chore(deps): bump roda from 3.107.0 to 3.108.0 in the rubygems group

[dependabot]

Bumps the rubygems group with 1 update: roda.

Updates roda from 3.107.0 to 3.108.0

Changelog

Sourced from roda's changelog.

=== 3.108.0 (2026-09-14)

• Make invalid_request_body r.POST exception handling reraise RodaErrors (jeremyevans)

• Make host_routing plugin downcase hostnames before storage and comparison (jeremyevans)

• Make :extension hash matcher in path_matchers plugin require . before extension (jeremyevans)

• Add params_capturing_restore plugin to have params_capturing work with pass and break plugins (jeremyevans)

• Always set Vary response header if considering Accept request header in type_routing plugin (jeremyevans)

• Have r.last_modified in caching plugin check If-Unmodified-Since before If-None-Match and If-Modified-Since (jeremyevans)

• Do not have r.on_segment in optimized_segment_matchers match empty segment (jeremyevans)

• Do not have r.on with String class matcher and default symbol matcher match empty segment (jeremyevans)

• Make pass plugin work with hash_branches and hash_paths plugins (jeremyevans)

• Make params_capturing plugin override a provided parameter named captures (jeremyevans)

• Deprecate the :clear_session csrf_failure option value in the route_csrf and sec_fetch_site_csrf plugins (jeremyevans)

• Make segment matching with convertor not consume remaining_path if convertor returns false/nil (jeremyevans)

• Make etag in the caching plugin return a 412 response if an If-Match header is submitted and weak option is used (jeremyevans)

• Make r.redirect without arguments use / if path starts with // (jeremyevans)

• Make run_append_slash with :use_redirects option not redirect if path starts with // (jeremyevans)

• Make hash matcher reset remaining path and captures on failure (jeremyevans)

• Make pass and break plugins work with optimized_{string,segment}_matchers plugins (jeremyevans)

• Make render method options have greater priority than options set via set_view_options (jeremyevans)

• Do not allow rendering templates outside an allowed_paths directory but having an allowed path as a prefix (jeremyevans)

• Do not add the :views directory as an allowed path if it isn't a directory (jeremyevans)

• Support json_parser :content_type_regexp plugin option, warn if not provided (jeremyevans)

• Add r.query to all_verbs plugin on Rack 3.3+ (jeremyevans)

• Support :exempt_request_methods option for route_csrf plugin, to use an allow list approach (jeremyevans)

• Add csrf_request_method to route_csrf plugin, to handle case where REQUEST_METHOD has been modified (jeremyevans)

Commits

• f13bb6b Bump version to 3.108.0
• 523005c Switch one of recommended :content_type_regexp examples to be case insensitive
• 3bd7215 Fix JRUBY_VERSION check in sessions spec to handle JRuby 10+
• aed701c Explain why you may want to use public plugin instead of static
• d579023 Make invalid_request_body r.POST exception handling reraise RodaErrors
• d7b9422 Make host_routing plugin downcase hostnames before storage and comparison
• 4401593 Make :extension hash matcher in path_matchers plugin require . before extension
• 6399979 Remove unneeded branch in hmac_paths plugin
• 3305442 Add params_capturing_restore plugin to have params_capturing work with pass a...
• acd56df Always set Vary response header if considering Accept request header in type_...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-17 22:07 UTC · Rule: dependabot · triggered by rule refactored queue action rule
• ✅ Checks passed · on draft merge queue: checking #1150 on main (3b93f25) #1151
• ✅ Merged — 2026-09-17 22:13 UTC · at adcc88ca0cbfce6bf4f9f4a9d48a319d54ef4b90 · squash

This pull request spent 5 minutes 57 seconds in the queue, including 5 minutes 32 seconds running CI.

Required conditions to merge

• author=dependabot[bot]
  • chore(deps): bump roda from 3.107.0 to 3.108.0 in the rubygems group #1150
• base=main
• check-success=docker-test (false)
• check-success=docker-test (true)
• github-review-approved [🛡 GitHub branch protection]
  • chore(deps): bump roda from 3.107.0 to 3.108.0 in the rubygems group #1150
• status-success=hadolint
• status-success=ruby
• any of [🛡 GitHub branch protection]:
  • check-success = frontend
  • check-neutral = frontend
  • check-skipped = frontend
• any of [🛡 GitHub branch protection]:
  • check-success = ruby
  • check-neutral = ruby
  • check-skipped = ruby
• any of [🛡 GitHub branch protection]:
  • check-success = docker-test (false)
  • check-neutral = docker-test (false)
  • check-skipped = docker-test (false)
• any of [🛡 GitHub branch protection]:
  • check-success = docker-test (true)
  • check-neutral = docker-test (true)
  • check-skipped = docker-test (true)