Bump the bundler group across 1 directory with 4 updates

[dependabot]

Bumps the bundler group with 4 updates in the / directory: irb, json, openssl and simplecov-cobertura.

Updates irb from 1.17.0 to 1.18.0

Release notes

Sourced from irb's releases.

v1.18.0

What's Changed

✨ Enhancements

• Completely migrate to prism by @​tompng in ruby/irb#1160
• Suppress error highlight for some incomplete code by @​tompng in ruby/irb#1173
• Display command description in doc dialog on tab completion by @​st0012 in ruby/irb#1180
• Add startup banner with Ruby logo, version info, and tips by @​st0012 in ruby/irb#1183
• Highlight the method name in method calls by @​shugo in ruby/irb#1189
• Add --nobanner option to suppress startup banner by @​st0012 in ruby/irb#1200

🐛 Bug Fixes

• Make ls command work for BasicObjects by @​eikes in ruby/irb#1177
• Fix IRB crash when typing string literal with control/meta sequence by @​tompng in ruby/irb#1182
• Wait for pager to terminate by @​tompng in ruby/irb#1192
• Fix incorrect dash in startup message by @​st0012 in ruby/irb#1206
• Colorize KEYWORD_DO_BLOCK (added in head Prism) by @​tompng in ruby/irb#1207

🛠 Other Changes

• Silence default_external warning in tests by @​Earlopain in ruby/irb#1172
• Ruby >= 4.1.0 allows trailing comma in method signature by @​eikes in ruby/irb#1178
• Fix display_document test fails in tty environment by @​tompng in ruby/irb#1185
• Use Prism::ParseResult#continuable? if possible by @​tompng in ruby/irb#1184
• Do not open nesting for character literals by @​shugo in ruby/irb#1190
• Fix random EPIPE failure in SIGINT restore tests by @​k0kubun in ruby/irb#1191
• Bump version to 1.18.0 by @​st0012 in ruby/irb#1208

New Contributors

• @​Earlopain made their first contribution in ruby/irb#1172
• @​eikes made their first contribution in ruby/irb#1178
• @​shugo made their first contribution in ruby/irb#1190

Full Changelog: ruby/irb@v1.17.0...v1.18.0

Commits

• 31e068a Bump version to 1.18.0 (#1208)
• f49d6b5 Colorize KEYWORD_DO_BLOCK (added in head Prism) (#1207)
• 96342e7 Fix incorrect dash in startup message (#1206)
• 9b930c8 Add --nobanner option to suppress startup banner (#1200)
• 9dc2a85 Bump rubygems/release-gem from 1.1.4 to 1.2.0
• 454964c Bump actions/upload-pages-artifact from 4 to 5
• b9719d1 Bump step-security/harden-runner from 2.16.0 to 2.17.0
• ee2af9f Highlight the method name in method calls (#1189)
• 75ad68d Bump actions/configure-pages from 5 to 6
• 6f757b9 Bump actions/deploy-pages from 4 to 5
• Additional commits viewable in compare view

Updates json from 2.19.3 to 2.20.0

Release notes

Sourced from json's releases.

v2.20.0

What's Changed

• Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
  • The :max_nesting option still defaults to 100.
• Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
• Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
• Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
• Integrate with Ruby 4.1 ruby_sized_xfree.

Full Changelog: ruby/json@v2.19.8...v2.20.0

v2.19.9

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: ruby/json@v2.19.8...v2.19.9

v2.19.8

What's Changed

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

Full Changelog: ruby/json@v2.19.7...v2.19.8

v2.19.7

What's Changed

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

Full Changelog: ruby/json@v2.19.6...v2.19.7

v2.19.6

What's Changed

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

Full Changelog: ruby/json@v2.19.5...v2.19.6

v2.19.5

What's Changed

• Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.

... (truncated)

Changelog

Sourced from json's changelog.

2026-06-23 (2.20.0)

• Both C and Java parsers are no longer recursive, so parsing very deep documents with max_nesting: false will no longer result in SystemStackError stack level too deep errors.
  • The :max_nesting option still defaults to 100.
• Optimized floating point number parsing further by replacing the ryu algorithm by a port of Eisel-Lemire Fast Float.
• Added JSON::ResumableParser to parse streams of JSON documents. Not yet available on JRuby.
• Deprecate default support of JavaScript comments in the parser and add allow_comments: true parsing option.
• Integrate with Ruby 4.1 ruby_sized_xfree.

2026-06-11 (2.19.9)

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO with JSON.generate(object, io). [CVE-2026-54696].

2026-06-03 (2.19.8)

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

2026-05-28 (2.19.7)

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

2026-05-28 (2.19.6)

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

2026-05-04 (2.19.5)

• Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.

2026-04-19 (2.19.4)

• Fix parsing of out of range floats (very large exponents that lead to either 0.0 or Inf).

Commits

• 1316292 Release 2.20.0
• 1443265 Remove useless executable bits
• 532065c Preserve UTF-8 encoding when reallocating a frozen ResumableParser buffer
• 7c8af4b Update extconf.rb guard to use RUBY_ENGINE_VERSION
• 2afd1a9 Cleanup the rb_catch_obj workaround
• 9892514 Simplify parser_config_init
• b30a8f8 ResumableParser: eagerly drop the buffer when reaching EOS
• f08c663 ResumableParser: accept only keyword arguments
• 9d8efcb Workaround TruffleRuby buggy rb_catch_obj implementation
• 4bd1e9b ResumableParser: use throw rather than raise for handled EOS
• Additional commits viewable in compare view

Updates openssl from 4.0.1 to 4.0.2

Release notes

Sourced from openssl's releases.

v4.0.2

Merged Pull Requests

• Fix missing error check on BIO_get_mem_ptr() by @​ndossche in ruby/openssl#1013
• Fix memory leak if sk_push fails by @​ndossche in ruby/openssl#1009
• Fix memory leak if ossl_bn_new() fails by @​ndossche in ruby/openssl#1010
• Fix UAF in OpenSSL.fixed_length_secure_compare by @​apocalypse9949 in ruby/openssl#1016
• Fix test failures with OpenSSL 4.0. by @​junaruga in ruby/openssl#1019
• Fix CI in 3.2 branch by @​rhenium in ruby/openssl#1049
• Backport OpenSSL 4.0 support by @​rhenium in ruby/openssl#1051

New Contributors

• @​apocalypse9949 made their first contribution in ruby/openssl#1016

Full Changelog: ruby/openssl@v4.0.1...v4.0.2

Changelog

Sourced from openssl's changelog.

Version 4.0.2

Merged changes in 3.2.4 and 3.3.3.

Commits

• 6e410b8 Ruby/OpenSSL 4.0.2
• 4d6d068 Merge branch 'maint-3.3' into maint-4.0
• 9720a76 Ruby/OpenSSL 3.3.3
• 6062da0 Merge branch 'maint-3.2' into maint-3.3
• d1fb31b Ruby/OpenSSL 3.2.4
• 4bae03b Merge branch 'maint-3.3' into maint-4.0
• b7f2b7e test_pkey_rsa.rb: Fix test_private_encoding_encrypted in OpenSSL 4.0 FIPS
• 1c29d55 Merge branch 'maint-3.2' into maint-3.3
• c37f74f Merge pull request #1051 from rhenium/ky/openssl-4.0-backport
• 3ef34d7 Merge branch 'maint-3.3' into maint-4.0
• Additional commits viewable in compare view

Updates simplecov-cobertura from 3.1.0 to 3.2.0

Release notes

Sourced from simplecov-cobertura's releases.

v3.2.0

What's Changed

• Changed calculation and added integration testing by @​jessebs in jessebs/simplecov-cobertura#58
• Revamp Calculations by @​jessebs in jessebs/simplecov-cobertura#59
• 3.2.0 version for release by @​jessebs in jessebs/simplecov-cobertura#60

Full Changelog: jessebs/simplecov-cobertura@v3.1.2...v3.2.0

v3.1.2

What's Changed

• Add 'require stringio' to root library file. by @​beporter in jessebs/simplecov-cobertura#47
• Build against ruby 4 by @​jessebs in jessebs/simplecov-cobertura#52
• Resolve #45 by @​jessebs in jessebs/simplecov-cobertura#51
• Bump version for 3.1.1 release by @​jessebs in jessebs/simplecov-cobertura#53
• Better branch coverage calculations by @​jessebs in jessebs/simplecov-cobertura#54
• Bump version for 3.1.2 release by @​jessebs in jessebs/simplecov-cobertura#55
• bump checkout action to v6 by @​jessebs in jessebs/simplecov-cobertura#56

New Contributors

• @​beporter made their first contribution in jessebs/simplecov-cobertura#47

Full Changelog: jessebs/simplecov-cobertura@v3.1.0...v3.1.2

Commits

• ba362da 3.2.0 - Refactor calculations (#60)
• c8b1d98 Revamp Calculations (#59)
• f0233ef Changed calculation and added integration testing (#58)
• 713fe69 bump checkout action to v6 (#56)
• c62ace9 Bump version for 3.1.2 release (#55)
• cc55569 Better branch coverage calculations (#54)
• c28e90b Bump version for 3.1.1 release (#53)
• eb015bd Resolve #45 (#51)
• 4b14890 Build against ruby 4 (#52)
• 12dd5d3 Add 'require stringio' to root library file. (#47)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (b5bffac) to head (72e99ad).

Additional details and impacted files

@@            Coverage Diff            @@
##              main        #4   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines          144       144           
=========================================
  Hits           144       144           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.