Bump the development-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the development-dependencies group with 5 updates in the / directory:

Package	From	To
rubocop-capybara	2.23.0	3.0.0
rubocop-rspec	3.9.0	3.10.2
brakeman	8.0.4	8.0.5
ferrum	0.17.1	0.17.2
herb	0.9.4	0.10.2

Updates rubocop-capybara from 2.23.0 to 3.0.0

Release notes

Sourced from rubocop-capybara's releases.

RuboCop Capybara v3.0.0

• Enable pending cops by default for the 3.0 release. (@​ydah)
• Remove the deprecated Capybara/ClickLinkOrButtonStyle cop. (@​ydah)
• Remove obsolete cop name migration config for the 2.x to 3.0 transition. (@​ydah)

Changelog

Sourced from rubocop-capybara's changelog.

3.0.0 (2026-06-22)

• Enable pending cops by default for the 3.0 release. ([@​ydah])
• Remove the deprecated Capybara/ClickLinkOrButtonStyle cop. ([@​ydah])
• Remove obsolete cop name migration config for the 2.x to 3.0 transition. ([@​ydah])

Commits

• a9b8f9a Merge pull request #177 from rubocop/v3.0.0
• 6a4579d release v3.0.0
• 75e7cda Merge pull request #176 from rubocop/docs/update-specific-matcher-readme
• f02ff72 Update SpecificMatcher README example
• ebe10e8 Merge pull request #174 from rubocop/enable-pending-capybara-cops
• 20a5721 Enable pending Capybara cops
• fee3774 Merge pull request #173 from rubocop/remove-obsolete-cop-name-migration
• ea818bd Remove obsolete cop name migration config
• 989fe3c Merge pull request #172 from rubocop/remove-click-link-or-button-style
• 5d5a5b8 Merge pull request #175 from rubocop/dependabot/github_actions/actions/checko...
• Additional commits viewable in compare view

Updates rubocop-rspec from 3.9.0 to 3.10.2

Release notes

Sourced from rubocop-rspec's releases.

RuboCop RSpec v3.10.2

• Fix false positives for RSpec/SpecFilePathFormat when CustomTransform maps a namespace to an empty string. (@​sakuro)
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with options. (@​bquorning)

RuboCop RSpec v3.10.1

• Add Strict option to RSpec/SharedContext to flag shared_context whenever it contains examples, even alongside setup code. (@​Darhazer)
• Add NegatedMatcher configuration option RSpec/ExpectChange. (@​Darhazer)
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with interpolations. (@​bquorning)

RuboCop RSpec v3.10.0

• Add new cop RSpec/MatchWithSimpleRegex to suggest include matcher when match is used with simple string literals without regex-specific features. (@​bquorning)
• Add new cop RSpec/DiscardedMatcher to detect matchers in void context (e.g. missing .and between compound matchers). (@​ydakuka)
• Add support for itblock nodes. (@​Darhazer)
• RSpec/ScatteredLet now preserves the order of lets during auto-correction. (@​Darhazer)
• Fix a false negative for RSpec/EmptyLineAfterFinalLet inside shared_examples / include_examples / it_behaves_like blocks. (@​Darhazer)
• Fix a false positive for RSpec/ContainExactly when contain_exactly has multiple splat arguments. (@​ydah)
• Add autocorrect support for RSpec/SubjectDeclaration. (@​eugeneius)
• Fix false negatives for RSpec/SpecFilePathFormat when the expected class path only partially matches a path segment. (@​ydah)
• Fix a false negative for RSpec/ExpectActual when the matcher takes no arguments (e.g. expect("foo").to be_present, expect(1).to be). (@​cvx)

Changelog

Sourced from rubocop-rspec's changelog.

3.10.2 (2026-06-06)

• Fix false positives for RSpec/SpecFilePathFormat when CustomTransform maps a namespace to an empty string. ([@​sakuro])
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with options. ([@​bquorning])

3.10.1 (2026-06-05)

• Add Strict option to RSpec/SharedContext to flag shared_context whenever it contains examples, even alongside setup code. ([@​Darhazer])
• Add NegatedMatcher configuration option RSpec/ExpectChange. ([@​Darhazer])
• Fix RSpec/MatchWithSimpleRegex to ignore regular expressions with interpolations. ([@​bquorning])

3.10.0 (2026-06-05)

• Add new cop RSpec/MatchWithSimpleRegex to suggest include matcher when match is used with simple string literals without regex-specific features. ([@​bquorning])
• Add new cop RSpec/DiscardedMatcher to detect matchers in void context (e.g. missing .and between compound matchers). ([@​ydakuka])
• Add support for itblock nodes. ([@​Darhazer])
• RSpec/ScatteredLet now preserves the order of lets during auto-correction. ([@​Darhazer])
• Fix a false negative for RSpec/EmptyLineAfterFinalLet inside shared_examples / include_examples / it_behaves_like blocks. ([@​Darhazer])
• Fix a false positive for RSpec/ContainExactly when contain_exactly has multiple splat arguments. ([@​ydah])
• Add autocorrect support for RSpec/SubjectDeclaration. ([@​eugeneius])
• Fix false negatives for RSpec/SpecFilePathFormat when the expected class path only partially matches a path segment. ([@​ydah])
• Fix a false negative for RSpec/ExpectActual when the matcher takes no arguments (e.g. expect("foo").to be_present, expect(1).to be). ([@​cvx])

Commits

• 2488441 Merge pull request #2189 from rubocop/release
• c9e53cf Bump version to 3.10.2
• 7ae0a42 Merge pull request #2186 from sakuro/fix/spec-file-path-format-empty-custom-t...
• 8b0b5e9 Merge branch 'master' into fix/spec-file-path-format-empty-custom-transform
• dc4465c Merge pull request #2188 from rubocop/fix-2185
• d5de6b2 Consider regexp with options a non-simple regexp
• bad0cb3 🐛 Fix RSpec/SpecFilePathFormat false positives when CustomTransform maps ...
• ec3eeab Merge pull request #2183 from rubocop/fix-match-with-simple-regex-with-interp...
• 16bbf49 Bump version to 3.10.1
• 2a78abd Ignore interpolation in MatchWithSimpleRegex
• Additional commits viewable in compare view

Updates standard from 1.54.0 to 1.56.0

Changelog

Sourced from standard's changelog.

1.56.0

• Updates rubocop to 1.88.0

1.55.0

• Updates rubocop to 1.87.0

Commits

• d695ba0 🏆⚽️ v1.56.0
• 86a92fa Merge pull request #823 from standardrb/upgrade-2026-07-15
• dfcaef8 Fixes Parallel's overzealous update
• 5e68710 Updates rubocop to 1.88
• 95f959b Merge pull request #822 from standardrb/dependabot/bundler/ruby-lsp-0.26.10
• 42c9d35 Bump ruby-lsp from 0.26.9 to 0.26.10
• 79cd977 Merge pull request #818 from standardrb/dependabot/bundler/language_server-pr...
• 3011204 Bump language_server-protocol from 3.17.0.5 to 3.17.0.6
• 505e8e6 Merge pull request #797 from standardrb/dependabot/bundler/ruby-lsp-0.26.9
• af5498a Merge pull request #816 from standardrb/dependabot/github_actions/step-securi...
• Additional commits viewable in compare view

Updates brakeman from 8.0.4 to 8.0.5

Release notes

Sourced from brakeman's releases.

8.0.5

• Add quote_schema_name to safe quote method list (changes by Zsolt Kozaroczy)
• Fix SQL injection false positive for compact_blank/compact on permitted params (changes by Arpit Jain)
• Fix inline render false positive for local named text (changes by Arpit Jain)
• Fix HAML crash on .raw calls (changes by Federico Franco)
• Fix Ruby version parsing - especially for non-CRuby versions (changes by Chris Southerland Jr)
• Fix TemplateAliasProcessor#template_name arity (changes by viralpraxis)
• Reduce false positives when using shell escaping (changes)

Changelog

Sourced from brakeman's changelog.

8.0.5 - 2026-06-12

• Add quote_schema_name to safe quote method list (Zsolt Kozaroczy)
• Fix SQL injection false positive for compact_blank/compact on permitted params (Arpit Jain)
• Fix inline render false positive for local named text (Arpit Jain)
• Fix HAML crash on .raw calls (Federico Franco)
• Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr)
• Fix TemplateAliasProcessor#template_name arity (viralpraxis)
• Reduce false positives when using shell escaping

Commits

• 104443e Bump to 8.0.5
• 8e61e2a Update CHANGES
• f014c15 Merge pull request #2028 from kiskoza/fix/quote_schema_name
• 9227822 Merge pull request #2027 from arpitjain099/fix/brakeman-1915-render-partial-t...
• 6788d28 Merge pull request #2025 from arpitjain099/fix/sql-fp-compact-blank
• b7c3906 Add quote_schema_name to safe quote method list
• f95c500 test: update line number for still-warns SQL injection case after fixture shift
• 4fba779 base_processor: skip hash render-type extraction when type set positionally
• 1e63a41 Fix SQL injection false positive for compact_blank/compact on permitted params
• 7ff9e49 Merge pull request #2023 from FFederi/fix-haml-chained-raw-crash
• Additional commits viewable in compare view

Updates ferrum from 0.17.1 to 0.17.2

Release notes

Sourced from ferrum's releases.

0.17.2

Added

• Ferrum::Network::Response#body! returns body or throws error if implicable
• Ferrum::Browser#new(dockerize: true) whether to add CLI flags to run a browser in a container, false by default
• Initial support for RBS types #565

Changed

• Ferrum::Network::Response#body returns body or nil in case of errors
• Disable Chrome code sign clones #555
• Ruby version required is >= 3.1 #565

Fixed

• Proper handle wss urls, and fix session_id loss for undetermined order of CDP events #559
• browser.reset tries to dispose default implicit context #566, #540

Changelog

Sourced from ferrum's changelog.

0.17.2 (March 23, 2026)

Added

• Ferrum::Network::Response#body! returns body or throws error if implicable
• Ferrum::Browser#new(dockerize: true) whether to add CLI flags to run a browser in a container, false by default
• Initial support for RBS types #565

Changed

• Ferrum::Network::Response#body returns body or nil in case of errors
• Disable Chrome code sign clones #555
• Ruby version required is >= 3.1 #565

Fixed

• Proper handle wss urls, and fix session_id loss for undetermined order of CDP events #559
• browser.reset tries to dispose default implicit context #566, #540

Removed

Commits

• 2f0699d Bump up
• aa0b7ad chore: revert default for :pending_connection_errors to true and update relat...
• 3606d54 fix: undefined method `find_target' for nil (NoMethodError) #542
• 25f68f8 chore: update CHANGELOG
• 56a46cd fix: browser.reset tries to dispose default implicit context #540 (#566)
• 0c4d14b Add RBS types (#565)
• e1b51b1 chore: add CHANGELOG entry
• 8c68153 fix: ensure session_id is set only if session is absent
• de385e2 Fix wss urls and session_id lost (#559)
• 1cd3d76 chore: move documentation to a dedicated website
• Additional commits viewable in compare view

Updates herb from 0.9.4 to 0.10.2

Release notes

Sourced from herb's releases.

v0.10.2

Parser

• Skip close tag search for tag names with no closing tags by @​marcoroth in marcoroth/herb#1794
• Add timeout to parse_option_T by @​marcoroth in marcoroth/herb#1795
• Add max_errors to parse_option_T by @​marcoroth in marcoroth/herb#1796
• Allow inline in expressions outside of case statements by @​ttilberg in marcoroth/herb#1821

Linter

New Linter Rules

• Implement a11y-no-redundant-image-alt rule by @​joelhawksley in marcoroth/herb#1686
• Implement a11y-disabled-attribute rule by @​joelhawksley in marcoroth/herb#1685
• Implement a11y-avoid-generic-link-text rule by @​joelhawksley in marcoroth/herb#1673
• Implement a11y-svg-has-accessible-text rule by @​joelhawksley in marcoroth/herb#1669
• Implement a11y-no-aria-label-misuse rule by @​joelhawksley in marcoroth/herb#1677
• Implement a11y-nested-interactive-elements rule by @​joelhawksley in marcoroth/herb#1674

Updates Rules

• Fix html-no-self-closing to preserve indentation by @​fgkolf in marcoroth/herb#1753
• Narrow html-no-self-closing offense location by @​marcoroth in marcoroth/herb#1777
• Add WAI-ARIA Graphics roles to html-aria-role-must-be-valid by @​miyatis in marcoroth/herb#1825
• Allow application/ld+json for html-allowed-script-type rule by @​xymbol in marcoroth/herb#1844

Formatter

• Fix disabled formatter stdin output by @​hschne in marcoroth/herb#1851

Laguage Server

• Fix comments inside multiline ERB tags by @​RSeven in marcoroth/herb#1776

Core

• Update AST Utils for HTMLConditionalOpenTagNode by @​marcoroth in marcoroth/herb#1781

JavaScript

• Upgrade to Node.js 24 by @​marcoroth in marcoroth/herb#1778

Ruby

• Add sig/manifest.yaml to declare stdlib dependencies by @​tk0miya in marcoroth/herb#1711
• Check RBS validity on CI by @​tk0miya in marcoroth/herb#1712

... (truncated)

Commits

• b224454 JavaScript: Set unreleased rules to v0.10.2
• 3f65710 v0.10.2 (#1853)
• 722d53c Language Server: Fix comments inside multiline ERB tags (#1776)
• a53af59 Bump @​types/node from 26.0.1 to 26.1.1 (#1848)
• 4a174b9 Bump sorbet from 0.6.13323 to 0.6.13341 (#1847)
• f8104b0 Bump @​vscode/vsce from 3.9.1 to 3.9.2 (#1850)
• 30160e1 Formatter: Fix disabled formatter stdin output (#1851)
• bda4e75 Bump picomatch from 4.0.4 to 4.0.5 (#1840)
• 7935fa7 Linter: Allow application/ld+json for html-allowed-script-type rule (#1844)
• 154ce08 Ruby: Require rails-html-sanitizer explicitly
• Additional commits viewable in compare view