[dependabot]

Bumps the dependencies group with 9 updates in the / directory:

Package	From	To
rails	8.1.3.1	8.1.4
sqlite3	2.9.6	2.10.0
listen	3.10.0	3.10.1
simplecov	1.3.0	1.3.2
tzinfo-data	1.2026.4	1.2026.5
cancancan	3.6.1	3.7.0
lograge	0.15.0	0.15.1
honeybadger	6.9.2	6.9.3
pg	1.6.3	1.7.0

Updates rails from 8.1.3.1 to 8.1.4

Release notes

Sourced from rails's releases.

8.1.4

Active Support

• Fix the debug error page rendering for SyntaxErrors with multi-line messages.

  Marco Roth

• Make ActiveSupport::JSON.decode compatible with the upcoming json 3.0 gem.

  Earlopain

• Fix number_to_human_size crashing for sizes above a terabyte by supporting petabyte, exabyte, and zettabyte storage units.

  Kenta Ishizaki

• Fix Range#sole raising NoMethodError when the enumerable core extension isn't already loaded.

  Kenta Ishizaki

• Fix ActiveSupport::Cache::FileStore raising NameError for FileUtils when fileutils isn't already loaded.

  Kenta Ishizaki

• Fix Enumerable#in_order_of with filter: true dropping nil elements explicitly named in the series.

  Kenta Ishizaki

• Keep HashWithIndifferentAccess#filter returning a HashWithIndifferentAccess instead of a plain Hash.

  Kenta Ishizaki

• Fix number_to_human and number_to_human_size crashing when :precision is nil.

  Kenta Ishizaki

• Fix ActiveSupport::InheritableOptions#to_h to recursively flatten nested InheritableOptions parents.

  Andrew Novoselac

• Fix ActiveSupport::StructuredEventSubscriber.debug_only leaking debug-only methods across subscriber subclasses.

  Kenta Ishizaki

... (truncated)

Commits

• c3466ea Preparing for 8.1.4 release
• 334dc3e Merge pull request #58854 from carlosdanielpohlod/strict-locals-ascii-only-body
• 8df6693 Merge pull request #58827 from rails/backport-alias-fallback-8-1-stable
• 2ed2c88 Define read_attribute_for_validation instead of aliasing send
• 2616145 Merge pull request #56705 from p8/activemodel/fix-read-attr-for-serialization...
• 20abac3 Merge pull request #58817 from yahonda/fix-alias-fallback-to-object-in-attrib...
• 2670772 Merge pull request #58733 from kwestein/create-or-find-by-deadlock
• 8236300 Merge pull request #58806 from Shopify/hm-wnqzpryypymkrxtn
• e6288a8 Update CHANGELOGs for 8-1-stable backports
• 44a7fd4 Merge pull request #58799 from e-akashsaini/fix-tuple-where-key-corrupting-at...
• Additional commits viewable in compare view

Updates sqlite3 from 2.9.6 to 2.10.0

Release notes

Sourced from sqlite3's releases.

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.
  • SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

• ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @​kch
• Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @​Maaarcocr

Fixed

• Fix Database#statement_timeout= interrupting statements almost immediately instead of after the timeout elapsed, including re-executed prepared statements and calls to Database#execute_batch2. #737 @​palkan @​flavorjones

Improved

• On CRuby, Statement#types allocates fewer strings. Each declared type is downcased and interned in C, instead of allocating two strings per column. #743 @​jhawthorn

Changed

• ResultSet#each and #each_hash return the result set when called with a block. As a consequence, Database#execute and #execute2 called with a block return the closed ResultSet instead of nil. #656 @​kch
• Statement#columns and Statement#types return frozen arrays, and the strings in Statement#types are frozen. Code that mutates them now raises FrozenError. #743 @​jhawthorn
• Statement#column_decltype and Statement#types return UTF-8 strings. Previously they returned ASCII-8BIT strings. #743 @​jhawthorn

dafeea94182af2eb53a10797be359fa6ec4270532bd45255d1c2beb69f2eb743  gems/sqlite3-2.10.0-aarch64-linux-gnu.gem
ec4ffedded0bd8579629e14d0647cfee9092c0af0009c05d6404d90857b1cb8b  gems/sqlite3-2.10.0-aarch64-linux-musl.gem
bcf2e165f27fd28f46ba34eeba3503d557ea7f76f9dd40434ce719f2ba0d5cda  gems/sqlite3-2.10.0-arm-linux-gnu.gem
338510e64876c7d02d91733eeaee384806c58b3835d8a688d1bfdbf7e468c497  gems/sqlite3-2.10.0-arm-linux-musl.gem
f619f33adfd01a1827e8764a3da92b289c1a99d93707d021a242dccba6909c4e  gems/sqlite3-2.10.0-arm64-darwin.gem
ec284ace2bca873737d0e8818f8eb31e5b84936b694f95933514872929b945d0  gems/sqlite3-2.10.0-x64-mingw-ucrt.gem
a3ac204853c8c6b3f2f6f94ebaa52cba26cfd48df82537b1b154a28fc687f057  gems/sqlite3-2.10.0-x86-linux-gnu.gem
96508597fc5e54bfc1a12f94eb2d9f8e0517a8a377bdbfd6cc824215c4530adb  gems/sqlite3-2.10.0-x86-linux-musl.gem
67306588548e62095855a511285daf33389d7f4311c1c33a1addd23e2b90cec5  gems/sqlite3-2.10.0-x86_64-darwin.gem
295f48b240ba663efa2e3b6f38cbc0f19f5c8a2823a71fda3bf15531be5dd0e8  gems/sqlite3-2.10.0-x86_64-linux-gnu.gem
876dd86a15c7828075ff7612e3d0ab0eb2eba0d8485b13fd4000e8a335f86bc5  gems/sqlite3-2.10.0-x86_64-linux-musl.gem
3fc6c4ac2249b1c54099e7b80e57afdd678e648c1f54de8ad3b4c775195c661a  gems/sqlite3-2.10.0.gem

Changelog

Sourced from sqlite3's changelog.

2.10.0 / 2026-10-13

Dependencies

• Vendored sqlite is updated to v3.54.0 (from v3.53.2). #750 @​flavorjones

  Notable changes in this version include:

  • ALTER TABLE now raises an error when adding, renaming, or dropping a column named ROWID, _ROWID_, or OID.
  • The authorizer callback is now invoked for SQL functions in the DEFAULT clauses of CREATE TABLE statements.
  • SQLite no longer supports Windows XP or earlier. On Windows, the precompiled gem and any installation that compiles the vendored sqlite now require Windows Vista or later.

Added

• ResultSet#each and #each_hash return an Enumerator when called without a block. Previously they raised LocalJumpError. #656 @​kch
• Introduce Database#serialize, which returns a database as a binary string, and Database#deserialize, which replaces a database with the contents of such a string. These wrap sqlite3_serialize() and sqlite3_deserialize(). Both methods are defined only when SQLite was compiled without SQLITE_OMIT_DESERIALIZE, and Database#deserialize also requires that the loaded SQLite is v3.54.0 or later. An image of a database in WAL mode cannot be queried after deserializing; see the Database#deserialize documentation. #685 @​Maaarcocr

Fixed

• Fix Database#statement_timeout= interrupting statements almost immediately instead of after the timeout elapsed, including re-executed prepared statements and calls to Database#execute_batch2. #737 @​palkan @​flavorjones

Improved

• On CRuby, Statement#types allocates fewer strings. Each declared type is downcased and interned in C, instead of allocating two strings per column. #743 @​jhawthorn

Changed

• ResultSet#each and #each_hash return the result set when called with a block. As a consequence, Database#execute and #execute2 called with a block return the closed ResultSet instead of nil. #656 @​kch
• Statement#columns and Statement#types return frozen arrays, and the strings in Statement#types are frozen. Code that mutates them now raises FrozenError. #743 @​jhawthorn
• Statement#column_decltype and Statement#types return UTF-8 strings. Previously they returned ASCII-8BIT strings. #743 @​jhawthorn

Commits

• 07186c3 version bump to v2.10.0
• 7ad6fc0 feat: Add Database#serialize and Database#deserialize methods (#685)
• c35ae35 Fix statement_timeout interrupting most queries (#737)
• ac1b9d9 Avoid string allocation of types on statement (and freeze arrays) (#743)
• 6067955 Allow calling each, each_hash without block (#656)
• f231517 build(deps): bump the actions group with 3 updates (#748)
• 64aa362 build(deps-dev): update standard requirement from 1.56.0 to 1.57.0 (#747)
• 197861a dep: update vendored sqlite to 3.54.0 (#750)
• b79f314 build(deps-dev): update rdoc requirement from 8.0.0 to 8.1.0 (#745)
• b265a20 build(deps): bump the actions group with 2 updates (#746)
• Additional commits viewable in compare view

Updates listen from 3.10.0 to 3.10.1

Release notes

Sourced from listen's releases.

v3.10.1

What's Changed

• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#597
• CI: Run all tests on Windows in addition by @​larskanis in guard/listen#585
• Preserve independent listener filters across updates by @​OskarEichler in guard/listen#599
• Revert "Fix flaky specs on TruffleRuby" by @​rymai in guard/listen#603
• Remove outdated note about performance by @​quadule in guard/listen#586
• Avoid selecting the filesystem adapter twice by @​OskarEichler in guard/listen#600
• Fix flaky specs on TruffleRuby by @​andrykonchin in guard/listen#605
• [LOW] Bound directory scanning under filesystem churn by @​OskarEichler in guard/listen#601
• [LOW] Pin workflow actions and token permissions by @​OskarEichler in guard/listen#602

New Contributors

• @​andrykonchin made their first contribution in guard/listen#597
• @​OskarEichler made their first contribution in guard/listen#599
• @​quadule made their first contribution in guard/listen#586

Full Changelog: guard/listen@v3.10.0...v3.10.1

Commits

• 6fbde9f Bump VERSION to 3.10.1
• d53f6d9 Merge pull request #602 from OskarEichler/codex/security-pin-workflow-actions
• d6bb203 Merge pull request #601 from OskarEichler/codex/security-bound-directory-scans
• fa07357 Merge pull request #605 from andrykonchin/ak/fix-flaky-specs-on-truffleruby
• b8360fd Refactor and simplify adapter/polling_spec.rb test because now stopping is sy...
• e2173ed Prevent spawning background threads in the Linux adapter unit tests
• a63463f Stop threads synchronously
• c5413b7 Merge pull request #600 from OskarEichler/audit/select-adapter-once
• 751b3f8 Merge pull request #586 from quadule/patch-1
• 309cf5f Merge pull request #603 from guard/revert-597-ak/fix-flaky-specs-on-truffleruby
• Additional commits viewable in compare view

Updates simplecov from 1.3.0 to 1.3.2

Release notes

Sourced from simplecov's releases.

v1.3.2

Bugfixes

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See simplecov-ruby/simplecov#1308.

v1.3.1

Bugfixes

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See simplecov-ruby/simplecov#1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See simplecov-ruby/simplecov#1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

Changelog

Sourced from simplecov's changelog.

1.3.2 (2026-09-30)

Bugfixes

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See simplecov-ruby/simplecov#1308.

1.3.1 (2026-09-24)

Bugfixes

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See simplecov-ruby/simplecov#1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See simplecov-ruby/simplecov#1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

Commits

• 52a8754 Bump version to 1.3.2
• 4fb4ae1 Format a result collected before exit on Rails 8.1.4
• 1476741 bundle update
• 343a933 Stop leaking a flush thread in the forked-child production specs
• e64fcaa Bump ruby/setup-ruby from 1.323.0 to 1.325.0
• cb8bd83 Bump oxlint from 1.83.0 to 1.85.0 in /html_frontend
• 4ee7894 Bump version to 1.3.1
• 486e55e bundle update
• d2a62a8 Resolve paths and wait on runners correctly on JRuby on Windows
• 3a2e08e Load Prism only when the static extractor runs
• Additional commits viewable in compare view

Updates tzinfo-data from 1.2026.4 to 1.2026.5

Release notes

Sourced from tzinfo-data's releases.

v1.2026.5

Based on version 2026e of the IANA Time Zone Database (https://lists.iana.org/hyperkitty/list/[email protected]/message/VXIA4AU73OQL3OZ3ZBZHWIASIIVBGUJV/).

Commits

• 8df8bad Update to tzdata version 2026e.
• See full diff in compare view

Updates cancancan from 3.6.1 to 3.7.0

Release notes

Sourced from cancancan's releases.

3.7.0

The one below is a list of all the PRs merged. For a more detailed update, read the blog post about this release.

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. (@​coorasse)
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). (@​coorasse)
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. (@​coorasse)
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. (@​coorasse)
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. (@​coorasse)
• #927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. (@​coorasse)
• #913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. (@​bruno-costanzo)
• #905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. (@​bruno-costanzo)
• #848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. (@​coorasse)
• #861, #846, #690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. (@​coorasse)
• #911: Load the resource when the id is only whitespace: a request like /books/%20 ran the action with a nil resource, authorized only against the class, instead of raising ActiveRecord::RecordNotFound. (@​bruno-costanzo)
• #833: Match nil in an array of enum values in can?, as accessible_by already did: can :read, Post, status: [nil, :published] now allows a post without a status. (@​jtagle2, @​coorasse)
• #910: Accept a subclass of CanCan::ModelAdapters::Strategies::Base as accessible_by_strategy, so the SQL generated by accessible_by can be customized with your own strategy. (@​cb341, @​coorasse)
• #909: Make can? and accessible_by consistent for cannot rules and single table inheritance: a cannot rule on a subclass keeps its precedence in accessible_by, records with NULL in a column of a cannot condition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING: accessible_by returns more records when a cannot rule has conditions on a nullable column, and can? on an STI base class no longer fails because a subclass is forbidden. (@​coorasse, @​0llirocks, @​kevinluo201)
• #880: Fix accessible_by with rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. (@​takayamaki, @​sjoulbak)
• #890: Support an Active Record relation as the value of a condition in can?: the selected column, or the primary key, is checked with a query, as accessible_by already did. (@​olistik)
• #908: Join consecutive can rules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. (@​coorasse)
• #907: Make with_accessible_by_strategy thread safe: the strategy chosen in the block no longer leaks into concurrent requests. (@​NikosVlagoidis, @​coorasse)
• #906: Keep the conditions of an association when a rule is a scope: group.posts.accessible_by(ability) returned the posts of every group matched by the scope. WARNING: accessible_by called on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped by merge are applied again, so a condition on a subquery like where(category: Category.where(...)) is not turned into IS NULL, and the conditions of a default scope removed by unscope in the rule stay removed. (@​coorasse)
• #694: Document that cannot supports the :all subject. (@​jaredbeck)
• #852: Add changelog_uri to the gemspec, so rubygems.org links to the changelog. (@​mark-young-atg)
• #842: Add disallowed_attributes to retrieve the attributes forbidden by cannot rules. (@​mswiszcz)
• #904: Assign the parent of a singleton resource through the inverse of the association when the resource has no setter named after the through option. (@​coorasse)
• #878: Support through_association together with singleton when loading a resource. (@​cgunther)
• #786: Fix the table aliases generated by accessible_by when the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. (@​daveallie)
• #902: Do not change the rules of the ability in accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. (@​bruno-costanzo)
• #901: Keep the scope of a has_many :through association in accessible_by: the association was rewritten into its through and source associations and its scope was dropped, so accessible_by returned records that can? denies. WARNING: accessible_by returns fewer records for a rule on a has_many :through association with a scope. (@​bruno-costanzo)
• Remove the VitePress documentation website: the documentation lives in the docs folder as plain Markdown. (@​coorasse)

3.6.2

• #898: Do not share cancan_skipper between controller subclasses: skip_authorize_resource and skip_load_resource in a subclass no longer apply to the superclass or sibling controllers. (@​bruno-costanzo)
• #894: Use lease_connection instead of the deprecated connection on Rails 7.2+. (@​benaitcheson)

Changelog

Sourced from cancancan's changelog.

3.7.0

• Merge the ControllerResourceLoader, ControllerResourceBuilder, ControllerResourceFinder, ControllerResourceNameFinder and ControllerResourceSanitizer modules into CanCan::ControllerResource, and call the params method of the controller only once per request: it was called once more for every attribute set by the conditions of the ability. WARNING: the five modules no longer exist; override their methods in a subclass of CanCan::ControllerResource instead. ([@​coorasse][])
• Expand the actions again after alias_action, clear_aliased_actions and merge: can? kept using the aliases expanded by a previous check, so clear_aliased_actions did not remove can :read from can?(:index, Model). ([@​coorasse][])
• Raise an error when an action is aliased to :manage, which granted every action, or to itself, which looped forever. ([@​coorasse][])
• Do not include the primary key in permitted_attributes for a rule without attributes, remove every attribute with a cannot rule without attributes, including those that are not columns, and accept a hash subject instead of raising a TypeError. WARNING: permitted_attributes no longer returns :id, and with a composite primary key none of its columns are returned. ([@​coorasse][])
• Convert a String resource name to a symbol in load_and_authorize_resource and the skip_* methods: load_and_authorize_resource 'article' treated the resource as a parent and authorized :show on the class instead of the action on the record. ([@​coorasse][])
• #927: Look up the unauthorized message of a String action through its aliases: authorize!('index', post) did not use the message defined for read. ([@​coorasse][])
• #913: Match a symbol in a condition with the string that has the same name in can?, as accessible_by already did: cannot :read, Post, state: :draft on a string column no longer allows can?(:read, draft). WARNING: a can rule with a symbol now also allows records whose string attribute has the same name. ([@​bruno-costanzo][])
• #905: Match String actions like Symbol actions: can?('destroy', user) ignored cannot :destroy, User when can :manage was defined, and skip_authorize_resource except: 'destroy' also skipped the authorization of destroy. WARNING: a String action now goes through the aliases like a Symbol action, so can?('show', order) and authorize!(action_name, order) are allowed by can :read, Order and may grant access that 3.6 denied. A rule defined with a String action now matches the same Symbol action, permissions returns symbols, and a block rule without a subject receives the action as a symbol. ([@​bruno-costanzo][])
• #848: Do not deny can?(:index, parent => Model) because of a cannot rule with conditions on the model, as can?(:index, Model) already did: load_and_authorize_resource failed on the index of a nested resource. ([@​coorasse][])
• #861, #846, #690: Give the conditions of accessible_by the table aliases that Active Record gives to the joined associations, and build them with the model of each table. A rule with a has_many :through association, or with an association without conditions, used the alias of another table: the query failed or returned the wrong records. On an aliased table, a model was not converted to its foreign key and the values were not cast with the attribute types of the model. ([@​coorasse][])
• #911: Load the resource when the id is only whitespace: a request like /books/%20 ran the action with a nil resource, authorized only against the class, instead of raising ActiveRecord::RecordNotFound. ([@​bruno-costanzo][])
• #833: Match nil in an array of enum values in can?, as accessible_by already did: can :read, Post, status: [nil, :published] now allows a post without a status. ([@​jtagle2][], [@​coorasse][])
• #910: Accept a subclass of CanCan::ModelAdapters::Strategies::Base as accessible_by_strategy, so the SQL generated by accessible_by can be customized with your own strategy. ([@​cb341][], [@​coorasse][])
• #909: Make can? and accessible_by consistent for cannot rules and single table inheritance: a cannot rule on a subclass keeps its precedence in accessible_by, records with NULL in a column of a cannot condition are no longer excluded, rules on subclasses of subclasses reach the base class, and a class check passes when the class or any of its subclasses is allowed. WARNING: accessible_by returns more records when a cannot rule has conditions on a nullable column, and can? on an STI base class no longer fails because a subclass is forbidden. ([@​coorasse][], [@​0llirocks][], [@​kevinluo201][])
• #880: Fix accessible_by with rules on STI subclasses: a rule on a subclass without conditions no longer discards the rules defined before it, and rules with the same conditions on different subjects are no longer compressed into one. ([@​takayamaki][], [@​sjoulbak][])
• #890: Support an Active Record relation as the value of a condition in can?: the selected column, or the primary key, is checked with a query, as accessible_by already did. ([@​olistik][])
• #908: Join consecutive can rules in a flat chain of ORs in the SQL conditions, so that many rules on the same model no longer overflow the parser of SQLite. ([@​coorasse][])
• #907: Make with_accessible_by_strategy thread safe: the strategy chosen in the block no longer leaks into concurrent requests. ([@​NikosVlagoidis][], [@​coorasse][])
• #906: Keep the conditions of an association when a rule is a scope: group.posts.accessible_by(ability) returned the posts of every group matched by the scope. WARNING: accessible_by called on an association now returns fewer records when the scope of a rule constrains the same column as the association. Only the conditions dropped by merge are applied again, so a condition on a subquery like where(category: Category.where(...)) is not turned into IS NULL, and the conditions of a default scope removed by unscope in the rule stay removed. ([@​coorasse][])
• #694: Document that cannot supports the :all subject. ([@​jaredbeck][])
• #852: Add changelog_uri to the gemspec, so rubygems.org links to the changelog. ([@​mark-young-atg][])
• #842: Add disallowed_attributes to retrieve the attributes forbidden by cannot rules. ([@​mswiszcz][])
• #904: Assign the parent of a singleton resource through the inverse of the association when the resource has no setter named after the through option. ([@​coorasse][])
• #878: Support through_association together with singleton when loading a resource. ([@​cgunther][])
• #786: Fix the table aliases generated by accessible_by when the same association is joined more than twice: the WHERE clause referenced an alias that was never joined. ([@​daveallie][])
• #902: Do not change the rules of the ability in accessible_by: a rule shared by several models kept the conditions normalized for the first queried model. ([@​bruno-costanzo][])
• #901: Keep the scope of a has_many :through association in accessible_by: the association was rewritten into its through and source associations and its scope was dropped, so accessible_by returned records that can? denies. WARNING: accessible_by returns fewer records for a rule on a has_many :through association with a scope. ([@​bruno-costanzo][])
• Remove the VitePress documentation website: the documentation lives in the docs folder as plain Markdown. ([@​coorasse][])

3.6.2

• #898: Do not share cancan_skipper between controller subclasses: skip_authorize_resource and skip_load_resource in a subclass no longer apply to the superclass or sibling controllers. ([@​bruno-costanzo][])
• #894: Use lease_connection instead of the deprecated connection on Rails 7.2+. ([@​benaitcheson][])

Commits

• 95c5593 Bump version to 3.7.0
• b6d9ca5 Merge the controller resource modules into ControllerResource (#930)
• ad9cef9 Fix aliased actions, permitted_attributes and String resource names (#929)
• 5b5e80a Remove unreachable subject lookups
• c9bd98f Look up the unauthorized message of a String action through its aliases (#927)
• 1c8f07e Apply again only the base conditions dropped by merge when a rule is a scope ...
• 522760d Match symbols with strings in can? as accessible_by does (#913)
• 604fec2 Match String actions like Symbol actions (#905)
• efb6c56 Document that a can rule without attributes permits every attribute (#888)
• 4a894f0 Do not deny nested class checks because of a cannot with conditions on the ch...
• Additional commits viewable in compare view

Updates lograge from 0.15.0 to 0.15.1

Changelog

Sourced from lograge's changelog.

0.15.1

• Fully suppress Rails' default Action View logs on Rails 7.1+ by also removing ActionView::LogSubscriber::Start #386
• Declare logger as a runtime dependency in the gemspec, since it is no longer a default gem in newer Rubies #401

Commits

• 106e833 Release 0.15.1 (#406)
• f12d78c Release 0.15.1
• a66e9bf Unsubscribe all Rails built-in subscribers (#386)
• 82a899d Match Rails log subscribers explicitly instead of by namespace
• f3b0e21 Merge branch 'master' into unsubscribe_all_action_view_subscribers_in_rails_71
• d0b1df5 Merge pull request #401 from leoarnold/leoarnold/gemspec
• dd847eb Add 'logger' as dependency in gemspec
• d5b43c6 Merge pull request #405 from roidrage/ci/fix-json3-and-rubocop
• 4939216 ci: run RuboCop once instead of across the whole matrix
• f3b821d ci: fix pre-existing failures from json 3.x and RuboCop 1.91
• Additional commits viewable in compare view

Updates honeybadger from 6.9.2 to 6.9.3

Release notes

Sourced from honeybadger's releases.

v6.9.3

6.9.3 (2026-09-29)

Bug Fixes

• propagate the Rails request ID to notices and Insights events (#848) (23edb08)

Changelog

Sourced from honeybadger's changelog.

6.9.3 (2026-09-29)

Bug Fixes

• propagate the Rails request ID to notices and Insights events (