[techmore]

Fixes what is red on main today, fixes one intermittent failure, and makes two tests pass on a Mac.

Changes

• Security scan (red on main). bundler-audit fails on advisories published today against loofah 2.25.2, nokogiri 1.19.4 and rails-html-sanitizer 1.7.1. This is a conservative update of only those three gems: loofah 2.25.3, nokogiri 1.19.7, rails-html-sanitizer 1.7.2. bundler-audit check --update passes locally.

• Host vitals test, portable. It read /proc directly, so it failed on macOS. HostVitals now reads /proc through one small method that the test stubs with fixed contents. The test checks exact CPU and memory percentages instead of only their types. Disk and database size still come from the real host. The real /proc read still runs where /proc exists (Linux CI) and skips elsewhere. A new test checks that an unreadable reading is nil, never 0.

• Platform overview instance label. Under a C/POSIX locale, such as a shell without LANG, Ruby returns ENV values as binary, so "SER8 · Incus" failed to match. The label is now read as UTF-8 under any locale. A value that is not valid UTF-8 shows as "Not configured" instead of raising.

• Intermittent CI (sqlite3) failure in PosCardPaymentTest. PosPaymentReconciliationJob takes one machine-wide flock and skips its sweep when the lock is held. Parallel test workers shared that file, so one test's job sometimes did nothing. This hit 6 of the last 25 failed CI runs: Web app UX pass: phone top bar, 24px targets, Dark contrast, clearer Settings and Staff #623, Bump @shopify/cli from 4.9.4 to 5.0.0 #597 and Bump the expo-sdk-patches group across 1 directory with 3 updates #598 at line 72, Speed score: 9 means ~2 s (log scale to 0 at 120 s) #588 at line 56. The lock path is now one method, and the tests use a temporary file per test. Holding the real lock from another process reproduces both failures on the old code, and they pass on the new one. Production keeps the same lock file.

Overlap

• Bump the gems-minor-and-patch group across 1 directory with 8 updates #606 (Dependabot gem group) also bumps these three gems, plus 8 unrelated ones. Dependabot will rebase it after this merges.
• Resolve all 15 Dependabot alerts in mobile build tooling #618 covers the mobile npm alerts. That workflow is path-filtered and does not run on main.

Testing

• Locally on macOS with Ruby 4.0.6: the full bin/rails test suite, the product-site checks and the node tests.
• CI runs on Linux.

🤖 Generated with Claude Code