chore(deps-dev): bump the bundler-dependencies group across 1 directory with 3 updates by dependabot[bot] · Pull Request #321 · PostHog/posthog-ruby

dependabot · 2026-10-28T18:23:38Z

Bumps the bundler-dependencies group with 3 updates in the / directory: mcp, rubocop and webmock.

Updates mcp from 1.7.0 to 1.8.1

Release notes

v1.8.1

This release brings the server's JSON-RPC framing and capability advertisement, and the HTTP client's handling of an initialize answered over SSE, in line with the MCP specification. The Changed entries alter answers on the wire, as fixes of incorrect conformance under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md. Only senders of null ids and client code that read the error event of a 4xx or 5xx SSE answer, which the client now raises as RequestHandlerError, have to change. A stdio server also survives a frame it cannot strip, parse or answer.

Changed

Refuse a request whose id is null and do not run a request method sent without an id (#612)

Leave the id out of an error response when the request id cannot be read (#615)

Return from initialize as soon as its SSE response arrives and raise on an error-status SSE answer in the HTTP client (#617)

Leave listChanged and subscribe out of a stateless server's initialize result (#620)

Fixed

Answer a method of an undeclared capability with Method not found (#611)

Accept any string as a request id (#613)

Ignore empty members of the Accept header (#616)

Keep Ruby 2.7 from warning about keywords in StdioTransport (#621)

Keep the stdio server running when a reply cannot be encoded (#623)

Treat a JSON key that is not valid UTF-8 as a parse error (#624)

Strip stdio frames as bytes (#625)

v1.8.0

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/HEAD/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

Add OAuth 2.1 resource server support (#545)

Add a scope selector for OAuth authorization-code clients (#579)

Changed

Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

Redact the Authorization header from the errors the HTTP transport retains (#591)

Close a refused SSE stream outside the registry lock (#592)

Let the session reaper finish before the transport closes (#593)

Bound the subscriptions/listen teardown on transport close (#595)

Close a failed subscriptions/listen stream only from the path that removed its entry (#596)

Accept any 2xx acknowledgement of a notification in the HTTP client (#600)

Changelog

Sourced from mcp's changelog.

[1.8.1] - 2026-10-21

This release brings the server's JSON-RPC framing and capability advertisement, and the HTTP client's handling of an initialize answered over SSE, in line with the MCP specification. The Changed entries alter answers on the wire, as fixes of incorrect conformance under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md. Only senders of null ids and client code that read the error event of a 4xx or 5xx SSE answer, which the client now raises as RequestHandlerError, have to change. A stdio server also survives a frame it cannot strip, parse or answer.

Changed

Refuse a request whose id is null and do not run a request method sent without an id (#612)

Leave the id out of an error response when the request id cannot be read (#615)

Return from initialize as soon as its SSE response arrives and raise on an error-status SSE answer in the HTTP client (#617)

Leave listChanged and subscribe out of a stateless server's initialize result (#620)

Fixed

Answer a method of an undeclared capability with Method not found (#611)

Accept any string as a request id (#613)

Ignore empty members of the Accept header (#616)

Keep Ruby 2.7 from warning about keywords in StdioTransport (#621)

Keep the stdio server running when a reply cannot be encoded (#623)

Treat a JSON key that is not valid UTF-8 as a parse error (#624)

Strip stdio frames as bytes (#625)

[1.8.0] - 2026-10-16

This release adds OAuth 2.1 resource server support to StreamableHTTPTransport: bearer tokens are verified by a JWT or an RFC 7662 introspection verifier (or one of your own), requests without a valid token get RFC 6750 challenges, and a Rack middleware serves the RFC 9728 Protected Resource Metadata document; token issuance stays with an external authorization server. The bundled client transports now reject server messages that are not JSON-RPC 2.0, which rejects what earlier releases accepted and ships in a minor release under the exceptions described in https://github.com/modelcontextprotocol/ruby-sdk/blob/main/VERSIONING.md: a server whose responses lack "jsonrpc": "2.0" has to send the member, since there is no opt-out.

Added

Add OAuth 2.1 resource server support (#545)

Add a scope selector for OAuth authorization-code clients (#579)

Changed

Reject server messages that are not JSON-RPC 2.0 in the client transports (#590)

Fixed

Redact the Authorization header from the errors the HTTP transport retains (#591)

Close a refused SSE stream outside the registry lock (#592)

Let the session reaper finish before the transport closes (#593)

... (truncated)

Commits

0e59bb4 Merge pull request #626 from koic/release_1_8_1
0b3f02d Release 1.8.1
9e2b3f7 Merge pull request #625 from koic/strip_stdio_frames_as_bytes
d280b57 Strip stdio frames as bytes
6d7b3c4 Merge pull request #624 from koic/treat_a_json_key_that_is_not_valid_utf_8_as...
c8e8b62 Merge pull request #623 from koic/keep_the_stdio_server_running_when_a_reply_...
54a6470 Merge pull request #620 from koic/leave_list_changed_out_of_initialize_on_a_s...
16a82a0 Keep the stdio server running when a reply cannot be encoded
0814e7a Treat a JSON key that is not valid UTF-8 as a parse error
4559336 Merge pull request #616 from koic/ignore_empty_members_of_the_accept_header
Additional commits viewable in compare view

Updates rubocop from 1.91.0 to 1.92.0

Release notes

Sourced from rubocop's releases.

RuboCop v1.92.0

New features

#15895: Add an MCP tool that explains what cops do. (@bbatsov)

#15700: Add --explain COP to describe what a cop does, how it is configured, and the examples from its documentation. (@bbatsov)

#15699: Add --max-offenses-per-cop to cap how many offenses a single cop reports. (@bbatsov)

#15948: Let MCP autocorrection apply the corrections of AutoCorrect: contextual cops when asked to. (@bbatsov)

#15945: Let MCP autocorrection preview its changes as a diff. (@bbatsov)

#15915: Let MCP inspection cap how many offenses each cop reports. (@bbatsov)

#15930: Let MCP tools choose which cops run and which files they check. (@bbatsov)

#14666: Make Lint/UselessAssignment register an offense for a block-captured variable that is never referenced. (@IslamElsayed)

#15695: Report autocorrection edits in the JSON formatter. (@bbatsov)

#15940: Report cop errors and warnings per file in --format json. (@bbatsov)

#15945: Report the offenses MCP autocorrection leaves behind. (@bbatsov)

Bug fixes

#15780: Fix an error for Lint/MissingCopEnableDirective when an enable-next or next +Cop directive suspends an open rubocop:disable, and a false positive for next -Cop scopes larger than MaxRangeSize. (@bbatsov)

#16005: Fix a false negative for Security/JSONLoad with create_additions as the second argument. (@bbatsov)

#15994: Fix a false positive for Layout/LineEndStringConcatenationIndentation with an already aligned part. (@bbatsov)

#15842: Fix a false positive for Style/ExplicitBlockArgument when the method uses argument forwarding (...). (@bbatsov)

#15843: Fix a false positive for Style/NegativeArrayIndex with a different length receiver. (@bbatsov)

#15841: Fix a false positive for Style/RedundantFreeze with an arithmetic operation on a non-numeric receiver. (@bbatsov)

#15843: Fix a false positive for Style/Sample with an endless range, which was corrected to a sample call of the wrong size. (@bbatsov)

#15842: Fix a false positive for Style/SuperArguments when the method has a destructuring parameter. (@bbatsov)

#15740: Fix an error for Layout/EmptyLinesAroundMethodBody when a method's arguments span multiple lines and the method ends on the last argument's line. (@viralpraxis)

#15860: Fix an error for Layout/HeredocIndentation with a heredoc nested in another heredoc. (@Starlexxx)

#15876: Fix an error for Lint/EmptyConditionalBody with else on the condition line. (@koic)

#16008: Fix an error for Lint/UnescapedBracketInRegexp when using regexp_parser 2.11.2 and earlier. (@bbatsov)

#15897: Fix an error for Metrics/ClassLength with a long singleton class in LSP mode. (@bbatsov)

#15749: Fix an error for Style/ClassAndModuleChildren when a compact class or module definition appears in an expression, such as an assignment value or a method argument. (@viralpraxis)

#15750: Fix an error for Style/ClassAndModuleChildren when using EnforcedStyle: compact and the nested body is indented less than Layout/IndentationWidth's Width. (@viralpraxis)

#15764: Fix an error for Style/ClassAndModuleChildren when EnforcedStyle: compact compacts an irregularly indented definition and Layout/IndentationStyle enforces tabs. (@viralpraxis)

#15946: Fix an error for Style/ExplicitBlockArgument with the shorthand call syntax. (@Starlexxx)

#15861: Fix an error for Style/FormatString with format nested in format. (@Starlexxx)

#15694: Fix an error for Style/HashSyntax when a no_mixed_keys style forces hash rockets on a hash whose value repeats its key. (@viralpraxis)

#16007: Fix an error for Style/IfInsideElse when the nested if shares a line with other code. (@bbatsov)

#15867: Fix an error for Style/MapIntoArray when pushing into a numbered or it block parameter. (@Starlexxx)

#15949: Fix an error for Style/Next with a modifier condition wrapping a block that has its own offense. (@Starlexxx)

#15797: Fix an error for Style/RedundantCondition when autocorrecting a redundant condition nested in the else branch of another one. (@koic)

#15928: Fix an error for Style/Semicolon when a semicolon follows an unparenthesized keyword parameter or hash pattern. (@viralpraxis)

#15714: Fix an error for Style/YodaCondition when one operand of a comparison contains another comparison the cop also corrects. (@viralpraxis)

#16011: Fix an error for the pacman formatter, which crashed with undefined method 'winsize' whether or not the output was a terminal. (@bbatsov)

#15731: Fix an error when caching offenses whose correction or justification cannot be represented as UTF-8. (@viralpraxis)

#16015: Fix an error when cleaning up a result cache that can't be written. (@bbatsov)

#15702: Fix an error when interrupting RuboCop with Ctrl-C. (@viralpraxis)

#16015: Fix an error when the cache directory or config can't be accessed under a sandbox. (@bbatsov)

#16015: Fix an error when the result cache directory exists but can't be written. (@bbatsov)

#15817: Fix an incorrect autocorrect for Gemspec/OrderedDependencies when the same dependency declaration appears more than once in the gemspec. (@viralpraxis)

#15903: Fix an incorrect autocorrect for Layout/ClassStructure with blank line cops. (@koic)

... (truncated)

Changelog

Sourced from rubocop's changelog.

1.92.0 (2026-10-10)

New features

#15895: Add an MCP tool that explains what cops do. ([@bbatsov][])

#15700: Add --explain COP to describe what a cop does, how it is configured, and the examples from its documentation. ([@bbatsov][])

#15699: Add --max-offenses-per-cop to cap how many offenses a single cop reports. ([@bbatsov][])

#15948: Let MCP autocorrection apply the corrections of AutoCorrect: contextual cops when asked to. ([@bbatsov][])

#15945: Let MCP autocorrection preview its changes as a diff. ([@bbatsov][])

#15915: Let MCP inspection cap how many offenses each cop reports. ([@bbatsov][])

#15930: Let MCP tools choose which cops run and which files they check. ([@bbatsov][])

#14666: Make Lint/UselessAssignment register an offense for a block-captured variable that is never referenced. ([@IslamElsayed][])

#15695: Report autocorrection edits in the JSON formatter. ([@bbatsov][])

#15940: Report cop errors and warnings per file in --format json. ([@bbatsov][])

#15945: Report the offenses MCP autocorrection leaves behind. ([@bbatsov][])

Bug fixes

#15780: Fix an error for Lint/MissingCopEnableDirective when an enable-next or next +Cop directive suspends an open rubocop:disable, and a false positive for next -Cop scopes larger than MaxRangeSize. ([@bbatsov][])

#16005: Fix a false negative for Security/JSONLoad with create_additions as the second argument. ([@bbatsov][])

#15994: Fix a false positive for Layout/LineEndStringConcatenationIndentation with an already aligned part. ([@bbatsov][])

#15842: Fix a false positive for Style/ExplicitBlockArgument when the method uses argument forwarding (...). ([@bbatsov][])

#15843: Fix a false positive for Style/NegativeArrayIndex with a different length receiver. ([@bbatsov][])

#15841: Fix a false positive for Style/RedundantFreeze with an arithmetic operation on a non-numeric receiver. ([@bbatsov][])

#15843: Fix a false positive for Style/Sample with an endless range, which was corrected to a sample call of the wrong size. ([@bbatsov][])

#15842: Fix a false positive for Style/SuperArguments when the method has a destructuring parameter. ([@bbatsov][])

#15740: Fix an error for Layout/EmptyLinesAroundMethodBody when a method's arguments span multiple lines and the method ends on the last argument's line. ([@viralpraxis][])

#15860: Fix an error for Layout/HeredocIndentation with a heredoc nested in another heredoc. ([@Starlexxx][])

#15876: Fix an error for Lint/EmptyConditionalBody with else on the condition line. ([@koic][])

#16008: Fix an error for Lint/UnescapedBracketInRegexp when using regexp_parser 2.11.2 and earlier. ([@bbatsov][])

#15897: Fix an error for Metrics/ClassLength with a long singleton class in LSP mode. ([@bbatsov][])

#15749: Fix an error for Style/ClassAndModuleChildren when a compact class or module definition appears in an expression, such as an assignment value or a method argument. ([@viralpraxis][])

#15750: Fix an error for Style/ClassAndModuleChildren when using EnforcedStyle: compact and the nested body is indented less than Layout/IndentationWidth's Width. ([@viralpraxis][])

#15764: Fix an error for Style/ClassAndModuleChildren when EnforcedStyle: compact compacts an irregularly indented definition and Layout/IndentationStyle enforces tabs. ([@viralpraxis][])

#15946: Fix an error for Style/ExplicitBlockArgument with the shorthand call syntax. ([@Starlexxx][])

#15861: Fix an error for Style/FormatString with format nested in format. ([@Starlexxx][])

#15694: Fix an error for Style/HashSyntax when a no_mixed_keys style forces hash rockets on a hash whose value repeats its key. ([@viralpraxis][])

#16007: Fix an error for Style/IfInsideElse when the nested if shares a line with other code. ([@bbatsov][])

#15867: Fix an error for Style/MapIntoArray when pushing into a numbered or it block parameter. ([@Starlexxx][])

#15949: Fix an error for Style/Next with a modifier condition wrapping a block that has its own offense. ([@Starlexxx][])

#15797: Fix an error for Style/RedundantCondition when autocorrecting a redundant condition nested in the else branch of another one. ([@koic][])

#15928: Fix an error for Style/Semicolon when a semicolon follows an unparenthesized keyword parameter or hash pattern. ([@viralpraxis][])

#15714: Fix an error for Style/YodaCondition when one operand of a comparison contains another comparison the cop also corrects. ([@viralpraxis][])

#16011: Fix an error for the pacman formatter, which crashed with undefined method 'winsize' whether or not the output was a terminal. ([@bbatsov][])

#15731: Fix an error when caching offenses whose correction or justification cannot be represented as UTF-8. ([@viralpraxis][])

#16015: Fix an error when cleaning up a result cache that can't be written. ([@bbatsov][])

#15702: Fix an error when interrupting RuboCop with Ctrl-C. ([@viralpraxis][])

#16015: Fix an error when the cache directory or config can't be accessed under a sandbox. ([@bbatsov][])

#16015: Fix an error when the result cache directory exists but can't be written. ([@bbatsov][])

#15817: Fix an incorrect autocorrect for Gemspec/OrderedDependencies when the same dependency declaration appears more than once in the gemspec. ([@viralpraxis][])

... (truncated)

Commits

4172ce5 Cut 1.92
7e75867 Require net/http in the references:verify task
7c107cb Update Changelog
81c7d42 Fix an error when cleaning up a result cache that can't be written
3b70129 Fix an error when the result cache directory exists but can't be written
830275f Fix an error when the cache directory or config can't be accessed under a san...
38b43fc Remove a check from Style/SingleLineMethods that the shared endless method ...
9897fb1 Fix an incorrect autocorrect for Style/EndlessMethod and `Style/SingleLineM...
1a2221e Fix an incorrect autocorrect for Style/ReturnNilInPredicateMethodDefinition...
f2f4fac Fix an incorrect autocorrect for Style/EndlessMethod with a modifier condit...
Additional commits viewable in compare view

Updates webmock from 3.26.4 to 3.34.0

Release notes

Sourced from webmock's releases.

3.34.0

Allow with(query: :any) to match any query string (#1099)

stub_request(:get, "www.example.com").with(query: :any) matches requests with any query string, or none. RSpec's anything works the same way. Previously, this raised NoMethodError, and you had to write with(query: hash_including({})).

Use a URL without query parameters when passing query: :any. Otherwise, WebMock raises ArgumentError.

Thanks to nightpool

Raise a clear ArgumentError for an unsupported query option

Previously, a value such as with(query: :all) raised NoMethodError (undefined method split). The new error lists the supported values.

Show anything for keys given without a value to hash_including or hash_excluding outside RSpec

Previously, with Minitest or Test::Unit, messages showed #<WebMock::Matchers::AnyArgMatcher:0x...>, for example for with(query: hash_including(:a)). RSpec's own matchers already showed anything.

Provide HTTP_HOST to to_rack apps when the client has not supplied a Host header (#1084)

Previously, requests from some HTTP clients reached the Rack app without HTTP_HOST. This caused host checks such as Sinatra's HostAuthorization to see an empty host.

WebMock now fills in the host from the request URL, including the port when it is not the default. An explicit Host header is preserved.

Thanks to Benoit Tigeot

Fix Rack compatibility for to_rack apps

The request environment now passes Rack::Lint.

SERVER_PORT and CONTENT_LENGTH are now strings. If your app or tests read them directly, use string comparisons, such as env['SERVER_PORT'] == "80". The environment also includes SERVER_PROTOCOL.

CONTENT_TYPE is omitted when the request has no content type. The Content-Length header is passed only as CONTENT_LENGTH, without an extra HTTP_CONTENT_LENGTH entry. Transfer-Encoding is removed because the body has already been decoded.

Repeated header values are joined into one string. Header values and the body read from rack.input now use binary (ASCII-8BIT) strings.

3.33.0

Return effective_url as a String for stubbed Typhoeus responses (#869)

Previously, this was an Addressable::URI. If your code calls methods such as effective_url.host, parse the returned string into a URI first.

The URL keeps the request's port, query order and encoding. It follows curl's formatting: for example, http://example.com:80 becomes http://example.com:80/. Stubbed timeouts now provide an effective_url too.

Thanks to Tom Brammar

Fix incorrect removal of default ports from displayed URLs

WebMock could accidentally remove :80 or :443 from a URL's path or query. For example, an error message could show /foo/bar instead of /foo:80/bar.

Only the host's default port is now removed. This also works when the port is immediately followed by a query string, as in http://example.com:80?a=b.

... (truncated)

Changelog

Sourced from webmock's changelog.

3.34.0

Allow with(query: :any) to match any query string (#1099)

stub_request(:get, "www.example.com").with(query: :any) matches requests with any query string, or none. RSpec's anything works the same way. Previously, this raised NoMethodError, and you had to write with(query: hash_including({})).

Use a URL without query parameters when passing query: :any. Otherwise, WebMock raises ArgumentError.

Thanks to nightpool

Raise a clear ArgumentError for an unsupported query option

Previously, a value such as with(query: :all) raised NoMethodError (undefined method split). The new error lists the supported values.

Show anything for keys given without a value to hash_including or hash_excluding outside RSpec

Previously, with Minitest or Test::Unit, messages showed #<WebMock::Matchers::AnyArgMatcher:0x...>, for example for with(query: hash_including(:a)). RSpec's own matchers already showed anything.

Provide HTTP_HOST to to_rack apps when the client has not supplied a Host header (#1084)

Previously, requests from some HTTP clients reached the Rack app without HTTP_HOST. This caused host checks such as Sinatra's HostAuthorization to see an empty host.

WebMock now fills in the host from the request URL, including the port when it is not the default. An explicit Host header is preserved.

Thanks to Benoit Tigeot

Fix Rack compatibility for to_rack apps

The request environment now passes Rack::Lint.

SERVER_PORT and CONTENT_LENGTH are now strings. If your app or tests read them directly, use string comparisons, such as env['SERVER_PORT'] == "80". The environment also includes SERVER_PROTOCOL.

CONTENT_TYPE is omitted when the request has no content type. The Content-Length header is passed only as CONTENT_LENGTH, without an extra HTTP_CONTENT_LENGTH entry. Transfer-Encoding is removed because the body has already been decoded.

Repeated header values are joined into one string. Header values and the body read from rack.input now use binary (ASCII-8BIT) strings.

3.33.0

Return effective_url as a String for stubbed Typhoeus responses (#869)

Previously, this was an Addressable::URI. If your code calls methods such as effective_url.host, parse the returned string into a URI first.

The URL keeps the request's port, query order and encoding. It follows curl's formatting: for example, http://example.com:80 becomes http://example.com:80/. Stubbed timeouts now provide an effective_url too.

Thanks to Tom Brammar

Fix incorrect removal of default ports from displayed URLs

WebMock could accidentally remove :80 or :443 from a URL's path or query. For example, an error message could show /foo/bar instead of /foo:80/bar.

... (truncated)

Commits

11392e4 Version 3.34.0
eabc151 Close the gaps a review found in the Rack env
38f08be Make the Rack env for to_rack apps follow the Rack spec
732328b Tidy the Rack host fallback and its specs
3d831ce Set HTTP_HOST in the Rack env instead of the Net::HTTP signature
aa71fc1 Merge pull request #1084 from benoittgt/prevent-empty-host
5fbb394 Reject query :any with a URI query and accept anything matchers
d94e918 Reject unsupported query options and describe :any as anything
0b56b62 Merge pull request #1099 from nightpool/add-any-query-option
78d1078 Version 3.33.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…ry with 3 updates Bumps the bundler-dependencies group with 3 updates in the / directory: [mcp](https://github.com/modelcontextprotocol/ruby-sdk), [rubocop](https://github.com/rubocop/rubocop) and [webmock](https://github.com/bblimke/webmock). Updates `mcp` from 1.7.0 to 1.8.1 - [Release notes](https://github.com/modelcontextprotocol/ruby-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/CHANGELOG.md) - [Commits](modelcontextprotocol/ruby-sdk@v1.7.0...v1.8.1) Updates `rubocop` from 1.91.0 to 1.92.0 - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.91.0...v1.92.0) Updates `webmock` from 3.26.4 to 3.34.0 - [Release notes](https://github.com/bblimke/webmock/releases) - [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md) - [Commits](bblimke/webmock@v3.26.4...v3.34.0) --- updated-dependencies: - dependency-name: mcp dependency-version: 1.8.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler-dependencies - dependency-name: rubocop dependency-version: 1.92.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler-dependencies - dependency-name: webmock dependency-version: 3.34.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: bundler-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-28T18:26:10Z

posthog-ruby-async Compliance Report

Date: 2026-10-28T18:26:07.790922+00:00
Duration: 98522ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

Capture Tests

✅ 30/30 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	111ms
Format Validation.Event Has Uuid	✅	107ms
Format Validation.Event Has Lib Properties	✅	111ms
Format Validation.Distinct Id Is String	✅	108ms
Format Validation.Token Is Present	✅	108ms
Format Validation.Custom Properties Preserved	✅	109ms
Format Validation.Event Has Timestamp	✅	108ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	8ms
Retry Behavior.Retries On 503	✅	5312ms
Retry Behavior.Does Not Retry On 400	✅	2112ms
Retry Behavior.Does Not Retry On 401	✅	2110ms
Retry Behavior.Respects Retry After Header	✅	8116ms
Retry Behavior.Implements Backoff	✅	15518ms
Retry Behavior.Retries On 500	✅	5210ms
Retry Behavior.Retries On 502	✅	5213ms
Retry Behavior.Retries On 504	✅	5212ms
Retry Behavior.Max Retries Respected	✅	15727ms
Deduplication.Generates Unique Uuids	✅	115ms
Deduplication.Preserves Uuid On Retry	✅	5214ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10417ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5215ms
Deduplication.No Duplicate Events In Batch	✅	113ms
Deduplication.Different Events Have Different Uuids	✅	109ms
Compression.Sends Gzip When Enabled	✅	110ms
Batch Format.Uses Proper Batch Structure	✅	108ms
Batch Format.Flush With No Events Sends Nothing	✅	6ms
Batch Format.Multiple Events Batched Together	✅	112ms
Error Handling.Does Not Retry On 403	✅	2109ms
Error Handling.Does Not Retry On 413	✅	2111ms
Error Handling.Retries On 408	✅	5213ms

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	111ms
Request Payload.Flags Request Uses V2 Query Param	✅	109ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	109ms
Request Payload.Flags Request Omits Authorization Header	✅	108ms
Request Payload.Token In Flags Body Matches Init	✅	110ms
Request Payload.Groups Round Trip	✅	113ms
Request Payload.Groups Default To Empty Object	✅	108ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	109ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	109ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	109ms
Request Lifecycle.No Flags Request On Init Alone	✅	4ms
Request Lifecycle.No Flags Request On Normal Capture	✅	106ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	115ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	109ms
Retry Behavior.Retries Flags On 502	✅	213ms
Retry Behavior.Retries Flags On 504	✅	213ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	116ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']

marandaneto

Automated advisory code review.

marandaneto · 2026-10-30T13:15:35Z

      rdoc (>= 4.0.0)
      reline (>= 0.4.2)
-    json (2.21.2)
+    json (3.1.0)


blocking: JSON 3 breaks the locked ActiveSupport serializer — The transitive JSON upgrade to 3.1.0 is incompatible with the still-locked ActiveSupport 7.2.3.1: its encoder calls JSON.generate(..., quirks_mode: true), but JSON 3 rejects that option. Since spec_helper.rb loads active_support/all, even appending a plain hash to MessageBatch now raises JSONGenerationError, breaking existing batching, capture, and transport tests. Keep the resolved JSON/ActiveSupport combination compatible in this dependency update. Reproduction: reproduced — bundle exec rspec spec/posthog/message_batch_spec.rb:10 fails on the reviewed head with Serialization error: unknown keyword: quirks_mode, passes on the exact merge-base, and reverting only JSON restores all 91 focused examples.

marandaneto · 2026-10-30T13:15:35Z

  gem 'rake', '~> 13.4.2'
  gem 'rspec', '~> 3.13'
-  gem 'rubocop', '~> 1.91.0'
+  gem 'rubocop', '~> 1.92.0'


blocking: Update the optional bundle lockfile with the shared RuboCop constraint — gemfiles/otel.gemfile evaluates this Gemfile, but its committed lockfile still requires and resolves RuboCop ~> 1.91.0. Raising the shared constraint to ~> 1.92.0 without updating that lockfile makes frozen installations fail before tests start. Both logs-integration CI jobs use this optional bundle with ruby/setup-ruby bundler-cache, which enables deployment mode when the lockfile exists. Reproduction: reproduced — BUNDLE_FROZEN=true BUNDLE_GEMFILE=gemfiles/otel.gemfile bundle install --local exits 16 on the reviewed head with the RuboCop constraint mismatch and exits 0 on the exact merge-base with the same dependency cache.

dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Oct 28, 2026

dependabot Bot requested a review from a team as a code owner October 28, 2026 18:23

marandaneto reviewed Oct 30, 2026

View reviewed changes

marandaneto requested a review from a team October 30, 2026 13:25

Navigation Menu

Repository navigation

chore(deps-dev): bump the bundler-dependencies group across 1 directory with 3 updates - #321

chore(deps-dev): bump the bundler-dependencies group across 1 directory with 3 updates#321
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bundler/bundler-dependencies-e5634c7705

dependabot Bot commented on behalf of github Oct 28, 2026

Uh oh!

github-actions Bot commented Oct 28, 2026

Failures

Uh oh!

marandaneto left a comment

Uh oh!

marandaneto Oct 30, 2026

Uh oh!

marandaneto Oct 30, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Oct 28, 2026

v1.8.1

Changed

Fixed

v1.8.0

Added

Changed

Fixed

[1.8.1] - 2026-10-21

Changed

Fixed

[1.8.0] - 2026-10-16

Added

Changed

Fixed

RuboCop v1.92.0

New features

Bug fixes

1.92.0 (2026-10-10)

New features

Bug fixes

3.34.0

3.33.0

3.34.0

3.33.0

Uh oh!

github-actions Bot commented Oct 28, 2026

posthog-ruby-async Compliance Report

⚠️ Some Tests Failed

Capture Tests

Feature_Flags Tests

Failures

Uh oh!

marandaneto left a comment

Choose a reason for hiding this comment

Uh oh!

marandaneto Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

marandaneto Oct 30, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant