chore(deps-dev): bump rack-mini-profiler from 4.0.1 to 5.0.0

[dependabot]

Bumps rack-mini-profiler from 4.0.1 to 5.0.0.

Changelog

Sourced from rack-mini-profiler's changelog.

5.0.0 - 2026-08-21

• [BREAKING CHANGE] Require Ruby 3.2.0 or later. #658
• [FEATURE] Record bind parameters for parameterized and prepared PostgreSQL queries. #405
• [FIX] Add CSP nonce support to flamegraph rendering. #648
• [FIX] Support simple Active Record bind parameters. #657
• [FIX] Prevent asset requests from clearing profiler authorization. #641
• [FIX] Preserve the full Cache-Control header when disable_caching is false. #620
• [FIX] Show the profiler badge after Turbo Drive page loads. #631
• [FIX] Disable advanced debugging tools by default in Rails development environments. #645
• [FIX] Prevent unhandled promise rejections when profiled fetch requests fail. #490

Commits

• d95511f new asset version
• c7405d0 update changelog
• 1d94d62 fix: prevent unhandled fetch rejections
• abc2a3a Record PostgreSQL bind parameters
• 8fa266a Add test for bind mapping
• 964d2d1 Support simple bind parameters (#657)
• 32cf225 Add missing red test for #641
• 2eb6460 Fix: Prevent request deauthorization when loading assets (#641)
• 0c05831 Add CSP nonce support for flamegraph rendering (#648)
• 435dd60 Fix missing badge for Turbo Drive page loads (#631)
• Additional commits viewable in compare view

[mroderick]

Dependency Upgrade Review: rack-mini-profiler 4.0.1 → 5.0.0

PR scope: dependency-only, dev dependency. Dependabot updated the Gemfile constraint (~> 4.0 → ~> 5.0) alongside the lockfile.

Changes in dependency

One breaking change: Ruby >= 3.2.0 required (the app pins Ruby 4.0.6, so it is satisfied with room to spare). Everything else is dev-tooling behavior: PostgreSQL bind-parameter recording, CSP nonce support for flamegraphs, Turbo Drive badge fix, and advanced debugging tools now off by default in Rails development. Nothing removes or changes an API.

Usage in this repository

• Lives in the :development group (Gemfile:89) next to web-console and better_errors — never installed in production, so Heroku is untouched.
• Zero custom usage: no initializer, no MiniProfiler references anywhere in config/ or lib/. The app relies purely on default middleware behavior, so API-level breaking changes have no surface to hit.

Local validation (worktree at the PR head)

• Boot clean, 189 controller examples, 0 failures.
• bundle exec rubocop: 376 files, no offenses.

Compatibility assessment

Compatible. The single breaking change (Ruby version) is already satisfied, the gem is dev-only with default configuration, and the one behavior change you will notice (debugging tools off by default in development) is deliberate upstream and easily re-enabled if you ever miss the advanced tools.

Confidence

High.

[mroderick]

Approved. See analysis comment above.