[dependabot]

Bumps the ruby-deps group with 4 updates: pg, pagy, listen and rubocop-rspec_rails.

Updates pg from 1.6.3 to 1.7.0

Changelog

Sourced from pg's changelog.

v1.7.0 [2026-10-02] Lars Kanis lars@greiz-reinsdorf.de

Added:

• Add PG::Connection#embed_params and keyword :typename for its parameter casting. #726 This allows to generate SQL strings with embedded parameters for easier debugging.
• Add PG::Connection#full_protocol_version which is new in PostgreSQL-18 #695
• Add PG::Result#each_tuple #675
• Add PG::TypeMap#query_param_encoders to retrieve encoders. #726
• Deduplicate result field name strings for better performance. #750

Removed:

• Remove compatibility to ruby < 3.1 and drops support of ruby-2.7 and ruby-3.0. #749
• Remove GLV unlocking at all functions which process data modifiable in a second thread. #721 This avoids possible premature garbage collection of query parameters and possible VM crash due to concurrent data manipulation.
• Remove :static_symbol result field names. #691
• Remove enforced rpath addition when no rpath is configured in rbconfig. #699

Fixes:

• Limit memory allocation on invalid input into PG::BinaryDecoder::Array. #743
• Free COPY buffers when decoders raise to avoid possible memory leak in get_copy_data. #742
• Prevent SQL injection in set_client_encoding. #741
• Add GC_GUARD to temporary ruby objects for conninfo string to avoid it's GC'ed prematurely. #739
• Remove option "quirks_mode" from JSON en/decoder to fix compat with json-3.0 gem. #737
• Respect calendar type of Ruby and PostgreSQL. #725
• Fix broken set_notice_(receiver|processor) callback after GC.compact. #734
• Disable DNS resolution in ruby when a service file is used, so that the priority of parameters is equal to libpq. #635
• Use RARRAY_LENINT to avoid possible overflow. #728
• Fix possible integer overflow at PG::BinaryEncoder::CopyRow and PG::TextEncoder::CopyRow. #714, #715
• Avoid possible integer overflow in query parameter encoding. #719
• Ensure conninfo is a valid C string before closing the connection to avoid a double free of PGconn. #709
• Raise on a too large input string to PG::TextEncoder::Bytea. #717
• Check PG::BinaryEncoder::CopyRow array input size instead of producing an invalid output.
• Remove accidentally copied "static" keyword from Copy and Record encoder. #711
• Avoid possibility to replace typemap while being used in Copy and Record encoders and decoders. #707
• Add GC_GUARD's for encoding converted strings sent to the server. #705
• Fix incomplete transaction commit when thread is shutdown ungracefully. #704
• Assign VALUE after registration per rb_gc_register_address() #703
• Update dependencies for binary gems to PostgreSQL-18.6, OpenSSL-3.6.5, krb5-1.22.2 #752

Commits

• fcf40c5 Add new gem signing certificate
• d41e07a Merge pull request #753 from larskanis/rm-pgsql-10
• 8e1ee8f Remove some conditions for PostgreSQL-10
• 050c56d Fix typo in CHANGELOG and add version note
• 2c4934e Bump VERSION to 1.7.0
• f644ba2 Update release notes once more
• b16542d Merge pull request #752 from larskanis/upd-binaries
• 66b27c6 Update dependencies for binary gems to
• 6a07394 Add CHANGELOG entry for pg-1.7.0
• 5390356 Merge pull request #749 from larskanis/minruby-3.1
• Additional commits viewable in compare view

Updates pagy from 43.6.3 to 43.7.0

Release notes

Sourced from pagy's releases.

Version 43.7.0

Changes in 43.7.0

• Refactor the Search::Arguments and Searcher classes to allow more flexibility in chaining queres.
• Fix the non-standard "previous" link relation in headers_hash and JSON:API urls_hash
  • headers_hash emits the conventional rel="prev" in the link header
  • urls_hash returns the :prev key with jsonapi: true, as the JSON:API specification requires
  • urls_hash keeps the :previous key otherwise
• Fix series_nav_js ignoring the :slots and :compact helper options
  • The :slots and :compact options passed to the series_nav_js helpers were silently ignored
  • The :steps option overrides the :slots option, while the :compact option applies to all the steps
• Fix the playground doc URLs and make the playground apps consistent
• Add :rails_active_search paginator, test and docs

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

• New :countish Paginator
  • Faster than OFFSET and supporting the full UI
• New Keynav Pagination
  • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
• New interactive dev-tools
  • New PagyWand to integrate the pagy CSS with your app themes.
  • New Pagy AI available right inside your own app.
• Intelligent automation
  • Configuration requirements reduced by 99%.
  • Simplified JavaScript setup.
  • Automatic I18n loading.
• Simpler API
  • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
  • Methods are autoloaded only if used, and consume no memory otherwise.
  • Methods have narrower scopes and can be overridden without deep knowledge.
• New documentation
  • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.7.0

• Refactor the Search::Arguments and Searcher classes to allow more flexibility in chaining queres.
• Fix the non-standard "previous" link relation in headers_hash and JSON:API urls_hash
  • headers_hash emits the conventional rel="prev" in the link header
  • urls_hash returns the :prev key with jsonapi: true, as the JSON:API specification requires
  • urls_hash keeps the :previous key otherwise
• Fix series_nav_js ignoring the :slots and :compact helper options
  • The :slots and :compact options passed to the series_nav_js helpers were silently ignored
  • The :steps option overrides the :slots option, while the :compact option applies to all the steps
• Fix the playground doc URLs and make the playground apps consistent
• Add :rails_active_search paginator, test and docs

Commits

• 16e2a25 Merge branch 'dev'
• 6a5a8fc Version 43.7.0
• 3fbd015 Update gems and packages
• fecc1d6 Skip console output failure due to different formatting of ruby < 3.4
• 5ac4cfb 💎 Refactor the Search::Arguments and Searcher classes to allow more flexibili...
• ac44f13 💎 Fix the non-standard "previous" link relation in headers_hash and JSON:API ...
• 553a95b 💎 Fix series_nav_js ignoring the :slots and :compact helper options
• 682a120 Add the script to update the docs console examples, and its test
• d09d8bb Review the docs for style, consistency and formatting
• 6471967 💎 Fix the playground doc URLs and make the playground apps consistent
• Additional commits viewable in compare view

Updates listen from 3.10.0 to 3.10.1

Release notes

Sourced from listen's releases.

v3.10.1

What's Changed

• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#597
• CI: Run all tests on Windows in addition by @​larskanis in guard/listen#585
• Preserve independent listener filters across updates by @​OskarEichler in guard/listen#599
• Revert "Fix flaky specs on TruffleRuby" by @​rymai in guard/listen#603
• Remove outdated note about performance by @​quadule in guard/listen#586
• Avoid selecting the filesystem adapter twice by @​OskarEichler in guard/listen#600
• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#605
• [LOW] Bound directory scanning under filesystem churn by @​OskarEichler in guard/listen#601
• [LOW] Pin workflow actions and token permissions by @​OskarEichler in guard/listen#602

New Contributors

• @​andrykonchin made their first contribution in guard/listen#597
• @​OskarEichler made their first contribution in guard/listen#599
• @​quadule made their first contribution in guard/listen#586

Full Changelog: guard/listen@v3.10.0...v3.10.1

Commits

• 6fbde9f Bump VERSION to 3.10.1
• d53f6d9 Merge pull request #602 from OskarEichler/codex/security-pin-workflow-actions
• d6bb203 Merge pull request #601 from OskarEichler/codex/security-bound-directory-scans
• fa07357 Merge pull request #605 from andrykonchin/ak/fix-flaky-specs-on-truffleruby
• b8360fd Refactor and simplify adapter/polling_spec.rb test because now stopping is sy...
• e2173ed Prevent spawning background threads in the Linux adapter unit tests
• a63463f Stop threads synchronously
• c5413b7 Merge pull request #600 from OskarEichler/audit/select-adapter-once
• 751b3f8 Merge pull request #586 from quadule/patch-1
• 309cf5f Merge pull request #603 from guard/revert-597-ak/fix-flaky-specs-on-truffleruby
• Additional commits viewable in compare view

Updates rubocop-rspec_rails from 2.32.0 to 2.33.0

Release notes

Sourced from rubocop-rspec_rails's releases.

RuboCop RSpec Rails v2.33.0

• Add RSpecRails/FileFixture cop to prefer file_fixture over hardcoded fixture paths. (@​ydah)
• Fix RSpecRails/HttpStatus to detect unknown symbolic HTTP statuses and handle custom numeric string statuses consistently. (@​ydah)
• Speed up loading rubocop-rspec_rails by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. (@​koic)
• Fix offense message for RSpecRails/HttpStatusNameConsistency cop. (@​fatkodima)
• Fix RSpecRails/MinitestAssertions autocorrection for quoted predicate symbols. (@​ydah)
• Fix RSpecRails/AvoidSetupHook to only check setup hooks inside example groups. (@​ydah)
• Fix a false positive for RspecRails/NegationBeValid when use to_not. (@​ydah)
• Fix false positives for RSpecRails/TravelAround when travel does not directly wrap the around example. (@​ydah)
• Supporting correcting assest_redirected_to in RSpec/Rails/MinitestAssertions. (@​nzlaura)
• Add new RSpecRails/ReceivePerformLater cop. (@​ydah)
• Fix RSpecRails/ReceivePerformLater offense range to exclude chains after the expectation. (@​ydah)
• Fix a false positive for RSpecRails/ReceivePerformLater when receive(:perform_later) is used inside another matcher. (@​ydah)
• Support described_class for RSpecRails/ReceivePerformLater. (@​ydah)
• Fix RSpecRails/TravelAround autocorrection to keep the indentation of the surrounding around block. (@​eugeneius)
• Fix RSpecRails/ReceivePerformLater offense messages for negative expectations. (@​ydah)

Changelog

Sourced from rubocop-rspec_rails's changelog.

2.33.0 (2026-10-07)

• Add RSpecRails/FileFixture cop to prefer file_fixture over hardcoded fixture paths. ([@​ydah])
• Fix RSpecRails/HttpStatus to detect unknown symbolic HTTP statuses and handle custom numeric string statuses consistently. ([@​ydah])
• Speed up loading rubocop-rspec_rails by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​koic])
• Fix offense message for RSpecRails/HttpStatusNameConsistency cop. ([@​fatkodima])
• Fix RSpecRails/MinitestAssertions autocorrection for quoted predicate symbols. ([@​ydah])
• Fix RSpecRails/AvoidSetupHook to only check setup hooks inside example groups. ([@​ydah])
• Fix a false positive for RspecRails/NegationBeValid when use to_not. ([@​ydah])
• Fix false positives for RSpecRails/TravelAround when travel does not directly wrap the around example. ([@​ydah])
• Supporting correcting assest_redirected_to in RSpec/Rails/MinitestAssertions. ([@​nzlaura])
• Add new RSpecRails/ReceivePerformLater cop. ([@​ydah])
• Fix RSpecRails/ReceivePerformLater offense range to exclude chains after the expectation. ([@​ydah])
• Fix a false positive for RSpecRails/ReceivePerformLater when receive(:perform_later) is used inside another matcher. ([@​ydah])
• Support described_class for RSpecRails/ReceivePerformLater. ([@​ydah])
• Fix RSpecRails/TravelAround autocorrection to keep the indentation of the surrounding around block. ([@​eugeneius])
• Fix RSpecRails/ReceivePerformLater offense messages for negative expectations. ([@​ydah])

Commits

• 38747b8 Merge pull request #127 from rubocop/release
• 7a2f21a Release v2.33.0
• c6f24fe Merge pull request #130 from rubocop/dependabot/github_actions/ruby/setup-rub...
• e9fff9d Bump ruby/setup-ruby from 1.321.0 to 1.326.0
• 7ce0b59 Merge pull request #128 from rubocop/docs/clarify-travel-around-cleanup
• 662f8de Merge pull request #129 from rubocop/feature/file-fixture-cop
• 52b051f Add RSpecRails/FileFixture cop
• 493a59c Clarify TravelAround cleanup and hook ordering
• ed29281 Merge pull request #60 from rubocop/doc-patch-1
• 83837cc Add safety note for autocorrection in have_http_status cop
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

Dependency Upgrade Review: ruby-deps group — pg, pagy, listen, rubocop-rspec_rails

PR scope

Dependency-only: Gemfile (pagy constraint ~> 43.6 → ~> 43.7) and Gemfile.lock. Dependabot declares 4 updates; the lockfile also moves 2 transitive gems: parallel 2.2.0 → 2.3.0 and uri 1.1.1 → 1.1.2.

Package	From	To	Runtime impact	Risk
pg	1.6.3	1.7.0	production (all DB access)	Low
pagy	43.6.3	43.7.0	production (pagination)	Low
listen	3.10.0	3.10.1	development only (Gemfile group :development)	None
rubocop-rspec_rails	2.32.0	2.33.0	lint only	None
uri (transitive)	1.1.1	1.1.2	production (faraday, premailer)	Low
parallel (transitive)	2.2.0	2.3.0	test/lint only	None

Changes in dependency

pg 1.7.0: drops Ruby < 3.1 (planner runs Ruby 4.0.6), removes GVL unlocking on functions that process data modifiable in a second thread (safer, and planner has no concurrent access to a single connection), removes :static_symbol result field names (unused). It also fixes a set_client_encoding SQL injection, several memory/overflow bugs, and date calendar handling. The calendar change only alters behaviour for dates before 1582-10-15 (commit 68b357d). All planner dates are modern, and PostgreSQL already stores Gregorian.

pagy 43.7.0: I read the full lib diff (9 files). Behavioural changes: Search::Arguments/Searcher refactor (planner has no pagy_search usage), headers_hash/urls_hash rel fix (planner emits no Link headers, uses no jsonapi option), series_nav_js slots/compact fix (planner uses the non-JS series_nav(:bootstrap), whose support file is not in the diff), and a new rails_active_search paginator. The pagy(...) dispatcher diff adds one map key. Everything planner calls is unchanged.

listen 3.10.1: file-watching fixes (adapter selection, directory-scan bound, filter preservation). Not present in production bundles.

rubocop-rspec_rails 2.33.0: new cops (RSpecRails/FileFixture, RSpecRails/ReceivePerformLater) and false-positive fixes; requires RuboCop ≥ 1.89 (lockfile has 1.91.0). .rubocop.yml sets NewCops: disable, so the new cops stay off.

uri 1.1.2: full diff read — URI.join parser alias, a rewrite of merge_path, docs. DEFAULT_PARSER and PARSER are the same object here (verified locally), so URI.join is a no-op change. merge_path runs on every faraday URL build (base + url in faraday 2.14.4 connection.rb:492), so I ran uri 1.1.1 and 1.1.2 side by side on 310 merge/join cases including the Flodesk base URLs: identical output in every case.

Usage in repository

• pg: no direct PG:: or require 'pg' anywhere in app/, lib/, config/, spec/ (searched). All access goes through the ActiveRecord adapter and its connection pool.
• pagy: include Pagy::Method in ApplicationController; pagy(...) in controllers; Pagy::Offset.new + Pagy::Request.new + page_url in app/queries/events_feed_query.rb; info_tag, series_nav(:bootstrap) in app/views/shared/_pagination.html.haml.
• uri: reached through faraday (Flodesk client lib/flodesk.rb), premailer (email HTML), and URI.encode_www_form in app/lib/omniauth/strategies/codebar.rb (untouched by the uri diff).

Compatibility assessment

Compatible — all four upgrades plus the two transitive bumps. No API planner uses changes in any of them.

Test coverage

CI on this PR head is fully green: RuboCop (with rubocop-rspec_rails 2.33.0), 6 parallel RSpec groups (94.3% coverage), security audit. Coverage of the changed paths: spec/features/listing_events_spec.rb paginates 22 events over 2 pages, which renders info_tag and series_nav(:bootstrap) end to end; spec/queries/events_feed_query_spec.rb asserts exact page_url output; mailer specs assert premailer-processed email HTML. Gap: nothing exercises the Flodesk client (external service), which is why I verified the uri change with the side-by-side battery instead.

Runtime and cross-service contracts

Contract	Touch point in this diff	Verification
Paginated HTML endpoints (browser)	pagy bump	Test-verified: feature specs render the nav on 2 pages at PR head
events feed pagination URLs	pagy bump	Test-verified: exact strings asserted in events_feed_query_spec.rb
DB reads/writes (AR → pg)	pg bump	Test-verified by the full suite at PR head; calendar change traced to pre-1582-only scope via commit message; no direct pg API use (grep)
Email HTML (premailer + uri)	uri bump	Test-verified by mailer specs; uri code diff read in full
Flodesk API request URLs (faraday → uri merge_path)	uri bump	Line-traced faraday's base + url; 310-case executed equivalence battery across uri 1.1.1/1.1.2
Auth-service OAuth calls (URI.encode_www_form)	none	Verified: the uri diff does not touch encode_www_form
Link headers / JSON:API URLs	changed upstream, unused	Verified non-use by search of app/, lib/, spec/, config/
Cookies, tokens, webhooks	none	Gemfile.lock-only diff; no emitted payload changes outside the rows above

Calibration

1. Weakest link: the pg row rests on the suite plus the calendar commit message rather than a line-trace of all 134 commits. A direct check would be running the suite locally on the PR worktree (mise exec -- bundle exec rspec), which repeats what CI already did on this head.
2. Relied-on absences: no change to modern-date encode/decode output (pg), no change to series_nav/info_tag link markup (pagy — argued from the file list plus the rendering specs), no behaviour change in parallel 2.3.0 (test tooling only, evidenced by green CI).
3. Disproven by: a failing date/timestamp assertion in the suite, a pagination spec failure, or a case in the uri battery where 1.1.1 and 1.1.2 diverge.

Confidence rating

High — used APIs are unchanged (diffs read), CI runs every affected path green at PR head, and the one contract without tests (Flodesk URLs) was verified by execution.

[mroderick]

Approved. See analysis comment above.