chore(deps): bump the ruby-deps group across 1 directory with 5 updates

[dependabot]

Bumps the ruby-deps group with 5 updates in the / directory:

Package	From	To
haml	7.3.0	7.4.1
haml_lint	0.77.0	0.78.0
rubocop-performance	1.26.1	1.27.0
rubocop-rails	2.36.0	2.37.0
webmock	3.26.2	3.26.3

Updates haml from 7.3.0 to 7.4.1

Release notes

Sourced from haml's releases.

v7.4.1

What's Changed

• Build the preserve regex once per tag list instead of per call by @​wilfison in haml/haml#1220

Full Changelog: haml/haml@v7.4.0...v7.4.1

v7.4.0

What's Changed

• Cut per-render overhead in AttributeBuilder by @​wilfison in haml/haml#1216
• Keep interpolated text in the source encoding by @​fukayatsu in haml/haml#1221
• Pick the html_safe escaper once at load instead of per value by @​wilfison in haml/haml#1217

Full Changelog: haml/haml@v7.3.1...v7.4.0

v7.3.1

What's Changed

• Keep Prism-derived fragments in the source encoding by @​fukayatsu in haml/haml#1219

New Contributors

• @​fukayatsu made their first contribution in haml/haml#1219

Full Changelog: haml/haml@v7.3.0...v7.3.1

Changelog

Sourced from haml's changelog.

7.4.1

• Build the preserve regex once per tag list instead of per call haml/haml#1220

7.4.0

• Haml::BOOLEAN_ATTRIBUTES is changed from Array to Set haml/haml#1216
• A guard on respond_to?(:html_safe?) is removed from Haml::Util.escape_html_safe haml/haml#1217
• Keep interpolated text in the source encoding, fixing the Encoding::CompatibilityError remaining on an ASCII-8BIT template source that mixes plain text and interpolation with non-ASCII characters haml/haml#1218

7.3.1

• Keep Prism-derived fragments in the source encoding, fixing Encoding::CompatibilityError on an ASCII-8BIT template source with non-ASCII characters (regression in 7.3.0) haml/haml#1218

Commits

• 7f51ae7 Version 7.4.1
• fce2365 Move find_and_preserve into Haml::Preserver
• 26c36cd Drop the tag list from the emitted find_and_preserve call
• 11796e2 Build the preserve regex once per tag list instead of per call
• 4b26909 Move find_and_preserve into Haml::Helpers
• 7da8851 Drop an empty tag from the preserve pattern
• 2e3e512 Match a newline with a String in preserve
• 9acd59c Require haml/helpers in the script compiler
• 5dc327f Version 7.4.0
• 78ddd14 Escape interpolated tag text through Haml::Escape (#1217)
• Additional commits viewable in compare view

Updates haml_lint from 0.77.0 to 0.78.0

Release notes

Sourced from haml_lint's releases.

0.78.0

What's Changed

• Add support for Haml 7.4 by @​wilfison in sds/haml-lint#693

New Contributors

• @​robbl-as made their first contribution in sds/haml-lint#694

Full Changelog: sds/haml-lint@v0.77.0...v0.78.0

Changelog

Sourced from haml_lint's changelog.

0.78.0

• Add support for Haml 7.4, which dropped the escape_html parameter from Haml::Util#unescape_interpolation and raised ArgumentError on any template containing interpolation

Commits

• f4e48f7 Cut 0.78.0 release (#695)
• a9d063d Add HAML 7.3 compatibility (#694)
• decd86c Add support for Haml 7.4 (#693)
• See full diff in compare view

Updates rubocop-performance from 1.26.1 to 1.27.0

Release notes

Sourced from rubocop-performance's releases.

RuboCop Performance v1.27.0

Bug fixes

• #532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. (@​koic)

Changes

• #530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. (@​koic)

Changelog

Sourced from rubocop-performance's changelog.

1.27.0 (2026-08-16)

Bug fixes

• #532: Fix false negatives for Performance/ChainArrayAllocation when using flat_map, filter_map, and collect_concat. ([@​koic][])

Changes

• #530: Speed up loading rubocop-performance by lazily loading only the cops needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])

Commits

• c07064d Cut 1.27.0
• 0e7abe8 Update Changelog
• 0d43a61 Suppress RuboCop offenses
• 72eb77d Merge pull request #533 from koic/fix_chain_array_allocation_false_negatives
• 9c60244 Merge pull request #528 from koic/fix_regexp_match_offense_message_for_bang_t...
• c3515cb [Fix #532] Fix false negatives for Performance/ChainArrayAllocation
• dba3d75 Merge pull request #530 from koic/lazy_load_cops
• dd5f992 Load cops lazily
• f1763dd [Fix #510] Clarify Performance/RegexpMatch message for !~
• 9c969a6 Fix JRuby CI failure caused by rbs native extension build
• Additional commits viewable in compare view

Updates rubocop-rails from 2.36.0 to 2.37.0

Release notes

Sourced from rubocop-rails's releases.

RuboCop Rails v2.37.0

Changes

• #1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. (@​kuboon)
• #1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. (@​moberegger)
• #1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. (@​koic)

Changelog

Sourced from rubocop-rails's changelog.

2.37.0 (2026-08-16)

Changes

• #1649: Allow frozen array/hash literal (e.g. [].freeze, {}.freeze) as :default value in Rails/AttributeDefaultBlockValue. ([@​kuboon][])
• #1652: Improve Rails/HttpPositionalArguments performance by checking for include Rack::Test::Methods once per file instead of once per HTTP call. ([@​moberegger][])
• #1650: Speed up loading rubocop-rails by lazily loading only the cops and mixins needed for a run. This requires RuboCop 1.89.0+. ([@​koic][])

Commits

• 2ccba59 Cut 2.37.0
• 597f352 Update Changelog
• a400494 Merge pull request #1652 from moberegger/moberegger/optimize-HttpPositionalAr...
• cbc6157 Optimize HttpPositionalArguments cop
• cb023b9 Suppress RuboCop offenses
• 166cfc6 Merge pull request #1650 from koic/lazy_load_cops
• 3dd6378 Load cops lazily
• 0b20dad Merge pull request #1649 from kuboon/copilot/attribute-default-block-value
• 7c76696 Allow frozen literal defaults in AttributeDefaultBlockValue
• 84fef55 Reset the docs version
• See full diff in compare view

Updates webmock from 3.26.2 to 3.26.3

Release notes

Sourced from webmock's releases.

3.26.3

• Confirm to work with curb 1.3.7

  Thanks to Josch Bockler

• Fix NameError in async-http adapter on protocol-http1 >= 0.40

  Thanks to Leslie Hoare

Changelog

Sourced from webmock's changelog.

3.26.3

• Confirm to work with curb 1.3.7

  Thanks to Josch Bockler

• Fix NameError in async-http adapter on protocol-http1 >= 0.40

  Thanks to Leslie Hoare

Commits

• ee409ac Version 3.26.3
• 2c976d5 Merge pull request #1127 from jbockler/curb-1.3
• 5b40155 Confirm to work with curb 1.3.7
• f685e7e Merge pull request #1130 from lesleh/fix-async-http-status-description
• a50557e Fix NameError in async-http adapter on protocol-http1 >= 0.40
• See full diff in compare view

[mroderick]

Dependency Upgrade Review: ruby-deps group (5 packages)

PR Scope

Dependency-only — only Gemfile.lock changed.

Changes per Package

Package	From	To	Risk
haml	7.3.0	7.4.1	Low
haml_lint	0.77.0	0.78.0	Low
rubocop-performance	1.26.1	1.27.0	Low
rubocop-rails	2.36.0	2.37.0	Low
webmock	3.26.2	3.26.3	Low

Changes in Dependencies

haml 7.3.0 → 7.4.1: Performance and internal refactoring only. BOOLEAN_ATTRIBUTES changed from Array to Set, html_safe? guard dropped from Haml::Util.escape_html_safe, and per-render overhead reduced. No breaking API changes for consumers.

haml_lint 0.77.0 → 0.78.0: Compatibility fix for haml 7.4 — it dropped an escape_html parameter from Haml::Util#unescape_interpolation.

rubocop-performance 1.26.1 → 1.27.0: Bug fix for Performance/ChainArrayAllocation false negatives and lazy cop loading for faster startup. Requires RuboCop >= 1.89.0.

rubocop-rails 2.36.0 → 2.37.0: Performance improvement in HttpPositionalArguments, allow frozen literals in AttributeDefaultBlockValue, and lazy cop loading. Requires RuboCop >= 1.89.0.

webmock 3.26.2 → 3.26.3: Compatibility with curb 1.3.7 and fix for NameError in async-http adapter. No API changes.

Usage in Repository

• haml: View engine for all 179 .haml views. No custom haml internals used (the commented-out Haml::Filters monkey patch in config/initializers/haml_markdown.rb is fully disabled).
• haml_lint: Dev-only linting; not run in CI but configured for local use.
• rubocop-performance / rubocop-rails: RuboCop plugins. Current rubocop is already at 1.89.0, satisfying the new minimum requirement.
• webmock: Test mocking in spec/spec_helper.rb (WebMock.disable_net_connect!, stub_request) and one spec file (WebMock.reset!).

Compatibility Assessment

Compatible — All changes are internal optimizations, bug fixes, or compatibility patches. None of the used APIs are affected.

Test Coverage

High — All 6 test groups, RuboCop, security audit, and coverage reports pass on CI. The upgrade touched no application code, only lockfile versions.

Confidence Rating

High — CI is green across all 8 checks, including the full test suite, RuboCop, and security audit.

[mroderick]

Approved. See analysis comment above.

[mroderick]

@dependabot rebase