Dependency maintenance + documentation release. No source/API changes.
Security
- Bump Rails to 8.1.3 via the 8.1.2.1 security release (#104) — five CVEs (XSS in tag/DebugExceptions helpers, Active Storage path-traversal, NumberConverter).
Changed
- Allow ViewComponent 4.x (#96):
view_componentconstraint widened>= 3.0, < 4.0→>= 3.0, < 5.0(lockfile now 4.5.0). Engine uses only stable VC APIs; host apps with VC 3.x customizations should review v4 notes beforebundle update. - Solid Queue 1.4.0 (#102); nokolexbor 0.6.4 (#103); json 2.19.2 (#99).
- Dev/CI bumps: test-prof 1.6.0 (#101), webmock 3.26.2 (#100), brakeman 8.0.4 (#88), selenium-webdriver 4.41.0 (#78), stackprof 0.2.28 (#71), GitHub Actions artifact actions (#87, #86).
Documentation
- Consolidate conventions into
AGENTS.mdas canonical cross-agent reference (#134); update README/docs/skill version refs to 0.15.0.