Bump the ruby-minor-and-patch group across 1 directory with 2 updates

[dependabot]

Bumps the ruby-minor-and-patch group with 2 updates in the / directory: fastlane-plugin-wpmreleasetoolkit and rmagick.

Updates fastlane-plugin-wpmreleasetoolkit from 14.10.0 to 14.11.0

Release notes

Sourced from fastlane-plugin-wpmreleasetoolkit's releases.

14.11.0

New Features

• New macos_verify_code_signing action, asserting that macOS artifacts are signed, signed by the expected authority, accepted by Gatekeeper, and have a notarization ticket stapled to them. Handles .app bundles and .dmg disk images, picking the checks that apply to each. #757

Bug Fixes

• StringsFileValidationHelper.find_duplicated_keys now parses unquoted keys/values and inter-token comments, matching the grammar plutil accepts, instead of raising Invalid character. This lets ios_lint_localizations' check_duplicate_keys work on InfoPlist.strings-style files. #741
• ios_lint_localizations' check_duplicate_keys now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat .strings. #741
• L10nHelper.merge_strings now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. #741
• Bump fastlane to ~> 2.237 to pull in excon >= 1.5.0, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. #754
• upload_github_release_assets: make release lookup more resilient by falling back to GitHub's direct release-by-tag lookup when the releases list does not include the requested release. #753

Internal Changes

• Added regression coverage for upload_github_release_assets direct release lookup errors. #755
• Centralized .strings duplicate-key detection behind StringsFileValidationHelper.scan_for_duplicate_keys, returning a [:scanned | :unsupported_format | :unscannable, payload] tri-state that callers can map to their own warn-and-skip vs fail-closed policy. #741
• L10nHelper.strings_file_type and StringsFileValidationHelper.scan_for_duplicate_keys accept assume_valid: to skip a redundant plutil -lint when the caller has already parsed the file. #741
• Bumped development Ruby version to 3.4.9 #729

Changelog

Sourced from fastlane-plugin-wpmreleasetoolkit's changelog.

14.11.0

New Features

• New macos_verify_code_signing action, asserting that macOS artifacts are signed, signed by the expected authority, accepted by Gatekeeper, and have a notarization ticket stapled to them. Handles .app bundles and .dmg disk images, picking the checks that apply to each. #757

Bug Fixes

• StringsFileValidationHelper.find_duplicated_keys now parses unquoted keys/values and inter-token comments, matching the grammar plutil accepts, instead of raising Invalid character. This lets ios_lint_localizations' check_duplicate_keys work on InfoPlist.strings-style files. #741
• ios_lint_localizations' check_duplicate_keys now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat .strings. #741
• L10nHelper.merge_strings now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. #741
• Bump fastlane to ~> 2.237 to pull in excon >= 1.5.0, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. #754
• upload_github_release_assets: make release lookup more resilient by falling back to GitHub's direct release-by-tag lookup when the releases list does not include the requested release. #753

Internal Changes

• Added regression coverage for upload_github_release_assets direct release lookup errors. #755
• Centralized .strings duplicate-key detection behind StringsFileValidationHelper.scan_for_duplicate_keys, returning a [:scanned | :unsupported_format | :unscannable, payload] tri-state that callers can map to their own warn-and-skip vs fail-closed policy. #741
• L10nHelper.strings_file_type and StringsFileValidationHelper.scan_for_duplicate_keys accept assume_valid: to skip a redundant plutil -lint when the caller has already parsed the file. #741
• Bumped development Ruby version to 3.4.9 #729

Commits

• 64a0694 Release 14.11.0 into trunk (#758)
• 04e6e26 Bumped to version 14.11.0
• a5c8412 Use Ruby 3.4.9 and re-bundle (#729)
• d43af2d Fix faraday regression to >= 1.10.5 instead of >=1.10.6
• afe31c6 Add changelog entry for Ruby version bump
• cab3b32 Use Xcode 26.6
• c7c1fa0 Use latest Bundler, 4.0.17
• 1cef861 Use latest Fastlane
• b3e85cf Remove Bundler dependency and use Gemfile for dev
• a9ec5d0 Address a ShellCheck issue
• Additional commits viewable in compare view

Updates rmagick from 7.0.5 to 7.1.0

Release notes

Sourced from rmagick's releases.

RMagick 7.1.0

[!IMPORTANT] Draw#annotate and Draw#get_type_metrics no longer interpret the text they are given. A %[...] or %x escape is now drawn as written instead of being replaced.

Build the string in Ruby instead — everything those escapes provided has a direct accessor:

# before
img.annotate(gc, 0, 0, 10, 20, '%wx%h')
after
img.annotate(gc, 0, 0, 10, 20, "#{img.columns}x#{img.rows}")

%[width]/%w → Image#columns, %[height]/%h → Image#rows, %f/%d → Image#filename, %m → Image#format, %b → Image#filesize, %[EXIF:*] and other properties → Image#[], %[artifact:KEY] → Image#artifact (new in this release), %[mean] → Image#channel_mean, %[pixel:p{x,y}] → Image#pixel_color, %[fx:...] → Image#fx or plain Ruby.

The interpolation was never documented, and leaving it in place meant that passing user-supplied text to annotate also handed that text to an expression evaluator, a pixel and metadata reader, and an unbounded CPU sink — on a 1500x1500 image, a 10 KB caption of %[mean] took 78 seconds. It also corrupted ordinary text: %d expanded to the directory the image had been read from, so a caption of "%d items" was drawn as /srv/app/uploads items.

Upgrading

• Text starting with @ is drawn instead of being read from that file. annotate(gc, 0, 0, 0, 20, '@notes.txt') now draws @notes.txt; read the file yourself if that is what you wanted.
• RVG path data is validated against the SVG path grammar. canvas.path(d) raises ArgumentError if d contains anything outside MmZzLlHhVvCcSsQqTtAa, digits, .,+-eE and whitespace.
• Pathnames containing a NUL byte raise ArgumentError instead of being silently truncated.
• Draw#clip_path and Draw#encoding now quote their argument in the generated MVG, and values interpolated by Draw#enquote have " and \ escaped. Rendering is unchanged; this is only visible if you compare Draw#inspect output.
• Text containing a backslash is now drawn as written. Previously a trailing \ escaped the closing delimiter of the MVG token, so the text was mangled.

Breaking Changes

• Reject embedded NUL bytes in pathname arguments by @​Watson1978 in rmagick/rmagick#1827
• Fix arbitrary file read in Draw#annotate with text starting with '@' by @​Watson1978 in rmagick/rmagick#1837
• Fix MVG injection from unvalidated RVG::Path data by @​Watson1978 in rmagick/rmagick#1839
• Fix MVG injection from unescaped values in Draw#enquote by @​Watson1978 in rmagick/rmagick#1841
• Draw annotation text as given instead of interpreting it by @​Watson1978 in rmagick/rmagick#1843

Improvements

• Fix grammar, typos, and content errors in the documentation by @​Watson1978 in rmagick/rmagick#1824
• Add Image#artifact to read the artifacts Image#define writes by @​Watson1978 in rmagick/rmagick#1842

Bug Fixes

• Fix unchecked SetImageArtifact() calls by @​ndossche in rmagick/rmagick#1822
• Fix copy_options() using the option value as the artifact key by @​Watson1978 in rmagick/rmagick#1823
• Fix Magick#set_log_event_mask() by @​ndossche in rmagick/rmagick#1826
• Fix SEGV in Info#stroke_width= and Info#attenuate= with a large Float by @​Watson1978 in rmagick/rmagick#1828
• Fix double free of the annotation text in Draw#annotate by @​Watson1978 in rmagick/rmagick#1829
• Fix double free of the interpreted text in Draw#get_type_metrics by @​Watson1978 in rmagick/rmagick#1830
• Fix use-after-free of cloned images in images_from_imagelist() by @​Watson1978 in rmagick/rmagick#1831
• Fix SEGV in Draw#marshal_load with a non-String pattern by @​Watson1978 in rmagick/rmagick#1832
• Fix heap over-read in Image#recolor by @​Watson1978 in rmagick/rmagick#1833
• Fix SEGV from integer overflow in Image#import_pixels geometry by @​Watson1978 in rmagick/rmagick#1834
• Fix heap over-read in Image#import_pixels with a long or empty map by @​Watson1978 in rmagick/rmagick#1835
• Fix memory leak in ImageList#composite_layers with an unusable source list by @​Watson1978 in rmagick/rmagick#1836

... (truncated)

Changelog

Sourced from rmagick's changelog.

RMagick 7.1.0

[!IMPORTANT] Draw#annotate and Draw#get_type_metrics no longer interpret the text they are given. A %[...] or %x escape in it is now drawn as written instead of being replaced by an image property. Everything those escapes provided is available directly from Ruby -- Image#columns, Image#rows, Image#format, Image#filesize, Image#filename, Image#[], Image#artifact, Image#channel_mean, Image#pixel_color and Image#fx -- so build the string in Ruby and pass the result.

The interpolation was undocumented, and it handed any caller that passed user-supplied text an expression evaluator, a pixel and metadata reader, and an unbounded CPU sink. It also corrupted ordinary captions: "%d items" was drawn as the directory the image had been read from.

Breaking Changes

• Draw annotation text as given instead of interpreting it (#1843)
• Draw text starting with '@' instead of reading it from that file (#1837)
• Validate RVG path data against the SVG path grammar (#1839)
• Escape values and quote the clip-path and encoding names in the MVG program (#1841)
• Reject embedded NUL bytes in pathname arguments (#1827)

Improvements

• Add Image#artifact to read the artifacts Image#define writes (#1842)
• Fix grammar, typos, and content errors in the documentation (#1824)

Bug Fixes

• Fix RVG text being quoted twice and the added quotes being drawn (#1840)
• Fix MVG injection in Draw#text from unescaped backslashes (#1838)
• Fix memory leak in ImageList#composite_layers with an unusable source list (#1836)
• Fix heap over-read in Image#import_pixels with a long or empty map (#1835)
• Fix SEGV from integer overflow in Image#import_pixels geometry (#1834)
• Fix heap over-read in Image#recolor (#1833)
• Fix SEGV in Draw#marshal_load with a non-String pattern (#1832)
• Fix use-after-free of cloned images in images_from_imagelist() (#1831)
• Fix double free of the interpreted text in Draw#get_type_metrics (#1830)
• Fix double free of the annotation text in Draw#annotate (#1829)
• Fix SEGV in Info#stroke_width= and Info#attenuate= with a large Float (#1828)
• Fix Magick#set_log_event_mask() (#1826)
• Fix copy_options() using the option value as the artifact key (#1823)
• Fix unchecked SetImageArtifact() calls (#1822)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.