DEPS: Bump the gems group across 1 directory with 5 updates

[dependabot]

Bumps the gems group with 5 updates in the / directory:

Package	From	To
simplecov	1.0.2	1.0.3
json	2.21.1	2.21.2
rbs	4.0.3	4.1.2
sorbet-runtime	0.6.13351	0.6.13405
zeitwerk	2.8.2	2.8.3

Updates simplecov from 1.0.2 to 1.0.3

Release notes

Sourced from simplecov's releases.

v1.0.3

What's Changed

• Bump ruby/setup-ruby from 1.316.0 to 1.318.0 by @​dependabot[bot] in simplecov-ruby/simplecov#1238
• fix: memoise key parsing in RubyDataParser to fix combiner performance regression by @​oleksii-leonov in simplecov-ruby/simplecov#1239

New Contributors

• @​oleksii-leonov made their first contribution in simplecov-ruby/simplecov#1239

Full Changelog: simplecov-ruby/simplecov@v1.0.2...v1.0.3

Changelog

Sourced from simplecov's changelog.

1.0.3 (2026-07-26)

Bugfixes

• Generating a report no longer crashes when the coverage universe contains a module that shadows #inspect with an incompatible signature. Rendering a method coverage key's receiver calls to_s, and a singleton class's to_s renders its attached object via #inspect — Liquid's Utils module defines inspect(value, max_depth = 2) as a module_function, so any suite whose report included Liquid's files (typically a vendored bundle under the project root, which is why this surfaced only in CI) raised ArgumentError from the at_exit hook and lost its report. The exposure predates 1.0.2's key normalization, which only moved the call. Rendering now recovers by rebuilding the name from Module#name via bound methods, which user code cannot shadow, falling back to an address form that the existing normalization collapses. The external_at_exit workaround is no longer needed. Reported with an exemplary diagnosis by @​bkuhlmann. See #1236.
• Method coverage entries are now aggregated by source location alone, completing the aggregation introduced in 1.0.2 (which keyed on name and location). Ruby records one method entry per defined method, so a builder looping container.each_key { |key| define_method(key) { ... } } produces an entry per generated name, all at the block's location — and every name whose generated wrapper no test happened to call showed as an uncovered method on a line with full line and branch coverage. A source location is the unit a file-based report can express, and regular defs map one location to one name, so they are unaffected. The same identity is used when merging resultsets across processes. This also covers methods copied into refinements via import_methods, which Ruby records once per importing refinement at the shared module's original location, so exercising the method through any refinement now marks the shared definition covered and the skip workaround for shared refinement modules can be dropped. Reported with exemplary diagnoses by @​bkuhlmann. See #1234 and #1237.
• SimpleCov.formatter and SimpleCov.formatters now accept formatter instances in addition to formatter classes, so constructor options can actually be passed — most notably SimpleCov::Formatter::HTMLFormatter.new(silent: true) to suppress the "Coverage report generated" status line. Previously SimpleCov unconditionally called .new on whatever was configured, so passing an instance crashed with NoMethodError at report time. See #1240.

Performance

• Fix 5x performance regression on report combining (introduced in 1.0.0 as a result of using Ripper#parse in a hot path) by adding parsed key memoisation to RubyDataParser.call.

Commits

• e9fddf0 Bump version to 1.0.3
• 1bc8a8c bundle update
• 0e6eae8 fix: memoise key parsing in RubyDataParser to fix combiner performance regres...
• 1a8a9ba Accept formatter instances in formatter configuration
• 3ef1068 Bump ruby/setup-ruby from 1.316.0 to 1.318.0
• f33a574 Assert engine-independent invariants for receiver name fallbacks
• 3492da6 Aggregate method coverage by source location alone
• 2e60550 Survive user code that breaks receiver name rendering
• See full diff in compare view

Updates json from 2.21.1 to 2.21.2

Release notes

Sourced from json's releases.

v2.21.2

What's Changed

• Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc].

Full Changelog: ruby/json@v2.21.1...v2.21.2

Changelog

Sourced from json's changelog.

2026-07-31 (2.21.2)

• Fix a use-after-free bug in JSON::ResumableParser. [GHSA-9hj4-r449-hfvc].

Commits

• 5a32e43 Release 2.21.2
• 2c332bf Also don't compute ResumableParser cursor position for warning
• 5499aa5 Improve max_nesting documentation
• 499d9bc Fix the parser benchmark bytes report
• f5fc245 Pass '-mno-outline' to the compiler (if supported) to prevent function outlin...
• See full diff in compare view

Updates rbs from 4.0.3 to 4.1.2

Release notes

Sourced from rbs's releases.

4.1.2

Release note

Miscellaneous

• Keep GC disabled during GC_test#test_stress_and_stress= (#3061)
• Fix GC_test#test_enable leaving GC disabled for the rest of the suite (#3059)

4.1.1

Release note

Library changes

• Include the trailing ? in a keyword key's symbol location (#3043)
• Mark type_name as optional on the alias annotations (#3039)

Miscellaneous

• Fix template drift for ext/rbs_extension/ast_translation.c (#3038)

4.1.1.pre.1

Release note

Library changes

• Include the trailing ? in a keyword key's symbol location (#3043)
• Mark type_name as optional on the alias annotations (#3039)

Miscellaneous

• Fix template drift for ext/rbs_extension/ast_translation.c (#3038)

4.1.0

Release note

RBS 4.1 ships with JRuby support. The RBS parser is written in plain C without depending on the Ruby C API, so it is compiled to WebAssembly and runs on a Wasm runtime, with the parsed AST serialized in a binary format and decoded into RBS objects. The full test suite runs on JRuby in CI.

The inline RBS syntax gets three new features: singleton method definitions (def self.), the module-self constraint, and instance variable annotations in module declarations. Note that RBS inline is still experimental and may change in future releases.

This release also introduces RBS::Rewriter, an API to edit RBS source text while preserving the surrounding content, which rbs annotate is now built on. Parsing performance is improved by interning type names in a shared trie and reducing allocations per node.

RBS::Prototype::Runtime, the RDoc plugin parser, and the top-level float type alias are deprecated in this release.

Signature updates

Updated classes/modules/methods: ARGF, Array, CSV, Class, Delegator, Digest, ERB, Enumerable, Enumerator, Enumerator::Product, Etc, File, File::Constants, File::Stat, FileUtils, Float, Gem, Hash, IO, IPAddr, Integer, JSON, Kernel, MatchData, Module, Monitor, Numeric, ObjectSpace::WeakKeyMap, OpenSSL, Pathname, RBS::Ops, Ractor, Range, Resolv, RubyVM::InstructionSequence, Set, Shellwords, String, StringIO, StringScanner, Struct, Tempfile, Thread, Timeout, TSort, URI::Generic, Zlib::GzipReader, Zlib::ZStream

• Remove stale Float constants and add a constant drift test (#2994)
• Update RDoc comments with Ruby 4.0.6 (#3035)
• Add a dependency on tempfile. (#3025)

... (truncated)

Changelog

Sourced from rbs's changelog.

4.1.2 (2026-08-03)

Miscellaneous

• Keep GC disabled during GC_test#test_stress_and_stress= (#3061)
• Fix GC_test#test_enable leaving GC disabled for the rest of the suite (#3059)

4.1.1 (2026-07-30)

Library changes

• Include the trailing ? in a keyword key's symbol location (#3043)
• Mark type_name as optional on the alias annotations (#3039)

Miscellaneous

• Fix template drift for ext/rbs_extension/ast_translation.c (#3038)

4.1.0 (2026-07-27)

RBS 4.1 ships with JRuby support. The RBS parser is written in plain C without depending on the Ruby C API, so it is compiled to WebAssembly and runs on a Wasm runtime, with the parsed AST serialized in a binary format and decoded into RBS objects. The full test suite runs on JRuby in CI.

The inline RBS syntax gets three new features: singleton method definitions (def self.), the module-self constraint, and instance variable annotations in module declarations. Note that RBS inline is still experimental and may change in future releases.

This release also introduces RBS::Rewriter, an API to edit RBS source text while preserving the surrounding content, which rbs annotate is now built on. Parsing performance is improved by interning type names in a shared trie and reducing allocations per node.

RBS::Prototype::Runtime, the RDoc plugin parser, and the top-level float type alias are deprecated in this release.

Signature updates

Updated classes/modules/methods: ARGF, Array, CSV, Class, Delegator, Digest, ERB, Enumerable, Enumerator, Enumerator::Product, Etc, File, File::Constants, File::Stat, FileUtils, Float, Gem, Hash, IO, IPAddr, Integer, JSON, Kernel, MatchData, Module, Monitor, Numeric, ObjectSpace::WeakKeyMap, OpenSSL, Pathname, RBS::Ops, Ractor, Range, Resolv, RubyVM::InstructionSequence, Set, Shellwords, String, StringIO, StringScanner, Struct, Tempfile, Thread, Timeout, TSort, URI::Generic, Zlib::GzipReader, Zlib::ZStream

• Remove stale Float constants and add a constant drift test (#2994)
• Update RDoc comments with Ruby 4.0.6 (#3035)
• Add a dependency on tempfile. (#3025)
• Support %a{implicitly-returns-nil} on MatchData#[] (#2990)
• Update Array (#2987)
• Allow nil output buffers for reader methods (#3002)
• Add stdlib signature tests for #2967 (#2989)
• Update Integer, phase 1 (#2995)
• Add RBS::Ops (#2934)
• Update Module (#2933)
• Correct core/stdlib signatures to match Ruby 4.0 (#2967)
• Revert Digest::Class method changes (#2980)
• Add stdlib tests for updated StringScanner signatures (#2968)
• Update StringScanner signatures to match strscan 3.1.6 (#2959)
• Remove StringScanner methods absent from the latest Ruby release (#2961)
• Fix Resolv#initialize signature: array of resolvers + use_ipv6: (#2960)
• [Hash] Update Hash's signatures and tests to be correct (#2694)
• update rbs signatures to be more consistent with generics (#2867)

... (truncated)

Commits

• 2c39462 Merge pull request #3062 from ruby/claude/release-4-1-2-hurcyr
• d710ede Version 4.1.2
• c95a7c9 Merge pull request #3061 from ruby/claude/gc-stress-test-performance-424sfy
• 1630d1f Keep GC disabled during GC_test#test_stress_and_stress=
• 7534c7e Merge pull request #3059 from ko1/fix-gc-test-enable-restore
• 75bcf93 Fix GC_test#test_enable leaving GC disabled for the rest of the suite
• c6eaca2 Merge pull request #3058 from ruby/claude/release-doc-new-minor
• a8913a8 Document the JRuby container, and correct what pins the jar versions
• 1da55ae Remove the release path that predates the release workflow
• 34b1188 Say what the version on master means
• Additional commits viewable in compare view

Updates sorbet-runtime from 0.6.13351 to 0.6.13405

Release notes

Sourced from sorbet-runtime's releases.

sorbet 0.6.13404.20260804113210-b67b894d5

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13404', :group => :development
gem 'sorbet-runtime', '0.6.13404'

sorbet 0.6.13403.20260803212946-5d91008ec

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13403', :group => :development
gem 'sorbet-runtime', '0.6.13403'

sorbet 0.6.13402.20260803205216-82fc68069

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13402', :group => :development
gem 'sorbet-runtime', '0.6.13402'

sorbet 0.6.13401.20260803185252-9b4fe53c4

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13401', :group => :development
gem 'sorbet-runtime', '0.6.13401'

sorbet 0.6.13400.20260803185155-0d2365842

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13400', :group => :development
gem 'sorbet-runtime', '0.6.13400'

sorbet 0.6.13399.20260803165146-7b13c0d0c

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13399', :group => :development
gem 'sorbet-runtime', '0.6.13399'

sorbet 0.6.13398.20260803163401-02cc33eb8

To use Sorbet add this line to your Gemfile:

gem 'sorbet', '0.6.13398', :group => :development
gem 'sorbet-runtime', '0.6.13398'

sorbet 0.6.13397.20260803145149-1d7c65c76

... (truncated)

Commits

• See full diff in compare view

Updates zeitwerk from 2.8.2 to 2.8.3

Changelog

Sourced from zeitwerk's changelog.

2.8.3 (1 Aug 2026)

• 2.8.0 introduced a regression: Collapsed directories that were also configured as eager load exclusions were eager loaded. The exclusion was not honored. This has been fixed.

Commits

• 607973f Ready for 2.8.3
• 8f09b96 Let eager loading skip collapsed eager loading exceptions
• f548f2c Remove unused variables
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions