v2.1.0 (Aug 11, 2026)

Security

• #1335 Pin third-party actions to commit SHA (@ryz310)
• #1337 Scope Dependabot auto-merge permissions per job (@ryz310)
• #1338 Use non-spoofable actor check for Dependabot auto-merge (@ryz310)
• #1339 Use pull_request trigger for Dependabot auto-merge (@ryz310)
• #1340 Disable credential persistence on checkout (zizmor artipacked) (@ryz310)

Dependabot

• #1237 Bump dependabot/fetch-metadata from 2 to 3 (@ryz310)
• #1291 Bump actions/checkout from 6 to 7 (@ryz310)
• #1317 Bump simplecov from 0.22.0 to 1.0.3 (@ryz310)
• #1323 Bump activesupport from 8.1.3 to 8.1.3.1 (@ryz310)
• #1329 Bump json from 2.21.1 to 2.21.2 (@ryz310)

Misc

• #1330 Add dependency cooldown to Gemfile and Dependabot (@ryz310)
• #1331 Always auto-merge verification app Dependabot PRs (except rails major) (@ryz310)
• #1332 Drop Ruby 3.2 support (EOL) (@ryz310)
• #1334 Require English for PR titles and descriptions (@ryz310)
• #1336 Use tool-specific branch prefix in branch creation rule (@ryz310)
• #1341 Align rails_app .ruby-version with Ruby 3.3 baseline (@ryz310)