shell completions, a man page, and richer machine-readable output.

Upgrade notes

• The minimum supported Ruby remains 3.2; JRuby 10 remains supported for line coverage.

... (truncated)

Changelog

Sourced from simplecov's changelog.

1.3.0 (2026-09-12)

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Highlights

• Ruby 3.2 is no longer supported. The minimum is Ruby 3.3, which bundles Prism, so the static coverage extractor stops probing for it and the emulation of 3.2's constant folding is gone.
• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax or as Ruby comments on a code line.
• --annotate KIND turns simplecov patch and simplecov uncovered into inline CI annotations for GitHub, GitLab, reviewdog, Azure, TeamCity, and Buildkite, so one CI step can both annotate and gate.
• Groups that match no files are omitted from the report instead of padding it at 100%, and the rails profile declares its groups alphabetically.
• cover_views is the only way to measure a template now: a cover glob that matches one warns and leaves it out, and ignore: :eval_generated no longer drops a template's real branches and methods.
• A file with nothing to cover reports the same percentage in the file list as it does in the source view.

Upgrade notes

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Breaking Changes

• Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Enhancements

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See simplecov-ruby/simplecov#1295.
• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See simplecov-ruby/simplecov#1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Bugfixes

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (simplecov-ruby/simplecov#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See simplecov-ruby/simplecov#1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

1.2.0 (2026-09-04)

SimpleCov 1.2 adds change-focused coverage, per-test attribution, production coverage, and a substantially expanded CLI while keeping the existing configuration API working through deprecation aliases.

Highlights

• track_tests, simplecov tests, and simplecov affected connect covered lines to the tests that exercised them; the HTML report displays the same attribution and simplecov watch uses it for focused reruns.
• simplecov patch, per-file baselines, missed-count caps, and coverage history make coverage gates useful for both new changes and legacy codebases.
• SimpleCov::Production records low-overhead production line coverage, while simplecov dead-code and the bundled reports cross it with test coverage.
• ActionView templates can be measured with cover_views, including ERB, Haml, and Slim source highlighting.

... (truncated)

Commits

• 9c9ecd1 Bump version to 1.3.0
• 71bb5ac Name the simulation context by its subject, not by Prism
• b2aec76 Drop support for Ruby 3.2
• 5e869ef Report a file with no branches as fully covered everywhere
• e425d8b Warn and leave out templates a cover glob matches
• 12d7914 Honor the deprecated nocov toggle in template comments
• 7d278ea Exempt templates from the eval_generated filter
• b39506d Honor simplecov directives inside Haml and Slim templates
• c5233a4 Honor simplecov directives inside ERB templates
• 5a8f224 Alphabetize the rails profile's groups by name
• Additional commits viewable in compare view

Updates webmock from 3.26.2 to 3.26.4

Release notes

Sourced from webmock's releases.

3.26.4

• Fix race condition in HTTPClient adapter async requests by @​koic in #1131

3.26.3

• Confirm to work with curb 1.3.7

  Thanks to Josch Bockler

• Fix NameError in async-http adapter on protocol-http1 >= 0.40

  Thanks to Leslie Hoare

Changelog

Sourced from webmock's changelog.

3.26.4

• Fix race condition in HTTPClient adapter async requests by @​koic in #1131

3.26.3

• Confirm to work with curb 1.3.7

  Thanks to Josch Bockler

• Fix NameError in async-http adapter on protocol-http1 >= 0.40

  Thanks to Leslie Hoare

Commits

• 0fdbad0 Version 3.26.4
• b187df8 Merge pull request #1131 from koic/fix_race_condition_in_httpclient_adapter_a...
• f275724 Fix race condition in HTTPClient adapter async requests
• ee409ac Version 3.26.3
• 2c976d5 Merge pull request #1127 from jbockler/curb-1.3
• 5b40155 Confirm to work with curb 1.3.7
• f685e7e Merge pull request #1130 from lesleh/fix-async-http-status-description
• a50557e Fix NameError in async-http adapter on protocol-http1 >= 0.40
• See full diff in compare view

Updates herb from 0.9.4 to 0.11.0

Release notes

Sourced from herb's releases.

v0.11.0

Herb v0.11

Herb v0.11 ships alongside ReActionView v0.6. Check out the "What's new in Herb v0.11" post on the Herb Blog.

Parser

• Introduce ERBIterationBlockNode and iteration_nodes option by @​marcoroth in marcoroth/herb#1912
• Introduce HerbDirectiveNode and HerbStateDirectiveNode by @​marcoroth in marcoroth/herb#2435
• Introduce ERBCommentNode by @​marcoroth in marcoroth/herb#2605
• Introduce XMLProcessingInstructionNode by @​marcoroth in marcoroth/herb#2266
• Add an erb_openers option for custom ERB tag openers by @​marcoroth in #2487, #2491 and Description has been truncated

[github-actions]

Thanks for taking the time to contribute to LayerRail.\n\nPull requests are temporarily closed while we complete core platform work and stabilize the public codebase. This is not a review of your contribution.\n\nPlease watch this repository for the reopening notice.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml