build(deps-dev): bump the development-dependencies group across 1 directory with 3 updates

[dependabot]

Updates the requirements on simplecov, standard and rubocop-minitest to permit the latest version.
Updates simplecov to 1.0.3

Release notes

Sourced from simplecov's releases.

v1.0.3

What's Changed

• Bump ruby/setup-ruby from 1.316.0 to 1.318.0 by @​dependabot[bot] in simplecov-ruby/simplecov#1238
• fix: memoise key parsing in RubyDataParser to fix combiner performance regression by @​oleksii-leonov in simplecov-ruby/simplecov#1239

New Contributors

• @​oleksii-leonov made their first contribution in simplecov-ruby/simplecov#1239

Full Changelog: simplecov-ruby/simplecov@v1.0.2...v1.0.3

Changelog

Sourced from simplecov's changelog.

1.0.3 (2026-07-26)

Bugfixes

• Generating a report no longer crashes when the coverage universe contains a module that shadows #inspect with an incompatible signature. Rendering a method coverage key's receiver calls to_s, and a singleton class's to_s renders its attached object via #inspect — Liquid's Utils module defines inspect(value, max_depth = 2) as a module_function, so any suite whose report included Liquid's files (typically a vendored bundle under the project root, which is why this surfaced only in CI) raised ArgumentError from the at_exit hook and lost its report. The exposure predates 1.0.2's key normalization, which only moved the call. Rendering now recovers by rebuilding the name from Module#name via bound methods, which user code cannot shadow, falling back to an address form that the existing normalization collapses. The external_at_exit workaround is no longer needed. Reported with an exemplary diagnosis by @​bkuhlmann. See #1236.
• Method coverage entries are now aggregated by source location alone, completing the aggregation introduced in 1.0.2 (which keyed on name and location). Ruby records one method entry per defined method, so a builder looping container.each_key { |key| define_method(key) { ... } } produces an entry per generated name, all at the block's location — and every name whose generated wrapper no test happened to call showed as an uncovered method on a line with full line and branch coverage. A source location is the unit a file-based report can express, and regular defs map one location to one name, so they are unaffected. The same identity is used when merging resultsets across processes. This also covers methods copied into refinements via import_methods, which Ruby records once per importing refinement at the shared module's original location, so exercising the method through any refinement now marks the shared definition covered and the skip workaround for shared refinement modules can be dropped. Reported with exemplary diagnoses by @​bkuhlmann. See #1234 and #1237.
• SimpleCov.formatter and SimpleCov.formatters now accept formatter instances in addition to formatter classes, so constructor options can actually be passed — most notably SimpleCov::Formatter::HTMLFormatter.new(silent: true) to suppress the "Coverage report generated" status line. Previously SimpleCov unconditionally called .new on whatever was configured, so passing an instance crashed with NoMethodError at report time. See #1240.

Performance

• Fix 5x performance regression on report combining (introduced in 1.0.0 as a result of using Ripper#parse in a hot path) by adding parsed key memoisation to RubyDataParser.call.

1.0.2 (2026-07-18)

Bugfixes

• The standalone simplecov CLI's colorizing subcommands (report, uncovered, coverage, diff) no longer crash with NoMethodError: undefined method 'color' when run in a project without a .simplecov file. The CLI deliberately loads only simplecov/cli rather than the full library, so SimpleCov.color was undefined unless a dotfile load had incidentally defined it — and --no-color was the only workaround, since the documented NO_COLOR env var was checked after the line that raised. Color.enabled? now treats missing configuration the same as its :auto default and falls through to NO_COLOR / FORCE_COLOR / TTY detection. Reported with an exemplary diagnosis by @​hasghari. See #1231.
• Branch tuples synthesized for tracked-but-unloaded files now match Ruby's Coverage for a safe-navigation call that takes a block. For x&.foo { ... } (and the second link of a chain like x&.foo&.bar { ... }) the extractor keyed the branch on the call node's full source range, which extends through the attached block, while Coverage ends the range at the call itself — so a simulated entry merging with a real one produced a phantom, permanently-missed branch, the same failure mode as the elsif fix in 1.0.1. Reported with an exemplary diagnosis and a suggested fix by @​alexdeng-mp. See #1233.
• Prompted by the two reports above, an exhaustive differential audit of StaticCoverageExtractor against Ruby's Coverage — a fuzzing harness that runs thousands of generated programs through both and diffs the branch tuples, now part of the spec suite (opt-in via SIMPLECOV_FUZZ=1) — surfaced and fixed four more mismatches of the same phantom-branch class. Conditions that are compile-time literals (if true, if 1, a ternary on a literal) are folded away by Ruby's compiler and no longer produce synthesized branches (while true still does — loops are not folded). On Ruby 3.3, three legacy conventions now match: the body range of a do-while (begin ... end while), the location of empty branch arms (which on 3.3 depends on whether the construct is in value or void position), and one-line pattern matching (x => pattern / x in pattern), which emits a :case branch on 3.3 and nothing on 3.4+. The audit also caught a crash on Ruby 3.3's stdlib Prism (0.19), which still exposes the else clause of UnlessNode / CaseNode / CaseMatchNode under its pre-1.3 name consequent: the extractor raised internally and silently dropped simulated branch and method data for any file containing unless/else or a case with an empty arm, unless a newer prism gem happened to be installed.
• As a defensive layer against any future extractor drift, merging now treats an actually-executed file's branch and method data as authoritative: when a resultset that merely tracked a file (with simulated, statically-derived tuples) merges with one from a process that really loaded it, the synthesized tuples are dropped rather than unioned. This contains any undiscovered mismatch to denominator inflation on files no process loaded, instead of phantom misses on fully-covered ones. Line coverage still combines from both sides, so tracked-but-unloaded files keep contributing to the line denominator as before.
• Method coverage no longer reports phantom uncovered methods for define_method / define_singleton_method blocks defined onto more than one receiver — e.g. a module's included hook defining the same block on every including class. Ruby records one method entry per receiver, all pointing at the same source location, so any receiver whose copy was never called showed as an uncovered method on a line with 100% line coverage. Entries are now aggregated by (name, source location) with hit counts summed, and cross-process merging matches methods on the same source identity rather than on the receiver class. Reported with an exemplary diagnosis by @​bkuhlmann. See #1234.
• Branch coverage under enable_coverage :eval no longer inflates denominators or reports phantom missed branches for templates compiled more than once — e.g. hanami-view compiles each template once per view class, and every ERB.new(...).result is a fresh compile. Ruby's Coverage emits a fresh set of branch entries per compile of the same file (nondeterministically through Ruby 4.0, consistently on current ruby master — see https://bugs.ruby-lang.org/issues/22203), each counting only the renders that flowed through that compile, so a side exercised under one compile appeared as a permanently-missed branch in another compile's entry at the same location, and ignore_branches :implicit_else swung the report wildly by stripping only the synthetic-else halves of the duplicates. Duplicated conditions are now aggregated by source location with arm counts summed. Reported with an exemplary diagnosis by @​bkuhlmann. See #1235.

1.0.1 (2026-07-14)

Enhancements

• The gem now ships type signatures under sig/, covering the public API: the configuration DSL (including the criterion-scoped coverage block and the legacy deprecated verbs), the Result / FileList / SourceFile / CoverageStatistics read API that formatter authors consume, the formatter and filter class hierarchies, exit codes, and the ParallelAdapters::Base contract. Internal classes carry repository-only skeleton signatures (sig/internal/, excluded from the gem package) so the entire codebase type-checks under Steep in strict mode, while the shipped signature payload stays small. Signatures are checked with rbs validate and steep check as part of the default rake task. RBS and Steep users no longer need the third-party signatures from ruby/gem_rbs_collection, which cover the 0.22 API and predate 1.0's configuration redesign.

Bugfixes

• Branch tuples synthesized for tracked-but-unloaded files now match Ruby's Coverage exactly for elsif and for if arms with empty bodies. StaticCoverageExtractor attributed the outer else arm of an elsif to the clause's body rather than the whole clause, and an empty if then-body to the whole node rather than Coverage's zero-width point at the predicate's end. Since resultset merges combine branch arms by their exact location, a simulated entry merging with a real one for the same file (parent and worker under Minitest's parallelize, or RSpec and Minitest suites collated together) produced phantom, permanently-missed branch arms. A new differential spec now pins every branch construct tuple-for-tuple against Ruby's Coverage — which promptly caught that CRuby 3.4 changed several of these conventions, so the extractor now emits whichever shape the running Ruby's Coverage uses (on 3.2/3.3: elsif clause ranges end at the chain's last content rather than the shared end, empty if/else/when bodies fall back to enclosing ranges, and empty while/in bodies collapse to points). Reported with an exemplary diagnosis by @​hasghari. See #1226.
• merge_subprocesses no longer silently drops all worker coverage under Minitest's fork-based parallelize(workers: N) (the setup the rails profile exists for). When Minitest's autorun was armed before SimpleCov.start — which is how rails test loads — SimpleCov deferred its report to Minitest.after_run, and forked workers inherited that deferral even though Minitest pins its after_run hook to the parent's pid, so no exit path in the worker ever stored its resultset. Workers now reset the inherited at_exit state on fork and re-arm their own hook, so their resultsets are stored and merged as documented. Reported with an exemplary diagnosis by @​hasghari. See #1227.
• Fixed SimpleCov.formatters= raising NoMethodError when given a single formatter instead of an Array — a regression from 0.22.x, where MultiFormatter.new normalized the value internally. This restores the long-documented SimpleCov.formatters = SimpleCov::Formatter::MultiFormatter.new([...]) pattern, in which MultiFormatter.new returns a Class rather than an Array. The regression surfaced in ruby/ruby's CI through net-imap's test helper. Thanks @​koic. See #1224.
• Formatter status lines ("Coverage report generated for X") and threshold-enforcement output (violation reports, "SimpleCov failed with exit N") no longer route through Kernel#warn. They still print to stderr, but they are program output rather than Ruby warnings, so Warning.warn hooks — warning trackers and raise-on-warning test setups — no longer intercept them as unaddressable noise, and threshold failure explanations now survive ruby -W0, which previously reduced a failing check to a bare exit code with no explanation. Genuine warnings (deprecations, dropped-file notices, parse failures) still use warn. Suppression remains explicit: silent: true for formatter status lines, print_errors false for enforcement output. Thanks @​viralpraxis. See #1225.

1.0.0 (2026-07-12)

First stable release of the 1.0 line. The entries below consolidate release candidates rc1 through rc5 and describe all changes since 0.22.1.

Breaking Changes

• Dropped support for Ruby 3.1 and JRuby 9.4. The minimum is now Ruby 3.2 (and JRuby 10, which reports RUBY_VERSION 3.4). Ruby 3.1 reached end of life in March 2025, and a recent i18n release calls Fiber[], a Ruby 3.2 API, at load time, so suites that load Rails no longer run on 3.1. Raising required_ruby_version to >= 3.2 also excludes JRuby 9.4, which reports RUBY_VERSION 3.1.x. See #1171.
• JSON formatter: group stats changed from { "covered_percent": 80.0 } to full stats shape { "covered": 8, "missed": 2, "total": 10, "percent": 80.0, "strength": 0.0 }. The key covered_percent is renamed to percent.
• JSON formatter: simplecov_json_formatter gem is now built in. require "simplecov_json_formatter" continues to work via a shim.
• StringFilter now matches at path-segment boundaries. "lib" matches /lib/ but no longer matches /library/. Use a Regexp filter for substring matching.
• SourceFile#project_filename now returns a truly relative path with no leading separator (e.g. lib/foo.rb instead of /lib/foo.rb). This also removes the leading / from file path keys in coverage.json and from the filename in minimum_coverage_by_file error messages. Anchored RegexFilters that relied on a leading / (e.g. %r{^/lib/}) should be rewritten (e.g. %r{\Alib/}).
• Removed docile gem dependency. The SimpleCov.configure block is now evaluated via instance_exec with instance variable proxying.
• Removed automatic activation of JSONFormatter when the CC_TEST_REPORTER_ID environment variable is set. The default HTMLFormatter now emits coverage.json alongside the HTML report (using JSONFormatter.build_hash to serialize the same payload JSONFormatter writes), so the env-var special case is no longer needed. Because of this, listing JSONFormatter alongside HTMLFormatter is redundant and can be removed.
• SimpleCov.start now loads the test_frameworks profile by default, which filters paths under test/, spec/, features/, and autotest/. Running the suite always executes 100% of the test files themselves, which inflated the overall percentage and obscured application coverage. To opt back in (e.g. to surface dead test helpers), drop the filter with remove_filter %r{\A(test|features|spec|autotest)/}. See #816.
• HTML and JSON formatters now write the "Coverage report generated for X to Y" status line (and the per-criterion totals beneath it) to stderr instead of stdout. The message is a diagnostic, not the program's output, and routing it to stdout polluted pipelines like rspec -f json. Suppress it entirely with silent: true on the formatter; redirect with 2>&1 if you want the old behavior. See #1060.
• Under parallel_tests, SimpleCov now waits in the first started process (via ParallelTests.first_process?) rather than the last. This matches the convention parallel_tests's own README recommends for "do something once after all workers finish" hooks, so user code that has its own ParallelTests.wait_for_other_processes_to_finish in an RSpec.after(:suite) (or equivalent) no longer deadlocks against SimpleCov's wait when both pick the same process. As a side benefit, the previous PARALLEL_TEST_GROUPS=1 workaround for last_process?'s "" == "1" mismatch (#1066) is no longer needed — first_process? handles that case naturally. Migration: the rare project that wired its own wait via ParallelTests.last_process? now hits the symmetric deadlock and must switch to first_process?. See #922.

... (truncated)

Commits

• e9fddf0 Bump version to 1.0.3
• 1bc8a8c bundle update
• 0e6eae8 fix: memoise key parsing in RubyDataParser to fix combiner performance regres...
• 1a8a9ba Accept formatter instances in formatter configuration
• 3ef1068 Bump ruby/setup-ruby from 1.316.0 to 1.318.0
• f33a574 Assert engine-independent invariants for receiver name fallbacks
• 3492da6 Aggregate method coverage by source location alone
• 2e60550 Survive user code that breaks receiver name rendering
• 803dcbc Bump version to 1.0.2
• 177b0cc Restore a clean Steep check for the post-1.0.1 code
• Additional commits viewable in compare view

Updates standard to 1.56.0

Changelog

Sourced from standard's changelog.

1.56.0

• Updates rubocop to 1.88.0

1.55.0

• Updates rubocop to 1.87.0

1.54.0

• Updates rubocop to 1.84.0

1.53.0

• Updates rubocop to 1.82.0
• Starts support for Ruby 4.0

1.52.0

• Updates rubocop to 1.81.7

1.51.1

• Fixes Layout/EmptyLineAfterGuardClause back to false after #750

1.51.0

• Updates rubocop to 1.81.2

1.50.0

• Updates rubocop to 1.75.5

1.49.0

• Updates standard performance to 1.8.0

1.48.0

• Updates rubocop to 1.75.2

1.47.0

• Updates standard performance to 1.7.0

1.46.0

• Updates rubocop to 1.73.2

1.45.0

... (truncated)

Commits

• d695ba0 🏆⚽️ v1.56.0
• 86a92fa Merge pull request #823 from standardrb/upgrade-2026-07-15
• dfcaef8 Fixes Parallel's overzealous update
• 5e68710 Updates rubocop to 1.88
• 95f959b Merge pull request #822 from standardrb/dependabot/bundler/ruby-lsp-0.26.10
• 42c9d35 Bump ruby-lsp from 0.26.9 to 0.26.10
• 79cd977 Merge pull request #818 from standardrb/dependabot/bundler/language_server-pr...
• 3011204 Bump language_server-protocol from 3.17.0.5 to 3.17.0.6
• 505e8e6 Merge pull request #797 from standardrb/dependabot/bundler/ruby-lsp-0.26.9
• af5498a Merge pull request #816 from standardrb/dependabot/github_actions/step-securi...
• Additional commits viewable in compare view

Updates rubocop-minitest to 0.40.0

Release notes

Sourced from rubocop-minitest's releases.

RuboCop Minitest v0.40.0

New features

• #355: Add new RuboCop::TestCase as a stable API for testing custom cops with Minitest. The cop under test is derived from the test class name and can be configured with cop_class, cop_config, other_cops, and target_ruby_version. (@​koic)

Changes

• #345: Fix false positives and negatives in Minitest/NonExecutableTestMethod for nested test classes and for test methods defined before the test class. (@​amckinnie)
• #278: (Breaking) Remove the cop argument from inspect_source and investigate in the Minitest test support; the cop under test is now resolved automatically. The test configuration now merges the default configuration for the cop under test and sets AllCops: TargetRubyVersion explicitly. (@​koic)

Changelog

Sourced from rubocop-minitest's changelog.

0.40.0 (2026-07-20)

New features

• #355: Add new RuboCop::TestCase as a stable API for testing custom cops with Minitest. The cop under test is derived from the test class name and can be configured with cop_class, cop_config, other_cops, and target_ruby_version. ([@​koic][])

Changes

• #345: Fix false positives and negatives in Minitest/NonExecutableTestMethod for nested test classes and for test methods defined before the test class. ([@​amckinnie][])
• #278: (Breaking) Remove the cop argument from inspect_source and investigate in the Minitest test support; the cop under test is now resolved automatically. The test configuration now merges the default configuration for the cop under test and sets AllCops: TargetRubyVersion explicitly. ([@​koic][])

0.39.1 (2026-02-24)

Bug fixes

• #347: Fix false positives in Minitest/AssertIncludes and Minitest/RefuteIncludes cops for key? and has_key? used with assert or refute. ([@​koic][])

0.39.0 (2026-02-24)

Changes

• #344: Disable Minitest/AssertEmptyLiteral by default. ([@​koic][])
• #315: Make Minitest/AssertIncludes and Minitest/RefuteIncludes aware of key?, has_key?, and member? alias methods. ([@​koic][])

0.38.2 (2025-08-30)

Bug fixes

• #321: Fix false positives for Minitest/MultipleAssertions when the assertion has a receiver. ([@​earlopain][])

0.38.1 (2025-05-31)

Bug fixes

• #332: Fix false positives for Minitest/NoAssertions when using matcher methods. ([@​koic][])
• #334: Fix minitest extension for the cop generator. ([@​rafaelfranca][])

0.38.0 (2025-04-01)

New features

• #331: Support it block parameter in Minitest cops. ([@​koic][])

0.37.1 (2025-02-16)

Bug fixes

• #330: Update add_dependency of RuboCop to 1.72 for plugin support. ([@​koic][])

0.37.0 (2025-02-16)

... (truncated)

Commits

• ee2ffba Cut 0.40.0
• a647bd0 Update Changelog
• 8d55114 Merge pull request #359 from koic/fix_multiple_assertions_todo_test_state_leak
• a7e210d Merge pull request #358 from koic/fix_uninitialized_instance_variable_warnings
• 113548b Fix Minitest/MultipleAssertions todo test on the oldest supported RuboCop
• 651e6b1 Suppress uninitialized instance variable warnings in the test support
• eeff9aa Merge pull request #355 from koic/add_rubocop_test_case_stable_api
• ef1fc28 Add RuboCop::TestCase as a stable API for testing custom cops
• ef90ead Merge pull request #354 from koic/fix_jruby_ci_failure_caused_by_rbs_native_e...
• 8027065 Fix JRuby CI failure caused by rbs native extension build
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
standard	[>= 1.51.a, < 1.52]

[flavorjones]

@dependabot rebase