chore(deps): update rubygems/configure-rubygems-credentials action to v2.1.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
rubygems/configure-rubygems-credentials	action	minor	v2.0.0 → v2.1.0

---

Release Notes

rubygems/configure-rubygems-credentials (rubygems/configure-rubygems-credentials)

v2.1.0

Compare Source

This release switches the action runtime from Node 20 to Node 24. The node24 declaration in action.yml removes the deprecation warning that every consumer — most visibly through rubygems/release-gem — has seen since GitHub announced the Node 20 deprecation, and gets ahead of runners switching JavaScript actions to Node 24 by default on June 16, 2026.

Note for self-hosted runners: the node24 runtime requires actions/runner 2.327.1 or later. GitHub-hosted runners are unaffected.

The pending major dependency updates are included as well: zod 4, @​actions/core 3, and @​actions/http-client 4. The actions toolkit majors ship only ES module builds now, so the build pipeline emits ES modules internally, while the bundled dist/index.js the runner executes remains CommonJS. The action's inputs, outputs, and behavior are unchanged.

Thanks to @​dduugg for first proposing the runtime switch in #​413.

What's Changed

• Clean up stale development configuration by @​hsbt in #​420
• Switch to Node 24 and adopt pending major dependency updates by @​hsbt in #​421

Full Changelog: rubygems/configure-rubygems-credentials@v2.0.0...v2.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

[greptile-apps]

PR author is in the excluded authors list.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1ab6820

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[wave-bugbot]

🌊 WAVE BugBot — 6 finding(s)

🔴 5 · 🟡 1

• 🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-863 — Unpinned action tag
  The action tag is pinned to a specific commit SHA rather than using the latest version tag (@v2.1.0). This can lead to security vulnerabilities if the commit is
• 🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-276 — Unpinned action tag with overbroad permissions
  The action tag specifies id-token: write, which grants broad permissions that could be exploited if the action is compromised. It's recommended to use a speci
• 🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-78 — Potential injection risk in action usage
  The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to command injection vulnerabilities.
• 🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-798 — Potential secret leakage in action usage
  The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to secret leakage vulnerabilities.
• 🔴 P0 .github/workflows/publish-rubygems.yml:63 CWE-269 — Potential security authorization issue with action usage
  The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to security authorization vulnerabilities.
• 🟡 P2 .github/workflows/publish-rubygems.yml:63 CWE-617 — Potential correctness issue with action usage
  The action tag is being interpolated into the YAML file. If this value comes from an untrusted source, it could lead to incorrect behavior or errors.

_{severity: critical · major · minor · info — local review · $0 inference · wave-dispatch · react 👍/👎 to tune}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 Pinned SHA vs. version comment cannot be verified offline

This change only bumps the pinned commit SHA for rubygems/configure-rubygems-credentials from the v2.0.0 pin to dc5a8d8... labelled v2.1.0. The correctness of the SHA↔tag mapping and whether v2.1.0 changed required inputs/behavior for OIDC trusted publishing cannot be confirmed from the repository alone; a reviewer should confirm the SHA corresponds to the upstream v2.1.0 tag and that no new inputs are required, since the publish job is only exercised on sdk-ruby-v* tag pushes (.github/workflows/publish-rubygems.yml:37-63) and a regression would surface only during a real release.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[macroscopeapp]

Approvability

Verdict: Needs human review

Dependency update to rubygems/configure-rubygems-credentials v2.1.0. The file is owned by wave-av/sdk-owners (not the author), and there's an unresolved comment noting the SHA↔tag mapping should be verified before merging since this workflow runs only during releases.

^{You can customize Macroscope's approvability policy. Learn more.}