chore(deps-dev): bump the bundler-dependencies group with 2 updates

[dependabot]

Bumps the bundler-dependencies group with 2 updates: mcp and oj.

Updates mcp from 1.6.0 to 1.6.1

Release notes

Sourced from mcp's releases.

v1.6.1

This release makes the OAuth client parse WWW-Authenticate headers and URLs in linear time and repairs the lifecycle of subscriptions/listen streams: same-id streams are served, a keepalive thread ends with its slot, and the acknowledgement precedes the closing result.

Fixed

• Replace authorization request parameters the endpoint URL already carries (#566)
• Serve subscriptions/listen streams that carry the same request id (#567)
• End a listen stream's keepalive thread when its slot is freed (#569)
• Parse the WWW-Authenticate challenge in linear time (#571)
• Keep the acknowledgement first when the transport closes during a listen registration (#574)
• Resolve dot segments in linear time when canonicalizing a URL (#575)

Changelog

Sourced from mcp's changelog.

[1.6.1] - 2026-09-27

This release makes the OAuth client parse WWW-Authenticate headers and URLs in linear time and repairs the lifecycle of subscriptions/listen streams: same-id streams are served, a keepalive thread ends with its slot, and the acknowledgement precedes the closing result.

Fixed

• Replace authorization request parameters the endpoint URL already carries (#566)
• Serve subscriptions/listen streams that carry the same request id (#567)
• End a listen stream's keepalive thread when its slot is freed (#569)
• Parse the WWW-Authenticate challenge in linear time (#571)
• Keep the acknowledgement first when the transport closes during a listen registration (#574)
• Resolve dot segments in linear time when canonicalizing a URL (#575)

Commits

• 48cc95e Merge pull request #576 from koic/release_1_6_1
• b2e3290 Merge pull request #577 from koic/drop_the_trailing_slash_from_the_examples_path
• 2e07e3e [Doc] Drop the trailing slash from directory paths in the documentation
• 709ac53 Release 1.6.1
• e87a192 Merge pull request #575 from koic/remove_dot_segments_in_linear_time
• 74451d3 Merge pull request #574 from koic/keep_the_listen_acknowledgement_first_on_tr...
• 5e2edae Resolve dot segments in linear time when canonicalizing a URL
• c9641fb Merge pull request #571 from koic/parse_www_authenticate_in_linear_time
• 77d4e4b Keep the acknowledgement first when the transport closes during a listen regi...
• b56d007 Merge pull request #569 from koic/end_listen_keepalive_threads_with_their_slot
• Additional commits viewable in compare view

Updates oj from 3.17.6 to 3.17.7

Release notes

Sourced from oj's releases.

v3.17.7

What's Changed

• Speed up hash-heavy documents: skip the 11KB per-parse memset and bulk-insert hashes by @​ST-eugenekrivdyuk in ohler55/oj#1096
• Avoid mutating JSON.pretty_generate options by @​OskarEichler in ohler55/oj#1098
• Preserve decimal placement for large parser numbers by @​OskarEichler in ohler55/oj#1099
• Keep zero digits in oversized parser exponents by @​OskarEichler in ohler55/oj#1100
• Parse very small usual-mode numbers correctly by @​OskarEichler in ohler55/oj#1101
• Speed up symbol keys by interning without a temporary String by @​Watson1978 in ohler55/oj#1102
• Keep Oj's own options out of the hash passed to to_json by @​sferik in ohler55/oj#1106
• Ensure class-cache mutex is released on exceptions by @​caplanmaor in ohler55/oj#1108
• Guard __has_include with an #ifdef to support older GCC versions (4.4.7 etc.) by @​sjanusz-r7 in ohler55/oj#1111

New Contributors

• @​ST-eugenekrivdyuk made their first contribution in ohler55/oj#1096
• @​OskarEichler made their first contribution in ohler55/oj#1098
• @​caplanmaor made their first contribution in ohler55/oj#1108
• @​sjanusz-r7 made their first contribution in ohler55/oj#1111

Full Changelog: ohler55/oj@v3.17.6...v3.17.7

Changelog

Sourced from oj's changelog.

3.17.7 - 2026-09-29

Fixed

• issue #1104, where Oj.dump in compat and custom mode forwarded its whole options hash to the to_json methods it calls, so with json 3.0, whose generator raises ArgumentError on options it does not know, dumping a Time or any other object whose to_json comes from the json gem failed with unknown keywords: mode, use_to_json. Nested values reach to_json even without use_to_json, so Oj.dump(data, mode: :compat) failed the same way for data holding a BigDecimal or Time. The options Oj acts on are now dropped from the hash to_json receives, except :only and :except, which ActiveSupport's as_json reads. Keys Oj does not know are passed through untouched.
• Speed up hash-heavy documents: skip the 11KB per-parse memset and bulk-insert hashes (#1096)
• Preserve decimal placement for large parser numbers (#1099)
• Keep zero digits in oversized parser exponents (#1100)
• Parse very small usual-mode numbers correctly (#1101)
• Speed up symbol keys by interning without a temporary String (#1102)
• Keep Oj's own options out of the hash passed to to_json (#1106)
• Ensure class-cache mutex is released on exceptions (#1108)
• Guard __has_include with an #ifdef to support older GCC versions (4.4.7 etc.) (#1111)

Commits

• 77a15a7 Update changelog
• 305f653 Guard __has_include with an #ifdef to support older GCC versions (4.4.7 etc.)...
• da60b2a Ensure class-cache mutex is released on exceptions (#1108)
• 46f27bb Keep Oj's own options out of the hash passed to to_json (#1106)
• 999ee8e Speed up symbol keys by interning without a temporary String (#1102)
• a1ef274 Parse very small usual-mode numbers correctly (#1101)
• 479405d Keep zero digits in oversized parser exponents (#1100)
• 7c2b880 Preserve decimal placement for large parser numbers (#1099)
• e0e056e Avoid mutating pretty_generate options (#1098)
• cf84edb Speed up hash-heavy documents: skip the 11KB per-parse memset and bulk-insert...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

posthog-ruby-sync Compliance Report

Date: 2026-10-07T18:59:18.919798+00:00
Duration: 93887ms

⚠️ Some Tests Failed

45/47 tests passed, 2 failed

---

Capture Tests

⚠️ 29/30 tests passed, 1 failed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	9ms
Format Validation.Event Has Uuid	✅	5ms
Format Validation.Event Has Lib Properties	✅	4ms
Format Validation.Distinct Id Is String	✅	8ms
Format Validation.Token Is Present	✅	4ms
Format Validation.Custom Properties Preserved	✅	5ms
Format Validation.Event Has Timestamp	✅	5ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	5ms
Retry Behavior.Retries On 503	✅	5250ms
Retry Behavior.Does Not Retry On 400	✅	2011ms
Retry Behavior.Does Not Retry On 401	✅	2011ms
Retry Behavior.Respects Retry After Header	✅	8015ms
Retry Behavior.Implements Backoff	✅	15326ms
Retry Behavior.Retries On 500	✅	5139ms
Retry Behavior.Retries On 502	✅	5114ms
Retry Behavior.Retries On 504	✅	5157ms
Retry Behavior.Max Retries Respected	✅	15497ms
Deduplication.Generates Unique Uuids	✅	15ms
Deduplication.Preserves Uuid On Retry	✅	5112ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10267ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5158ms
Deduplication.No Duplicate Events In Batch	✅	15ms
Deduplication.Different Events Have Different Uuids	✅	7ms
Compression.Sends Gzip When Enabled	✅	4ms
Batch Format.Uses Proper Batch Structure	✅	5ms
Batch Format.Flush With No Events Sends Nothing	✅	3ms
Batch Format.Multiple Events Batched Together	❌	14ms
Error Handling.Does Not Retry On 403	✅	2006ms
Error Handling.Does Not Retry On 413	✅	2010ms
Error Handling.Retries On 408	✅	5157ms

Failures

batch_format.multiple_events_batched_together

Expected 1 requests, got 5

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	9ms
Request Payload.Flags Request Uses V2 Query Param	✅	5ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	6ms
Request Payload.Flags Request Omits Authorization Header	✅	5ms
Request Payload.Token In Flags Body Matches Init	✅	5ms
Request Payload.Groups Round Trip	✅	5ms
Request Payload.Groups Default To Empty Object	✅	5ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	5ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	6ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	5ms
Request Lifecycle.No Flags Request On Init Alone	✅	2ms
Request Lifecycle.No Flags Request On Normal Capture	✅	4ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	8ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	5ms
Retry Behavior.Retries Flags On 502	✅	139ms
Retry Behavior.Retries Flags On 504	✅	108ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	7ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']

[github-actions]

posthog-ruby-async Compliance Report

Date: 2026-10-07T18:59:19.646740+00:00
Duration: 98034ms

⚠️ Some Tests Failed

46/47 tests passed, 1 failed

---

Capture Tests

✅ 30/30 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	107ms
Format Validation.Event Has Uuid	✅	105ms
Format Validation.Event Has Lib Properties	✅	108ms
Format Validation.Distinct Id Is String	✅	105ms
Format Validation.Token Is Present	✅	107ms
Format Validation.Custom Properties Preserved	✅	105ms
Format Validation.Event Has Timestamp	✅	106ms
Format Validation.Non Utc Event Timestamp Is Converted To Utc	✅	6ms
Retry Behavior.Retries On 503	✅	5309ms
Retry Behavior.Does Not Retry On 400	✅	2110ms
Retry Behavior.Does Not Retry On 401	✅	2107ms
Retry Behavior.Respects Retry After Header	✅	8014ms
Retry Behavior.Implements Backoff	✅	15622ms
Retry Behavior.Retries On 500	✅	5210ms
Retry Behavior.Retries On 502	✅	5214ms
Retry Behavior.Retries On 504	✅	5210ms
Retry Behavior.Max Retries Respected	✅	15522ms
Deduplication.Generates Unique Uuids	✅	110ms
Deduplication.Preserves Uuid On Retry	✅	5211ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	10316ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	5212ms
Deduplication.No Duplicate Events In Batch	✅	108ms
Deduplication.Different Events Have Different Uuids	✅	106ms
Compression.Sends Gzip When Enabled	✅	105ms
Batch Format.Uses Proper Batch Structure	✅	105ms
Batch Format.Flush With No Events Sends Nothing	✅	4ms
Batch Format.Multiple Events Batched Together	✅	107ms
Error Handling.Does Not Retry On 403	✅	2107ms
Error Handling.Does Not Retry On 413	✅	2108ms
Error Handling.Retries On 408	✅	5211ms

Feature_Flags Tests

⚠️ 16/17 tests passed, 1 failed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	106ms
Request Payload.Flags Request Uses V2 Query Param	✅	106ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	106ms
Request Payload.Flags Request Omits Authorization Header	✅	107ms
Request Payload.Token In Flags Body Matches Init	✅	106ms
Request Payload.Groups Round Trip	✅	107ms
Request Payload.Groups Default To Empty Object	✅	107ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	106ms
Request Payload.Disable Geoip Omitted Defaults To False	❌	106ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	106ms
Request Lifecycle.No Flags Request On Init Alone	✅	2ms
Request Lifecycle.No Flags Request On Normal Capture	✅	104ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	109ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	105ms
Retry Behavior.Retries Flags On 502	✅	257ms
Retry Behavior.Retries Flags On 504	✅	234ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	108ms

Failures

request_payload.disable_geoip_omitted_defaults_to_false

Field 'geoip_disable' not found in /flags request body at path 'geoip_disable'. Available keys: ['distinct_id', 'groups', 'person_properties', 'group_properties', 'flag_keys_to_evaluate', 'token']