[dependabot]

Bumps the ruby-deps group with 5 updates:

Package	From	To
pagy	43.7.1	43.8.1
commonmarker	2.10.0	2.10.1
faraday	2.14.4	2.15.0
view_component	4.15.0	4.17.0
rubocop-capybara	3.0.0	3.1.0

Updates pagy from 43.7.1 to 43.8.1

Release notes

Sourced from pagy's releases.

Version 43.8.1

Changes in 43.8.1

• Fix Active Record connection checkout in keyset pagination (#931)

CHANGELOG

Version 43

We needed a leap version to unequivocally signal that it's not just a major version: it's a complete redesign of the legacy code at all levels, usage and API included.

Why 43? Because it's exactly one step beyond "The answer to the ultimate question of life, the Universe, and everything." 😉

Improvements

This version introduces several enhancements, such as new :countish and :keynav_js paginators and improved automation and configuration processes, reducing setup requirements by 99%. The update also includes a simpler API and new interactive development tools, making it a comprehensive upgrade from previous versions.

• New :countish Paginator
  • Faster than OFFSET and supporting the full UI
• New Keynav Pagination
  • The pagy-exclusive technique using the fastest keyset pagination alongside all frontend helpers.
• New interactive dev-tools
  • New PagyWand to integrate the pagy CSS with your app themes.
  • New Pagy AI available right inside your own app.
• Intelligent automation
  • Configuration requirements reduced by 99%.
  • Simplified JavaScript setup.
  • Automatic I18n loading.
• Simpler API
  • You solely need the pagy method and the @​pagy instance to paginate any collection and use any navigation tag and helper.
  • Methods are autoloaded only if used, and consume no memory otherwise.
  • Methods have narrower scopes and can be overridden without deep knowledge.
• New documentation
  • Very concise, straightforward, and easy to navigate and understand.

Upgrade to 43

See the Upgrade Guide

Version 43.8.0

Changes in 43.8.0

• Add Romanian localization (#930)

... (truncated)

Changelog

Sourced from pagy's changelog.

Version 43.8.1

• Fix Active Record connection checkout in keyset pagination (#931)

Version 43.8.0

• Add Romanian localization (#930)

Commits

• 0b1b56c Merge branch 'dev'
• 88afb38 Version 43.8.1
• 04a8bb8 💎 Fix Active Record connection checkout in keyset pagination (#931)
• 3c1a9ea Fix retype.yml
• 6a74ffb Update gems and packages and refactor dockshots
• 5a2de59 Add release RM run config
• bbc95ca Refactor top 100 contributors ordering by changes and commits.
• 07e1903 Merge branch 'dev'
• d8734bc Version 43.8.0
• eb6c50d 💎 Add Romanian localization (#930)
• Additional commits viewable in compare view

Updates commonmarker from 2.10.0 to 2.10.1

Release notes

Sourced from commonmarker's releases.

v2.10.1

2.10.1 (2026-10-16)

Bug Fixes

• prevent native stack overflows on deeply nested input (GHSA-c4fj-h48v-9fxp) (459585e)

Performance Improvements

• Reuse the CSS syntax highlighter across renders (#485)

Miscellaneous Chores

• Bump magnus from 0.9.2 to 0.9.3 (#487)
• Lint PR titles for Conventional Commits (65e9e12)
• Bump rb-sys to 0.9.130 (0253ccd)

Changelog

Sourced from commonmarker's changelog.

2.10.1 (2026-10-16)

Bug Fixes

• prevent native stack overflows on deeply nested input (GHSA-c4fj-h48v-9fxp) (459585e)

Performance Improvements

• Reuse the CSS syntax highlighter across renders (#485)

Miscellaneous Chores

• Bump magnus from 0.9.2 to 0.9.3 (#487)
• Lint PR titles for Conventional Commits (65e9e12)
• Bump rb-sys to 0.9.130 (0253ccd)

Commits

• 93a8ed9 [skip test] Release v2.10.1 (#486)
• a70bfd4 build: Bump magnus from 0.9.2 to 0.9.3 (#487)
• f300d53 perf: Reuse the CSS syntax highlighter across renders (#485)
• 459585e fix: prevent native stack overflows on deeply nested input (GHSA-c4fj-h48v-9fxp)
• dab784b Merge pull request #485 from volition-co/reuse-css-highlighter
• cea8adc Merge commit from fork
• 7886987 test deep nesting end to end
• 2ccadf4 walk the tree iteratively
• 3d0c84a enforce max_nesting_depth while parsing
• e26f4f6 copy the parse tree without recursing
• Additional commits viewable in compare view

Updates faraday from 2.14.4 to 2.15.0

Release notes

Sourced from faraday's releases.

v2.15.0

What's Changed

• [LOW] Keep Coveralls token out of pull-request code by @​OskarEichler in lostisland/faraday#1711
• [LOW] Remove vulnerable docs preview dependencies by @​OskarEichler in lostisland/faraday#1714
• chore: Use Docsify 5, to avoid the dropped 4.x version series by @​olleolleolle in lostisland/faraday#1670
• Fix typo in Faraday::Connection#options doc by @​Bo98 in lostisland/faraday#1674
• Preserve request ports for no_proxy matching by @​OskarEichler in lostisland/faraday#1705
• Preserve parallel manager across nested batches by @​OskarEichler in lostisland/faraday#1704
• Reject adapter changes after locking the stack by @​OskarEichler in lostisland/faraday#1701
• Preserve literal plus signs when decoding URI userinfo by @​OskarEichler in lostisland/faraday#1694
• Preserve explicit proxy settings when duplicating connections by @​OskarEichler in lostisland/faraday#1693
• Add GitHub Agentic Workflow for new-issue triage by @​iMacTia with @​Copilot in lostisland/faraday#1720
• Remove unused RackBuilder#adapter_set? by @​dpep in lostisland/faraday#1719
• Fetch current option values after mutation by @​OskarEichler in lostisland/faraday#1690
• gemspec: Relax faraday-net_http to < 3.6 by @​olleolleolle in lostisland/faraday#1722

New Contributors

• @​Bo98 made their first contribution in lostisland/faraday#1674

Full Changelog: lostisland/faraday@v2.14.4...v2.15.0

Commits

• af2db2d v2.15.0
• 8456969 gemspec: Relax faraday-net_http to < 3.6
• dc8c26b test: cover Options fetch after mutation
• a2a95dd Fetch current option values after mutation
• 19a9968 Remove unused RackBuilder#adapter_set?
• 9e369d2 Add issue triage agentic workflow (#1720)
• deeb6ef Test that Connection#dup preserves manually set proxy
• bbb8ab5 Preserve explicit proxy settings when duplicating connections
• fb42726 Add tests for literal plus signs in URI userinfo
• 5755083 Preserve literal plus signs when decoding URI userinfo
• Additional commits viewable in compare view

Updates view_component from 4.15.0 to 4.17.0

Release notes

Sourced from view_component's releases.

4.17.0

• Only register the executor hook that watches component templates when Action View doesn't cache templates at boot. With template caching on, as in production, the hook did nothing but still read ActionView::Base.cache_template_loading on every request. That value lives in a class variable, which non-main Ractors can't read on Ruby 4.0, so under Rails' experimental Rails.application.ractorize! every request failed.

  Mikael Henriksson

• Fix Component.translate raising UncaughtThrowError for keys missing from the sidecar translations, and NoMethodError for components without sidecar translations. It now falls back to the global translations, like the instance method does. Fix translate returning the default: value instead of an existing global translation.

  Andrii Furmanets

• Only recompile components when a template or a translation file changed, instead of before every request, when templates aren't cached. Pages render about twice as fast in development.

  Clément Joubert

4.16.0

• Fix subclasses defined after their parent renders a collection using the parent's default collection parameter name instead of their own. Fix recompiling a component not refreshing its collection parameter, counter, and iteration detection. Compute that detection when a component compiles, and store the results frozen so they're shareable across Ractors.

  Ben Sheldon

• Fix collection counter and iteration detection, and collection and reserved parameter validation, when initialize arguments are forwarded through anonymous arguments (... or **), such as by prepended modules and subclasses calling super.

  Ben Sheldon

• Update development and documentation dependencies, baseline existing Audition findings, and accommodate updated lint rules.

  Joel Hawksley

• Invalidate Action View's memoized template digests when a component registers with ViewComponent::CacheDigest, so a digest computed before the component loaded isn't served for the rest of the process.

  Erik Axel Nielsen

• Raise errors encountered while computing a component's cache digest instead of degrading to an untracked component that can serve stale fragments.

  Erik Axel Nielsen

• Give <% cache %> blocks inside a component's own template a digest, for components that include ViewComponent::ExperimentallyCacheable.

  Rails digests the virtual path of whichever template is rendering. Inside a component that path resolves to no template, because component templates aren't in the view paths, so the Digestor returned an empty digest and the fragment was never invalidated. The only signal was a Couldn't find template for digesting line in the log. 4.15.0 fixed the case where the cache block wraps the component in a view. This fixes the case where the block sits in the component's template.

  Erik Axel Nielsen

• Fix line numbers and, under coverage, missing output for ERB templates that Rails doesn't annotate.

  On Rails 8.1+, ViewComponent compensated for the newline Rails adds to compiled ERB output (rails/rails#53731) for every ERB template, whether from a file or from erb_template. That newline lives inside the <!-- BEGIN ... --> annotation, which Rails only emits when annotate_rendered_view_with_filenames is enabled and the template's format is HTML. Compensating unconditionally shifted backtraces for non-HTML templates (.text.erb, .css.erb) and for every ERB template when annotations are disabled, such as in production, by one line. When coverage was running, the same mismatch made the annotation-stripping workaround remove real template source, so non-HTML templates rendered empty.

  Inline templates now decide the compensation when they compile rather than when the component class is defined, matching file templates.

  Ryutaro Mizokami

... (truncated)

Changelog

Sourced from view_component's changelog.

4.17.0

• Only register the executor hook that watches component templates when Action View doesn't cache templates at boot. With template caching on, as in production, the hook did nothing but still read ActionView::Base.cache_template_loading on every request. That value lives in a class variable, which non-main Ractors can't read on Ruby 4.0, so under Rails' experimental Rails.application.ractorize! every request failed.

  Mikael Henriksson

• Fix Component.translate raising UncaughtThrowError for keys missing from the sidecar translations, and NoMethodError for components without sidecar translations. It now falls back to the global translations, like the instance method does. Fix translate returning the default: value instead of an existing global translation.

  Andrii Furmanets

• Only recompile components when a template or a translation file changed, instead of before every request, when templates aren't cached. Pages render about twice as fast in development.

  Clément Joubert

4.16.0

• Fix subclasses defined after their parent renders a collection using the parent's default collection parameter name instead of their own. Fix recompiling a component not refreshing its collection parameter, counter, and iteration detection. Compute that detection when a component compiles, and store the results frozen so they're shareable across Ractors.

  Ben Sheldon

• Fix collection counter and iteration detection, and collection and reserved parameter validation, when initialize arguments are forwarded through anonymous arguments (... or **), such as by prepended modules and subclasses calling super.

  Ben Sheldon

• Update development and documentation dependencies, baseline existing Audition findings, and accommodate updated lint rules.

  Joel Hawksley

• Invalidate Action View's memoized template digests when a component registers with ViewComponent::CacheDigest, so a digest computed before the component loaded isn't served for the rest of the process.

  Erik Axel Nielsen

• Raise errors encountered while computing a component's cache digest instead of degrading to an untracked component that can serve stale fragments.

  Erik Axel Nielsen

• Give <% cache %> blocks inside a component's own template a digest, for components that include ViewComponent::ExperimentallyCacheable.

  Rails digests the virtual path of whichever template is rendering. Inside a component that path resolves to no template, because component templates aren't in the view paths, so the Digestor returned an empty digest and the fragment was never invalidated. The only signal was a Couldn't find template for digesting line in the log. 4.15.0 fixed the case where the cache block wraps the component in a view. This fixes the case where the block sits in the component's template.

  Erik Axel Nielsen

• Fix line numbers and, under coverage, missing output for ERB templates that Rails doesn't annotate.

  On Rails 8.1+, ViewComponent compensated for the newline Rails adds to compiled ERB output (rails/rails#53731) for every ERB template, whether from a file or from erb_template. That newline lives inside the <!-- BEGIN ... --> annotation, which Rails only emits when annotate_rendered_view_with_filenames is enabled and the template's format is HTML. Compensating unconditionally shifted backtraces for non-HTML templates (.text.erb, .css.erb) and for every ERB template when annotations are disabled, such as in production, by one line. When coverage was running, the same mismatch made the annotation-stripping workaround remove real template source, so non-HTML templates rendered empty.

  Inline templates now decide the compensation when they compile rather than when the component class is defined, matching file templates.

  Ryutaro Mizokami

... (truncated)

Commits

• 6cf5d75 Merge pull request #2731 from ViewComponent/release-4-17-0
• 915750b release 4.17.0
• 5a58870 Merge pull request #2728 from mhenrixon/register-compile-cache-hook-only-with...
• 6af7b96 Merge branch 'main' into register-compile-cache-hook-only-without-template-ca...
• 5713b34 Merge pull request #2727 from afurm/class-translate-missing-keys
• 3d8e7b2 Move cached-template integration test to isolated tests
• b9efa46 Test template caching by booting apps with ActiveSupport::Testing::Isolation
• ff23301 Restore cached-template integration test
• ac0a307 Merge main and check template caching once
• 51f6e48 Merge branch 'main' into class-translate-missing-keys
• Additional commits viewable in compare view

Updates rubocop-capybara from 3.0.0 to 3.1.0

Release notes

Sourced from rubocop-capybara's releases.

RuboCop Capybara v3.1.0

• Add new Capybara/UnorderedWindowAccess cop. (@​ydah)
• Add new Capybara/AbsoluteXPathInElementScope cop. (@​ydah)
• Add new Capybara/AlwaysTrueCountQuery cop. (@​ydah)
• Add new Capybara/RSpec/CurrentUrlExpectation cop. (@​ydah)
• Add new Capybara/ModalMethodWithoutBlock cop. (@​ydah)
• Add new Capybara/NativeAttribute cop. (@​ydah)
• Add new Capybara/VisibilityOption cop. (@​ydah)
• Add new Capybara/ChainedFind cop. (@​ydah)
• Add new Capybara/IgnoredQueryOption cop. (@​ydah)
• Add new Capybara/RSpec/FindElementValueEq cop. (@​ydah)
• Recognize have_element and have_no_element in the RSpec negation cops. (@​ydah)
• Detect have_no_selector in Capybara/RSpec/HaveSelector. (@​ydah)
• Autocorrect visible: true in Capybara/RSpec/VisibilityMatcher for known selectors. (@​ydah)
• Add support for using find with :link and :field in Capybara/SpecificFinders cop. (@​ydah)
• Speed up loading rubocop-capybara by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. (@​koic)
• Fix false positives in Capybara/RSpec/SpecificMatcher for input types excluded by have_field. (@​ydah)
• Avoid interpolating literal #{...}, #@..., and #$... patterns in Capybara/RSpec/CurrentPathExpectation and Capybara/RSpec/CurrentUrlExpectation autocorrection. (@​ydah)
• Fix false positives and negatives for Capybara/SpecificActions when CSS attribute values contain spaces. (@​ydah)
• Honor DefaultSelector: null in selector-dependent cops, including Capybara/RSpec/HaveSelector. (@​ydah)
• Fix false positives for custom elements in Capybara/SpecificActions and Capybara/RSpec/SpecificMatcher. (@​ydah)
• Avoid unsafe block autocorrection and unnecessary receiver parentheses in Capybara/RSpec/PredicateMatcher. (@​ydah)
• Fix a crash in Capybara/RSpec/CurrentPathExpectation for invalid regexp strings. (@​ydah)
• Fix Capybara/SpecificFinders when CSS id values are true or false. (@​ydah)
• Fix a crash in Capybara/SpecificActions for blank find selectors. (@​ydah)
• Fix reversed autocorrection in Capybara/RSpec/PredicateMatcher for eql and equal boolean matchers. (@​ydah)
• Avoid errors and unsafe autocorrection in Capybara/SpecificFinders with dynamic class: options. (@​ydah)
• Fix incorrect autocorrections and missed offenses for non-CSS locators in Capybara/SpecificFinders. (@​ydah)
• Use the :id selector when Capybara/RedundantWithinFind autocorrects find_by_id, preserving special and dynamic IDs. (@​ydah)
• Avoid unsafe find_field autocorrections for input types and boolean attributes in Capybara/SpecificFinders. (@​ydah)
• Fix false positives and incorrect autocorrections for Capybara/FindAllFirst when find or all uses match: :first. (@​ydah)
• Avoid Capybara/FindAllFirst offenses when the result is used with safe navigation or as a condition. (@​ydah)
• Fix an incorrect autocorrect for Capybara/RedundantWithinFind when find_by_id uses a dynamic id. (@​ydah)
• Fix an incorrect autocorrect for Capybara/RedundantWithinFind when a finder call has a block argument. (@​ydah)
• Fix a false positive for Capybara/RSpec/HaveSelector when DefaultSelector is unsupported. (@​ydah)
• Fix an incorrect autocorrect for Capybara/SpecificFinders when a selector class is empty or contains an escaped dot. (@​ydah)
• Fix a false positive for Capybara/SpecificFinders when an id selector contains unsupported CSS identifier syntax. (@​ydah)
• Fix a false negative for Capybara/RSpec/NegationMatcherAfterVisit when using to_not. (@​ydah)
• Fix an incorrect autocorrect for Capybara/RSpec/PredicateMatcher when EnforcedStyle: explicit and expect actual is a complex expression. (@​ydah)
• Fix Capybara/RSpec/CurrentPathExpectation autocorrection for match when the URL has a query string. (@​ydah)
• Fix a false positive for Capybara/SpecificActions when click uses arguments or a block. (@​ydah)
• Fix an incorrect autocorrect for Capybara/SpecificFinders when a selector class is used with nested class: options. (@​ydah)
• Fix CSS attribute parsing when attribute values contain quotes. (@​ydah)
• Fix CSS attribute parsing to return raw values and format Ruby literals in autocorrection. (@​ydah)
• Fix a false negative for Capybara/SpecificFinders when using find with input field attributes. (@​ydah)

Changelog

Sourced from rubocop-capybara's changelog.

3.1.0 (2026-10-16)

• Add new Capybara/UnorderedWindowAccess cop. ([@​ydah])
• Add new Capybara/AbsoluteXPathInElementScope cop. ([@​ydah])
• Add new Capybara/AlwaysTrueCountQuery cop. ([@​ydah])
• Add new Capybara/RSpec/CurrentUrlExpectation cop. ([@​ydah])
• Add new Capybara/ModalMethodWithoutBlock cop. ([@​ydah])
• Add new Capybara/NativeAttribute cop. ([@​ydah])
• Add new Capybara/VisibilityOption cop. ([@​ydah])
• Add new Capybara/ChainedFind cop. ([@​ydah])
• Add new Capybara/IgnoredQueryOption cop. ([@​ydah])
• Add new Capybara/RSpec/FindElementValueEq cop. ([@​ydah])
• Recognize have_element and have_no_element in the RSpec negation cops. ([@​ydah])
• Detect have_no_selector in Capybara/RSpec/HaveSelector. ([@​ydah])
• Autocorrect visible: true in Capybara/RSpec/VisibilityMatcher for known selectors. ([@​ydah])
• Add support for using find with :link and :field in Capybara/SpecificFinders cop. ([@​ydah])
• Speed up loading rubocop-capybara by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​koic])
• Fix false positives in Capybara/RSpec/SpecificMatcher for input types excluded by have_field. ([@​ydah])
• Avoid interpolating literal #{...}, #@..., and #$... patterns in Capybara/RSpec/CurrentPathExpectation and Capybara/RSpec/CurrentUrlExpectation autocorrection. ([@​ydah])
• Fix false positives and negatives for Capybara/SpecificActions when CSS attribute values contain spaces. ([@​ydah])
• Honor DefaultSelector: null in selector-dependent cops, including Capybara/RSpec/HaveSelector. ([@​ydah])
• Fix false positives for custom elements in Capybara/SpecificActions and Capybara/RSpec/SpecificMatcher. ([@​ydah])
• Avoid unsafe block autocorrection and unnecessary receiver parentheses in Capybara/RSpec/PredicateMatcher. ([@​ydah])
• Fix a crash in Capybara/RSpec/CurrentPathExpectation for invalid regexp strings. ([@​ydah])
• Fix Capybara/SpecificFinders when CSS id values are true or false. ([@​ydah])
• Fix a crash in Capybara/SpecificActions for blank find selectors. ([@​ydah])
• Fix reversed autocorrection in Capybara/RSpec/PredicateMatcher for eql and equal boolean matchers. ([@​ydah])
• Avoid errors and unsafe autocorrection in Capybara/SpecificFinders with dynamic class: options. ([@​ydah])
• Fix incorrect autocorrections and missed offenses for non-CSS locators in Capybara/SpecificFinders. ([@​ydah])
• Use the :id selector when Capybara/RedundantWithinFind autocorrects find_by_id, preserving special and dynamic IDs. ([@​ydah])
• Avoid unsafe find_field autocorrections for input types and boolean attributes in Capybara/SpecificFinders. ([@​ydah])
• Fix false positives and incorrect autocorrections for Capybara/FindAllFirst when find or all uses match: :first. ([@​ydah])
• Avoid Capybara/FindAllFirst offenses when the result is used with safe navigation or as a condition. ([@​ydah])
• Fix an incorrect autocorrect for Capybara/RedundantWithinFind when find_by_id uses a dynamic id. ([@​ydah])
• Fix an incorrect autocorrect for Capybara/RedundantWithinFind when a finder call has a block argument. ([@​ydah])
• Fix a false positive for Capybara/RSpec/HaveSelector when DefaultSelector is unsupported. ([@​ydah])
• Fix an incorrect autocorrect for Capybara/SpecificFinders when a selector class is empty or contains an escaped dot. ([@​ydah])
• Fix a false positive for Capybara/SpecificFinders when an id selector contains unsupported CSS identifier syntax. ([@​ydah])
• Fix a false negative for Capybara/RSpec/NegationMatcherAfterVisit when using to_not. ([@​ydah])
• Fix an incorrect autocorrect for Capybara/RSpec/PredicateMatcher when EnforcedStyle: explicit and expect actual is a complex expression. ([@​ydah])
• Fix Capybara/RSpec/CurrentPathExpectation autocorrection for match when the URL has a query string. ([@​ydah])
• Fix a false positive for Capybara/SpecificActions when click uses arguments or a block. ([@​ydah])
• Fix an incorrect autocorrect for Capybara/SpecificFinders when a selector class is used with nested class: options. ([@​ydah])
• Fix CSS attribute parsing when attribute values contain quotes. ([@​ydah])
• Fix CSS attribute parsing to return raw values and format Ruby literals in autocorrection. ([@​ydah])
• Fix a false negative for Capybara/SpecificFinders when using find with input field attributes. ([@​ydah])

Commits

• 4933f08 Merge pull request #270 from rubocop/release/3.1.0
• 6074750 Prepare RuboCop Capybara 3.1.0 release
• 69545a0 Merge pull request #273 from rubocop/refactor/shared-visibility-checks
• ca6373e Share visibility filter checks and offense handling
• ac538d8 Merge pull request #264 from rubocop/fix/visibility-matcher-autocorrect
• 1cf61a1 Merge pull request #250 from rubocop/fix/specific-finders-unsafe-field-selectors
• 5b428d0 Avoid incorrect find_field autocorrection for input selectors
• 36f526b Merge pull request #251 from rubocop/fix/redundant-within-find-id-selector
• 2668812 Autocorrect safe visibility matcher options
• 777b38a Merge pull request #272 from rubocop/fix/simplecov-deprecations
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head af7180810071bdd06aea07c20688280b0620924c) · Confidence: Medium

Five production/development gems bump within minor boundaries with no breaking changes on the paths this repo uses: pagy unchanged in lib/, commonmarker's tagfilter removal is inert because the app renders with defaults (unsafe:false keeps raw HTML omitted), faraday's changes miss Flodesk's middleware chain, and view_component ships fixes plus performance work covered by passing suites. Verification passes (planner-suite, auth-suite, probe), so the upgrade is safe to merge.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
Flodesk HTTP payloads to api.flodesk.com (subscribe/unsubscribe, Basic auth)	Verified	Read faraday 2.14.4...2.15.0 lib diff; used middleware chain unchanged; flodesk_spec exercises request/response via test adapter.
dot_markdown member-facing HTML omits raw HTML	Verified	Read pinned config.rb at v2.10.1 + diff; repo spec asserts raw HTML omitted and planner-suite passes.
Paginated event-feed links keep only year/page params (pagy querify)	Partially verified	Compare shows no lib/ changes; repo test path exercises querify only — rendered-link behavior not diff-traced.
ViewComponent collection rendering output for member-facing pages	Partially verified	Changelog read; event_card component spec passes, but most components lack specs and no full line-trace of collection changes.

Compatibility analysis — 8 packages

• pagy 43.7.1 → 43.8.1: No lib/ changes upstream; repo exercises only Offset/Request/pagy-method paths the diff never touches.
• commonmarker 2.10.0 → 2.10.1: Security fix (deep-nesting stack overflow, max_nesting_depth 1000); tagfilter removed from defaults but repo relies on unsafe:false, unchanged — raw HTML still omitted.
• faraday 2.14.4 → 2.15.0: Parallel-manager, dup-proxy, URI-unescape and locked-builder changes; none on the middleware chain lib/flodesk.rb uses.
• view_component 4.15.0 → 4.17.0: Bug fixes for collection iteration, recompilation, translate fallback, ractor-safe executor hook; repo's helper-driven with_collection path is exercised by passing component specs.
• rubocop-capybara 3.0.0 → 3.1.0: Cop bug fixes (false negative/positive, autocorrect); dev-only lint, no runtime surface.
• faraday-net_http 3.4.4 → 3.5.0 (transitive): Adapter dependency bump widening faraday's constraint to <3.6; no API change at this call depth.
• net-http 0.9.1 → 0.10.0 (transitive): Patch-level Ruby stdlib gem bump pulled by the chain; no usage surface in the repo reads this directly.
• parser 3.3.12.0 → 3.3.13.0 (transitive): Ruby syntax parser used by rubocop/prism tooling; lint-only impact.

Usage of 5 dependencies

• pagy: app/controllers/application_controller.rb (include Pagy::Method); app/queries/events_feed_query.rb (Pagy::Request.new, Pagy::Offset); app/controllers/dashboard_controller.rb (pagy + querify); admin controllers; ~15 haml views.
• commonmarker: app/helpers/application_helper.rb dot_markdown → Commonmarker.to_html(text) with defaults; config/initializers/commonmarker.rb require only.
• faraday: lib/flodesk.rb only: Faraday.new + request :json, response :raise_error/:logger/:json, authorization Basic, run_request, Faraday::Error rescue.
• view_component: ~20 components under app/components (event_card, chapters_sidebar, chapter_picker, admin/table components); render with_collection(event_card).
• rubocop-capybara: Gemfile dev group (require: false); .rubocop.yml plugin registration; lint runs only.

Test coverage

• Strong: flodesk_spec drives the Faraday JSON request/response chain via the test adapter (suite pass).
• Strong: application_helper_spec asserts the exact raw-HTML-omission behavior members depend on (suite pass).
• Thin: component specs cover only a few components (chapter_picker, chapters_sidebar, event_card, some admin); others rely on suite-wide render checks.
• Gap: Flodesk's live HTTP path to api.flodesk.com is never exercised outside the test adapter — inherent to this repo.
• Gap: bundle exec rubocop with the bumped rubocop-capybara is not part of the provided suites.

Calibration and confidence

Confidence: Medium — All changes look inert on used paths and both suites plus the probe pass, but three contracts are only partially verified (no lint run, no full line-trace of view_component's reworked collection code, no live-render compare), so confidence is capped at Medium.

1. Weakest claim: The view_component rendering contract rests on the changelog and a passing component-spec subset, not a line-trace of the reworked collection.rb/render loop — a snapshot HTML compare of collection renders would shore it up.
2. Relied on but unverified: That view_component's collection-render restructuring and dev-recompilation changes keep rendered HTML byte-identical; that pagy emits links for page/year without any offset-path change given its empty lib/ diff list.
3. Falsifier: A rendered-page HTML diff after the upgrade showing changed pagination links, changed event-card output, or dot_markdown emitting raw HTML for member input would prove this wrong.