rails-profiler 0.31.5 → 0.32.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87fc21dec17ab7627d4430f49b042e53061efb33034d7309ea07aac6eb83ac5d
-  data.tar.gz: 3e64027bb71fa5ce3d2a23a23cf1525f0e5a55c508c019f1398c35c705f20434
+  metadata.gz: 623e8531db783ddb27296b83dba2beae12f411e6b2c71630c3b14003b7e67f40
+  data.tar.gz: eebbf3cda8334b412ca1a4543cb81f7ef05e65c0f28672794fc9f0b7b57a250f
 SHA512:
-  metadata.gz: 596fda2dad5ffa7e2a7c98a2b749c03901df7748d26776203a30d88a86b842e5956d92453b3847a3cf856a7afee5c4511f02ce83070a6dd26d0ef4d1e6784b5b
-  data.tar.gz: b70a833918e15474ac410c182763f13e03e0352e39cd7a0ed066c68a47f2f86762e7ef01fcd5246bfe47d391d86c03556929f66dbb84f0098f0bc43c43e9b415
+  metadata.gz: 27241cbff0c9d09418f1d75a6757a55dba4b6474b822860f11e98b5149d2dda4b7fe7ad13a03e136bf9c1ca56dbd9fbdf4366dc394fa7127d3d9bba69cf23944
+  data.tar.gz: 25ad634237aecccf4a698f3ba7f221afbc53965a5b3a18845336c2ce8fef257f1d7fc8234b40545153fe0a9ba7b28fae92f52708994a50d4e81063d0a789116b

data/CHANGELOG.md

@@ -19,6 +19,55 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.32.0] - 2026-10-06
+
+<!-- stamped -->
+
+### Added
+
+- **MCP:** The HTTP endpoint at `/_profiler/mcp` accepts the `Host` headers of a reverse proxy
+  without a monkey-patch: besides the loopback names, it now accepts the hosts the application lists
+  in `config.hosts` (when that list is not empty), so an application behind Traefik usually has
+  nothing to set, and the entries of the new `config.mcp_allowed_hosts` (default `[]`): a host name
+  or `host:port`, or a `Regexp` anchored with `\A` and `\z`, matched against the whole host name,
+  for example `["api.myapp.test", %r{\Amyapp[a-z0-9-]*\z}]`. With mcp 1.x the
+  transport only accepted the loopback names and answered `Forbidden: Invalid Host header` behind
+  a proxy. The profiler now makes the check itself, before the transport, for every kind of entry,
+  and keeps the transport's `Origin` check (same origin or `cors_allowed_origins`), whatever
+  `api_forgery_protection` says; the transport's own check, which only knows exact names, is turned
+  off. A `Regexp` that is not anchored, or that cannot match a whole host name, and a String
+  holding `*` raise an `ArgumentError` when assigned. The defaults keep the previous behaviour.
+
+## [0.31.6] - 2026-10-05
+
+<!-- stamped -->
+
+### Fixed
+
+- **Storage:** With `config.compress_bodies` (on by default), a text body larger than
+  `config.compress_body_threshold` (10 KB) is now stored gzip+base64, as the README said: the
+  profile was decompressed again before every save, so the file, Redis and memory stores kept the
+  body as text, next to the compressed copy the request collector keeps, and the compression only
+  cost time. A 132 KB HTML page now takes 86 KB in those stores instead of 171 KB (273 KB without
+  compression); SQLite, which only keeps that copy, 44 KB instead of 36 KB at the faster level.
+  Compressing it costs 1.6 ms on the request instead of 4.1 ms (the fastest zlib level), saving
+  the profile 0.2 ms instead of 1.2 ms; the bodies are decompressed only when a profile is shown,
+  about 0.7 ms. The profile page, its API, the job, console and test APIs, the lists the cluster
+  proxy reads and the MCP tools still give the bodies as text; the toolbar, which shows no body,
+  gets them as stored (86 KB instead of 171 KB for that page).
+- **Storage:** The profile list summaries kept by the file, SQLite and Redis stores no longer
+  carry the first 500 characters of the request and response bodies. Summaries written by 0.31.4
+  and 0.31.5 keep them until their profiles are evicted; no list shows them.
+- **MCP:** The `curl` command of `get_profile_detail` carries the request body as it was sent: a
+  body larger than `compress_body_threshold` came out as its compressed base64 form, and a binary
+  body as base64 text. A binary body is now left out of the command.
+- **Upgrading:** the profiles already stored, all as text, are read as before, with no migration.
+  An earlier version reading a store written by this one shows the compressed bodies as text too,
+  and a cluster master and its slaves may run either version: the profile API they read still
+  gives the bodies as text. A body that cannot be decompressed is shown as it is stored, never as
+  an error. To keep the bodies readable as text in the stored files or Redis keys, set
+  `config.compress_bodies = false`.
+
 ## [0.31.5] - 2026-10-05
 
 <!-- stamped -->

data/app/controllers/profiler/api/console_controller.rb

@@ -14,7 +14,7 @@ module Profiler
           return render json: { error: "Console profile not found" }, status: :not_found
         end
 
-        render json: profile.to_h
+        render json: profile.to_h(decode_bodies: true)
       end
 
       def destroy

data/app/controllers/profiler/api/jobs_controller.rb

@@ -14,7 +14,7 @@ module Profiler
           return render json: { error: "Job profile not found" }, status: :not_found
         end
 
-        render json: profile.to_h.merge(
+        render json: profile.to_h(decode_bodies: true).merge(
           child_jobs: build_child_jobs(profile),
           parent_profile: build_parent_summary(profile)
         )

data/app/controllers/profiler/api/profiles_controller.rb

@@ -28,7 +28,7 @@ module Profiler
         # The route table and ENV are the process's, not stored in the profile
         Profiler::ProcessSnapshot.hydrate(profile)
 
-        render json: profile.to_h.merge(
+        render json: profile.to_h(decode_bodies: true).merge(
           child_jobs: build_child_jobs(profile),
           parent_profile: build_parent_summary(profile)
         )

data/app/controllers/profiler/api/tests_controller.rb

@@ -14,7 +14,7 @@ module Profiler
           return render json: { error: "Test profile not found" }, status: :not_found
         end
 
-        render json: profile.to_h
+        render json: profile.to_h(decode_bodies: true)
       end
 
       def destroy

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -19,6 +19,7 @@ module Profiler
         # The route table and ENV are the process's, not stored in the profile
         Profiler::ProcessSnapshot.hydrate(profile)
 
+        # The bodies as stored (gzip+base64 past compress_body_threshold): the toolbar shows none.
         render json: {
           profile: profile.to_h.merge(child_jobs: build_child_jobs(profile)),
           events_cursor: events_cursor

data/app/controllers/profiler/application_controller.rb

@@ -74,9 +74,10 @@ module Profiler
       render_page(Profiler.storage.list(limit: limit + 1, offset: offset, type: type, summary: summary), limit, offset)
     end
 
+    # The bodies as text: the cluster proxy lists whole profiles (all_types), a summary has none.
     def render_page(profiles, limit, offset)
       render json: {
-        profiles: profiles.first(limit).map(&:to_h),
+        profiles: profiles.first(limit).map { |profile| profile.to_h(decode_bodies: true) },
         limit:    limit,
         offset:   offset,
         has_more: profiles.size > limit

data/app/controllers/profiler/profiles_controller.rb

@@ -25,7 +25,7 @@ module Profiler
       # The route table and ENV are the process's, not stored in the profile
       Profiler::ProcessSnapshot.hydrate(@profile)
 
-      @profile_data = @profile.to_h.merge(
+      @profile_data = @profile.to_h(decode_bodies: true).merge(
         child_jobs: build_child_jobs(@profile),
         parent_profile: build_parent_summary(@profile)
       )

data/lib/profiler/configuration.rb

@@ -132,6 +132,7 @@ module Profiler
       @cluster_secret = nil
       @cluster_require_secret = true
       @cluster_allowed_slave_urls = []
+      @mcp_allowed_hosts = []
       @cluster_allow_insecure_http = false
       # Where the profiler's own errors go (Profiler.log): Rails.logger when nil, or $stderr when
       # there is none.
@@ -147,7 +148,16 @@ module Profiler
       @tmp_path = value.nil? ? nil : Pathname.new(value)
     end
 
-    attr_reader :cluster_allowed_slave_urls
+    attr_reader :cluster_allowed_slave_urls, :mcp_allowed_hosts
+
+    # Host names the MCP HTTP endpoint accepts beyond the loopback ones and config.hosts: a String
+    # (a host name, any port, or a host:port) or a Regexp anchored with \A and \z, matched
+    # against the host name without its port. A wildcard String is refused.
+    def mcp_allowed_hosts=(value)
+      require_relative "cluster/security"
+      Array(value).each { |entry| validate_mcp_allowed_host(entry) }
+      @mcp_allowed_hosts = Array(value)
+    end
 
     # Deprecated: the figure it was meant for was never a byte count (see AllocationCounter).
     # Read and written as allocated_objects_warning_threshold times the bytes per object the
@@ -300,5 +310,28 @@ module Profiler
         raise Error, "Unknown storage backend: #{@storage}"
       end
     end
+
+    def validate_mcp_allowed_host(entry)
+      case entry
+      when String
+        return unless entry.strip.empty? || entry.include?("*")
+
+        raise ArgumentError, "config.mcp_allowed_hosts: #{entry.inspect} is not a host name; list each host, " \
+                             "or use an anchored Regexp"
+      when Regexp then validate_mcp_allowed_host_pattern(entry)
+      else raise ArgumentError, "config.mcp_allowed_hosts: #{entry.inspect} must be a String or a Regexp"
+      end
+    end
+
+    def validate_mcp_allowed_host_pattern(pattern)
+      unless Profiler::Cluster::Security.anchored_pattern?(pattern)
+        raise ArgumentError, "config.mcp_allowed_hosts: #{pattern.inspect} must start with \\A and end with \\z, " \
+                             "so that it matches the whole host name"
+      end
+      Profiler::Cluster::Security.whole_url_pattern(pattern)
+    rescue RegexpError => e
+      raise ArgumentError, "config.mcp_allowed_hosts: #{pattern.inspect} cannot be matched against the whole " \
+                           "host name (#{e.message})"
+    end
   end
 end

data/lib/profiler/local_request.rb

@@ -85,6 +85,18 @@ module Profiler
         false
       end
 
+      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
+      # already refused every other host; a host it lists is one the developer trusts.
+      def permitted_by_rails_hosts?(host)
+        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
+
+        hosts = Rails.application.config.hosts
+        return false if hosts.nil? || hosts.empty?
+
+        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
+      end
+
       private
 
       def host_denial_reason(request)
@@ -143,17 +155,6 @@ module Profiler
         permitted_by_rails_hosts?(host)
       end
 
-      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
-      # already refused every other host; a host it lists is one the developer trusts.
-      def permitted_by_rails_hosts?(host)
-        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
-        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
-
-        hosts = Rails.application.config.hosts
-        return false if hosts.nil? || hosts.empty?
-
-        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
-      end
     end
   end
 end

data/lib/profiler/mcp/body_formatter.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
-require "base64"
-require "zlib"
+require_relative "../models/profile"
 
 module Profiler
   module MCP
@@ -19,13 +18,7 @@ module Profiler
         return "  *(binary, base64 encoded)*" if encoding == "base64"
         return nil if body.nil? || body.empty?
 
-        if encoding == "gzip+base64"
-          begin
-            body = Zlib::Inflate.inflate(Base64.strict_decode64(body))
-          rescue Zlib::Error, ArgumentError
-            # fall through with original body
-          end
-        end
+        body, = Models::Profile.decode_body(body, encoding)
 
         if params["save_bodies"]
           path = FileCache.save(token, name, body)

data/lib/profiler/mcp/http_guard.rb

@@ -2,6 +2,8 @@
 
 require "json"
 require "uri"
+require_relative "../cluster/security"
+require_relative "../local_request"
 
 module Profiler
   module MCP
@@ -25,20 +27,86 @@ module Profiler
           return deny("Profiler is disabled") unless config.enabled
 
           request = ActionDispatch::Request.new(env)
+          if (host_denial = host_denial(request, config))
+            return deny(host_denial)
+          end
           return deny("Not authorized to access the profiler") unless config.authorized?(request)
+          if (origin_denial = origin_denial(request, config))
+            return deny(origin_denial)
+          end
           return nil unless config.api_forgery_protection
 
           forgery_denial(request, config)
         end
 
+        # The DNS rebinding check of the MCP transport, done here so that one rule covers every
+        # host: the transport itself only knows exact names, and is created without its own check
+        # (see Profiler::MCP::Server#http_transport). A Host header is accepted when it names a
+        # loopback address, a host the application lists in config.hosts (when that list is not
+        # empty, Rails' HostAuthorization already refuses every other host), or an entry of
+        # config.mcp_allowed_hosts. A request without a Host header (HTTP/1.0) is let through, as
+        # the transport did: the rebinding vector always carries one.
+        def allowed_host?(raw_host, config = Profiler.configuration)
+          return true if raw_host.nil?
+
+          full = raw_host.to_s.strip.downcase
+          name = host_name(full)
+          return false if name.empty?
+          return true if LOOPBACK_HOSTS.include?(name)
+          return true if Array(config.mcp_allowed_hosts).any? { |entry| host_entry_allows?(entry, name, full) }
+
+          # Rails matches config.hosts against the whole Host header (an entry may carry a port);
+          # the bare name covers entries written without one.
+          Profiler::LocalRequest.permitted_by_rails_hosts?(full) ||
+            Profiler::LocalRequest.permitted_by_rails_hosts?(name)
+        end
+
         private
 
-        def forgery_denial(request, config)
-          origin = request.get_header("HTTP_ORIGIN")
-          if origin && !origin.empty? && !allowed_origin?(origin, request, config)
-            return deny("Cross-origin request refused: Origin #{origin} is not allowed")
+        LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+
+        def host_denial(request, config)
+          raw = request.get_header("HTTP_HOST")
+          return nil if allowed_host?(raw, config)
+
+          "Host #{raw} is not allowed for the MCP endpoint: list it in config.hosts or " \
+            "config.mcp_allowed_hosts"
+        end
+
+        # A String matches the host name (any port) or the whole host:port, case-insensitively; a
+        # Regexp must match the whole host name, without the port.
+        def host_entry_allows?(entry, name, full)
+          case entry
+          when Regexp
+            Profiler::Cluster::Security.anchored_pattern?(entry) &&
+              Profiler::Cluster::Security.whole_url_pattern(entry).match?(name)
+          when String
+            allowed = entry.strip.downcase
+            allowed == name || allowed == full
+          else
+            false
           end
+        rescue RegexpError
+          false
+        end
+
+        # "[::1]:3000" gives "::1", "app.local:3000" gives "app.local". Anything else (two hosts, a
+        # port that is not a number, text after the brackets) gives "", which is refused.
+        def host_name(host)
+          match = host.match(/\A\[([^\]]+)\](?::\d+)?\z/) || host.match(/\A([^:\s,]+)(?::\d+)?\z/)
+          match ? match[1] : ""
+        end
 
+        # The Origin check of the transport, kept whatever api_forgery_protection says: a
+        # browser's Origin must be the profiler's own or one of cors_allowed_origins.
+        def origin_denial(request, config)
+          origin = request.get_header("HTTP_ORIGIN")
+          return nil if origin.nil? || origin.empty? || allowed_origin?(origin, request, config)
+
+          "Cross-origin request refused: Origin #{origin} is not allowed"
+        end
+
+        def forgery_denial(request, _config)
           if request.post? && media_type(request) != JSON_MEDIA_TYPE
             return deny("A POST to the MCP endpoint needs Content-Type: #{JSON_MEDIA_TYPE}")
           end
@@ -53,13 +121,20 @@ module Profiler
         def allowed_origin?(origin, request, config)
           return true if Array(config.cors_allowed_origins).include?(origin)
 
-          same_origin?(origin, request.base_url)
+          same_origin?(origin, request)
         end
 
-        def same_origin?(origin, base_url)
-          a = URI.parse(origin)
-          b = URI.parse(base_url)
-          a.scheme.to_s.casecmp?(b.scheme.to_s) && a.host.to_s.casecmp?(b.host.to_s) && a.port == b.port
+        # The Origin's host and port against the Host header, as the transport compares them: the
+        # scheme is left out, since behind a proxy that ends TLS the request says http while the
+        # browser's Origin says https, and the default port of the Origin's scheme is dropped.
+        def same_origin?(origin, request)
+          uri = URI.parse(origin)
+          host = request.get_header("HTTP_HOST").to_s.downcase
+          return false if uri.host.nil? || host.empty?
+
+          authority = uri.port == uri.default_port ? uri.host.downcase : "#{uri.host.downcase}:#{uri.port}"
+          host = host.delete_suffix(":#{uri.default_port}")
+          authority == host
         rescue URI::InvalidURIError
           false
         end

data/lib/profiler/mcp/server.rb

@@ -46,12 +46,21 @@ module Profiler
 
       def http_transport
         @http_transport ||= begin
-          t = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server)
+          t = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server, **http_transport_options)
           @server.transport = t
           t
         end
       end
 
+      # HttpGuard checks the Host and Origin headers of every request before the transport sees
+      # it, with config.hosts, config.mcp_allowed_hosts and Regexp entries, which the transport's
+      # own check (exact names only) cannot express. Older mcp versions have no such check, nor
+      # the option.
+      def http_transport_options
+        params = ::MCP::Server::Transports::StreamableHTTPTransport.instance_method(:initialize).parameters
+        params.any? { |_type, name| name == :dns_rebinding_protection } ? { dns_rebinding_protection: false } : {}
+      end
+
       def start(transport: :stdio)
         case transport
         when :stdio

data/lib/profiler/mcp/tools/get_profile_detail.rb

@@ -2,6 +2,7 @@
 
 require_relative "../slave_support"
 require_relative "../../process_snapshot"
+require_relative "../../models/profile"
 
 require "shellwords"
 require "cgi"
@@ -666,7 +667,10 @@ module Profiler
         def self.generate_curl(profile, req_data)
           headers  = req_data&.dig("headers")  || {}
           params   = req_data&.dig("params")   || {}
-          req_body = req_data&.dig("request_body")
+          # As captured: a binary body cannot be typed on a command line.
+          req_body, req_encoding = Models::Profile.decode_body(req_data&.dig("request_body"),
+                                                               req_data&.dig("request_body_encoding"))
+          req_body = nil unless req_encoding.nil? || req_encoding == "text"
 
           parts = ["curl -X #{profile.method}"]
 

data/lib/profiler/models/profile.rb

@@ -117,9 +117,15 @@ module Profiler
       end
       private :collector_metadata
 
-      def to_h
-        req_body,  req_enc  = decode_body(@request_body,  @request_body_encoding)
-        resp_body, resp_enc = decode_body(@response_body, @response_body_encoding)
+      # The profile as the stores keep it: a body compressed by compress_bodies stays gzip+base64.
+      # decode_bodies: true gives the bodies as text, for the responses that show them.
+      def to_h(decode_bodies: false)
+        req_body,  req_enc  = @request_body,  @request_body_encoding
+        resp_body, resp_enc = @response_body, @response_body_encoding
+        if decode_bodies
+          req_body,  req_enc  = self.class.decode_body(req_body, req_enc)
+          resp_body, resp_enc = self.class.decode_body(resp_body, resp_enc)
+        end
 
         {
           profile_type: @profile_type,
@@ -155,6 +161,7 @@ module Profiler
         }
       end
 
+      # The stored form, as #to_h.
       def to_json(*args)
         to_h.to_json(*args)
       end
@@ -212,6 +219,18 @@ module Profiler
         profile
       end
 
+      # A body kept gzip+base64 as text, with its encoding then "text"; any other body as it is.
+      # One that cannot be decompressed (cut, damaged) is returned as it is: unreadable at worst.
+      def self.decode_body(body, encoding)
+        return [body, encoding] unless encoding == "gzip+base64"
+        return [body, encoding] if body.nil? || body.empty?
+
+        decoded = Zlib::Inflate.inflate(Base64.strict_decode64(body))
+        [decoded.force_encoding(Encoding::UTF_8).scrub, "text"]
+      rescue Zlib::Error, ArgumentError
+        [body, encoding]
+      end
+
       def self.deep_stringify_keys(obj)
         case obj
         when Hash
@@ -235,7 +254,8 @@ module Profiler
         else
           text = Redaction.filter_body(raw, content_type).encode("UTF-8", invalid: :replace, undef: :replace)
           if compress_body?(text)
-            { body: Base64.strict_encode64(Zlib::Deflate.deflate(text)), encoding: "gzip+base64" }
+            # The fastest level: paid on the request, a quarter larger than the default level.
+            { body: Base64.strict_encode64(Zlib::Deflate.deflate(text, Zlib::BEST_SPEED)), encoding: "gzip+base64" }
           else
             { body: text, encoding: "text" }
           end
@@ -253,16 +273,6 @@ module Profiler
           text.bytesize > Profiler.configuration.compress_body_threshold
       end
 
-      def decode_body(body, encoding)
-        return [body, encoding] unless encoding == "gzip+base64"
-        return [body, encoding] if body.nil? || body.empty?
-
-        decoded = Zlib::Inflate.inflate(Base64.strict_decode64(body))
-        [decoded, "text"]
-      rescue Zlib::Error, ArgumentError
-        [body, encoding]
-      end
-
       def binary_content_type?(ct)
         ct.to_s.match?(%r{image/(?!svg)|application/(?:pdf|octet-stream|zip)|audio/|video/})
       end

data/lib/profiler/storage/summary.rb

@@ -7,16 +7,19 @@ module Profiler
     # What the profile lists show of a profile, for the stores to keep apart from the profile
     # itself: the top-level fields without the bodies, params, headers and tabs, and for each
     # collector its scalar values only (database.total_queries, job.queue, test.test_name...),
-    # nested lists and hashes left out, strings cut at MAX_SCALAR_LENGTH (a console return value,
-    # an exception message). Built from Profile#to_h, after the collectors and the
-    # redaction have run: a summary is a subset of the stored profile (a long string cut to its
-    # start) and holds no value the profile does not.
+    # nested lists and hashes and the request collector's copy of the bodies left out, strings
+    # cut at MAX_SCALAR_LENGTH (a console return value, an exception message). Built from
+    # Profile#to_h, after the collectors and the redaction have run: a summary is a subset of the
+    # stored profile (a long string cut to its start) and holds no value the profile does not.
     module Summary
       MAX_SCALAR_LENGTH = 500
 
       DROPPED = %i[params headers response_headers request_body request_body_encoding
                    response_body response_body_encoding tabs].freeze
 
+      # The request collector keeps a copy of the bodies: no more listed than the profile's own.
+      DROPPED_SCALARS = %w[request_body request_body_encoding response_body response_body_encoding].freeze
+
       module_function
 
       # From a Profile, or the Hash its #to_h returns.
@@ -37,6 +40,7 @@ module Profiler
       def scalars(values)
         values.each_with_object({}) do |(key, value), kept|
           next unless scalar?(value)
+          next if DROPPED_SCALARS.include?(key.to_s)
 
           kept[key.to_s] = value.is_a?(String) && value.length > MAX_SCALAR_LENGTH ? value[0, MAX_SCALAR_LENGTH] : value
         end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.31.5"
+  VERSION = "0.32.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.31.5
+  version: 0.32.0
 platform: ruby
 authors:
 - Sébastien Duplessy
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails