Update bundler non-major dependencies to v1.26.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
bootsnap	1.24.6 → 1.26.0
graphql (source, changelog)	2.6.7 → 2.6.10
pagy (source, changelog)	43.6.1 → 43.6.2
rubocop (source, changelog)	1.89.0 → 1.90.0
rubocop-graphql (changelog)	1.7.0 → 1.8.0
rubocop-performance (source, changelog)	1.26.1 → 1.27.0
rubocop-rails (source, changelog)	2.36.0 → 2.37.0
scout_apm (source, changelog)	6.2.1 → 6.3.0
selenium-webdriver (source, changelog)	4.46.0 → 4.48.0
simplecov (changelog)	1.0.3 → 1.2.0
sqlite3	2.9.5 → 2.9.6
webmock (changelog)	3.26.2 → 3.26.4

---

Release Notes

rmosolgo/graphql-ruby (graphql)

v2.6.10

Compare Source

New features

• Execution::Next: Add dataload: { ..., method: } shorthand #​5706

Bug fixes

• AsyncDataloader: Avoid ClosedError race in old fibers #​5702
• AsyncDataloader: fix nested dataloader runs #​5703
• Validation: speed up FieldsWillMerge #​5704
• AsyncDataloader: Fix ActiveRecord relation loads in connections #​5708
• Execution::Next: handle SystemStackErrors #​5705
• Restore current multiplex after nested execution #​5714
• Parser: handle out-of-range Unicode escapes as parse errors #​5710
• Lexer: re-raise unexpected ArgumentErrors #​5711
• Parser: support short braced unicode escapes #​5712
• Float: reject non-finite values #​5713

v2.6.9

Compare Source

Security

• Parser cache: validate payloads before loading them (GHSA-rmxg-5p3r-j6hh)

v2.6.8

Compare Source

New features

• Support JSON 3 (remove quirks_mode: true) #​5699

Bug fixes

• Handle SystemStackError during execution #​5683
• Restrict dashboard schema selection #​5688
• Reduce allocations in block string parsing #​5695
• Fix lexer position in multibyte input #​5692 #​5697
• Execution::Next: fix no-method error in mutations #​5698
• SDL: reduce memory use in description strings #​5701

rubocop/rubocop (rubocop)

v1.90.0

Compare Source

New features

• #​15073: Add AllowTrailingComment option to Style/DisableCopsWithinSourceCodeDirective. ([@​bbatsov][])
• #​9505: Add disable-next directives scoped to the following statement. ([@​bbatsov][])
• #​15550: Add --display-suppressed option to also report offenses suppressed by directive comments, including their -- justification in the JSON formatter. ([@​bbatsov][])
• #​15523: Add new Lint/ArgumentMismatch cop. ([@​bbatsov][])
• #​15594: Add new Lint/SuperArgumentMismatch cop. ([@​bbatsov][])
• #​15581: Add new Style/TimeNow cop. ([@​Starlexxx][])
• #​15111: Add NumberOfEmptyLines option to Layout/EmptyLineAfterMagicComment to configure the minimum number of empty lines required after magic comments. ([@​alejofraga][])
• #​13037: Add --report-unused-todo-entries to catch rotting todo files. ([@​bbatsov][])
• #​15559: Add new Style/DirectiveScope cop to flag disable/enable pairs and disable-only push/pop scopes that wrap a single statement and can use disable-next instead. ([@​bbatsov][])
• #​15547: Make Lint/RedundantCopEnableDirective flag # rubocop:pop directives without a matching # rubocop:push. ([@​bbatsov][])

Bug fixes

• #​15584: Fix a crash in Lint/NameTypo and Lint/UnusedPrivateMethod on string literals with invalid encoding. ([@​bbatsov][])
• #​15541: Fix a false negative for Lint/OutOfRangeRegexpRef when a preceding element access with a non-string literal argument (e.g. hash[:key]) discarded the tracked capture count. ([@​koic][])
• #​7958: Add todo comments for skipped unsafe corrections with --disable-uncorrectable. ([@​bbatsov][])
• #​15569: Fix an error for the built-in language server when a workspace/executeCommand request has no document URI in its arguments. ([@​koic][])
• #​15410: Fix an incorrect autocorrect for Naming/BinaryOperatorParameterName. ([@​bbatsov][])
• #​15576: Fix an incorrect autocorrect for Style/Sample when shuffle is given a random: argument; the offense is still reported but no longer autocorrected, since shuffle and sample consume a seeded generator differently and would select different elements. ([@​koic][])
• #​15590: Fix an infinite loop error for Layout/FirstArgumentIndentation when EnforcedStyle: with_fixed_indentation is specified for Layout/ArgumentAlignment and Layout/FirstMethodArgumentLineBreak is enabled with AllowMultilineFinalElement: true. ([@​Starlexxx][])
• #​15588: Fix RuboCop::Cop::IgnoredMethods and RuboCop::Cop::IgnoredPattern being unreachable after require 'rubocop'. ([@​SeanLF][])
• #​8349: Don't autocorrect away directives for unknown cops. ([@​bbatsov][])
• #​7894: Don't flag disables of pending cops as redundant. ([@​bbatsov][])
• #​9963: Fix false negatives for Layout/ExtraSpacing. ([@​Starlexxx][])
• #​15525: Fix false negatives in Layout/LineLength when a constant path like Http::UploadedFile matches URISchemes case-insensitively. ([@​koic][])
• #​13941: Fix false positives for Lint/UselessConstantScoping when assigning with Class.new, Module.new, Struct.new, or Data.define after private. ([@​pdobb][])
• #​15526: Fix false positives in Layout/MultilineMethodCallIndentation when a line has multiple single-line blocks before a multiline block. ([@​koic][])
• #​15538: Fix false positives in Lint/ConstantReassignment when a constant is assigned in compact-style namespaces (e.g. module A::B). ([@​alex-tan][])
• #​15517: Fix false positives in Lint/RedundantSafeNavigation when InferNonNilReceiver is enabled and the receiver name is rebound by a nested block (it or a shadowed block parameter). ([@​koic][])
• #​15572: Fix RuboCop::Cop::Registry#freeze to freeze its internal collections, so that registering a lazily loaded cop after the freeze fails fast at the registration site instead of corrupting the registry. ([@​koic][])
• #​15585: Make Lint/DuplicateMethods honor silence_redefinition_of_method and redefine_method as intentional redefinitions. ([@​bbatsov][])
• #​15558: Fix --display-suppressed reporting a nil justification when the offense is loaded from the result cache. ([@​corsonknowles][])
• #​10449: Fix Layout/ClassStructure autocorrection producing a wrong order when an element cannot be moved, and make offenses report the category that actually blocks the expected order. ([@​koic][])
• #​15568: Fix Lint/NameTypo registering false positives for names provided by a gem whose namespace the project reopens, and for constants read from a namespace with an unresolved ancestor. ([@​HoneyryderChuck][])
• #​15556: Fix Lint/UnusedPrivateMethod retaining every past project_index object it has seen (and the index graph reachable from each), rather than only the most recent one. This caused unbounded memory growth in long-lived processes such as rubocop --server. ([@​bquorning][])
• #​10046: Fix Lint/UselessMethodDefinition false positive for methods with **kwargs. ([@​bbatsov][])
• #​15589: Fix --lsp and --mcp being silently ignored when the RuboCop server is running: they now start the protocol server in the current process instead of being forwarded to the server as a lint request. ([@​koic][])
• #​11148: Merge department and cop-level Exclude settings. ([@​bbatsov][])
• #​15531: Fix a regression in RuboCop 1.89 where the modifier cops could produce lines longer than Layout/LineLength Max when exemptions like AllowedPatterns matched the result. ([@​bbatsov][])
• #​15574: Fix an incorrect warning such as AllCops does not support TargetRailsVersion parameter when a plugin declares a custom AllCops key with a nil value and another plugin is loaded after it. ([@​koic][])
• #​9543: Preserve escape notation in Style/StringConcatenation autocorrect. ([@​bbatsov][])
• #​11119: Preserve persistent cop instances across files. ([@​Eljees][])
• #​13022: Fix rubocop . (and other relative directory arguments) needlessly traversing directories excluded by the configuration, which made it much slower than rubocop in projects with large ignored trees. ([@​bbatsov][])
• #​15561: Fix Lint/RedundantCopDisableDirective and Lint/RedundantCopEnableDirective leaving a directive's -- reason behind when removing the directive. ([@​corsonknowles][])
• #​15593: Fix false positives for Lint/UnusedPrivateMethod for private definitions of Ruby runtime hooks like inherited and const_missing. ([@​bbatsov][])
• #​15547: Make Lint/MissingCopEnableDirective suggest # rubocop:pop instead of # rubocop:enable for an unclosed # rubocop:push. ([@​bbatsov][])
• #​14379: Suppress multi-line offenses with a directive on any of their lines. ([@​bbatsov][])
• #​15593: Fix false positives for Lint/UnusedPrivateMethod when a method name is composed with an interpolated symbol or string prefix. ([@​bbatsov][])

Changes

• #​15585: Add AllowedCrossFilePaths option to Lint/DuplicateMethods to skip cross-file duplicates in configured paths. ([@​bbatsov][])
• #​15593: Add AllowedNames and AllowedPatterns options to Lint/UnusedPrivateMethod. ([@​bbatsov][])
• #​15587: Backfill missing StyleGuide metadata for 21 cops and fix four broken style guide links. ([@​bbatsov][])
• #​15530: Improve Lint/DeprecatedReference performance by short-circuiting deprecated?. ([@​connorshea][])
• #​15529: Improve Lint/NameTypo performance by deferring the literal-name scan. ([@​connorshea][])
• #​15554: Change AllowForAlignment to no longer treat a same-indentation line beyond the enclosing block as an alignment anchor for Layout/ExtraSpacing, Layout/SpaceAroundOperators, and Layout/SpaceBeforeFirstArg. ([@​koic][])
• #​15582: Make JUnit formatter output <testcase> elements only for cops enabled for each inspected file, instead of all cops. ([@​koic][])
• #​15562: Make Layout/SpaceAroundOperators aware of endless method definitions. ([@​koic][])
• #​14673: Make Lint/CopDirectiveSyntax catch keyword typos and unknown cop names. ([@​bbatsov][])
• #​12219: Stop honoring wrongly-namespaced disable directives. ([@​bbatsov][])

DmitryTsepelev/rubocop-graphql (rubocop-graphql)

v1.8.0

Compare Source

• PR#191 GraphQL/FieldDescription no longer flags fields built from a resolver, mutation or subscription class, which inherit that class's description ([@​corsonknowles][])
• PR#190 Add GraphQL/DisallowedTypes cop: flags field and argument types the project has configured as disallowed, with a message explaining what to use instead ([@​corsonknowles][])
• PR#189 Add GraphQL/NullabilityMismatch cop: a null: false field whose Sorbet resolver signature returns a nilable type raises an invalid null error at runtime ([@​corsonknowles][])
• PR#188 Add GraphQL/DefaultForOptionalArgument cop: an optional argument with no default value in the resolver signature raises ArgumentError when the client omits it ([@​corsonknowles][])
• PR#187 GraphQL/ObjectDescription only flags classes and modules that are actually GraphQL types, instead of every class and every module with an include ([@​corsonknowles][])
• PR#186 Speed up loading rubocop-graphql by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​bquorning][])

rubocop/rubocop-performance (rubocop-performance)

v1.27.0

Compare Source

Bug fixes

• #​532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. ([@​koic][])

Changes

• #​530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])

rubocop/rubocop-rails (rubocop-rails)

v2.37.0

Compare Source

Changes

• #​1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. ([@​kuboon][])
• #​1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. ([@​moberegger][])
• #​1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])

scoutapp/scout_apm_ruby (scout_apm)

v6.3.0

Compare Source

• Fix span leak on ActionController::Live streaming requests (#​631)

SeleniumHQ/selenium (selenium-webdriver)

v4.48.0

Compare Source

=========================

• Support CDP versions: v150, v151, v152
• add low-level BiDi protocol integration specs (#​17878)
• [build] Automated Browser Version Update (major) with CDP (#​17910)
• fix silent hang on oversized WebSocket frames (#​17655)
• always reject a missing required inbound BiDi field (#​17936)
• accept a whole-valued float for an integer BiDi field (#​17939)
• reject an inbound BiDi scalar outside its union's declared arms (#​17947)

v4.47.0

Compare Source

=========================

• Support CDP versions: v149, v150, v151
• support WebDriver BiDi on Safari Preview and move #bidi onto Driver (#​17729)
• link generated BiDi elements to their spec definitions (#​17781)
• add objectOnly/preserveExtras/scalar-primitive BiDi schema signals (#​17784)
• construct the BiDi transport inside the domain from a connection (#​17796)
• route BiDiBridge navigation through the generated Protocol::BrowsingContext (#​17785)
• resolve spec runfiles via Bazel::Runfiles (#​17810)
• [build] standardize generated-file license and not to edit markers across generators (#​17816)
• validate nullable-constant BiDi params outbound (#​17818)
• [build] upgrade rules_ruby to 0.28.0 and drop vendored Bazel::Runfiles workaround (#​17824)
• [build] Merge vendor cddl files into shared BiDi schema and implement custom Firefox webExtension options (#​17840)
• [grid] honor client-advertised se:remoteUrl for reachable BiDi/CDP/VNC URLs (#​17790)
• tolerate and warn on missing required inbound BiDi fields, with SE_BIDI_STRICT to escalate (#​17844)
• remove deprecated FTP proxy support (#​17846)
• prevent CDP access with Firefox (#​17849)
• test matchers assert log entries by id and optional messages and match severity (#​17848)
• [bidi] Correct float/enum type fidelity in the shared schema and validate primitives outbound in Ruby (#​17852)
• [bidi] mark BiDi types extensible per spec and update Ruby handling (#​17853)
• raise typed WebDriver errors for BiDi from a generated error-code map (#​17855)
• allow pending test guards to require matching provided exception (#​17859)
• pass --enable-chrome-logs unless CHROME_LOG_FILE is set (#​17858)
• support custom vendor specific capabilities in options classes (#​17862)
• validate BiDi outbound ref fields against their declared type (#​17861)
• generate BiDi domain type accessors and union variant factories (#​17865)
• deprecate invalid Firefox profile code (#​17871)
• [build] Automated Browser Version Update with CDP (#​17873)

simplecov-ruby/simplecov (simplecov)

v1.2.0

Compare Source

==================

SimpleCov 1.2 adds change-focused coverage, per-test attribution, production coverage, and a substantially expanded
CLI while keeping the existing configuration API working through deprecation aliases.

Highlights

• track_tests, simplecov tests, and simplecov affected connect covered lines to the tests that exercised them; the HTML report displays the same attribution and simplecov watch uses it for focused reruns.
• simplecov patch, per-file baselines, missed-count caps, and coverage history make coverage gates useful for both new changes and legacy codebases.
• SimpleCov::Production records low-overhead production line coverage, while simplecov dead-code and the bundled reports cross it with test coverage.
• ActionView templates can be measured with cover_views, including ERB, Haml, and Slim source highlighting.
• The CLI gains annotated source, report freshness, history, badges, shell completions, a man page, and richer machine-readable output.

Upgrade notes

• The minimum supported Ruby remains 3.2; JRuby 10 remains supported for line coverage.
• Successful runs now maintain the bounded coverage/.history.json file by default. Set history_limit 0 to disable it.
• Existing configuration continues to work, but criterion-specific filters and threshold scopes now prefer coverage(:criterion) { ignore ... } and minimum ..., per: .... The legacy forms warn with their exact replacements, and deprecations :raise can enforce a completed migration.
• coverage.json advances additively to schema 1.3 for test-context, history, baseline-error, and production data. Previously published versioned schemas remain frozen for pinned consumers.

Enhancements

• The HTML report's source view renders the track_tests recording. A covered line no recorded test executed drains from green to a slate tint, with a "Covered outside tests" legend chip, so coverage produced only by load time, suite setup, or helpers stops passing for tested code at a glance. Every executed line carries a tests badge naming its count, and clicking it opens an inline panel listing the covering tests, the same ids in the same order simplecov tests file:line prints, each one selectable with a click for handing to a runner. Drained lines explain themselves in the same panel instead of listing nothing. The file header's Line coverage row splits its fraction by the same attribution ("Line coverage: 100.00% 21/30 relevant lines covered by tests, 9/30 relevant lines covered outside tests"), the legend's covered chip splits to match (green "Covered by tests" beside the slate "Covered outside tests"), keyboard access rides on real buttons with the report's focus ring, and the panel closes on Escape without closing the source dialog. The file list draws the same distinction: each line coverage bar splits its fill into the share recorded tests produced (in the usual band colour) and a slate share covered only outside them, in the file rows and the live-filtered totals row alike, and sorting by line coverage breaks ties on the by-tests share, so of two files at 100% the one whose coverage rests on its tests ranks above the one warmed by load time. All of it appears only when the report was generated with track_tests enabled, so other reports render exactly as before.

• simplecov patch reports coverage of just the lines a change touched, the question diff does not answer. Where diff compares two reports and asks whether the overall number moved — which a large or legacy project cannot shift in one pull request — patch reads git diff --unified=0 --merge-base <base>, intersects the added and modified line numbers with the current report, and prints line coverage — and, when the report measured branches or methods, branch and method coverage over the branches and methods those lines carry — for only that change, so a project sitting at 40% can still insist that everything it adds is tested. --minimum N exits non-zero below a floor (every measured criterion must clear it), composing with CI as a per-change gate alongside the existing thresholds; --base selects the ref to diff against (defaulting to the branch origin's HEAD points at, else main; in CI, the target branch or its merge-base); --find-renames follows a moved file instead of counting it as all-new; and --json emits the rows the other read-only commands do. Only files the report already carries are scored, and a line LinesClassifier deems never relevant stays out of the denominator the same way it stays out of a file's total, so a comment-only or whitespace change reads as nothing to cover rather than as a gap. A brand-new file that was never git added appears in no diff yet is still the change's work, so untracked files are scored too, every report-known line of them as new. The diff is anchored at the repository root rather than the working directory, so a run from a subdirectory reports the same change, and changed files resolve against the report by exact path, so a lookalike entry elsewhere in the report can never be scored in a changed file's place. A changed line beyond what the report knows for its file draws a staleness warning instead of silently scoring nothing, a git failure reports git's own words rather than a guess, and a path that matches more than one report entry names its candidates, in coverage and tests too, instead of a bare "no entry". Almost none of this is new machinery: the report already knows which lines are relevant and which were hit, leaving a hunk-header parser and path resolution against the report's root. Prior art is diff-cover, Codecov's patch status, and the undercover gem, which does this for Ruby but needs its own formatter and a git dependency to get there. See #​1262.

• track_tests recording got a cost model and the levers to control it. Recording now settles at segment boundaries: consecutive tests share their boundary coverage snapshot (one snapshot closes one test's segment and opens the next, attributing any in-between code to the later test), which halves the per-test sampling cost outright, and the project-root check is memoized per file. On top of that, track_tests granularity: :file records one context per test file instead of per test, so the suite pays one snapshot per change of file in run order rather than one per test, and test selection needs no more than file identity anyway. On a real 1,756-test Minitest suite measuring line, branch, and method coverage, the two changes together cut tracking overhead from 52 seconds to 28 at the default granularity and to 13 at :file. The remaining floor is Ruby's own Coverage.peek_result copy, which scales with the criteria the run measures: a millisecond or two under line coverage alone, an order of magnitude more with branch and method tables, which the docs now spell out.

• simplecov tests answers which tests cover a file or line, from the terminal. Bare, it lists every test recorded under track_tests. With a path it narrows to the tests touching that file, and with path:line to one line. Text output is one test id per line and nothing else on stdout, sorted, so the list can feed a runner directly (simplecov tests lib/foo.rb:42 | xargs bundle exec rspec), with empty answers noted on stderr instead. --json emits a JSON array, and --input picks the report like the other read-only subcommands. It reads the contexts data in coverage.json, so it works on any report generated after track_tests was enabled, and explains what to enable when the recording is missing.

• simplecov tests --redundant lists the tests whose covered lines other tests also cover, the tests contributing no coverage of their own, computed from the same track_tests recording with no new measurement. The flag composes with the narrowing, so simplecov tests --redundant lib/foo.rb lists the redundant tests among those touching the file. The listed ids are candidates for review rather than a delete list: assertions and mutation-killing power are invisible to coverage, and two tests covering exactly the same lines subsume each other, so both are listed and deleting both would lose the lines. An empty answer over a real recording is good news and says so on stderr.

• simplecov affected selects the tests that touch changed code. It diffs the working tree against the merge base of a git ref (--base, defaulting to the branch origin's HEAD points at, else main) and HEAD, so uncommitted work counts as part of the change while commits that landed on the base after the branch point do not, includes untracked files, and prints the test files whose recorded tests touch the changed files, so the local inner loop can run simplecov affected --run bundle exec rspec instead of the whole suite. Everything after --run is the runner command, the selection is appended to it, and the exit status is the command's own. The set intersection is the easy half. The hard half is knowing when to distrust the map, because a test map is stale the moment something changes that no test mentions by name, so any changed file outside the tracked set fails open to the full suite, out loud: a changed Gemfile.lock, .simplecov, spec helper, runner configuration, or any file the report has no data for is named on stderr as the trigger, while stdout prints nothing, which a bare runner reads as run everything. Changed or brand-new test files always select themselves, recorded or not, a test file deleted by the change drops out of the answer, and a recorded test whose file no longer exists anywhere else reads as staleness rather than being silently skipped. --json emits the selection with its full_suite verdict and triggers for tooling, and --input picks the report like the other read-only subcommands. Like patch, the diff is anchored at the repository root, so a run from a subdirectory selects over the whole change, with --run starting the runner at that root, and changed files resolve against the report by exact path, so a lookalike entry elsewhere in the report can never stand in for a changed file the report does not carry. Built for the local inner loop first, because a wrong answer in CI is a green build on a broken change. See #​1264. track_tests in a SimpleCov.start block samples coverage around every RSpec example and Minitest test, and stores the map in .resultset.json under a versioned contexts key beside the merged coverage, exposed as SimpleCov::Result#contexts with a covering(path, line) lookup. The data layer speaks of contexts rather than tests because the mechanism is general and matches the vocabulary a future Coverage library feature would use, while under track_tests every context is one test. Test ids are interned and each test's covered lines are packed into per-file bitmaps, which keeps the naive tests-times-lines storage in hand. Merges union the maps when every merged result recorded one and drop them out loud otherwise, across suites, concurrent runners, parallel workers, and simplecov collate alike, since a partial map would present one worker's tests as the whole run's. The Minitest wrapper installs through the minitest 5 plugin, and under minitest 6, whose autorun no longer discovers plugins, the moment Minitest::Test is defined. Other runners wrap their own units of work with SimpleCov.track_test. Tests running concurrently in threads inside one process cannot be told apart, because coverage counters are process-global, so such a process warns and stores no map rather than a misattributed one, while process-parallel workers each record their own. The serialized map carries a format version, so a future format reads as absent instead of being misread. The map also flows into coverage.json, the durable artifact downstream tools build on, as a document-level contexts array plus per-file hex bitmaps, under coverage.json schema 1.1 (schemas/coverage-v1.1.schema.json, with 1.0 staying frozen for pinned integrations, and the new keys optional so documents without recordings stay minimal). Opt-in because sampling around every test costs run time and the map costs space. Needs regular line coverage, so :oneshot_line is rejected at startup, because a line reports only its first hit ever and every later test's delta would miss it. See #​1263.

• ActionView templates can be part of the report. cover_views in a SimpleCov.start block turns on eval coverage, which is what measures a template the suite renders, and compiles the templates it never renders so they appear at 0% rather than not at all. Rendering already produced usable data, because ActionView compiles each template with module_eval(source, identifier, offset) where the identifier is the template's own path and the offset cancels the def line its wrapper adds, so the generated code is attributed back to the .erb file at the template's own line numbers and nothing needs remapping. The gap was the other half: a template no test renders is never compiled, so Coverage never hears about it, and the views with no coverage were exactly the ones the report omitted. cover_views defaults to a Rails app's views, takes globs of its own for templates that live elsewhere, and honors skip like any other file in the report. The rails profile gains a matching Views group, which stays empty in a project that has not opted in. Needs CRuby 3.2 or later, which is what eval coverage needs. See #​1265.

• The source view highlights each file by its own language rather than assuming Ruby. A .erb template used to be handed to the Ruby grammar, which declines to match markup and left the view almost entirely unhighlighted, so templates now go through an ERB grammar that marks up the tags and highlights what is between them as Ruby. It is a small grammar of SimpleCov's own rather than the one highlight.js ships, whose markup is delegated to a full XML grammar that carries a literal </script the report cannot inline (the whole report is one index.html with its JavaScript in a <script> element) and that would have cost around 5KB in every report written. The one shipped costs 627 bytes.

• The changelog is back at CHANGELOG.md in the project root, where the convention documented at keepachangelog.com puts it and where humans and tooling look for it. Moving it under docs/ was never what kept it out of the packaged gem: gem.files lists what ships, so the file stays unpackaged where it is. The gem's changelog_uri metadata follows it back, and the pre-0.18 entries stay at docs/Changelog.old.md. See #​1272.

• cover_views reaches Haml and Slim, and its default glob is now app/views/**/*.{erb,haml,slim}. Nothing was needed to measure them beyond looking the handler up the way ActionView's own resolver does: both generate Ruby that keeps the template's line structure, so hits land on the lines their authors wrote. The same goes for any other language a project has registered a handler for, which needs only its extension named in a glob. An extension with no registered handler is now left out of the report instead of being compiled through ActionView's raw handler, which would have reported a project that has no Haml a file of static text for every .haml its default glob happened to match. The source view highlights Haml and Slim as themselves, the second through a small grammar of SimpleCov's own since highlight.js ships none.

• simplecov watch turns the report into something you look at while writing the test. It serves the report the way serve does, polls the tracked files for saves, re-runs the given command when something changes, and pushes a reload to the open tab over server-sent events the moment the report regenerates, with the result line naming the change and the coverage delta ("lib/result.rb changed, running 3 files... 100.00% (+0.40%)"), the number following the report's primary criterion. With a track_tests recording in the report a save re-runs only the tests touching the changed files, by the same selection walk simplecov affected uses and with the same fail-open rule, and without one every save runs the full command. The watched set is the report's own tracked files plus the recorded tests' files, polled by mtime rather than through a filesystem-event dependency, which also keeps report writes from triggering the next run. Child runs get a day-long merge window through the new SIMPLECOV_MERGE_TIMEOUT environment variable (honored by merge_timeout generally), so subset re-runs keep merging into a whole report across a long session. The report on disk stays byte-identical to a plain run's, with the reload listener added only on the way out of the server, and --open pops the report in the default browser on start. See #​1269.

• simplecov show <path> prints annotated source in the terminal, the way go tool cover and llvm-cov show do: hit counts in the gutter, a caret marker naming each miss under its line, and branch and method misses annotated the same way when the report measured them. --uncovered-only collapses the answer to path:40,52-58,71, a form that greps, fits in a commit message, and hands a coding agent exactly the lines whose tests are missing, and --json emits the whole annotation as data (missed lines, per-line hits, marker labels) for editor integrations. With no path, --uncovered-only sweeps the whole project into one path:ranges line per file with misses, and a bare --json emits the same sweep as data. Colors follow the usual NO_COLOR, FORCE_COLOR, and --no-color rules. The source comes from the report itself when it embeds one, and otherwise from disk, accepted only while the file's line count still matches the report's, since annotating drifted source would put hit counts on the wrong lines. See #​1270.

• simplecov status answers "is this report fresh?" from metadata the artifacts have carried all along: the report's age, the SimpleCov version and run that produced it, the recorded commit and how many commits HEAD has moved since, the measured totals, whether a track_tests map is present (and what to enable when it isn't), and the resultset's entries with their ages. --json emits the same facts as data. Every staleness question the change-aware commands raise now has a one-command answer.

• simplecov uncovered --missing appends the missed line ranges to each row (50.00% 5/10 lib/foo.rb missing 4-7,9), following the chosen criterion (zero-hit lines, or the lines missed branches and methods report on), and adds a missing array to each --json row, so the list says not just where to add tests but which lines they're for. --annotate github emits ::warning workflow commands instead of rows, one per contiguous missed range, so a plain GitHub Actions workflow gets inline diff annotations with no upload step and no code-scanning permissions.

• simplecov badge renders the report's percentage as a flat SVG badge in the shields.io style, to stdout or to a file with --output, so a README or CI artifact can carry the number straight from the local report with no badge service in the loop. The color follows the ladder badge services use for coverage (bright green at 90% and above, stepping down to red below 50%), --criterion picks the line, branch, or method percentage, and the label names the chosen criterion ("line coverage", "branch coverage", "method coverage") unless --label replaces it. The percent comes from the totals coverage.json already carries, so the badge always matches what the other read-only commands report.

• simplecov completions fish|bash|zsh prints a tab-completion script for the named shell, covering every subcommand with its description and each command's own options. The script is generated from the usage document itself rather than a hand-kept table, so a new command or option appears in completions the moment it is documented.

• The gem ships a man page, man/simplecov.1, covering every CLI command and option with the environment variables and files the commands honor. Like the shell completions, it is generated from the usage document (rake man regenerates it) so it cannot drift, and the suite fails when the committed copy is stale. RubyGems does not install man pages onto MANPATH, so read it with man $(gem contents simplecov | grep man/simplecov.1) or let a system package manager place it.

• Every CLI command answers --help / -h with its own slice of the usage text: the command's row, its options, and the shared options it accepts, instead of the full listing. It also replaces what optparse's built-in handler did before, which was to print a bare option summary under the host program's banner and exit the process from inside the parser.

• A checked-in per-file coverage baseline that only ratchets up, for legacy codebases where one minimum_coverage number does nothing and one minimum_coverage_by_file number lets the single worst file set the ceiling for the whole policy. simplecov ratchet writes .simplecov_baseline.yml from the current report, one floor per file per measured criterion, and the exit check fails any listed file that drops below its own floor. Rewriting only ever tightens: files that improved get their floors raised, files that regressed keep the floors they are now below (and are named in the summary), entries for deleted files are pruned, and new files never get an entry, so they answer to the real minimum_per_file standard (which files with an entry are exempt from, per criterion) rather than to a floor cut at whatever they launched with. The diff on the baseline file becomes the honest record of which direction the codebase moved, reviewable in the same PR as the change that moved it, the way .rubocop_todo.yml records offenses. The issue left open whether a floor should be a percent or a count of uncovered lines, since a percent moves when a file is edited without any coverage change at all. Each floor stores both: the percent is the policy, and the missed count is the dampener, so a violation requires a lower percent and more misses together, and an edit that only reshuffles covered lines fails nothing. A hand-written bare-percent entry (lib/foo.rb: 41.2) is accepted and decided by percent alone until the next ratchet records its missed count, while a malformed baseline fails loudly rather than silently un-enforcing every floor it carried. --init deliberately regenerates the file from scratch (new files added, floors reset), --dry-run prints without writing, --json emits the summary as data, and --baseline names the file, defaulting to the project's SimpleCov.baseline_file, which the command reads from .simplecov the way the read-only commands read coverage_dir. Baseline violations also land in coverage.json's errors section, under schema 1.2 (additive, with 1.1 staying frozen for pinned integrations). See #​1268.

• maximum_missed and maximum_missed_per_file cap the number of misses instead of demanding a ratio, per criterion: uncovered lines, branch arms, or methods, counted in the criterion's own units. The suite-wide cap is a burn-down number, because "12 uncovered lines left" stays meaningful as the codebase grows and shrinks and is the sentence a team driving to 100% actually says, while the equivalent percentage moves with every edit. The per-file cap says what a per-file percent minimum cannot: a 2,000-line file at 99% hides 20 misses while a 10-line file at 80% fails over 2, so the cap holds every file to the same absolute budget. Both are verbs in the coverage block (`coverage(:line) { maximum_missed 12; maximum_missed_

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.