Bump the bundler group with 2 updates

[dependabot]

Bumps the bundler group with 2 updates: simplecov and http.

Updates simplecov from 1.0.0 to 1.0.1

Release notes

Sourced from simplecov's releases.

v1.0.1

What's Changed

• Fix NoMethodError in formatters= for non-Array arguments by @​koic in simplecov-ruby/simplecov#1224
• Explicitly write formatter's status message to STDERR by @​viralpraxis in simplecov-ruby/simplecov#1225

New Contributors

• @​viralpraxis made their first contribution in simplecov-ruby/simplecov#1225

Full Changelog: simplecov-ruby/simplecov@v1.0.0...v1.0.1

Changelog

Sourced from simplecov's changelog.

1.0.1 (2026-07-14)

Enhancements

• The gem now ships type signatures under sig/, covering the public API: the configuration DSL (including the criterion-scoped coverage block and the legacy deprecated verbs), the Result / FileList / SourceFile / CoverageStatistics read API that formatter authors consume, the formatter and filter class hierarchies, exit codes, and the ParallelAdapters::Base contract. Internal classes carry repository-only skeleton signatures (sig/internal/, excluded from the gem package) so the entire codebase type-checks under Steep in strict mode, while the shipped signature payload stays small. Signatures are checked with rbs validate and steep check as part of the default rake task. RBS and Steep users no longer need the third-party signatures from ruby/gem_rbs_collection, which cover the 0.22 API and predate 1.0's configuration redesign.

Bugfixes

• Branch tuples synthesized for tracked-but-unloaded files now match Ruby's Coverage exactly for elsif and for if arms with empty bodies. StaticCoverageExtractor attributed the outer else arm of an elsif to the clause's body rather than the whole clause, and an empty if then-body to the whole node rather than Coverage's zero-width point at the predicate's end. Since resultset merges combine branch arms by their exact location, a simulated entry merging with a real one for the same file (parent and worker under Minitest's parallelize, or RSpec and Minitest suites collated together) produced phantom, permanently-missed branch arms. A new differential spec now pins every branch construct tuple-for-tuple against Ruby's Coverage — which promptly caught that CRuby 3.4 changed several of these conventions, so the extractor now emits whichever shape the running Ruby's Coverage uses (on 3.2/3.3: elsif clause ranges end at the chain's last content rather than the shared end, empty if/else/when bodies fall back to enclosing ranges, and empty while/in bodies collapse to points). Reported with an exemplary diagnosis by @​hasghari. See #1226.
• merge_subprocesses no longer silently drops all worker coverage under Minitest's fork-based parallelize(workers: N) (the setup the rails profile exists for). When Minitest's autorun was armed before SimpleCov.start — which is how rails test loads — SimpleCov deferred its report to Minitest.after_run, and forked workers inherited that deferral even though Minitest pins its after_run hook to the parent's pid, so no exit path in the worker ever stored its resultset. Workers now reset the inherited at_exit state on fork and re-arm their own hook, so their resultsets are stored and merged as documented. Reported with an exemplary diagnosis by @​hasghari. See #1227.
• Fixed SimpleCov.formatters= raising NoMethodError when given a single formatter instead of an Array — a regression from 0.22.x, where MultiFormatter.new normalized the value internally. This restores the long-documented SimpleCov.formatters = SimpleCov::Formatter::MultiFormatter.new([...]) pattern, in which MultiFormatter.new returns a Class rather than an Array. The regression surfaced in ruby/ruby's CI through net-imap's test helper. Thanks @​koic. See #1224.
• Formatter status lines ("Coverage report generated for X") and threshold-enforcement output (violation reports, "SimpleCov failed with exit N") no longer route through Kernel#warn. They still print to stderr, but they are program output rather than Ruby warnings, so Warning.warn hooks — warning trackers and raise-on-warning test setups — no longer intercept them as unaddressable noise, and threshold failure explanations now survive ruby -W0, which previously reduced a failing check to a bare exit code with no explanation. Genuine warnings (deprecations, dropped-file notices, parse failures) still use warn. Suppression remains explicit: silent: true for formatter status lines, print_errors false for enforcement output. Thanks @​viralpraxis. See #1225.

Commits

• ab1b6d4 Bump version to 1.0.1
• cfb58a2 Emit branch tuples matching the running Ruby's Coverage conventions
• 56ed0be Match Coverage's branch tuples for elsif and empty if bodies
• bee8c3e Store forked worker coverage when Minitest owns the exit hook
• ead027d Keep enforcement output out of the Warning subsystem
• 7274905 Explicitly write formatter's status message to STDERR
• 26c8c42 Ship RBS signatures checked by Steep
• c903a2a Fix NoMethodError in formatters= for non-Array arguments
• See full diff in compare view

Updates http from 6.0.3 to 6.0.4

Changelog

Sourced from http's changelog.

[6.0.4] - 2026-07-14

Fixed

• On Ruby 3.4+ with TCPSocket, the redundant Timeout.timeout wrap around socket-level connect_timeout is removed. The native timeout is used alone, which avoids a slow Thread leak from Timeout::Request retention under abnormal exit paths (see #542). On Ruby 3.2/3.3 and with custom socket classes the previous Timeout.timeout wrap is preserved.

Security

• HTTP::Request::Builder#make_request_uri now rejects protocol-relative inputs (//host/path) when resolving against a configured base_uri or persistent origin. Previously such inputs were treated as network-path references per RFC 3986 §5.2 and replaced the base authority — via URI#join on the base_uri branch and via string concatenation on the persistent branch — allowing an attacker who controlled the path argument to redirect the request to an arbitrary host and leak any connection-scoped headers (HTTP.auth(...), etc.). See GHSA-r98x-p6m8-xcrv for details.

Commits

• 942b1b3 Exclude non-runtime Gemfile groups in gem push workflow
• 76aa76c Update v6.0.4 release date and link CHANGELOG version headers
• 6d4df4d Update SimpleCov to version 1.0
• 1c7e992 Fix typos in code comments
• 9981d0c Release v6.0.4
• 45a8993 Follow-ups to httprb/http#840
• 79ecf7e Fix tests
• 7371ad8 Skip Timeout.timeout wrap when TCPSocket native connect_timeout is available
• 1a07d7a Polish GHSA-r98x-p6m8-xcrv fix
• c7517ab Reject protocol-relative inputs in base_uri / persistent resolution
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Copilot]

Copilot can't review bot-authored pull requests automatically. A user with Copilot access can request a review manually.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (de60dc2) to head (99a82fb).

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #104   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           28        28           
  Lines          379       379           
=========================================
  Hits           379       379           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.