my_api_client 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f8d67936b7bbacf5cfe58e3c642d532be762848659f1839a920ea40795414931
-  data.tar.gz: c290910ca41637527fac5461a280d6ce3a22ba680fccb67f5eff4593a0cbea96
+  metadata.gz: 8c810e4644f4b3276f9be5b136b196040081204ffd2c1a4590d35f75f7267f37
+  data.tar.gz: a20a2ad006d18a8211ab056d760d9454f6883dcd6e4f88fcdcda38f6f9bb524b
 SHA512:
-  metadata.gz: dea3cf5c8b42477b130ea300427be44275c2e040ad167c0ff5052e77c5d8c41fd819d1352c15b7ce2051fe652114fb007e663e580ce08958f1c1a27400e4cdcb
-  data.tar.gz: 39d3f36f90c2e3f8c0099e9aa117e76430c9b72a20780edf0ebb21317e435b2f92abb16bbf6abe4b3eb147f6fe333d2e35fa4ad7de919def333993118597b202
+  metadata.gz: 3c6a1873fb33961931afccaee071ad8c2f734c1bcf3d29937274eae92cac18727a881edb00cd02890a6e7d566d1e8168b12a5cf8c5b124ef61aff27a960e9a50
+  data.tar.gz: c78a1a59b9f50c89b4489a23fd6fb501727f4e412b184acf5ae9f8be6fe7d1a93a621f1620bc67a25b20193c7a9f766b9d0fdc9642b0e488d45c3a1eeca6b81a

data/.github/dependabot.yml

@@ -1,4 +1,7 @@
 version: 2
+# cooldown: defer version bumps until a release has aged, reducing the risk of
+# adopting a compromised or broken version right after publication. Longer for
+# higher-impact bumps (major > minor > patch).
 updates:
 - package-ecosystem: bundler
   directory: "/"
@@ -6,6 +9,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -21,6 +29,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -32,6 +45,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -43,6 +61,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -54,6 +77,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -65,6 +93,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -76,6 +109,11 @@ updates:
     interval: weekly
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -88,6 +126,11 @@ updates:
     day: monday
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310
@@ -100,6 +143,11 @@ updates:
     day: monday
     time: "08:00"
     timezone: Asia/Tokyo
+  cooldown:
+    default-days: 7
+    semver-major-days: 14
+    semver-minor-days: 7
+    semver-patch-days: 3
   open-pull-requests-limit: 10
   assignees:
   - ryz310

data/.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby_version: ['3.2', '3.3', '3.4', '4.0']
+        ruby_version: ['3.3', '3.4', '4.0']
         rails_version: ['7.2', '8.0', '8.1']
         bundler_option:
           - name: with_integrations
@@ -28,10 +28,12 @@ jobs:
             with: ""
             without: integrations
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby ${{ matrix.ruby_version }}
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby_version }}
           bundler-cache: false
@@ -92,16 +94,18 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        ruby_version: ['3.2', '3.3', '3.4', '4.0']
+        ruby_version: ['3.3', '3.4', '4.0']
         rails_version: ['7.2', '8.0', '8.1']
     defaults:
       run:
         working-directory: rails_app/rails_${{ matrix.rails_version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby ${{ matrix.ruby_version }}
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby_version }}
           bundler-cache: false
@@ -141,7 +145,9 @@ jobs:
     name: integration_api_via_docker_compose
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Build and start my_api
         run: docker compose up -d --build my_api
@@ -184,7 +190,9 @@ jobs:
     name: my_api_request_specs_via_docker_compose
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Build and start my_api
         run: docker compose up -d --build my_api
@@ -220,10 +228,12 @@ jobs:
   rubocop:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '4.0'
           bundler-cache: false
@@ -240,10 +250,12 @@ jobs:
   yardoc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '4.0'
           bundler-cache: false
@@ -279,10 +291,12 @@ jobs:
     env:
       QLTY_COVERAGE_TOKEN: ${{ secrets.QLTY_COVERAGE_TOKEN }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '4.0'
           bundler-cache: false
@@ -323,7 +337,7 @@ jobs:
 
       - name: Upload coverage to Qlty
         if: ${{ env.QLTY_COVERAGE_TOKEN != '' && hashFiles('coverage/coverage.json') != '' }}
-        uses: qltysh/qlty-action/coverage@v2
+        uses: qltysh/qlty-action/coverage@08a0a862c159eae9b9003081da6663d96efef637 # v2.3.0
         with:
           token: ${{ env.QLTY_COVERAGE_TOKEN }}
           files: coverage/coverage.json

data/.github/workflows/dependabot-auto-merge.yml

@@ -1,43 +1,95 @@
 name: Dependabot Auto Merge
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
       - synchronize
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   enable-automerge-bundler:
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Enable auto-merge for bundler patch/minor updates (rails_app or direct development)
-        if: ${{ steps.metadata.outputs.package-ecosystem == 'bundler' && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor') && (contains(github.event.pull_request.head.ref, '/rails_app/') || steps.metadata.outputs.dependency-type == 'direct:development') }}
+      - name: Validate bundler update safety
+        id: guard
+        if: ${{ steps.metadata.outputs.package-ecosystem == 'bundler' }}
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          UPDATE_TYPE: ${{ steps.metadata.outputs.update-type }}
+          DEPENDENCY_TYPE: ${{ steps.metadata.outputs.dependency-type }}
+          DEPENDENCY_NAME: ${{ steps.metadata.outputs.dependency-name }}
+          DEPENDENCY_NAMES: ${{ steps.metadata.outputs.dependency-names }}
+        run: |
+          set -euo pipefail
+
+          safe=false
+
+          deps="$DEPENDENCY_NAMES"
+          if [[ -z "$deps" ]]; then
+            deps="$DEPENDENCY_NAME"
+          fi
+
+          rails_involved=false
+          while IFS= read -r dep; do
+            dep="$(echo "$dep" | xargs)"
+            [[ -z "$dep" ]] && continue
+            if [[ "$dep" == "rails" ]]; then
+              rails_involved=true
+            fi
+          done < <(echo "$deps" | tr ',' '\n')
+
+          if [[ "$HEAD_REF" == *"/rails_app/"* ]]; then
+            # Verification Rails apps: always auto-merge, except a major bump of the rails gem itself.
+            if [[ "$UPDATE_TYPE" == "version-update:semver-major" && "$rails_involved" == "true" ]]; then
+              echo "Skip auto-merge: major update of the rails gem in a rails_app verification app."
+              safe=false
+            else
+              safe=true
+            fi
+          elif [[ "$HEAD_REF" == *"/my_api/"* ]]; then
+            # Verification API app: always auto-merge regardless of update type.
+            safe=true
+          elif [[ ("$UPDATE_TYPE" == "version-update:semver-patch" || "$UPDATE_TYPE" == "version-update:semver-minor") && "$DEPENDENCY_TYPE" == "direct:development" ]]; then
+            # The gem itself (root Gemfile): only direct development patch/minor updates.
+            safe=true
+          else
+            echo "Skip auto-merge: gem update does not match auto-merge policy ($UPDATE_TYPE, $DEPENDENCY_TYPE)."
+          fi
+
+          echo "safe=$safe" >> "$GITHUB_OUTPUT"
+
+      - name: Enable auto-merge for safe bundler updates
+        if: ${{ steps.metadata.outputs.package-ecosystem == 'bundler' && steps.guard.outputs.safe == 'true' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: gh pr merge --repo "$GITHUB_REPOSITORY" --auto --merge "$PR_NUMBER"
 
   enable-automerge-github-actions:
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
 
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@v3
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

data/.github/workflows/release.yml

@@ -18,13 +18,15 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      # rubygems/release-gem runs `rake release`, which pushes the git tag,
+      # so the checkout credentials must persist for this release job.
+      - uses: actions/checkout@v7 # zizmor: ignore[artipacked]
         with:
           fetch-depth: 0
           ref: ${{ github.ref_name }}
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '4.0'
           bundler-cache: true

data/.github/workflows/rubocop_challenge.yml

@@ -18,10 +18,12 @@ jobs:
     if: ${{ github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/master' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      # rubocop_challenger pushes a branch and opens a pull request,
+      # so the checkout credentials must persist for the git push.
+      - uses: actions/checkout@v7 # zizmor: ignore[artipacked]
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: '4.0'
 

data/.rubocop.yml

@@ -7,7 +7,7 @@ plugins:
 inherit_from: .rubocop_todo.yml
 
 AllCops:
-  TargetRubyVersion: 3.2
+  TargetRubyVersion: 3.3
   NewCops: enable
   Exclude:
     - rails_app/**/*

data/.ruby-version

@@ -1 +1 @@
-3.2.9
+3.3.12

data/AGENTS.md

@@ -5,18 +5,21 @@
 - Always create a new branch from `master`.
 - Before creating a branch, update local `master` with the latest commits from `origin`.
 - After updating local `master`, reload and re-read `AGENTS.md` before starting any new task.
-- Example flow:
+- Use a branch prefix that matches the agent tool in use:
+  - Codex: `codex/<new-branch-name>`
+  - Claude Code: `claude/<new-branch-name>`
+- Example flow (replace `<prefix>` with the prefix for your tool):
   1. `git checkout master`
   2. `git fetch origin`
   3. `git pull --ff-only origin master`
   4. Re-open `AGENTS.md` and confirm instructions
-  5. `git checkout -b codex/<new-branch-name>`
+  5. `git checkout -b <prefix>/<new-branch-name>`
 
 ## Development Version Policy
 
 - In development environments, always use the oldest versions among currently supported Ruby and Rails.
-- Current baseline: Ruby 3.2 and Rails 7.2.
-- Patch versions may be updated to the latest available releases within the selected baseline (e.g., Ruby 3.2.x and Rails 7.2.x).
+- Current baseline: Ruby 3.3 and Rails 7.2.
+- Patch versions may be updated to the latest available releases within the selected baseline (e.g., Ruby 3.3.x and Rails 7.2.x).
 - When updating support policy, also update `.ruby-version`, `Dockerfile` (`ARG RUBY_VERSION` and `BUNDLE_GEMFILE`), and development Dockerfiles under `rails_app/`.
 
 ## Support Matrix Update Procedure
@@ -32,15 +35,25 @@
 - Check other workflows under `.github/workflows/` for fixed Ruby versions and align them when support policy changes.
 - Update supported versions in:
   - `README.md`
+  - `AGENTS.md` (`Development Version Policy` baseline line)
 - Keep development baseline files aligned:
   - `.ruby-version`
   - `Dockerfile` (`ARG RUBY_VERSION`)
   - `rails_app/*/Dockerfile` (`ARG RUBY_VERSION`) for supported Rails verification apps
+  - `rails_app/*/.ruby-version` for supported Rails verification apps (Dependabot
+    reads the per-directory `.ruby-version` to resolve the path gem; a stale value
+    breaks `@dependabot rebase` with "can't resolve your Ruby dependency files")
+  - Before commit, list every `.ruby-version` in the repo and confirm each matches
+    the intended baseline:
+    `find . -name .ruby-version | xargs -I{} sh -c 'echo "{}: $(cat {})"'`
 - Keep verification assets aligned with supported Rails:
   - remove unsupported `gemfiles/rails_*.gemfile`
   - remove unsupported `rails_app/rails_*` directories
   - keep only supported Rails verification app directories
-- Validate before commit:
+- Validate before commit. A support matrix change affects config files
+  (e.g. `.rubocop.yml` `TargetRubyVersion`, gemspec constraints) that break
+  lint/specs even without any `.rb` change, so always run all three below
+  regardless of the general Validation Rule:
   - `docker run --rm -v "$PWD":/app -w /app my_api_client-dev bundle exec rspec`
   - `docker run --rm -v "$PWD":/app -w /app my_api_client-dev bundle exec rubocop`
   - `docker run --rm -v "$PWD":/app -w /app my_api_client-dev bundle exec rake build`
@@ -101,6 +114,7 @@
 ## Pull Request Description Rule
 
 - In PR descriptions, include a `Purpose of this change` section that explains why the change is needed, not only what changed.
+- Write PR titles and descriptions in English to keep them consistent across the repository.
 
 ## GitHub CLI Body Safety
 
@@ -109,12 +123,19 @@
   - Use plain text without backticks in inline `--body`.
   - Write the body to a temporary file and pass it via file-based options (or equivalent safe method) to prevent shell command substitution.
 
+## GitHub Actions Pinning Policy
+
+- Pin third-party actions to a full commit SHA with a version comment (e.g. `uses: ruby/setup-ruby@<sha> # v1.321.0`) to satisfy zizmor `unpinned-uses`.
+- GitHub-owned actions (`actions/*`, `github/*`, `rubygems/*`, `dependabot/*`) may stay ref-pinned; Dependabot (`github-actions`) keeps the pins and version comments updated.
+
 ## Runbook
 
 - Dependabot PR review and auto-merge operation steps are documented in `docs/runbooks/dependabot_pr_auto_merge.md`.
 
 ## CHANGELOG Organization Rule
 
+- Do NOT add `CHANGELOG.md` entries in individual feature/fix PRs.
+  Entries are compiled and added at gem release time, not per-PR.
 - Follow the format of past versions in `CHANGELOG.md`.
 - Use `-` for bullet list items (not `*`).
 - Categorize entries under these headings, keeping only the headings that have entries (omit empty ones):

data/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Change log
 
+## v2.1.0 (Aug 11, 2026)
+
+### Security
+
+- [#1335](https://github.com/ryz310/my_api_client/pull/1335) Pin third-party actions to commit SHA ([@ryz310](https://github.com/ryz310))
+- [#1337](https://github.com/ryz310/my_api_client/pull/1337) Scope Dependabot auto-merge permissions per job ([@ryz310](https://github.com/ryz310))
+- [#1338](https://github.com/ryz310/my_api_client/pull/1338) Use non-spoofable actor check for Dependabot auto-merge ([@ryz310](https://github.com/ryz310))
+- [#1339](https://github.com/ryz310/my_api_client/pull/1339) Use pull_request trigger for Dependabot auto-merge ([@ryz310](https://github.com/ryz310))
+- [#1340](https://github.com/ryz310/my_api_client/pull/1340) Disable credential persistence on checkout (zizmor artipacked) ([@ryz310](https://github.com/ryz310))
+
+### Dependabot
+
+- [#1237](https://github.com/ryz310/my_api_client/pull/1237) Bump dependabot/fetch-metadata from 2 to 3 ([@ryz310](https://github.com/ryz310))
+- [#1291](https://github.com/ryz310/my_api_client/pull/1291) Bump actions/checkout from 6 to 7 ([@ryz310](https://github.com/ryz310))
+- [#1317](https://github.com/ryz310/my_api_client/pull/1317) Bump simplecov from 0.22.0 to 1.0.3 ([@ryz310](https://github.com/ryz310))
+- [#1323](https://github.com/ryz310/my_api_client/pull/1323) Bump activesupport from 8.1.3 to 8.1.3.1 ([@ryz310](https://github.com/ryz310))
+- [#1329](https://github.com/ryz310/my_api_client/pull/1329) Bump json from 2.21.1 to 2.21.2 ([@ryz310](https://github.com/ryz310))
+
+### Misc
+
+- [#1330](https://github.com/ryz310/my_api_client/pull/1330) Add dependency cooldown to Gemfile and Dependabot ([@ryz310](https://github.com/ryz310))
+- [#1331](https://github.com/ryz310/my_api_client/pull/1331) Always auto-merge verification app Dependabot PRs (except rails major) ([@ryz310](https://github.com/ryz310))
+- [#1332](https://github.com/ryz310/my_api_client/pull/1332) Drop Ruby 3.2 support (EOL) ([@ryz310](https://github.com/ryz310))
+- [#1334](https://github.com/ryz310/my_api_client/pull/1334) Require English for PR titles and descriptions ([@ryz310](https://github.com/ryz310))
+- [#1336](https://github.com/ryz310/my_api_client/pull/1336) Use tool-specific branch prefix in branch creation rule ([@ryz310](https://github.com/ryz310))
+- [#1341](https://github.com/ryz310/my_api_client/pull/1341) Align rails_app .ruby-version with Ruby 3.3 baseline ([@ryz310](https://github.com/ryz310))
+
 ## v2.0.0 (Jul 21, 2026)
 
 This major release marks the shift to an AI-assisted (agent-driven) development workflow.

data/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG RUBY_VERSION=3.2.9
+ARG RUBY_VERSION=3.3.12
 FROM ruby:${RUBY_VERSION}-slim
 
 WORKDIR /app

data/Gemfile

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
-source 'https://rubygems.org'
+# cooldown: skip gem versions published within the last 7 days to reduce the
+# risk of pulling in a compromised or broken release right after publication.
+source 'https://rubygems.org', cooldown: 7
 
 git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    my_api_client (2.0.0)
+    my_api_client (2.1.0)
       activesupport (>= 7.2.0)
       faraday (>= 0.17.1)
       jsonpath
@@ -10,7 +10,7 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -39,7 +39,6 @@ GEM
       bigdecimal
       rexml
     diff-lcs (1.6.2)
-    docile (1.4.1)
     drb (2.2.3)
     faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
@@ -51,7 +50,7 @@ GEM
     i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     io-console (0.8.2)
-    json (2.21.1)
+    json (2.21.2)
     jsonpath (1.1.5)
       multi_json
     language_server-protocol (3.17.0.6)
@@ -133,12 +132,7 @@ GEM
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
     securerandom (0.4.1)
-    simplecov (0.22.0)
-      docile (~> 1.1)
-      simplecov-html (~> 0.11)
-      simplecov_json_formatter (~> 0.1)
-    simplecov-html (0.13.2)
-    simplecov_json_formatter (0.1.4)
+    simplecov (1.0.3)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (3.2.0)
@@ -167,7 +161,7 @@ DEPENDENCIES
   rubocop-rake
   rubocop-rspec
   rubocop-rspec_rails
-  simplecov (= 0.22.0)
+  simplecov (= 1.0.3)
   webmock
   yard
 

data/README.md

@@ -16,7 +16,7 @@ It is primarily designed for Ruby on Rails, but it also works in other environme
 
 ## Supported Versions
 
-- Ruby 3.2, 3.3, 3.4, 4.0
+- Ruby 3.3, 3.4, 4.0
 - Rails 7.2, 8.0, 8.1
 
 ## Installation

data/docs/runbooks/dependabot_pr_auto_merge.md

@@ -24,6 +24,15 @@ sed -n '1,260p' AGENTS.md
 ## Auto-merge workflow policy
 - Keep `package-ecosystem` decisions separated in `.github/workflows/dependabot-auto-merge.yml`.
 - Apply independent conditions for each ecosystem to avoid cross-ecosystem condition mixing.
+- For `bundler` ecosystem auto-merge:
+  - Verification apps (`rails_app/*` and `my_api`) are always auto-merged regardless of update type
+    (including major), because bundle update failures there do not affect the published gem and are
+    gated by CI/branch protection.
+  - Exception: a major update of the `rails` gem itself under `rails_app/*` is NOT auto-merged,
+    because a Rails major bump is treated as an explicit support-matrix decision that requires manual
+    review. Other gems' major updates under `rails_app/*` are still auto-merged.
+  - The gem itself (root `Gemfile`) is auto-merged only for `direct:development` dependencies on
+    non-major updates (patch/minor).
 - For `github-actions` ecosystem auto-merge, require all of the following:
   - GitHub official actions only (`actions/*` or `github/*`)
   - non-major updates only (patch/minor)

data/lib/my_api_client/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module MyApiClient
-  VERSION = '2.0.0'
+  VERSION = '2.1.0'
 end