[stuartmg]

Summary

Adds Ruby 4.0 support and fixes the publishing workflow, which has never been able to run since it was added.

Ruby 4 support

• memorb.gemspec: removed the < 3.5 upper bound on required_ruby_version.

• memorb.gemspec: relaxed the bundler development dependency from ~> 2.0 to >= 2.0. Ruby 4.0 ships Bundler 4.0.3, and without this change bundle install fails on Ruby 4:

  Because the current Bundler version (4.0.3) does not satisfy bundler ~> 2.0
    and Gemfile depends on bundler ~> 2.0,
    version solving has failed.
  

• lib/memorb/version.rb: bumped 1.0.0 to 1.1.0. Adding a supported Ruby is additive, so a minor bump.

• CHANGELOG.md: added the 1.1.0 entry.

• .github/workflows/main.yml: added ruby-4.0 (Bundler 4.0) to the test matrix.

No changes to lib/ were needed. Nothing in the library gates on RUBY_VERSION, and concurrent-ruby ~> 1.1 resolves cleanly on Ruby 4.

Workflow fixes

• Publishing was dead code. Both the push trigger and the publish job's if: guard referenced master, but the default branch is main. Pushes to main never triggered the workflow, so the 1.0.0 release never published to GitHub Packages. Both references now point at main.

• Actions pinned to commit SHAs as a supply-chain precaution, with the version in a trailing comment so Dependabot can still track them:

  Action	Before	After
  actions/checkout	@v4	@3d3c42e5aac5ba805825da76410c181273ba90b1 (v7.0.1)
  ruby/setup-ruby	@v1	@95ef2b042f9d7a56d8268cba8559e2842e2ad01b (v1.321.0)

  The checkout jump from v4 to v7 requires a Node 24 capable runner (v5) and moves persisted credentials to a separate file (v6). Neither affects this workflow: it runs on GitHub-hosted ubuntu-latest and nothing depends on the credential location.

Misc

• .gitignore: added .serena/ (local tooling state).

Verification

Ran locally against both Rubies with a fresh Gemfile.lock:

Ruby	Bundler	bundle install	bundle exec rspec	gem build
3.4.8	2.6.9	ok	129 examples, 0 failures, 2 pending	not run
4.0.1	4.0.3	ok	129 examples, 0 failures, 2 pending	ok, memorb-1.1.0.gem

Workflow file parses as valid YAML and passes actionlint (only pre-existing shellcheck style notes on the *.gemspec / *.gem globs).

Heads up for merging

This is the first time the publish job will actually fire. Merging to main will push memorb 1.1.0 to GitHub Packages.