[ndbroadbent]

Brings the gems, the docs and tooling packages and CI's Rails versions up to date, and clears the audits. It replaces Dependabot's #37, #41, #52, #53, #54 and #55.

Most of the 222 changed files are generated: RBIs, log structs and lockfiles. The hand-written changes come to 56 files, +174/-139, and the commits keep them apart from the generated ones, so reading it commit by commit is easiest.

What changes for people using the gem

• sorbet-runtime 0.6.12698 or later is now required (it was >= 0.5). LogStruct::SemanticLogger::Logger's signature uses T::Module, which first appears in that version.
• Custom log structs need override: true on their level, timestamp and additional_data props, with the interfaces included above them. The changelog says so, and the docs example is updated.

Gemfile.lock only affects this repository's development and tests, so the gem's other dependencies don't change.

Sorbet 0.6

Sorbet moves from 0.5.11888 to 0.6.13635, and Tapioca from 0.16 to 0.20.

• Sorbet now reports error 5051 when a T::Struct prop implements an abstract method without override: true. The change is in the generator's template, tools/codegen/templates/sorbet/_event_class_body.rb.erb, and the structs in lib/log_struct/log/ are regenerated. A prop marked override needs the method to exist already, so the interface includes move above the props.
• Tapioca 0.20 no longer loads minitest/mock unless it's required, so sorbet/tapioca/require.rb requires it.
• Zeitwerk is no longer excluded from Tapioca, and BroadcastLogger#tagged is declared in the overrides because it's delegated through method_missing.

Advisories

• crass 1.0.8 patches GHSA-pq4g-8rxf-4g29.
• Jest 30 still asks for glob 10 and its minimatch, which have open advisories, so pnpm overrides move both to patched versions, in package.json and docs/pnpm-workspace.yaml.
• deepmerge (GHSA-gcqx-w48m-w2h4) has no patched version. Only jest-config uses it, in development, on Jest's own config, so docs/pnpm-workspace.yaml tells the audit to ignore it. Its Dependabot alert stays open until a patch exists or someone dismisses it.

RuboCop

RuboCop moves from 1.71 to 1.91 and rubocop-sorbet from 0.8 to 0.17, and the config moves to plugins:. Most of the lib/ and test/ diff is autocorrection: redundant T.lets on constants, grep(Regexp), a void signature on MultiErrorReporter.reporter=, and blank lines after includes.

Four suppressions are worth a look:

• Sorbet/BlockMethodDefinition is excluded for test/**. Tests build doubles with Class.new, which need real method definitions: define_method can't use implicit super, and the cop's autocorrect doesn't produce code that parses for all of them.
• The same cop is disabled on Ahoy's prepended track method, which calls implicit super.
• Sorbet/ConstantsFromStrings is disabled in the GoodJob integration. GoodJob::Notifier::CONNECTION_ERRORS holds class names, because an app might not have loaded the database adapter they belong to.
• Lint/InterpolationCheck is disabled in the boot logs integration test. That string is a script for rails runner, which does the interpolation.

jscpd

jscpd 4.3.0 detects a file's format from its shebang, so it now scans Bundler's binstubs in bin/, which are alike by design. It also doesn't read docs/.gitignore, so it scans YARD's output under docs/public/yard locally. .jscpd.json now lists both.

The check only ran in GitHub's Lint job, so task ci runs it too now.

Rails matrix

CI now tests Rails 7.1.6, 7.2.4, 8.0.5.2 and 8.1.4.1. Two of those have four-part versions, so the docs test that reads the matrix accepts them.

Left out

These major versions aren't included: sentry-ruby 7 (#39), honeybadger 6 (#40), simplecov 1 (#38), TypeScript 6 (#33, which also needs a baseUrl migration), lucide-react 1 (#47), jscpd 5 (#31), sidekiq 8, minitest 6, dalli 5 and json 3.

bigdecimal 4 and openssl 4 did come in with the bundle update, as development dependencies only.

Testing

task ci passes locally on Ruby 3.4.5, on these commits: Sorbet, Tapioca's check, RuboCop, jscpd, CSpell, Prettier, both audits, Jest (184 tests), 530 unit tests and 78 Rails integration tests on Rails 7.1.6. The other Ruby and Rails combinations run on this PR's CI.