Bump bullet from 8.1.2 to 8.1.3

[dependabot]

Bumps bullet from 8.1.2 to 8.1.3.

Changelog

Sourced from bullet's changelog.

8.1.3 (06/02/2026)

• Handle inversed polymorphic belongs_to false positives

Commits

• bc55c03 Bumping version to 8.1.3
• bf01943 Merge pull request #774 from sloane/sloane/shorten-it-block-comment
• f30f124 Fixup ActiveRecord versions
• 899c97f Green
• 68ad149 Red
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

Test coverage

91.64% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/27607692103

[cursor]

Stale comment

Dependabot assessment: bullet 8.1.2 → 8.1.3

Verdict: Safe to merge.

Lockfile-only patch bump of a :development/:test gem. CI lint and test both pass (run). Local Docker/Ruby unavailable here; verification via CI.

Safety of merging

• No production impact — bullet is not loaded outside dev/test.
• Behaviour change is a false-positive fix — 8.1.3 stops flagging inversed polymorphic belongs_to reads as unused eager loading / N+1. This reduces noise; it does not change application code or runtime query behaviour.
• Low relevance to this codebase — domain models have no polymorphic associations (only Active Storage internals). Bullet is enabled in test with Bullet.raise = true, and the full suite passed.

Concerns unlikely to be caught by tests:

• Real N+1 queries on inversed polymorphic belongs_to associations would no longer be reported by Bullet in development — only relevant if such associations are added later.
• Subtle changes to Bullet's unused-eager-loading heuristics for that edge case may alter dev-time warnings without affecting CI.

Proposed fixes

None — no failing tests, deprecations, or code changes required.

  

_{Sent by Cursor Automation: Editor-* - Tests Dependabot PRs}

[cursor]

Dependabot assessment: bullet 8.1.2 → 8.1.3

Verdict: Safe to merge

Testing

• CI: lint and full RSpec suite passed (run).
• Local: Docker/Ruby unavailable here; relied on CI.

Safety of merging

• Lockfile-only patch bump; no application code changes.
• bullet is a dev/test dependency (:development, :test) — not shipped to production.
• Test env sets Bullet.raise = true, so N+1 / unused-eager-loading issues fail the suite.
• 8.1.3 fixes false positives for inversed polymorphic belongs_to (unused-eager-loading noise), building on 8.1.2's optional-nil-polymorphic handling.

Concerns tests may not catch:

• Detection logic for inversed polymorphic associations is relaxed; a real N+1 on such an association could theoretically slip through — low risk here (no app-level polymorphic models; Active Storage is safelisted for Project.images_attachments).
• Development uses Bullet.raise = false, so log output for polymorphic inverse paths may differ — dev-only, cosmetic.

Proposed fixes

None required.

  

_{Sent by Cursor Automation: Editor-* - Tests Dependabot PRs}