chore(deps): bump the ruby-deps group across 1 directory with 4 updates

[dependabot]

Bumps the ruby-deps group with 4 updates in the / directory: haml, image_processing, bullet and webmock.

Updates haml from 7.4.1 to 7.5.1

Release notes

Sourced from haml's releases.

v7.5.1

What's Changed

• Improve frozen strings management by @​tagliala in haml/haml#1205

Full Changelog: haml/haml@v7.5.0...v7.5.1

v7.5.0

What's Changed

• Remove redundant require and use extend directly by @​tagliala in haml/haml#1204
• Compile a multi-line attribute hash statically by @​wilfison in haml/haml#1222

Full Changelog: haml/haml@v7.4.1...v7.5.0

Changelog

Sourced from haml's changelog.

7.5.1

• Improve frozen strings management haml/haml#1205

7.5.0

• Compile a multi-line attribute hash statically haml/haml#1222
  • Errors from multi-line attributes will be reported on the tag's line instead of the expression that raised the error.

Commits

• c06aad5 Version 7.5.1
• 3e6dbb3 Improve frozen strings management (#1205)
• d1a4022 Version 7.5.0
• 281f030 Compile a multi-line attribute hash statically
• 0b503a3 Move the attribute newline count onto DynamicAttributes
• 234a855 Count lines through fescape and html attribute expressions
• f86c0cc Remove redundant require and use extend directly (#1204)
• See full diff in compare view

Updates image_processing from 2.0.3 to 2.1.0

Changelog

Sourced from image_processing's changelog.

2.1.0 (2026-09-01)

• [minimagick] Add inherit_fds: so a loader can name an already-open input (thanks to @​flavorjones)

Commits

• 3d990c3 Set version to 2.1.0
• 722d900 Add inherit_fds: so a loader can name an already-open input (#147)
• See full diff in compare view

Updates bullet from 8.1.3 to 8.2.0

Changelog

Sourced from bullet's changelog.

8.2.0 (08/29/2026)

• Add thread-safe Bullet.pause, Bullet.resume, Bullet.paused?, and Bullet.skip APIs
• Add configurable footer positioning
• Fix unused eager loading false positives when N+1 detection is disabled
• Fix unused eager loading false positives for conditional has_many :through associations
• Fix Ruby 4.0 compatibility issues
• Drop support for ActiveRecord versions older than 7 and Mongoid versions older than 8

Commits

• 805fc58 Bump version to 8.2.0
• fa67b54 Merge pull request #777 from deivid-rodriguez/deivid-rodriguez/fix-has-many-t...
• 5471086 Merge pull request #780 from deivid-rodriguez/deivid-rodriguez/mongoid-compat
• 0962b7b Make Gemfile.mongoid-8.0 installable
• 8ca4ff0 Drop no longer supported mongoid versions
• a48b03a rbx implementation is no longer maintained
• 1372b2b Fix has many through unused eager load false positives
• 09cd01d Merge pull request #779 from deivid-rodriguez/deivid-rodriguez/drop-very-old-...
• 770547f Drop support for ActiveRecord older than 7.x
• 3820804 Merge pull request #776 from deivid-rodriguez/deivid-rodriguez/fix-unused-eag...
• Additional commits viewable in compare view

Updates webmock from 3.26.3 to 3.26.4

Release notes

Sourced from webmock's releases.

3.26.4

• Fix race condition in HTTPClient adapter async requests by @​koic in #1131

Changelog

Sourced from webmock's changelog.

3.26.4

• Fix race condition in HTTPClient adapter async requests by @​koic in #1131

Commits

• 0fdbad0 Version 3.26.4
• b187df8 Merge pull request #1131 from koic/fix_race_condition_in_httpclient_adapter_a...
• f275724 Fix race condition in HTTPClient adapter async requests
• See full diff in compare view

[mroderick]

@dependabot rebase

[mroderick]

Dependency upgrade review

Gem	From → To	Assessment
haml	7.4.1 → 7.5.1	Low risk — internal cleanups, static compilation of multi-line attribute hashes
image_processing	2.0.3 → 2.1.0	Low risk — additive inherit_fds: loader option
bullet	8.1.3 → 8.2.0	Low risk — thread-safe pause/resume APIs, false-positive fixes; drops AR < 7 (this app is on Rails 8.1)
webmock	3.26.3 → 3.26.4	Low risk — one patch fix, HTTPClient adapter race
json (not in PR body)	2.21.2 → 3.0.2	Breaking for this app — see below

The lockfile diff contains a fifth change the PR body doesn't mention: a major json bump, pulled in transitively by rubocop's json >= 2.3.

json 3.0 made JSON.parse keyword-only. Rails 8.1's ActiveSupport::JSON.decode calls JSON.parse(json, options) with a positional hash, which now raises ArgumentError: wrong number of arguments (given 2, expected 1). Every request that reads the encrypted session cookie crashes, so any spec touching a session fails — that's why all six test groups are red with the session.key? signature in ApplicationController#current_user.

Verified locally: the four named bumps are fine; reverting only json to 2.21.2 (with the four bumps still applied) turns everything green again.

Fixed by #2865, which pins json ~> 2.3 on master. Rebasing this PR on latest master (@dependabot rebase) should turn CI green. After that, this PR is safe to merge.

[mroderick]

@dependabot rebase

[dependabot]

Looks like this PR is already up-to-date with master! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.