[openstreetmap/openstreetmap-website] Bump the dependencies group with 5 updates (PR #7281)

Wed Jul 29 21:48:20 UTC 2026

Bumps the dependencies group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) | `1.228.0` | `1.228.1` |
| [danger](https://github.com/danger/danger) | `9.6.0` | `9.6.1` |
| [simplecov](https://github.com/simplecov-ruby/simplecov) | `1.0.2` | `1.0.3` |
| [annotaterb](https://github.com/drwl/annotaterb) | `4.23.0` | `4.24.0` |
| [database_consistency](https://github.com/djezzzl/database_consistency) | `3.0.6` | `3.0.8` |

Updates `aws-sdk-s3` from 1.228.0 to 1.228.1
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-ruby/blob/version-3/gems/aws-sdk-s3/CHANGELOG.md">aws-sdk-s3's changelog</a>.</em></p>
<blockquote>
<h2>1.228.1 (2026-07-23)</h2>
<ul>
<li>Issue - Ensure the source file is closed on multipart <code>upload_file</code> part failure, preventing leaked file descriptors (<a href="https://redirect.github.com/aws/aws-sdk-ruby/issues/3408">#3408</a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a href="https://github.com/aws/aws-sdk-ruby/commits">compare view</a></li>
</ul>
</details>
<br />

Updates `danger` from 9.6.0 to 9.6.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/danger/danger/releases">danger's releases</a>.</em></p>
<blockquote>
<h2>9.6.1</h2>
<ul>
<li>Support git gem 5.0 - <a href="https://github.com/ashleyHutton"><code>@ashleyHutton</code></a> <a href="https://redirect.github.com/danger/danger/pull/1550">#1550</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/danger/danger/blob/master/CHANGELOG.md">danger's changelog</a>.</em></p>
<blockquote>
<h2>9.6.1</h2>
<ul>
<li>Support git gem 5.0 - <a href="https://github.com/ashleyHutton"><code>@ashleyHutton</code></a> <a href="https://redirect.github.com/danger/danger/pull/1550">#1550</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/danger/danger/commit/c94d38b3ce68e8c476afbdd63e4c9febdfadd757"><code>c94d38b</code></a> Prepare for release</li>
<li><a href="https://github.com/danger/danger/commit/4cd08300bffc4fcdce0c33d04bde8d3fa0e4a56f"><code>4cd0830</code></a> Merge pull request <a href="https://redirect.github.com/danger/danger/issues/1550">#1550</a> from ashleyHutton/task/git-5-compatibility</li>
<li><a href="https://github.com/danger/danger/commit/153f894255208b7e531c29bb1315b11ebc147f5f"><code>153f894</code></a> Add git 5 compatibility</li>
<li><a href="https://github.com/danger/danger/commit/bd317327d8b42fd06d6e23b88cfed09f9dab6602"><code>bd31732</code></a> Merge pull request <a href="https://redirect.github.com/danger/danger/issues/1548">#1548</a> from danger/dependabot/github_actions/actions/checko...</li>
<li><a href="https://github.com/danger/danger/commit/2b84ec39977e6a1219004452dba0af02c3cd9288"><code>2b84ec3</code></a> Bump actions/checkout from 6 to 7</li>
<li>See full diff in <a href="https://github.com/danger/danger/compare/v9.6.0...v9.6.1">compare view</a></li>
</ul>
</details>
<br />

Updates `simplecov` from 1.0.2 to 1.0.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/simplecov-ruby/simplecov/releases">simplecov's releases</a>.</em></p>
<blockquote>
<h2>v1.0.3</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump ruby/setup-ruby from 1.316.0 to 1.318.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/simplecov-ruby/simplecov/pull/1238">simplecov-ruby/simplecov#1238</a></li>
<li>fix: memoise key parsing in RubyDataParser to fix combiner performance regression by <a href="https://github.com/oleksii-leonov"><code>@oleksii-leonov</code></a> in <a href="https://redirect.github.com/simplecov-ruby/simplecov/pull/1239">simplecov-ruby/simplecov#1239</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/oleksii-leonov"><code>@oleksii-leonov</code></a> made their first contribution in <a href="https://redirect.github.com/simplecov-ruby/simplecov/pull/1239">simplecov-ruby/simplecov#1239</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/simplecov-ruby/simplecov/compare/v1.0.2...v1.0.3">https://github.com/simplecov-ruby/simplecov/compare/v1.0.2...v1.0.3</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/simplecov-ruby/simplecov/blob/main/CHANGELOG.md">simplecov's changelog</a>.</em></p>
<blockquote>
<h1>1.0.3 (2026-07-26)</h1>
<h2>Bugfixes</h2>
<ul>
<li>Generating a report no longer crashes when the coverage universe contains a module that shadows <code>#inspect</code> with an incompatible signature. Rendering a method coverage key's receiver calls <code>to_s</code>, and a singleton class's <code>to_s</code> renders its attached object via <code>#inspect</code> — Liquid's <code>Utils</code> module defines <code>inspect(value, max_depth = 2)</code> as a <code>module_function</code>, so any suite whose report included Liquid's files (typically a vendored bundle under the project root, which is why this surfaced only in CI) raised <code>ArgumentError</code> from the at_exit hook and lost its report. The exposure predates 1.0.2's key normalization, which only moved the call. Rendering now recovers by rebuilding the name from <code>Module#name</code> via bound methods, which user code cannot shadow, falling back to an address form that the existing normalization collapses. The <code>external_at_exit</code> workaround is no longer needed. Reported with an exemplary diagnosis by <a href="https://github.com/bkuhlmann"><code>@bkuhlmann</code></a>. See <a href="https://redirect.github.com/simplecov-ruby/simplecov/issues/1236">#1236</a>.</li>
<li>Method coverage entries are now aggregated by source location alone, completing the aggregation introduced in 1.0.2 (which keyed on name and location). Ruby records one method entry per defined method, so a builder looping <code>container.each_key { |key| define_method(key) { ... } }</code> produces an entry per generated name, all at the block's location — and every name whose generated wrapper no test happened to call showed as an uncovered method on a line with full line and branch coverage. A source location is the unit a file-based report can express, and regular <code>def</code>s map one location to one name, so they are unaffected. The same identity is used when merging resultsets across processes. This also covers methods copied into refinements via <code>import_methods</code>, which Ruby records once per importing refinement at the shared module's original location, so exercising the method through any refinement now marks the shared definition covered and the <code>skip</code> workaround for shared refinement modules can be dropped. Reported with exemplary diagnoses by <a href="https://github.com/bkuhlmann"><code>@bkuhlmann</code></a>. See <a href="https://redirect.github.com/simplecov-ruby/simplecov/issues/1234">#1234</a> and <a href="https://redirect.github.com/simplecov-ruby/simplecov/issues/1237">#1237</a>.</li>
<li><code>SimpleCov.formatter</code> and <code>SimpleCov.formatters</code> now accept formatter instances in addition to formatter classes, so constructor options can actually be passed — most notably <code>SimpleCov::Formatter::HTMLFormatter.new(silent: true)</code> to suppress the "Coverage report generated" status line. Previously SimpleCov unconditionally called <code>.new</code> on whatever was configured, so passing an instance crashed with <code>NoMethodError</code> at report time. See <a href="https://redirect.github.com/simplecov-ruby/simplecov/issues/1240">#1240</a>.</li>
</ul>
<h2>Performance</h2>
<ul>
<li>Fix 5x performance regression on report combining (introduced in <code>1.0.0</code> as a result of using <code>Ripper#parse</code> in a hot path) by adding parsed key memoisation to <code>RubyDataParser.call</code>.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/e9fddf0a0c52e81182dee5a50491ead2ebd7c120"><code>e9fddf0</code></a> Bump version to 1.0.3</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/1bc8a8c5fad26e9b0861b96340f3d6ac9373b649"><code>1bc8a8c</code></a> bundle update</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/0e6eae8cf14b033c41545bbdcd3f08d07a0a91eb"><code>0e6eae8</code></a> fix: memoise key parsing in RubyDataParser to fix combiner performance regres...</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/1a8a9ba783a89d05285e140363b0b0fa9ba9672a"><code>1a8a9ba</code></a> Accept formatter instances in formatter configuration</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/3ef1068d307c27feab4f83759b50355c13dee625"><code>3ef1068</code></a> Bump ruby/setup-ruby from 1.316.0 to 1.318.0</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/f33a57450b0b986ddd42085ccbcca9f906a1d07c"><code>f33a574</code></a> Assert engine-independent invariants for receiver name fallbacks</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/3492da62adb899f05c991cf93c99e0b3bef451fe"><code>3492da6</code></a> Aggregate method coverage by source location alone</li>
<li><a href="https://github.com/simplecov-ruby/simplecov/commit/2e605507d4bce6f802087636e70eb7807fe32e0c"><code>2e60550</code></a> Survive user code that breaks receiver name rendering</li>
<li>See full diff in <a href="https://github.com/simplecov-ruby/simplecov/compare/v1.0.2...v1.0.3">compare view</a></li>
</ul>
</details>
<br />

Updates `annotaterb` from 4.23.0 to 4.24.0
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/drwl/annotaterb/blob/main/CHANGELOG.md">annotaterb's changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/drwl/annotaterb/tree/v4.24.0">v4.24.0</a> (2026-07-24)</h2>
<p><a href="https://github.com/drwl/annotaterb/compare/v4.23.0...v4.24.0">Full Changelog</a></p>
<p><strong>Implemented enhancements:</strong></p>
<ul>
<li>Annotate postgres enums <a href="https://redirect.github.com/drwl/annotaterb/issues/309">#309</a></li>
<li><code>--frozen</code> option returns a zero error code when database is inaccessible <a href="https://redirect.github.com/drwl/annotaterb/issues/240">#240</a></li>
<li>Add support for printing enum types <a href="https://redirect.github.com/drwl/annotaterb/issues/176">#176</a></li>
</ul>
<p><strong>Fixed bugs:</strong></p>
<ul>
<li>Annotation placement for namespaced models is inconsistent — anchor shifts with file shape (doc comment presence) <a href="https://redirect.github.com/drwl/annotaterb/issues/366">#366</a></li>
<li>Fixture files that start with <% (erb) insert doc inside the erb block <a href="https://redirect.github.com/drwl/annotaterb/issues/345">#345</a></li>
<li>Schema information inserted every run into some fixture files. <a href="https://redirect.github.com/drwl/annotaterb/issues/344">#344</a></li>
</ul>
<p><strong>Closed issues:</strong></p>
<ul>
<li>Routes are not annotated after migration tasks <a href="https://redirect.github.com/drwl/annotaterb/issues/251">#251</a></li>
</ul>
<p><strong>Merged pull requests:</strong></p>
<ul>
<li>Bump version to v4.24.0 <a href="https://redirect.github.com/drwl/annotaterb/pull/371">#371</a> (<a href="https://github.com/drwl">drwl</a>)</li>
<li>Revert "Release v4.24.0" <a href="https://redirect.github.com/drwl/annotaterb/pull/370">#370</a> (<a href="https://github.com/drwl">drwl</a>)</li>
<li>Show DEFERRABLE INITIALLY on foreign keys <a href="https://redirect.github.com/drwl/annotaterb/pull/365">#365</a> (<a href="https://github.com/kamipo">kamipo</a>)</li>
<li>Annotate PostgreSQL unique and exclusion constraints <a href="https://redirect.github.com/drwl/annotaterb/pull/364">#364</a> (<a href="https://github.com/kamipo">kamipo</a>)</li>
<li>Fix <code>--without-comment</code> help text to say exclude <a href="https://redirect.github.com/drwl/annotaterb/pull/363">#363</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Fix NoMethodError when handling malformed annotations <a href="https://redirect.github.com/drwl/annotaterb/pull/362">#362</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Remove empty TODO comment from Runner <a href="https://redirect.github.com/drwl/annotaterb/pull/361">#361</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Move ignore_database_name check into AnnotationBuilder <a href="https://redirect.github.com/drwl/annotaterb/pull/360">#360</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Add YAML configuration option reference to the README. <a href="https://redirect.github.com/drwl/annotaterb/pull/359">#359</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Respect DB column defaults over <code>attribute :foo, default: X</code> overrides <a href="https://redirect.github.com/drwl/annotaterb/pull/358">#358</a> (<a href="https://github.com/kamipo">kamipo</a>)</li>
<li>added :ignore_database_name option <a href="https://redirect.github.com/drwl/annotaterb/pull/357">#357</a> (<a href="https://github.com/HoneyryderChuck">HoneyryderChuck</a>)</li>
<li>Add Markdown annotation idempotency test <a href="https://redirect.github.com/drwl/annotaterb/pull/356">#356</a> (<a href="https://github.com/aouxwoux">aouxwoux</a>)</li>
<li>Fix schema_like? to recognize markdown-formatted annotation rows <a href="https://redirect.github.com/drwl/annotaterb/pull/354">#354</a> (<a href="https://github.com/nashirox">nashirox</a>)</li>
<li>Keep fixture annotations out of ERB blocks (<a href="https://redirect.github.com/drwl/annotaterb/issues/345">#345</a>) <a href="https://redirect.github.com/drwl/annotaterb/pull/353">#353</a> (<a href="https://github.com/Halvanhelv">Halvanhelv</a>)</li>
<li>Stop tracking generated secondary DB artifacts in dummyapp <a href="https://redirect.github.com/drwl/annotaterb/pull/352">#352</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Add Rails version matrix to CI <a href="https://redirect.github.com/drwl/annotaterb/pull/351">#351</a> (<a href="https://github.com/OdenTakashi">OdenTakashi</a>)</li>
<li>Create release script <a href="https://redirect.github.com/drwl/annotaterb/pull/349">#349</a> (<a href="https://github.com/drwl">drwl</a>)</li>
<li>Generate changelog for v4.23.0 <a href="https://redirect.github.com/drwl/annotaterb/pull/348">#348</a> (<a href="https://github.com/drwl">drwl</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/drwl/annotaterb/commit/c7fbd3acb726ac1835965c504d59b92eddd5ec66"><code>c7fbd3a</code></a> Bump version to v4.24.0 (<a href="https://redirect.github.com/drwl/annotaterb/issues/371">#371</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/a03524408369117496b9da842c5716fb876c6eb5"><code>a035244</code></a> Revert "Release v4.24.0" (<a href="https://redirect.github.com/drwl/annotaterb/issues/370">#370</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/28476ce5aad1317337ffb3217b3001eb98c8c3a8"><code>28476ce</code></a> Release v4.24.0</li>
<li><a href="https://github.com/drwl/annotaterb/commit/615383aaecfcffc9cada4528a097de55cc1ef6b0"><code>615383a</code></a> Show DEFERRABLE INITIALLY on foreign keys (<a href="https://redirect.github.com/drwl/annotaterb/issues/365">#365</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/a504deb914891e907c699a4ee8b8b250bb338e38"><code>a504deb</code></a> Annotate PostgreSQL unique and exclusion constraints (<a href="https://redirect.github.com/drwl/annotaterb/issues/364">#364</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/d2a9a483afb7e574f3cf94c2326671e6b3b88a64"><code>d2a9a48</code></a> Fix <code>--without-comment</code> help text to say exclude (<a href="https://redirect.github.com/drwl/annotaterb/issues/363">#363</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/adc8bfe3e8c4d55e564b12dccf6f54b4307266aa"><code>adc8bfe</code></a> Move ignore_database_name check into AnnotationBuilder (<a href="https://redirect.github.com/drwl/annotaterb/issues/360">#360</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/76d48c01a9dd8da93e3fcff7f2ae5ac7a1592f96"><code>76d48c0</code></a> Fix NoMethodError when handling malformed annotations (<a href="https://redirect.github.com/drwl/annotaterb/issues/362">#362</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/cd7210fe93b8ce44714a5ff825d9b488d8491a18"><code>cd7210f</code></a> Remove empty TODO comment from Runner (<a href="https://redirect.github.com/drwl/annotaterb/issues/361">#361</a>)</li>
<li><a href="https://github.com/drwl/annotaterb/commit/2b383f1a632d8ae2421734f396f90783bd45fa7a"><code>2b383f1</code></a> Add YAML configuration option reference to the README. (<a href="https://redirect.github.com/drwl/annotaterb/issues/359">#359</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/drwl/annotaterb/compare/v4.23.0...v4.24.0">compare view</a></li>
</ul>
</details>
<br />

Updates `database_consistency` from 3.0.6 to 3.0.8
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/djezzzl/database_consistency/blob/master/CHANGELOG.md">database_consistency's changelog</a>.</em></p>
<blockquote>
<h3>[3.0.8] - 2026/07/28</h3>
<ul>
<li>Fix <code>NumericalityConstraintChecker</code> false positives for attributes that have validators but no <code>numericality</code> validator. Thanks <a href="https://github.com/panteo">panteo</a> for reporting this in <a href="https://redirect.github.com/djezzzl/database_consistency/issues/309">#309</a>!</li>
</ul>
<h3>[3.0.7] - 2026/07/26</h3>
<ul>
<li>Add <code>NumericalityConstraintChecker</code> to detect <code>numericality</code> validators without matching DB <code>CHECK</code> constraints. Thanks <a href="https://github.com/chaadow">Chedli Bourguiba</a> for reporting this in <a href="https://redirect.github.com/djezzzl/database_consistency/issues/181">#181</a>!</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/djezzzl/database_consistency/commit/2c4ff0278e96f4b632f12be2d8fb748767c2450d"><code>2c4ff02</code></a> Release v3.0.8</li>
<li><a href="https://github.com/djezzzl/database_consistency/commit/59365938a700d496b791f6acd6e279aca098aed0"><code>5936593</code></a> Fix NumericalityConstraintChecker false positives on non-numerical validators...</li>
<li><a href="https://github.com/djezzzl/database_consistency/commit/5391e1fe448dcd8f96e3c1c2c5649c5e28888dc6"><code>5391e1f</code></a> Release v3.0.7</li>
<li><a href="https://github.com/djezzzl/database_consistency/commit/0bd5287b2607bfa5a9a88393ee00cd4ce9161496"><code>0bd5287</code></a> Add NumericalityConstraintChecker for <code>numericality</code> validators vs DB <code>CHECK</code>...</li>
<li>See full diff in <a href="https://github.com/djezzzl/database_consistency/compare/v3.0.6...v3.0.8">compare view</a></li>
</ul>
</details>
<br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions

</details>
You can view, comment on, or merge this pull request online at:

  https://github.com/openstreetmap/openstreetmap-website/pull/7281

-- Commit Summary --

  * Bump the dependencies group with 5 updates

-- File Changes --

    M Gemfile.lock (14)

-- Patch Links --

https://github.com/openstreetmap/openstreetmap-website/pull/7281.patch
https://github.com/openstreetmap/openstreetmap-website/pull/7281.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/pull/7281
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/pull/7281 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20260729/5bdfbfec/attachment-0001.htm>