[dependabot]

Updates the requirements on simplecov to permit the latest version.
Updates simplecov to 1.3.2

Release notes

Sourced from simplecov's releases.

v1.3.2

Bugfixes

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See simplecov-ruby/simplecov#1308.

Changelog

Sourced from simplecov's changelog.

[1.3.2] - 2026-09-30

Fixed

• The HTML report is generated again on Rails 8.1.4 when a parallelize_teardown hook calls SimpleCov.result. Rails 8.1.4 runs those hooks in the parent process as well as in each worker, and collecting the result there stops Coverage, which the exit handler took as a sign that nothing was left to report. The exit handler now formats a result that was already collected. See #1308.

[1.3.1] - 2026-09-24

Fixed

• cover_views compiles templates on Rails main again. Rails removed ActionView::Template.registered_template_handler; the lookup reads ActionView::Template::Handlers.template_handlers and still skips an extension with no handler. See #1300.
• require "simplecov" works again on JRuby on Windows, where 1.3.0 raised LoadError: Could not open library '.../libprism.dll'. Prism's FFI backend cannot open its native library there, and 1.3.0 required Prism as soon as SimpleCov loaded. Prism now loads only when branch or method coverage needs the static extractor, which a line-only run never does. Where it cannot load at all, the extractor falls back to empty branch and method tables for never-loaded files, as it did before 1.3.0. See #1299.
• simplecov affected --run works on JRuby on Windows, where it crashed with NoMethodError because Process.wait2 answers no status there. On that platform the runner starts through Kernel#system instead.
• simplecov serve refuses a symlink that points outside the report on JRuby on Windows too. JRuby's File.realpath follows no symlinks there, so serve would have served the file the link pointed to, and simplecov clean and the coverage.json lookup compared paths that were never resolved. On JRuby the CLI now resolves paths through the JDK.

[1.3.0] - 2026-09-12

SimpleCov 1.3 raises the minimum Ruby to 3.3, brings the coverage directives to ERB, Haml, and Slim templates, teaches simplecov patch and simplecov uncovered to annotate CI hosts natively, and settles what the report says about files and groups that hold nothing.

Upgrade notes:

• The minimum supported Ruby is now 3.3. Ruby 3.2 reached end of life in March 2026. JRuby 10 remains supported for line coverage.
• A group that matched no files disappears from the HTML report, coverage.json, and the history file, and a per-group minimum on it passes silently rather than complaining that the group does not exist.
• The rails profile's group tabs come out in alphabetical order, so an existing project's tabs move.
• A never-loaded file with no branches or methods reports 100% for those criteria rather than 0%, so a per-file branch or method threshold that failed such a file passes now. A file the report carries no branch or method table for at all is still unaccounted for, and keeps its 0%.
• A cover glob matching .erb, .haml, or .slim warns and drops those files from the report. Measure templates with cover_views instead.
• coverage.json stays at schema 1.3, unchanged by this release.

Added

• # simplecov:disable and # simplecov:enable work inside ERB, Haml, and Slim templates measured with cover_views, in each language's own comment syntax (<%# simplecov:disable %>, -# simplecov:disable, / simplecov:disable) or as Ruby comments on a code line. A template's directives were never found before: the comment scan tokenizes a file as Ruby, and in ERB %> opens a percent literal that swallowed every comment after the template's first tag, while Haml and Slim comments are not Ruby comments at all and a Slim - # simplecov:disable line even read as an inline directive that disabled only itself. The scan now reads only the Ruby a template holds, at the template's own lines, so a Devise app can disable the confirmable link it never renders instead of carrying it as uncovered. See #1295.
• simplecov patch and simplecov uncovered annotate CI hosts natively. --annotate KIND on both commands turns the answer into inline annotations in the host's own channel, one per contiguous missed range with project-relative paths (patch adds one per uncovered touched branch or method when the report measured them): github emits ::warning workflow commands, gitlab a Code Quality report for the codequality artifact, rdjson reviewdog's Diagnostic Format for any host reviewdog posts to, azure ##vso[task.logissue] logging commands, teamcity code inspection service messages, and buildkite the Markdown body for buildkite-agent annotate. uncovered previously offered only github, and its annotations now name the chosen criterion the way patch's do. Nothing else reaches stdout in that mode and patch --minimum still sets the exit status, so one CI step can annotate and gate. Documented under CI annotations in docs/CLI.md.

Changed

• Groups that match no files are omitted from the report instead of appearing as 100% covered with nothing in them. Formatters, coverage.json, and the history file all skip them, so the rails profile's Channels, Mailers, and Views tabs no longer pad the HTML report of an app without those directories, and a project can declare a group per directory it might have (Dir["app/*"].each { |dir| group File.basename(dir).capitalize, dir }) without checking each one for Ruby files first. A minimum_coverage_by_group threshold on a group that matched nothing passes silently, as it did when the empty group reported 100%, rather than complaining that the group does not exist. See #1293.
• The rails profile declares its groups in alphabetical order: Channels, Controllers, Helpers, Jobs, Libraries, Mailers, Models, Views. Group tabs render in declaration order, so the report of a Rails app lists them that way instead of in the order they accumulated over the years. Nothing else about the groups changes, and a project that declares its own groups is unaffected.

Removed

• Breaking: Dropped support for Ruby 3.2. The minimum supported Ruby is now 3.3 (required_ruby_version >= 3.3), with JRuby 10 still supported and TruffleRuby exercised only by the nightly unstable build. Prism is bundled with every supported Ruby, so the static coverage extractor stops probing for it: StaticCoverageExtractor.available? and the empty-hash fallbacks for its absence are gone. So is the emulation of Ruby 3.2's constant folding, where parentheses were transparent for every literal and a folded dead arm's branches survived in the branch table.

Fixed

• A file with no branches or no methods reports the same percentage everywhere. A file tracked but never loaded had its empty branch and method sets forced to 0% (#902), from a time when simulation recorded no tuples for such a file and an empty set really did mean "nobody knows". Simulation has synthesized those tuples statically for a while now, so an empty set is a fact about the file: it has no branches, or a directive skipped the ones it has. Such a file now reports 100% the way a loaded file with none always has, so the file list stops showing 0% beside a source view that says 100%, and a per-file branch or method minimum stops failing a file that has nothing to cover. A file carrying no table at all for the criterion is still unaccounted for, and 0% stands there. The HTML report's source view also takes each header percentage from the report rather than recomputing it from the fraction, so the two views cannot drift again. See #1296.
• A cover glob that matches a template warns and leaves it out instead of simulating it. Simulation classifies lines as Ruby and parses for branches, so a swept-in template appeared with a comment counted as a missed line, an #id tag counted as never relevant, and no branches at all. The warning names the templates and points at cover_views, which compiles them and measures the real thing.
• The deprecated # :nocov: toggle works in a template's own comment syntax (<%# :nocov: %>, -# :nocov:, / :nocov:) and emits its deprecation warning there. The matcher read raw lines and needed the line to begin with #, so those forms were silently ignored while the Ruby-comment form inside an ERB code tag happened to work. The matcher now reads the same extracted Ruby the directives do.
• ignore: :eval_generated no longer drops a template's real branches and methods. The filter keeps a Coverage entry only when Prism finds a matching construct in the static source, which for a template measured with cover_views meant parsing ERB, Haml, or Slim as Ruby. That usually fails and the entry is kept, but a template whose text happens to parse (a Haml or Slim #id tag reads as a Ruby comment, and so does an ERB text line starting with #) yielded a confident wrong parse, and the template's own conditionals vanished from branch coverage. Templates now skip the parse, since everything a template reports is eval-generated by construction and the filter has nothing to distinguish there.

... (truncated)

Commits

• 52a8754 Bump version to 1.3.2
• 4fb4ae1 Format a result collected before exit on Rails 8.1.4
• 1476741 bundle update
• 343a933 Stop leaking a flush thread in the forked-child production specs
• e64fcaa Bump ruby/setup-ruby from 1.323.0 to 1.325.0
• cb8bd83 Bump oxlint from 1.83.0 to 1.85.0 in /html_frontend
• 4ee7894 Bump version to 1.3.1
• 486e55e bundle update
• d2a62a8 Resolve paths and wait on runners correctly on JRuby on Windows
• 3a2e08e Load Prism only when the static extractor runs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[arosasg]

Closing: simplecov 1.x requires Ruby 3.3, the SDK promises Ruby 3.1. The ignore entry is now on main (#11), so this will not reopen.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml