chore(deps): bump the ruby-deps group with 5 updates

[dependabot]

Bumps the ruby-deps group with 5 updates:

Package	From	To
csv	3.3.5	3.3.6
haml	7.2.0	7.2.2
msgpack	1.8.3	1.8.4
simplecov	1.0.2	1.0.3
sitemap_generator	7.1.0	7.1.1

Updates csv from 3.3.5 to 3.3.6

Release notes

Sourced from csv's releases.

csv 3.3.6 - 2026-07-27

Improvements

• CSV::Row#to_h: Added support for block.

  • GH-356
  • Patch by Vlad

• Ensured using path_or_io for parameter name that accepts path or IO.

  • GH-358
  • Patch by Yuto Urushima

• Changed to not using enumerator in CSV.

  • GH-361
  • GH-363
  • Reported by Cas Donoghue

Fixes

• Fixed a bug that \r in unquoted fields are rejected when row separator doesn't contain \r

  • GH-60
  • GH-346
  • Patch by Jas

• Fixed a typo in documentation.

  • GH-350
  • Patch by tmr111116

Thanks

• Jas
• tmr111116
• Vlad
• Yuto Urushima
• Cas Donoghue

Changelog

Sourced from csv's changelog.

3.3.6 - 2026-07-27

Improvements

• CSV::Row#to_h: Added support for block.

  • GH-356
  • Patch by Vlad

• Ensured using path_or_io for parameter name that accepts path or IO.

  • GH-358
  • Patch by Yuto Urushima

• Changed to not using enumerator in CSV.

  • GH-361
  • GH-363
  • Reported by Cas Donoghue

Fixes

• Fixed a bug that \r in unquoted fields are rejected when row separator doesn't contain \r

  • GH-60
  • GH-346
  • Patch by Jas

• Fixed a typo in documentation.

  • GH-350
  • Patch by tmr111116

Thanks

• Jas
• tmr111116
• Vlad
• Yuto Urushima
• Cas Donoghue

Commits

• 0873ab3 Add 3.3.6 entry
• c94763a Don't use enumerator in CSV (#363)
• b36c160 Bump actions/checkout from 6 to 7 (#360)
• c773f27 Bump rubygems/configure-rubygems-credentials from 2.0.0 to 2.1.0 (#359)
• 19c7649 Unify first parameter name to path_or_io across methods (#358)
• 79eb55a Bump rubygems/configure-rubygems-credentials from 1.0.0 to 2.0.0 (#357)
• 4a5c504 Support block in CSV::Row#to_h (#356)
• bc69827 Bump actions/checkout from 5 to 6 (#354)
• a2bda1e Link to LICENSE.txt
• 0de1bf0 Bump actions/checkout from 4 to 5 (#351)
• Additional commits viewable in compare view

Updates haml from 7.2.0 to 7.2.2

Release notes

Sourced from haml's releases.

v7.2.2

What's Changed

• Remove obsolete TruffleRuby compatibility skips by @​ollym in haml/haml#1210

New Contributors

• @​ollym made their first contribution in haml/haml#1210

Full Changelog: haml/haml@v7.2.1...v7.2.2

v7.2.1

What's Changed

• Do not rely on Ripper quirk in parsing old-style Haml attributes by @​andrykonchin in haml/haml#1212

New Contributors

• @​andrykonchin made their first contribution in haml/haml#1212

Full Changelog: haml/haml@v7.2.0...v7.2.1

Changelog

Sourced from haml's changelog.

7.2.2

• Remove obsolete TruffleRuby compatibility skips haml/haml#1210

7.2.1

• Do not rely on Ripper quirk in parsing old-style Haml attributes haml/haml#1212

Commits

• 8f293ac Version 7.2.2
• a33ec14 Remove obsolete TruffleRuby compatibility skips (#1210)
• c613224 Version 7.2.1
• c013fe4 Pin rdoc below 8 on JRuby
• ab098cf Do not rely on Ripper quick in parsing old-style Haml attributes (#1212)
• 0880837 Add Ruby 4.0 to tested versions
• See full diff in compare view

Updates msgpack from 1.8.3 to 1.8.4

Changelog

Sourced from msgpack's changelog.

2026-07-28 1.8.4

• Fix MessagePack::Buffer to stop using already released memory page. This could have caused data to leak across buffers when using the MessagePack::Buffer API directly.

Commits

• 42378b0 Release 1.8.4
• 7cb88d4 Merge pull request #399 from Watson1978/fix-rmem-page-ownership
• ce44d0e Fix rmem page released while a later chunk still points into it
• 8ab8a5a Merge pull request #398 from hsbt/claude/vigilant-chebyshev-63ce11
• b136b7f Merge pull request #397 from Watson1978/fix-recursive-ext-stack-overflow
• cf586e9 Build deep recursive-extension spec payload without deep recursion
• 752ad7f Skip recursive-extension StackError spec on JRuby
• 1b0cdf7 Raise StackError instead of crashing on deeply nested recursive extensions
• d2e1c88 Fix build failure on mswin due to empty UNREACHABLE_RETURN()
• 3efa8bd Move dev dependencies in the Gemfile
• Additional commits viewable in compare view

Updates simplecov from 1.0.2 to 1.0.3

Release notes

Sourced from simplecov's releases.

v1.0.3

What's Changed

• Bump ruby/setup-ruby from 1.316.0 to 1.318.0 by @​dependabot[bot] in simplecov-ruby/simplecov#1238
• fix: memoise key parsing in RubyDataParser to fix combiner performance regression by @​oleksii-leonov in simplecov-ruby/simplecov#1239

New Contributors

• @​oleksii-leonov made their first contribution in simplecov-ruby/simplecov#1239

Full Changelog: simplecov-ruby/simplecov@v1.0.2...v1.0.3

Changelog

Sourced from simplecov's changelog.

1.0.3 (2026-07-26)

Bugfixes

• Generating a report no longer crashes when the coverage universe contains a module that shadows #inspect with an incompatible signature. Rendering a method coverage key's receiver calls to_s, and a singleton class's to_s renders its attached object via #inspect — Liquid's Utils module defines inspect(value, max_depth = 2) as a module_function, so any suite whose report included Liquid's files (typically a vendored bundle under the project root, which is why this surfaced only in CI) raised ArgumentError from the at_exit hook and lost its report. The exposure predates 1.0.2's key normalization, which only moved the call. Rendering now recovers by rebuilding the name from Module#name via bound methods, which user code cannot shadow, falling back to an address form that the existing normalization collapses. The external_at_exit workaround is no longer needed. Reported with an exemplary diagnosis by @​bkuhlmann. See #1236.
• Method coverage entries are now aggregated by source location alone, completing the aggregation introduced in 1.0.2 (which keyed on name and location). Ruby records one method entry per defined method, so a builder looping container.each_key { |key| define_method(key) { ... } } produces an entry per generated name, all at the block's location — and every name whose generated wrapper no test happened to call showed as an uncovered method on a line with full line and branch coverage. A source location is the unit a file-based report can express, and regular defs map one location to one name, so they are unaffected. The same identity is used when merging resultsets across processes. This also covers methods copied into refinements via import_methods, which Ruby records once per importing refinement at the shared module's original location, so exercising the method through any refinement now marks the shared definition covered and the skip workaround for shared refinement modules can be dropped. Reported with exemplary diagnoses by @​bkuhlmann. See #1234 and #1237.
• SimpleCov.formatter and SimpleCov.formatters now accept formatter instances in addition to formatter classes, so constructor options can actually be passed — most notably SimpleCov::Formatter::HTMLFormatter.new(silent: true) to suppress the "Coverage report generated" status line. Previously SimpleCov unconditionally called .new on whatever was configured, so passing an instance crashed with NoMethodError at report time. See #1240.

Performance

• Fix 5x performance regression on report combining (introduced in 1.0.0 as a result of using Ripper#parse in a hot path) by adding parsed key memoisation to RubyDataParser.call.

Commits

• e9fddf0 Bump version to 1.0.3
• 1bc8a8c bundle update
• 0e6eae8 fix: memoise key parsing in RubyDataParser to fix combiner performance regres...
• 1a8a9ba Accept formatter instances in formatter configuration
• 3ef1068 Bump ruby/setup-ruby from 1.316.0 to 1.318.0
• f33a574 Assert engine-independent invariants for receiver name fallbacks
• 3492da6 Aggregate method coverage by source location alone
• 2e60550 Survive user code that breaks receiver name rendering
• See full diff in compare view

Updates sitemap_generator from 7.1.0 to 7.1.1

Changelog

Sourced from sitemap_generator's changelog.

7.1.1

• Fix: rake sitemap:clean (clean_files) now respects the configured sitemaps_path/public_path and also removes uncompressed .xml sitemaps, instead of only deleting hardcoded public/sitemap*.xml.gz files. #474 #502
• Fix: SitemapGenerator::Interpreter now respects ActionController::Base.default_url_options, so Rails URL helpers honor globally configured defaults (e.g. :protocol, :port) instead of ignoring them. #355 #507
• Fix: Non-ASCII characters in URL paths are now percent-encoded in the <loc> element, so generated sitemaps conform to the sitemap protocol. #346 #506
• Fix: Relative alternate hreflang hrefs (starting with /) are now expanded to absolute URLs using the configured host, producing valid sitemap XML instead of broken relative links. #343 #504
• Fix: SitemapGenerator.verbose = false is now respected by rake sitemap:refresh and other rake tasks, silencing output as configured. #332 #503
• Fix: Sitemap file lastmod is now captured at write time rather than read back via File.mtime, fixing incorrect timestamps and improving compatibility with time-freezing test helpers. #508
• Fix: URL lastmod now defaults to Time.zone.now under Rails (falling back to Time.now otherwise), so the configured Rails timezone and time-freezing helpers like travel_to are respected instead of always using system local time. #422 #505
• Internal: Enable RuboCop on the spec suite (previously fully excluded), fix real bugs the linting surfaced along the way (always-passing tests with no assertions, a latent NameError, broken path comparisons), and resolve all temporary RuboCop spec-suite exclusions. #510 #511 #512 #513 #514

Commits

• ce2c377 chore(release): prepare 7.1.1 (#515)
• 209416c test: resolve the last RuboCop relaxations across the spec suite (#514)
• dcc4421 fix(specs): resolve RSpec/SubjectStub, RSpec/InstanceVariable, and RSpec/Stub...
• 3c24c29 test(specs): resolve the second batch of RuboCop spec-suite exclusions (#512)
• 14d5e03 test(specs): resolve the first batch of RuboCop spec-suite exclusions (#511)
• a8e0129 chore(specs): enable RuboCop to catch broken and silently-passing tests (#510)
• 12d81b6 fix: use timezone-aware current time for default lastmod (#505)
• b7bcd69 fix: capture write time in SitemapFile to support frozen time in tests (#508)
• 254a9f4 fix: respect SitemapGenerator.verbose in rake tasks (#503)
• 4f63b24 fix: prepend host to relative alternate hrefs (#504)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

Dependency Upgrade Review: ruby-deps group (5 bumps) — csv, haml, msgpack, simplecov, sitemap_generator

PR Scope

Dependency-only — touches only Gemfile.lock (10+/10−). No code, manifest, or workflow changes.

Changes in Dependency

All five are patch releases containing bug fixes and backward-compatible improvements only:

• csv 3.3.6 — CSV::Row#to_h block support, param rename, removed enumerator; fixes \r parsing in unquoted fields.
• haml 7.2.2 — dropped obsolete TruffleRuby skips; fix for old-style attribute parsing relying on a Ripper quirk.
• msgpack 1.8.4 — fixes a MessagePack::Buffer memory-page leak (data leak across buffers when using the Buffer API directly).
• simplecov 1.0.3 — report-generation bugfixes (receiver-name rendering, method-coverage aggregation by location), formatter-instance support, and a 5x report-combine performance fix.
• sitemap_generator 7.1.1 — rake sitemap:clean respects configured paths, default_url_options respect, non-ASCII URL percent-encoding, absolute alternate hreflang URLs, timezone-aware lastmod, verbose=false respected.

No breaking changes, no removed APIs, no major/minor version jumps.

Usage in Repository

• csv — CSV.generate { |csv| csv << ... } (two call sites). No use of changed APIs.
• haml — default view engine; the attribute-parsing fix only affects old-style attributes and is a correctness improvement.
• msgpack — transitive dependency (Rails cache); not referenced directly.
• simplecov — spec/spec_helper.rb uses standard SimpleCov.start with HTMLFormatter/LcovFormatter. 1.0.3's fixes target report-rendering edge cases and improve combining.
• sitemap_generator — config/sitemap.rb defaults to SitemapGenerator::Sitemap.create with default_host and add; no usages intersect any changed option.

Compatibility Assessment

Compatible — all changes are bug fixes/improvements in features this app doesn't use (haml's TruffleRuby/Ripper quirk, msgpack's direct Buffer API, sitemap's rake-clean paths, simplecov's report-rendering edge cases). Patch-level within each pinned minor, so no breaking API surface.

Test Coverage

Good — full RSpec suite exercises the Haml views, CSV generation (event/meeting invite exports), and the Rails caching path (msgpack), and the suite runs under simplecov. The 1.0.2→1.0.3 simplecov move was already validated locally in prior work.

Confidence Rating

High — dependency-only diff, all patch releases, no used API intersects a breaking change, and existing test coverage exercises the relevant paths.

[mroderick]

Approved. See analysis comment above.