chore(deps): bump the ruby group with 5 updates

[dependabot]

Bumps the ruby group with 5 updates:

Package	From	To
html2rss	537b09f	644c7f0
html2rss-configs	71981af	7f40e65
io-event	1.19.4	1.19.5
protocol-url	0.10.0	0.18.0
rack	3.2.6	3.2.7

Updates html2rss from 537b09f to 644c7f0

Commits

• 644c7f0 chore(release): bump version to v0.25.0 (#440)
• 9044ec3 refactor(auto_source): decompose JsonState scraper into modular peer subcompo...
• 088a77e perf(auto_source): optimize semantic post-order traversal with bitmasks
• 5cc2a34 refactor(selectors)!: remove legacy :link selector alias
• ff3aec6 chore(reek): tune detector thresholds and disable noisy inspections
• e334b79 fix: fail loud on empty auto_source and emit channel author/image
• 237c63f fix(security): fail-closed network guard and strip style from feeds
• bc303b3 refactor(html): share article rules and raise test flight level (#437)
• d9df31f feat(auto_source): tiered extract, lazy SST, and --limit (#436)
• 6044b3f feat(auto_source): SST heuristic pipeline and Nokogiri boundary pushback (#435)
• Additional commits viewable in compare view

Updates html2rss-configs from 71981af to 7f40e65

Commits

• 7f40e65 refactor(configs): migrate remaining browserless configurations to botasaurus...
• See full diff in compare view

Updates io-event from 1.19.4 to 1.19.5

Release notes

Sourced from io-event's releases.

v1.19.5

• Preserve the original exception or non-local control flow when IO::Event::WorkerPool cancellation interrupts a blocked fiber, while still cancelling and draining the in-flight blocking operation before returning control to Ruby.

Changelog

Sourced from io-event's changelog.

v1.19.5

• Preserve the original exception or non-local control flow when IO::Event::WorkerPool cancellation interrupts a blocked fiber, while still cancelling and draining the in-flight blocking operation before returning control to Ruby.

Commits

• 65d863c Bump patch version.
• db54a3f Preserve worker pool control flow during cancellation. (#209)
• 758917b Make the Basic Event Loop example show the flow of control. (#208)
• See full diff in compare view

Updates protocol-url from 0.10.0 to 0.18.0

Release notes

Sourced from protocol-url's releases.

v0.18.0

• Support explicit URL serialization for mixed grammars, and remove explicit prefixes from relative path calculation.

v0.17.0

• Add optional explicit ./ prefixes when generating same-directory relative URLs.

v0.16.0

• Preserve directory and file semantics when generating relative URL paths.

v0.15.0

• Add Protocol::URL::Relative#relative_to for expressing root-relative URLs relative to a base path.

v0.14.0

• Allow paths to compare with their encoded string representation.

v0.13.0

• Add conservative normalization of encoded URL paths.

v0.12.0

• Allow unfrozen relative and absolute URLs to replace their components.

v0.11.0

No release notes provided.

Changelog

Sourced from protocol-url's changelog.

v0.18.0

• Support explicit URL serialization for mixed grammars, and remove explicit prefixes from relative path calculation.

v0.17.0

• Add optional explicit ./ prefixes when generating same-directory relative URLs.

v0.16.0

• Preserve directory and file semantics when generating relative URL paths.

v0.15.0

• Add Protocol::URL::Relative#relative_to for expressing root-relative URLs relative to a base path.

v0.14.0

• Allow paths to compare with their encoded string representation.

v0.13.0

• Add conservative normalization of encoded URL paths.

v0.12.0

• Allow unfrozen relative and absolute URLs to replace their components.

Commits

• e234f4a Bump minor version.
• e740110 Serialize relative URLs explicitly if requested. (#20)
• 3676599 Bump minor version.
• e17a07a Support explicit relative URL paths. (#19)
• 0306af5 Bump minor version.
• 1b8bfa2 Preserve relative URL path semantics. (#18)
• bf81879 Bump minor version.
• 0b20bf6 Add relative URL conversion. (#17)
• 033cf9f Bump minor version.
• 10b99c3 Compare paths with encoded strings. (#16)
• Additional commits viewable in compare view

Updates rack from 3.2.6 to 3.2.7

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

Unreleased

SPEC Changes

• Define rack.response_finished callback arguments more strictly. (#2365, @​skipkayhil)

Added

• Add Rack::Files#assign_headers to allow overriding how the configured file headers are set. (#2377, @​codergeek121)
• Add support for rack.response_finished to Rack::TempfileReaper. (#2363, @​skipkayhil)
• Add support for streaming bodies when using Rack::Events. (#2375, @​unflxw)
• Add deflaters option to Rack::Deflater to enable custom compression algorithms like zstd. (#2168, @​alexanderadam)
• Add Rack::Request#prefetch? for identifying requests with Sec-Purpose: prefetch header set. (#2405, @​glaszig)
• Add rack.request.config environment key to configure Rack::Request behavior.
• Add Rack::Request#headers for simpler access to request headers by header name. (#1881, @​jeremyevans)
• Allow disabling the Rack::QueryParser bytesize and params limits by passing nil for the bytesize_limit/params_limit keyword arguments, or a negative value for RACK_QUERY_PARSER_BYTESIZE_LIMIT/RACK_QUERY_PARSER_PARAMS_LIMIT. (#2492, @​alpaca-tc)

Changed

• Require Ruby 2.7.3 or newer and replace ruby2_keywords with argument forwarding.
• Raise before exceeding a part limit, not after. (#2362, @​matthew-puku)
• Rack::Deflater now uses a fixed GZip mtime value. (#2372, @​bensheldon)
• Multipart parser drops support for RFC 2231 filename* parameter (prohibited by RFC 7578) and now properly handles UTF-8 encoded filenames via percent-encoding and direct UTF-8 bytes. (#2398, @​wtn)
• The query parser now raises Rack::QueryParser::IncompatibleEncodingError if we try to parse params that are not ASCII compatible. (#2416, @​bquorning)
• The mime type for .pem files has been changed from application/x-x509-ca-cert to application/x-pem-file. (#2435, @​jeremyevans)
• Freeze Rack::Auth::AbstractRequest::AUTHORIZATION_KEYS, Rack::Utils::STATUS_WITH_NO_ENTITY_BODY, Rack::Multipart::Parser::EMPTY, Rack::Utils.default_query_parser, and internal constants in Rack::Lint. (#2428, @​jhawthorn)

Fixed

• Rack::Multipart::UploadedFile now delegates keyword arguments to the wrapped tempfile. Calls such as uploaded_file.readlines(chomp: true) raised TypeError on Ruby 3.0+. (#2481, #2499, @​SeanLF)
• Multipart parser: limit MIME header size check to the unread buffer region to avoid false multipart mime part header too large errors when previously read data accumulates in the scan buffer. (#2392, @​alpaca-tc, @​willnet, @​krororo)
• Multipart parser: add nil guards to prevent NoMethodError crashes when handling Content-Disposition without parameters and Content-Type parameters without '='. (@​haruki0409)

Commits

• 70d2e10 Bump patch version.
• 9b31adf Fix specs on Ruby 2.4
• 7c0abab Do not ignore Ruby 2.4/2.5 errors in CI
• ef52d4e Fix FORWARDED typo.
• 108405e Restore Ruby 2.4/2.5 compatibility
• c3fe393 Update changelog.
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-08-15 11:00 UTC · Rule: dependabot · triggered by rule refactored queue action rule
• ✅ Checks passed · on draft merge queue: checking main (1f9167f) and #1230 together #1231
• ✅ Merged — 2026-08-15 11:02 UTC · at 61b01d4e5226eafcfc32b22c4230b0f62fb49ff4 · squash

This pull request spent 1 minute 26 seconds in the queue, including 1 minute 3 seconds running CI.

Required conditions to merge

• author=dependabot[bot]
  • chore(deps): bump the ruby group with 5 updates #1230
• base=main
• github-review-approved [🛡 GitHub repository ruleset rule main]
  • chore(deps): bump the ruby group with 5 updates #1230
• status-success=build
• any of [🛡 GitHub repository ruleset rule main]:
  • check-success = @github-actions/build
  • check-neutral = @github-actions/build
  • check-skipped = @github-actions/build
• any of [🛡 GitHub repository ruleset rule main]:
  • check-success = @github-actions/lint
  • check-neutral = @github-actions/lint
  • check-skipped = @github-actions/lint