docs: separate the security milestone, and test Ruby 4.0

[cardmagic]

Two related changes to what the project claims about itself.

The milestone wording

Milestone 5 read as "Expand security scanning. Compatibility CI across supported Rails and Ruby versions is implemented; Ruby 4.0 is not yet in the matrix."

Leading with a capability already recorded under "Implemented and tested" made a still-open milestone look like a completed item filed in the wrong section.

The milestone does belong where it is: compatibility CI shipped in #17, but expanding security scanning has not. Brakeman runs; there is no dependency auditing, secret scanning, or code scanning. So the milestone now states only what remains.

This is what the #15 rule was meant to catch, and it slipped through because I appended a caveat to a milestone instead of correcting the entry it belonged to.

Ruby 4.0 in the matrix

The gemspec requires Ruby >= 3.3, so 4.0 was already inside the advertised range and simply untested. That is the gap the compatibility job exists to close.

Verified locally on Ruby 4.0.5 before adding it:

Ruby 4.0.5 + Rails 8.1	333 runs, 0 failures
Ruby 4.0.5 + Rails 8.0	333 runs, 0 failures

Development has run on 4.0.5 throughout this work, so this records something already true rather than making a new claim. The matrix goes from four cells to six.

The Ruby 4.0 caveat is removed from the compatibility entry, since it no longer applies.

bundle exec rake                          # 333 runs, 0 failures
RAILS_VERSION=8.0 bundle exec rake test   # 333 runs, 0 failures, on Ruby 4.0.5

No version bump: CI and documentation only.

[greptile-apps]

Greptile Summary

The PR extends compatibility CI to Ruby 4.0 and updates project documentation to match the tested matrix and remaining security milestone.

• Adds Ruby 4.0 to the Rails 8.0/8.1 compatibility matrix.
• Records the expanded matrix in the changelog and roadmap.
• Separates unfinished security-scanning work from completed compatibility work.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds Ruby 4.0 to the existing compatibility matrix for both supported Rails lines.
CHANGELOG.md	Adds an unreleased entry documenting the expanded Ruby compatibility matrix.
docs/roadmap.md	Updates the tested compatibility span and narrows the security milestone to unfinished scanning work.

_{Reviews (2): Last reviewed commit: "ci: add Ruby 4.0 to the compatibility ma..." | Re-trigger Greptile}

[greptile-apps]

Gemspec compatibility claim conflicts

The gemspec declares required_ruby_version = ">= 3.3", which includes Ruby 4.0, so saying that the gemspec does not advertise Ruby 4.0 conflicts with the package metadata and public “Ruby 3.3 or newer” requirement.

Suggested change

	rather than assumed. Ruby 4.0 is not in the matrix, and the gemspec does not
	advertise it
	rather than assumed. Ruby 4.0 is not in the matrix

Prompt To Fix With AI

This is a comment left during a code review.
Path: docs/roadmap.md
Line: 49-50

Comment:
**Gemspec compatibility claim conflicts**

The gemspec declares `required_ruby_version = ">= 3.3"`, which includes Ruby 4.0, so saying that the gemspec does not advertise Ruby 4.0 conflicts with the package metadata and public “Ruby 3.3 or newer” requirement.

```suggestion
  rather than assumed. Ruby 4.0 is not in the matrix
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[cardmagic]

Correct, and already resolved by the newer commit. required_ruby_version = ">= 3.3" does include Ruby 4.0, so claiming the gemspec did not advertise it contradicted the package metadata.

I reached the same conclusion independently when adding 4.0 to the matrix: the version was inside the advertised range and simply untested, which is the gap the compatibility job exists to close. The whole caveat is gone rather than reworded, and the matrix now runs six cells with (4.0, 8.0) and (4.0, 8.1) passing in CI. Verified locally on Ruby 4.0.5 against both Rails lines before adding them.

[cardmagic]

@greptileai review