Security: bump activesupport, rexml, yard

Addresses security vulnerabilities in transitive dependencies:
- activesupport 7.0.4.3 -> 8.1.3 (major version bump, 4 GHSAs fixed)
- rexml 3.2.5 -> 3.4.4 (6 GHSAs fixed)
- yard 0.9.36 -> 0.9.44 (1 GHSA fixed)

All existing tests pass.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: technicalpickles

Gemfile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 source 'https://rubygems.org'
 
 # Specify your gem's dependencies in pack_stats.gemspec

Gemfile.lock

@@ -2,6 +2,7 @@ PATH
   remote: .
   specs:
     pack_stats (0.2.1)
+      activesupport (>= 7.2.3.1)
       code_ownership
       code_teams
       dogapi
@@ -13,29 +14,43 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.4.3)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
+    activesupport (8.1.3)
+      base64
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
+      json
+      logger (>= 1.4.2)
       minitest (>= 5.1)
-      tzinfo (~> 2.0)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     ast (2.4.2)
-    base64 (0.2.0)
+    base64 (0.3.0)
+    bigdecimal (4.1.2)
     code_ownership (1.32.17)
       code_teams (~> 1.0)
       packs
       sorbet-runtime
     code_teams (1.0.1)
       sorbet-runtime
     coderay (1.1.3)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.3.7)
+    connection_pool (3.0.2)
     diff-lcs (1.5.0)
     dogapi (1.45.0)
       multi_json
-    i18n (1.13.0)
+    drb (2.2.3)
+    i18n (1.15.1)
       concurrent-ruby (~> 1.0)
     json (2.6.3)
+    logger (1.7.0)
     method_source (1.0.0)
-    minitest (5.18.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     multi_json (1.15.0)
     packs (0.0.6)
       sorbet-runtime
@@ -45,6 +60,7 @@ GEM
     parser (3.2.2.3)
       ast (~> 2.4.1)
       racc
+    prism (1.9.0)
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
@@ -57,7 +73,7 @@ GEM
       sorbet-runtime (>= 0.5.9204)
       unparser (>= 0.5.6)
     regexp_parser (2.8.0)
-    rexml (3.2.5)
+    rexml (3.4.4)
     rspec (3.12.0)
       rspec-core (~> 3.12.0)
       rspec-expectations (~> 3.12.0)
@@ -93,6 +109,7 @@ GEM
     rubocop-sorbet (0.7.0)
       rubocop (>= 0.90.0)
     ruby-progressbar (1.13.0)
+    securerandom (0.4.1)
     sorbet (0.5.11370)
       sorbet-static (= 0.5.11370)
     sorbet-runtime (0.5.10796)
@@ -118,7 +135,8 @@ GEM
     unparser (0.6.8)
       diff-lcs (~> 1.3)
       parser (>= 3.2.0)
-    yard (0.9.36)
+    uri (1.1.1)
+    yard (0.9.44)
     yard-sorbet (0.8.1)
       sorbet-runtime (>= 0.5)
       yard (>= 0.9)

Rakefile

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # typed: ignore
 
 require 'bundler/gem_tasks'

bin/tapioca

@@ -8,11 +8,11 @@
 # this file is here to facilitate running it.
 #
 
-require "pathname"
-ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../Gemfile",
-  Pathname.new(__FILE__).realpath)
+require 'pathname'
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile',
+                                           Pathname.new(__FILE__).realpath)
 
-bundle_binstub = File.expand_path("../bundle", __FILE__)
+bundle_binstub = File.expand_path('bundle', __dir__)
 
 if File.file?(bundle_binstub)
   if File.read(bundle_binstub, 300) =~ /This file was generated by Bundler/
@@ -23,7 +23,7 @@ Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this
   end
 end
 
-require "rubygems"
-require "bundler/setup"
+require 'rubygems'
+require 'bundler/setup'
 
-load Gem.bin_path("tapioca", "tapioca")
+load Gem.bin_path('tapioca', 'tapioca')

lib/pack_stats.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # typed: strict
 
 require 'sorbet-runtime'
@@ -19,12 +20,12 @@
 module PackStats
   extend T::Sig
 
-  ROOT_PACKAGE_NAME = T.let('root'.freeze, String)
+  ROOT_PACKAGE_NAME = T.let('root', String)
 
   DEFAULT_COMPONENTIZED_SOURCE_CODE_LOCATIONS = T.let(
     [
       Pathname.new('components'),
-      Pathname.new('gems'),
+      Pathname.new('gems')
     ].freeze, T::Array[Pathname]
   )
 
@@ -47,17 +48,17 @@ def self.report_to_datadog!(
     app_name:,
     source_code_pathnames:,
     componentized_source_code_locations: DEFAULT_COMPONENTIZED_SOURCE_CODE_LOCATIONS,
-    report_time: Time.now, # rubocop:disable Rails/TimeZone
+    report_time: Time.now,
     verbose: false,
     packaged_source_code_locations: [],
     max_enforcements_tag_value: false
   )
 
-    all_metrics = self.get_metrics(
-      source_code_pathnames: source_code_pathnames,
-      componentized_source_code_locations: componentized_source_code_locations,
-      app_name: app_name,
-      max_enforcements_tag_value: max_enforcements_tag_value,
+    all_metrics = get_metrics(
+      source_code_pathnames:,
+      componentized_source_code_locations:,
+      app_name:,
+      max_enforcements_tag_value:
     )
 
     # This helps us debug what metrics are being sent
@@ -68,8 +69,8 @@ def self.report_to_datadog!(
     end
 
     Private::DatadogReporter.report!(
-      datadog_client: datadog_client,
-      report_time: report_time,
+      datadog_client:,
+      report_time:,
       metrics: all_metrics
     )
   end
@@ -100,17 +101,17 @@ def self.get_metrics(
 
     Private::DatadogReporter.get_metrics(
       source_code_files: source_code_files(
-        source_code_pathnames: source_code_pathnames,
-        componentized_source_code_locations: componentized_source_code_locations,
+        source_code_pathnames:,
+        componentized_source_code_locations:
       ),
-      app_name: app_name
+      app_name:
     )
   end
 
   sig do
     params(
       source_code_pathnames: T::Array[Pathname],
-      componentized_source_code_locations: T::Array[Pathname],
+      componentized_source_code_locations: T::Array[Pathname]
     ).returns(T::Array[Private::SourceCodeFile])
   end
   def self.source_code_files(
@@ -119,7 +120,9 @@ def self.source_code_files(
   )
 
     # Sorbet has the wrong signatures for `Pathname#find`, whoops!
-    componentized_file_set = Set.new(componentized_source_code_locations.select(&:exist?).flat_map { |pathname| T.unsafe(pathname).find.to_a })
+    componentized_file_set = Set.new(componentized_source_code_locations.select(&:exist?).flat_map do |pathname|
+                                       T.unsafe(pathname).find.to_a
+                                     end)
 
     packaged_file_set = Packs.all.flat_map do |pack|
       pack.relative_path.find.to_a
@@ -132,7 +135,7 @@ def self.source_code_files(
       packaged_file = packaged_file_set.include?(pathname)
 
       Private::SourceCodeFile.new(
-        pathname: pathname,
+        pathname:,
         team_owner: CodeOwnership.for_file(pathname.to_s),
         is_componentized_file: componentized_file,
         is_packaged_file: packaged_file

lib/pack_stats/gauge_metric.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 # typed: strict
 
 module PackStats
@@ -19,8 +20,8 @@ def self.for(metric_name, count, tags)
 
       all_tags = [*tags, max_enforcements_tag]
       new(
-        name: name,
-        count: count,
+        name:,
+        count:,
         tags: all_tags
       )
     end
@@ -32,9 +33,9 @@ def to_s
 
     sig { params(other: GaugeMetric).returns(T::Boolean) }
     def ==(other)
-      other.name == self.name &&
-        other.count == self.count &&
-        other.tags == self.tags
+      other.name == name &&
+        other.count == count &&
+        other.tags == tags
     end
 
     sig { params(tag_value: T::Boolean).void }

lib/pack_stats/private.rb

@@ -1,13 +1,15 @@
+# frozen_string_literal: true
 # typed: strict
 
 module PackStats
   module Private
     extend T::Sig
 
-    sig { params(package: ParsePackwerk::Package).returns(T.nilable(String) )}
+    sig { params(package: ParsePackwerk::Package).returns(T.nilable(String)) }
     def self.package_owner(package)
       pack = Packs.find(package.name)
       return nil if pack.nil?
+
       CodeOwnership.for_package(pack)&.name
     end
   end

lib/pack_stats/private/datadog_reporter.rb

@@ -27,7 +27,7 @@ def self.get_metrics(source_code_files:, app_name:)
         [
           *Metrics::Files.get_metrics(source_code_files, app_name),
           *Metrics::Packages.get_package_metrics(packages, app_name),
-          *Metrics::PackagesByTeam.get_package_metrics_by_team(packages, app_name),
+          *Metrics::PackagesByTeam.get_package_metrics_by_team(packages, app_name)
         ]
       end
 
@@ -49,7 +49,8 @@ def self.report!(datadog_client:, report_time:, metrics:)
         metrics.each_slice(1000).each do |metric_slice|
           datadog_client.batch_metrics do
             metric_slice.each do |metric|
-              datadog_client.emit_points(metric.name, [[report_time, metric.count]], type: 'gauge', tags: metric.tags.map(&:to_s))
+              datadog_client.emit_points(metric.name, [[report_time, metric.count]], type: 'gauge',
+                                                                                     tags: metric.tags.map(&:to_s))
             end
           end
         end

lib/pack_stats/private/metrics.rb

@@ -14,17 +14,14 @@ def self.tags_for_team(team_name)
 
       sig { params(package: ParsePackwerk::Package, app_name: String).returns(T::Array[Tag]) }
       def self.tags_for_package(package, app_name)
-
         tags = [
           Tag.new(key: 'package', value: humanized_package_name(package.name)),
           Tag.new(key: 'app', value: app_name),
-          *Metrics.tags_for_team(Private.package_owner(package)),
+          *Metrics.tags_for_team(Private.package_owner(package))
         ]
 
         layer = package.config['layer']
-        if layer
-          tags << Tag.new(key: 'layer', value: layer)
-        end
+        tags << Tag.new(key: 'layer', value: layer) if layer
 
         tags
       end

lib/pack_stats/private/metrics/dependencies.rb

@@ -7,8 +7,11 @@ module Metrics
       class Dependencies
         extend T::Sig
 
-        sig { params(prefix: String, packages: T::Array[ParsePackwerk::Package], app_name: String).returns(T::Array[GaugeMetric]) }
-        def self.get_metrics(prefix, packages, app_name)
+        sig do
+          params(_prefix: String, packages: T::Array[ParsePackwerk::Package],
+                 app_name: String).returns(T::Array[GaugeMetric])
+        end
+        def self.get_metrics(_prefix, packages, app_name)
           all_metrics = T.let([], T::Array[GaugeMetric])
           inbound_explicit_dependency_by_package = {}
           packages.each do |package|
@@ -26,17 +29,17 @@ def self.get_metrics(prefix, packages, app_name)
             #
             package.dependencies.each do |explicit_dependency|
               to_package = ParsePackwerk.find(explicit_dependency)
-              if to_package.nil?
-                raise StandardError, "Could not find matching package #{explicit_dependency}"
-              end
+              raise StandardError, "Could not find matching package #{explicit_dependency}" if to_package.nil?
 
               owner = Private.package_owner(to_package)
-              tags = package_tags + [Tag.for('other_package', Metrics.humanized_package_name(explicit_dependency))] + Metrics.tags_for_other_team(owner)
+              tags = package_tags + [Tag.for('other_package',
+                                             Metrics.humanized_package_name(explicit_dependency))] + Metrics.tags_for_other_team(owner)
               all_metrics << GaugeMetric.for('by_package.dependencies.by_other_package.count', 1, tags)
             end
 
             all_metrics << GaugeMetric.for('by_package.dependencies.count', package.dependencies.count, package_tags)
-            all_metrics << GaugeMetric.for('by_package.depended_on.count', inbound_explicit_dependency_by_package[package.name]&.count || 0, package_tags)
+            all_metrics << GaugeMetric.for('by_package.depended_on.count',
+                                           inbound_explicit_dependency_by_package[package.name]&.count || 0, package_tags)
           end
 
           all_metrics