chore(deps-dev): bump rbs from 4.0.3 to 4.1.2

[dependabot]

Bumps rbs from 4.0.3 to 4.1.2.

Release notes

Sourced from rbs's releases.

4.1.2

Release note

Miscellaneous

• Keep GC disabled during GC_test#test_stress_and_stress= (#3061)
• Fix GC_test#test_enable leaving GC disabled for the rest of the suite (#3059)

4.1.1

Release note

Library changes

• Include the trailing ? in a keyword key's symbol location (#3043)
• Mark type_name as optional on the alias annotations (#3039)

Miscellaneous

• Fix template drift for ext/rbs_extension/ast_translation.c (#3038)

4.1.1.pre.1

Release note

Library changes

• Include the trailing ? in a keyword key's symbol location (#3043)
• Mark type_name as optional on the alias annotations (#3039)

Miscellaneous

• Fix template drift for ext/rbs_extension/ast_translation.c (#3038)

4.1.0

Release note

RBS 4.1 ships with JRuby support. The RBS parser is written in plain C without depending on the Ruby C API, so it is compiled to WebAssembly and runs on a Wasm runtime, with the parsed AST serialized in a binary format and decoded into RBS objects. The full test suite runs on JRuby in CI.

The inline RBS syntax gets three new features: singleton method definitions (def self.), the module-self constraint, and instance variable annotations in module declarations. Note that RBS inline is still experimental and may change in future releases.

This release also introduces RBS::Rewriter, an API to edit RBS source text while preserving the surrounding content, which rbs annotate is now built on. Parsing performance is improved by interning type names in a shared trie and reducing allocations per node.

RBS::Prototype::Runtime, the RDoc plugin parser, and the top-level float type alias are deprecated in this release.

Signature updates

Updated classes/modules/methods: ARGF, Array, CSV, Class, Delegator, Digest, ERB, Enumerable, Enumerator, Enumerator::Product, Etc, File, File::Constants, File::Stat, FileUtils, Float, Gem, Hash, IO, IPAddr, Integer, JSON, Kernel, MatchData, Module, Monitor, Numeric, ObjectSpace::WeakKeyMap, OpenSSL, Pathname, RBS::Ops, Ractor, Range, Resolv, RubyVM::InstructionSequence, Set, Shellwords, String, StringIO, StringScanner, Struct, Tempfile, Thread, Timeout, TSort, URI::Generic, Zlib::GzipReader, Zlib::ZStream

• Remove stale Float constants and add a constant drift test (#2994)
• Update RDoc comments with Ruby 4.0.6 (#3035)
• Add a dependency on tempfile. (#3025)

... (truncated)

Changelog

Sourced from rbs's changelog.

4.1.2 (2026-08-03)

Miscellaneous

• Keep GC disabled during GC_test#test_stress_and_stress= (#3061)
• Fix GC_test#test_enable leaving GC disabled for the rest of the suite (#3059)

4.1.1 (2026-07-30)

Library changes

• Include the trailing ? in a keyword key's symbol location (#3043)
• Mark type_name as optional on the alias annotations (#3039)

Miscellaneous

• Fix template drift for ext/rbs_extension/ast_translation.c (#3038)

4.1.0 (2026-07-27)

RBS 4.1 ships with JRuby support. The RBS parser is written in plain C without depending on the Ruby C API, so it is compiled to WebAssembly and runs on a Wasm runtime, with the parsed AST serialized in a binary format and decoded into RBS objects. The full test suite runs on JRuby in CI.

The inline RBS syntax gets three new features: singleton method definitions (def self.), the module-self constraint, and instance variable annotations in module declarations. Note that RBS inline is still experimental and may change in future releases.

This release also introduces RBS::Rewriter, an API to edit RBS source text while preserving the surrounding content, which rbs annotate is now built on. Parsing performance is improved by interning type names in a shared trie and reducing allocations per node.

RBS::Prototype::Runtime, the RDoc plugin parser, and the top-level float type alias are deprecated in this release.

Signature updates

Updated classes/modules/methods: ARGF, Array, CSV, Class, Delegator, Digest, ERB, Enumerable, Enumerator, Enumerator::Product, Etc, File, File::Constants, File::Stat, FileUtils, Float, Gem, Hash, IO, IPAddr, Integer, JSON, Kernel, MatchData, Module, Monitor, Numeric, ObjectSpace::WeakKeyMap, OpenSSL, Pathname, RBS::Ops, Ractor, Range, Resolv, RubyVM::InstructionSequence, Set, Shellwords, String, StringIO, StringScanner, Struct, Tempfile, Thread, Timeout, TSort, URI::Generic, Zlib::GzipReader, Zlib::ZStream

• Remove stale Float constants and add a constant drift test (#2994)
• Update RDoc comments with Ruby 4.0.6 (#3035)
• Add a dependency on tempfile. (#3025)
• Support %a{implicitly-returns-nil} on MatchData#[] (#2990)
• Update Array (#2987)
• Allow nil output buffers for reader methods (#3002)
• Add stdlib signature tests for #2967 (#2989)
• Update Integer, phase 1 (#2995)
• Add RBS::Ops (#2934)
• Update Module (#2933)
• Correct core/stdlib signatures to match Ruby 4.0 (#2967)
• Revert Digest::Class method changes (#2980)
• Add stdlib tests for updated StringScanner signatures (#2968)
• Update StringScanner signatures to match strscan 3.1.6 (#2959)
• Remove StringScanner methods absent from the latest Ruby release (#2961)
• Fix Resolv#initialize signature: array of resolvers + use_ipv6: (#2960)
• [Hash] Update Hash's signatures and tests to be correct (#2694)
• update rbs signatures to be more consistent with generics (#2867)

... (truncated)

Commits

• 2c39462 Merge pull request #3062 from ruby/claude/release-4-1-2-hurcyr
• d710ede Version 4.1.2
• c95a7c9 Merge pull request #3061 from ruby/claude/gc-stress-test-performance-424sfy
• 1630d1f Keep GC disabled during GC_test#test_stress_and_stress=
• 7534c7e Merge pull request #3059 from ko1/fix-gc-test-enable-restore
• 75bcf93 Fix GC_test#test_enable leaving GC disabled for the rest of the suite
• c6eaca2 Merge pull request #3058 from ruby/claude/release-doc-new-minor
• a8913a8 Document the JRuby container, and correct what pins the jar versions
• 1da55ae Remove the release path that predates the release workflow
• 34b1188 Say what the version on master means
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	rbs@​4.0.3 ⏵ 4.1.2	-1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		License policy violation: gem rbs under Ruby License: Ruby - The applicable license policy does not permit this license (5) (COPYING) License: BSD-2-Clause - The applicable license policy does not permit this license (5) (Ruby Gem Metadata) License: Ruby - The applicable license policy does not permit this license (5) (Ruby Gem Metadata) License: BSD-2-Clause - The applicable license policy does not permit this license (5) (rbs.gemspec) License: Ruby - The applicable license policy does not permit this license (5) (rbs.gemspec) From: Gemfile.lock → gem/rbs@4.1.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore gem/rbs@4.1.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[kriptoburak]

Closed as superseded by the consolidated dependency update merged into the default branch.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.