Update ruby dependencies (non-major) to v4.1.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
bigdecimal	4.1.2 → 4.1.3
mongoid (source, changelog)	9.1.0 → 9.1.1
newrelic_rpm (source, changelog)	10.7.1 → 10.9.0
rubocop (source, changelog)	1.90.0 → 1.91.0
selenium-webdriver (source, changelog)	4.48.0 → 4.49.0
simplecov (changelog)	1.3.0 → 1.3.1
strava-ruby-client	3.0.0 → 3.1.0

---

Release Notes

mongodb/mongoid (mongoid)

v9.1.1: 9.1.1

Compare Source

The MongoDB Ruby team is pleased to announce version 9.1.1 of the mongoid gem - a Ruby ODM for MongoDB. This is a new patch release in the 9.1.x series of Mongoid.

Install this release using RubyGems via the command line as follows:

gem install -v 9.1.1 mongoid

Or simply add it to your Gemfile:

gem 'mongoid', '9.1.1'

Have any feedback? Click on through to MongoDB's Jira and open a new ticket to let us know what's on your mind.

Bug Fixes

Bound regular-expression execution time in in-memory queries (MONGOID-5981) (CVE-2026-93761)

Queries evaluated in memory, such as those against embedded associations, run in the calling thread and can spend an unbounded amount of CPU matching regular expressions. A single in-memory query is now limited by Mongoid.in_memory_regexp_time_limit (default 5.0 seconds); exceeding the limit raises Mongoid::Errors::InMemoryRegexpTimeout.

Fix encryption schema generation for automatic encryption (MONGOID-5984) (MONGOID-5989) (CVE-2026-93764) (CVE-2026-93763)

Automatic encryption schema generation no longer loops on models that embed themselves, and it now handles polymorphic embeds_one relations and embedded schemas that carry their own encryptMetadata correctly. A model whose collection has no entry in the generated schema is no longer written without encryption: such a write raises Mongoid::Errors::NoEncryptionSchema instead of storing the field in plaintext.

Resolve nested attribute ids within the caller's association (MONGOID-5992) (CVE-2026-93758)

An id given in nested attributes is now resolved within the association the attributes are being applied to, rather than falling back to a collection-wide lookup that ignored default scopes. A document that is not part of that association raises Mongoid::Errors::DocumentNotFound, and a request to destroy a document that is not in the association is ignored. The Mongoid.allow_reparenting_via_nested_attributes option now defaults to false; set it to true to restore the previous reparenting behavior.

Reject the string form of where under the query operator guard (MONGOID-5993) (CVE-2026-93759)

A String passed to #where is sent to MongoDB as a $where expression. This now raises Mongoid::Errors::InvalidQuery when Mongoid.allow_unsafe_query_operators is false (the default); the string form is allowed only when that option is enabled.

Reject JavaScript query operators at any depth (MONGOID-5994) (CVE-2026-93760)

Mongoid.allow_unsafe_query_operators now defaults to false. When it is false, the $where, $function, and $accumulator operators are rejected anywhere in a query selector. The guard covers every criterion-building method (where, find_by, or, and, nor, not, any_of, none_of, and elem_match) and inspects nested expressions such as {'$expr' => {'$function' => ...}} in full.

Other Bug Fixes

• In-memory queries, such as those executed against embedded associations, now read field names from the query as data rather than dispatching them as method calls on the document (MONGOID-5973) (CVE-2026-93762) (CVE-2026-93765)

newrelic/newrelic-ruby-agent (newrelic_rpm)

v10.9.0

Compare Source

• Feature: Continuous Profiling (preview)

  Continuous Profiling is a new feature which is not yet generally available for use. The agent-side component code is now present in the agent but to actually use it ahead of the General Availability release, you will need to contact your New Relic sales representative to join the preview early.

  Continuous Profiling repeatedly samples the Ruby call stacks of your running application and reports them to New Relic, so you can see which methods are consuming the most CPU time (or allocating the most objects) in production, without adding code to your app.

  To turn it on, add the stackprof and google-protobuf gems to your application's Gemfile, then set profiling.enabled to true:

    profiling.enabled: true

  With only profiling.enabled set, the agent samples CPU time every 10 milliseconds for the life of the process. These options let you tune that behavior:

  Configuration name	Default	Behavior
  profiling.enabled	false	If true, the agent collects and reports continuous profiling data.
  profiling.include	cpu	What to sample: cpu for CPU time, or object for object allocations.
  profiling.sample_period	0.01	Seconds between stack samples. Only used when profiling.include is cpu. Must be between 0.000001 and 0.999999.
  profiling.object_allocation_interval	10000	Object allocations between stack samples. Only used when profiling.include is object. Must be between 1000 and 999999.
  profiling.delay	0	Milliseconds to wait before profiling starts. 0 starts immediately.
  profiling.duration	0	Milliseconds to profile before stopping automatically. 0 profiles until the process exits.

  PR#3617

• Feature: Add support for Dalli 5.1.1

  Dalli 5.1.1 added arguments to some of the methods the agent instruments, which could raise an ArgumentError on multi-key operations or cause request options to be silently dropped. Now, the agent accepts and forwards a variable number of positional and keyword arguments for these methods. PR#3683

v10.8.0

Compare Source

• Feature: Report a unique hostname for Google Cloud Run Worker Pools and Jobs

  The Cloud Run hostname support added in PR#3609 detected Cloud Run by looking for K_REVISION, which Cloud Run Services set. The agent now also recognizes CLOUD_RUN_REVISION (Worker Pools) and CLOUD_RUN_EXECUTION (Jobs), so utilization.gcp_cloud_run.use_instance_as_host applies to all three resource types. When utilization.gcp_cloud_run.include_revision_in_host is true, the hostname uses whichever of those variables is set, for example {CLOUD_RUN_EXECUTION}-{instance id} on a Job. Issue#3651 Thanks to @​choznerol for contributing this enhancement! PR#3652

• Feature: Add browser_monitoring.version configuration option

  Customers can now pin the exact browser agent loader version New Relic injects by setting the new browser_monitoring.version configuration option. See the browser agent EOL policy for which versions are currently available and supported.

• Feature: Add span.kind to background job libraries

  Now, the span.kind attribute will be added to produce and consume operations from background job libraries. This includes ActiveJob, Sidekiq, Resque and DelayedJob. PR#3636

• Bugfix: DelayedJob instrumentation no longer reinstalls itself on every worker under prepend mode

  When DelayedJob instrumentation is installed via prepend (the default), creating more than one Delayed::Worker in the same process caused the agent to log "Installing DelayedJob instrumentation" and reinitialize the plugin again for each additional worker. This was harmless but noisy; it's now only done once per process, matching the existing chain-instrumentation behavior. PR#3654

• Bugfix: Allowlisted configuration values are no longer case sensitive

  Configuration options that validate against an allowlist now match values regardless of case. For example, setting slow_sql.record_sql to OBFUSCATED or ObFuScAtEd is now treated the same as obfuscated. Previously, a value with unexpected casing that wasn't an exact match would silently fall back to the default. PR#3645

• Bugfix: Puma instrumentation works when Puma is lazy-loaded

  With gem "puma", require: false, Puma was not yet loaded when the agent's dependency check ran, so Puma instrumentation would fail to install. The agent now recognizes Puma::RackHandler as evidence that Puma is present, fixing this issue. Thank you @​jdelStrother for finding this issue and providing a solution! PR#3650

rubocop/rubocop (rubocop)

v1.91.0

Compare Source

New features

• #​15631: Add a preview channel for unstable behavior. ([@​bbatsov][])
• #​15627: Add a SARIF formatter. ([@​bbatsov][])
• #​15686: Add AllCops: FailLevel, the configuration equivalent of --fail-level. ([@​bbatsov][])
• #​15650: Add AllowedDirectives option to Style/DisableCopsWithinSourceCodeDirective, exempting directive kinds such as generated rubocop:todo comments. ([@​bbatsov][])
• #​15629: Add --changed to inspect only the files git says changed. ([@​bbatsov][])
• #​15628: Add --diff to preview autocorrection without writing files. ([@​bbatsov][])
• #​15615: Add new Lint/MisplacedMagicComment cop to flag magic comments in positions where Ruby ignores them. ([@​bbatsov][])
• #​15600: Add the rubocop:enable-next directive to re-enable cops for the next statement only. ([@​bbatsov][])
• #​15600: Add the rubocop:next directive, combining push-style +/- arguments with disable-next's statement scope. ([@​bbatsov][])
• #​15363: Let a cop's entry in the default configuration carry a Preview section with the defaults it is expected to adopt in the next major release, applied under Preview. ([@​bbatsov][])

Bug fixes

• #​15349: Fix a false positive for Style/RedundantRegexpCharacterClass with \8/\9. ([@​bbatsov][])
• #​15646: Fix an error for Layout/ElseAlignment when else is used with rescue in a class, module, or singleton class body. ([@​viralpraxis][])
• #​15613: Fix an error for Layout/HashAlignment when a hash value starts on the line below its key. ([@​viralpraxis][])
• #​15623: Fix an error for Layout/HashAlignment when the first pair of a hash omits its value, and an incorrect autocorrection when a later pair does. ([@​viralpraxis][])
• #​15602: Fix an error for Layout/IndentationWidth on under-indented code with tab indentation. ([@​Starlexxx][])
• #​15672: Fix an error for Lint/RedundantCopDisableDirective when a file contains more than one rubocop:push/rubocop:pop pair. ([@​koic][])
• #​15625: Fix an error for Style/AccessModifierDeclarations when a body repeats the same access modifier. ([@​viralpraxis][])
• #​15603: Fix an error for Style/AccessModifierDeclarations with EnforcedStyle: inline when an access modifier is the body of an if without an else branch. ([@​viralpraxis][])
• #​15604: Fix an error for Style/ConstantVisibility when a visibility declaration splats anything other than an array literal, e.g. private_constant(*constants(false)). ([@​viralpraxis][])
• #​15647: Fix an error for Style/DocumentationMethod when an inline module_function/ruby2_keywords def is preceded by another argument. ([@​viralpraxis][])
• #​15680: Fix an error for Style/EndlessMethod when a method definition is nested inside another method definition. ([@​viralpraxis][])
• #​15674: Fix an error for Style/FloatDivision when using EnforcedStyle: fdiv and one operand of a float division is itself a parenthesized float division. ([@​viralpraxis][])
• #​15624: Fix an error for Style/HashLookupMethod when the looked-up key is itself a hash lookup. ([@​viralpraxis][])
• #​15642: Fix an error for Style/HashSyntax when hash rockets are enforced and a hash value repeats its key. ([@​viralpraxis][])
• #​15634: Fix an incorrect autocorrect for Lint/LiteralAsCondition when the other operand is a parenthesized return. ([@​Starlexxx][])
• #​15648: Fix an incorrect autocorrect for Lint/ParenthesesAsGroupedExpression when the parentheses contain and, or, not, or a modifier expression. ([@​Starlexxx][])
• #​15612: Fix an incorrect autocorrect for Naming/BlockForwarding with Style/MethodDefParentheses. ([@​Starlexxx][])
• #​15680: Fix an incorrect autocorrect for Style/EndlessMethod when using EnforcedStyle: require_always and the method body has a rescue or ensure clause. ([@​viralpraxis][])
• #​15669: Fix an incorrect autocorrect for Style/FloatDivision when using EnforcedStyle: fdiv and the divisor is a method call with parenthesized arguments. ([@​viralpraxis][])
• #​15678: Fix an incorrect autocorrect for Style/For when using EnforcedStyle: for and the block body has a rescue or ensure clause. ([@​viralpraxis][])
• #​15645: Fix an incorrect autocorrect for Style/GuardClause with Style/MissingElse. ([@​Starlexxx][])
• #​15668: Fix an incorrect autocorrect for Style/MethodCallWithArgsParentheses when EnforcedStyle: omit_parentheses is used together with Style/TrailingCommaInArguments. ([@​viralpraxis][])
• #​15347: Fix an incorrect autocorrect for Style/NestedModifier. ([@​bbatsov][])
• #​15347: Fix an incorrect autocorrect for Style/NonNilCheck. ([@​bbatsov][])
• #​15347: Fix an incorrect autocorrect for Style/Not with a flip-flop or assignment. ([@​bbatsov][])
• #​15349: Fix an incorrect autocorrect for Style/RedundantDoubleSplatHashBraces with a braced merge argument. ([@​bbatsov][])
• #​15349: Fix an incorrect autocorrect for Style/RedundantParentheses around and/or. ([@​bbatsov][])
• #​15349: Fix an incorrect autocorrect for Style/RedundantRegexpConstructor with %r{} delimiters. ([@​bbatsov][])
• #​15614: Fix an infinite loop between Layout/ArgumentAlignment and Layout/HashAlignment with separator style. ([@​Starlexxx][])
• #​15599: Fix an infinite loop error for Layout/CommentIndentation when many comment blocks with the same indentation are separated by empty lines. ([@​Starlexxx][])
• #​15597: Fix an infinite loop error for Layout/EmptyLinesAfterModuleInclusion when a module inclusion is directly before rescue. ([@​Starlexxx][])
• #​15617: Fix an infinite loop between Layout/ExtraSpacing with ForceEqualSignAlignment and Layout/SpaceAroundOperators. ([@​Starlexxx][])
• #​15638: Fix an infinite loop error for Layout/FirstArrayElementIndentation with Layout/ArrayAlignment when EnforcedStyle: with_fixed_indentation is configured. ([@​RedZapdos123][])
• #​15639: Fix an infinite loop error for Layout/FirstParameterIndentation with Layout/ParameterAlignment when EnforcedStyle: with_fixed_indentation is configured. ([@​RedZapdos123][])
• #​15619: Fix an infinite loop for Layout/LineLength with SplitStrings: true when the split point lands on a trailing space. ([@​Starlexxx][])
• #​15675: Fix an infinite loop between Layout/SpaceAroundOperators and Layout/ExtraSpacing with ForceEqualSignAlignment: true for aligned operator assignments. ([@​Starlexxx][])
• #​15598: Fix an infinite loop error for Lint/AssignmentInCondition when an assignment is inside defined?. ([@​Starlexxx][])
• #​15665: Fix an infinite loop between Style/EmptyMethod and Style/SingleLineMethods with AllowIfMethodIsEmpty: false. ([@​Starlexxx][])
• #​15644: Fix an infinite loop error for Style/EndlessMethod when an indented method definition would exceed Layout/LineLength once made endless. ([@​viralpraxis][])
• #​15651: Fix an infinite loop error for Style/EndlessMethod when a method body is a block spread over several lines. ([@​viralpraxis][])
• #​15618: Fix an infinite loop between Style/ParenthesesAroundCondition with AllowSafeAssignment: false and Lint/AssignmentInCondition. ([@​Starlexxx][])
• #​15662: Fix an infinite loop between Layout/SpaceAroundBlockParameters and Layout/SpaceInsideParens when the two cops enforce conflicting styles for a lambda's parameter parentheses. ([@​viralpraxis][])
• #​15670: Fix an infinite loop for Style/NumericLiteralPrefix with signed literals. ([@​dylanpulver][])
• #​15636: Fix Lint/CopDirectiveSyntax falsely reporting multiple directives when valid reason text mentions another directive. ([@​RedZapdos123][])
• #​15679: Fix false positives in Lint/DuplicateMethods for singleton methods in separate anonymous classes. ([@​rafaelfranca][])
• #​15347: Fix incorrect autocorrects for Style/NilComparison with precedence-sensitive operands. ([@​bbatsov][])
• #​15611: Fix Lint/ArgumentMismatch registering false positives for Foo.new calls, which are documented as out of scope but were checked against whichever new the project index could reach. ([@​HoneyryderChuck][])
• #​15610: Fix Lint/ArgumentMismatch registering false positives for calls that resolve to a private method on Object, such as a bare def written at the top level of a DSL file. ([@​HoneyryderChuck][])
• #​15600: Make rubocop:push +Cop arguments enable cops that are disabled in the configuration. ([@​bbatsov][])
• #​9325: Merge Exclude with the default configuration and with inherited files under Preview. ([@​bbatsov][])
• #​15626: Fix RemoteConfig failing to follow relative HTTP redirects for remote configuration files. ([@​RedZapdos123][])
• #​15661: Fix the result cache reading and processing non-regular files. ([@​viralpraxis][])
• #​15621: Fix incorrect analysis results when the result cache cannot compute a file checksum, which could serve one file's cached results for another file. ([@​koic][])
• #​11696: Fix Style/DataInheritance to not register an offense when the class body defines constants, nested classes, or nested modules. ([@​MatheusRich][])
• #​15655: Fix Style/StructInheritance to not register an offense when the class body defines constants, nested classes, or nested modules. ([@​MatheusRich][])

Changes

• #​15363: Disable Metrics/MethodLength, Metrics/AbcSize, Metrics/ClassLength, Metrics/ModuleLength, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/BlockLength, Metrics/ParameterLists and Metrics/BlockNesting under Preview, ahead of them being disabled by default in RuboCop 2.0. ([@​bbatsov][])
• #​15363: Disable Style/IfUnlessModifier, Style/GuardClause, Style/Next, Style/ClassAndModuleChildren, Style/DoubleNegation, Style/NumericPredicate, Style/SpecialGlobalVars, Style/PerlBackrefs, Style/FrozenStringLiteralComment, Style/FormatStringToken, Style/FormatString, Style/RegexpLiteral, Style/SignalException, Style/Lambda, Style/ParallelAssignment, Style/RaiseArgs, Style/ModuleFunction, Style/BlockDelimiters, Style/NumericLiterals, Style/NegatedIf, Naming/VariableNumber, Naming/HeredocDelimiterNaming, Layout/EmptyLineAfterGuardClause and Bundler/OrderedGems under Preview, ahead of them being disabled by default in RuboCop 2.0. ([@​bbatsov][])
• #​15363: Set AllCops: FailLevel to warning under Preview, so that style offenses are reported without failing the build, ahead of it becoming the default in RuboCop 2.0. ([@​bbatsov][])
• #​15363: Set the community-preferred EnforcedStyle of Style/StringLiterals, Style/StringLiteralsInInterpolation, Layout/CaseIndentation, Layout/EndAlignment, Layout/MultilineMethodCallIndentation, Layout/MultilineOperationIndentation, Layout/FirstHashElementIndentation, Layout/FirstArrayElementIndentation, Layout/ParameterAlignment, Layout/ArgumentAlignment, Style/EmptyMethod, Style/Alias, Style/RescueStandardError and Style/TernaryParentheses under Preview, ahead of them becoming the defaults in RuboCop 2.0. ([@​bbatsov][])
• #​15363: Set the EnforcedStyle of Style/SymbolArray and Style/WordArray to brackets under Preview, ahead of it becoming the default in RuboCop 2.0. ([@​bbatsov][])
• #​15686: Derive a cop's default severity from its department: Security cops now report as warning and Metrics cops as refactor. ([@​bbatsov][])
• #​15363: Disable Style/Documentation under Preview, ahead of it being disabled by default in RuboCop 2.0. ([@​bbatsov][])
• #​15616: Enable Lint/CopDirectiveSyntax by default, so directives that silently disable nothing are reported. ([@​bbatsov][])
• #​15601: Make Style/DirectiveScope convert single-statement signed push/pop scopes and enable/disable pairs to the next, enable-next and disable-next forms. ([@​bbatsov][])
• #​15650: Make AllowedCops and DisallowedCops of Style/DisableCopsWithinSourceCodeDirective match department names as well as cop names. ([@​bbatsov][])
• #​15616: Remove Style/DoubleCopDisableDirective, superseded by Lint/CopDirectiveSyntax, which now reports and corrects more than one directive on a line. ([@​bbatsov][])
• #​15607: Recognize warn_indent as a magic comment. This fixes a false positive for Layout/EmptyLineAfterMagicComment and makes Lint/OrderedMagicComments and Style/MagicCommentFormat aware of it. ([@​koic][])
• #​15650: Rename the AllowTrailingComment option of Style/DisableCopsWithinSourceCodeDirective to AllowWithReason. ([@​bbatsov][])

SeleniumHQ/selenium (selenium-webdriver)

v4.49.0

=========================

• Support CDP versions: v151, v152, v153
• derive BiDi field names and enum value types in the schema (#​17966)
• [build] Automated CDDL Spec Update (#​17990)
• [build] ship prebuilt Selenium Manager Linux arm64 binary in all bindings (#​17999)
• [build] Automated Browser Version Update (major) with CDP (#​18005)

simplecov-ruby/simplecov (simplecov)

v1.3.1

Compare Source

==================

Bugfixes

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See #​1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See #​1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

dblock/strava-ruby-client (strava-ruby-client)

v3.1.0

Compare Source

• #​110: Removes club_activities, club_members, and club_admins, which Strava retired on September 1, 2026 - @​dblock, @​Copilot.
• #​100: Adds comprehensive rdoc documentation - @​dblock.
• #​103: Migrate Danger to use the danger-pr-comment reusable workflow - @​dblock, @​Copilot.
• #​104: Fixes Danger Comment workflow failing with a contents: none permissions error - @​dblock.
• #​102: Adds revoke, deprecating deauthorize, per Strava's June 2026/2027 developer program changes - @​dblock.
• #​105: Adds total_elevation_gain, total_elevation_loss and formatted helpers to Strava::Models::Stream, computed from altitude stream data - @​dblock.
• #​106: Adds test coverage reporting with coveralls.io - @​dblock.
• #​108: Adds an integration test that verifies the real Strava API endpoint is reachable, run in CI on every push and pull request via rake spec:integration - @​dblock.
• #​107: Fixes explore_segments and star_segment raising UncaughtThrowError instead of ArgumentError for missing required arguments - @​dblock.
• #​107: Fixes start_date_local to always derive the timezone offset from the difference between start_date and start_date_local, since Strava's timezone property does not account for daylight saving time - @​dblock.
• #​109: Fixed coverage reporting to Coveralls not running on pull requests, and to report coverage from every Ruby/JRuby test matrix job merged into a single build, by switching from coveralls_reborn/COVERALLS_REPO_TOKEN to coverallsapp/github-action/GITHUB_TOKEN - @​dblock.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.