Commit Graph

199 Commits

Author SHA1 Message Date
David Heinemeier Hansson
e3da4fc53d
Add allow_browser to set minimum versions for your application (#50505)
* Add allow_browser to set minimum versions for your application
2023-12-31 19:19:16 +01:00
Jean Boussier
6ba2fdb2fe Bump the required Ruby version to 3.1.0
Until now, Rails only droped compatibility with older
rubies on new majors, but I propose to change this policy
because it causes us to either keep compatibility with long
EOLed rubies or to bump the Rails major more often, and to
drop multiple Ruby versions at once when we bump the major.

In my opinion it's a bad alignments of incentives. And we'd
be much better to just drop support in new minors whenever they
go EOL (so 3 years).

Also Ruby being an upstream dependency, it's not even
a semver violation AFAICT.

Since Rails 7.2 isn't planned before a few months, we
can already drop Ruby 3.0 as it will be EOL in March.
2023-12-31 08:54:03 +01:00
Hartley McGuire
5005480adf
Add racc dependency because it will be bundled
Ruby 3.3.0 is going to start warning for racc not being specififed as a
dependency, and Ruby 3.4.0 will raise if it is not specified.

This commit prevents those issues by adding racc to the Action Pack
gemspec, since `racc/parser` is a runtime dependency of the Journey
parser.
2023-10-20 12:59:18 -04:00
Mike Dalessio
8a57ba8c0e
Update Action View and Dispatch to use Rails::Dom::Testing helpers
Use the helpers introduced in rails-dom-testing 2.2.0 instead of
managing the HTML parsers as was done in #48523.

See also related #47144 / ad79ed0e
2023-08-03 11:17:38 -04:00
Mike Dalessio
500ccaaeea
Update dependency on rails-html-sanitizer to ~>1.6
for HTML5 sanitizer support
2023-05-28 14:00:35 -04:00
Sean Doyle
ad79ed0e6b ActionDispatch::Testing::TestResponse#parsed_body parse HTML with Nokogiri
Prior to this commit, the only out-of-the-box parsing that
`ActionDispatch::Testing::TestResponse#parsed_body` supported was for
`application/json` requests. This meant that `response.body ==
response.parsed_body` for HTML requests.

```ruby
get "/posts"
response.content_type         # => "text/html; charset=utf-8"
response.parsed_body.class    # => Nokogiri::HTML5::Document
response.parsed_body.to_html  # => "<!DOCTYPE html>\n<html>\n..."
```

Using `parsed_body` for JSON requests supports `Hash#fetch`, `Hash#dig`,
and Ruby 3.2 destructuring assignment and pattern matching.

The introduction of [Nokogiri support for pattern
matching][nokogiri-pattern-matching] poses an opportunity to make assertions
about the structure of the HTML response.

On top of that, there is ongoing work to [introduce pattern matching
support in MiniTest][minitest-pattern-matching].

[nokogiri-pattern-matching]: https://github.com/sparklemotion/nokogiri/pull/2523
[minitest-pattern-matching]: https://github.com/minitest/minitest/pull/936
2023-01-27 23:52:21 -05:00
Rafael Mendonça França
1b44989521
Merge PR #46594 2023-01-25 20:13:18 +00:00
Rafael Mendonça França
859b526c5b
Remove upper bound of rack
Allow users to install any version and try to see if Rails is compatible.
2023-01-25 15:25:49 +00:00
zzak
896c7faedf Use Gemfile to manage Rack version for dev 2023-01-25 12:24:19 +09:00
Samuel Williams
4c58755862
Add rack-session and rackup gems.
Rack 2 includes this code, but in Rack 3 it was extracted into gems. These
gems include a v1 release compatible with Rack 2, and a v2 release
compatible with Rack v3+.
2023-01-21 06:03:41 +13:00
Josef Šimánek
b0fdca4fbc Rescue Rack::QueryParser::ParamsTooDeepError in HTTP request.
- render HTTP 400
- needs Rack 2.2.4+
2022-09-11 01:40:28 +02:00
Rafael Mendonça França
1fde031e89 Fix gemspec 2021-11-15 21:06:21 +00:00
Rafael Mendonça França
9195b7fd0a
Require MFA to release rails 2021-11-15 20:37:42 +00:00
John Hawthorn
14688b5578 Bump rack to remove ssl? override
Rack 2.2+ already understands "wss" as being "ssl", so bumping the
requirement lets us remove this override and call to super.
2021-06-01 11:15:14 -07:00
Rafael Mendonça França
6487836af8
Rails 7 requires Ruby 2.7 and prefer Ruby 3+
The code cleanup is comming in later commits but this
already remove support to Ruby < 2.7.
2021-02-04 16:34:53 +00:00
Eugene Kenny
d58739e226 Update minimum Rack version to 2.0.9
Since 28f81c05589e4be98b6500b2b915842c68846c41, if the `same_site:`
option is set to `:none` when creating a cookie, it will be passed
through to Rack. Support for `:none` was added in Rack 2.0.9, so we
should bump the minimum required version to ensure it's available.
2020-04-19 23:28:18 +01:00
Abhay Nikam
bdfffd1355 Update the Rails mailing list URLs to new discuss discourse URL [ci skip] 2020-04-02 22:00:28 +05:30
Rafael Mendonça França
92ec9f270d
Fix possible information leak / session hijacking vulnerability.
The `ActionDispatch::Session::MemcacheStore` is still vulnerable
given it requires the gem dalli to be updated as well.

CVE-2019-16782
2019-12-18 17:01:09 -03:00
Orien Madgwick
493edf044f Add bug tracker/documentation/mailing list URIs to the gemspecs 2019-10-11 20:47:19 -04:00
Kasper Timm Hansen
12001611d6
Require and support rails-html-sanitzer 1.2.0
Rails now requires 1.2.0 because it relies on the safe_list_sanitizer
API exclusively.

Also raise `sanitizer_vendor` API from the dead for
rails-deprecated_sanitizer.

Fixes https://github.com/rails/rails-deprecated_sanitizer/pull/6
2019-08-09 00:07:45 +02:00
Abhay Nikam
476abd403b Updated links from http to https in guides, docs, etc 2019-03-09 16:43:47 +05:30
Kasper Timm Hansen
647d7e6167
Revert "Revert "Merge pull request #34387 from yhirano55/rails_info_properties_json""
I reverted the wrong commit. Damn it.

This reverts commit f66a977fc7ae30d2a07124ad91924c4ee638a703.
2019-01-08 22:19:22 +01:00
Kasper Timm Hansen
f66a977fc7
Revert "Merge pull request #34387 from yhirano55/rails_info_properties_json"
We had a discussion on the Core team and we don't want to expose this information
as a JSON endpoint and not by default.

It doesn't make sense to expose this JSON locally and this controller is only
accessible in dev, so the proposed access from a production app seems off.

This reverts commit 8eaffe7e89719ac62ff29c2e4208cfbeb1cd1c38, reversing
changes made to b6e4305c3bca4c673996d0af9db0f4cfbf50215e.
2019-01-08 22:16:58 +01:00
Kasper Timm Hansen
1b7c3222e8
Require Ruby 2.5 for Rails 6.
Generally followed the pattern for https://github.com/rails/rails/pull/32034

* Removes needless CI configs for 2.4
* Targets 2.5 in rubocop
* Updates existing CHANGELOG entries for fewer merge conflicts
* Removes Hash#slice extension as that's inlined on Ruby 2.5.
* Removes the need for send on define_method in MethodCallAssertions.
2018-12-19 21:47:50 +01:00
Gannon McGibbon
e74fdbe00c Amend CVE note and security guide section wordings
Reword first sentence of dep management and CVE section of
security guide. Also, reword and move gemspec notes above deps.

[ci skip]
2018-11-06 18:06:57 -05:00
Gannon McGibbon
1c11688b56 Add CVE note to security guide and gemspecs
[ci skip]
2018-11-06 14:25:36 -05:00
Jeremy Daer
d4eb0dc89e Rails 6 requires Ruby 2.4.1+
Skipping over 2.4.0 to sidestep the `"symbol_from_string".to_sym.dup` bug.

References #32028
2018-02-17 15:34:57 -08:00
Rafael Mendonça França
0ea8e7db1a Remove support to Ruby 2.2
Rails 6 will only support Ruby >= 2.3.
2018-02-16 18:52:10 -05:00
Kir Shatrov
dfcc766163 Use frozen string literal in actionpack/ 2017-07-29 14:02:40 +03:00
Dwight Watson
de550be5ea Update rack-test dependency constraint 2017-07-24 15:09:00 +10:00
Matthew Draper
87b3e226d6 Revert "Merge pull request #29540 from kirs/rubocop-frozen-string"
This reverts commit 3420a14590c0e6915d8b6c242887f74adb4120f9, reversing
changes made to afb66a5a598ce4ac74ad84b125a5abf046dcf5aa.
2017-07-02 02:15:17 +09:30
Kir Shatrov
cfade1ec7e Enforce frozen string in Rubocop 2017-07-01 02:11:03 +03:00
Grey Baker
3e6ce1cd69 Add source code and changelog links to gemspecs 2017-06-28 10:06:01 +01:00
bogdanvlviv
40bdbce191
Define path with __dir__
".. with __dir__ we can restore order in the Universe." - by @fxn

Related to 5b8738c2df003a96f0e490c43559747618d10f5f
2017-05-23 00:53:51 +03:00
Xavier Noria
adca8154c6 applies new string literal convention in the gemspecs
The current code base is not uniform. After some discussion,
we have chosen to go with double quotes by default.
2016-08-06 19:27:12 +02:00
Rafael Mendonça França
3bf0fe4a9c
Do not allow rack pre releases 2016-06-30 15:12:08 -03:00
Connor Shea
86c860ff0c
Update rails-dom-testing gem to 2.0
Resolves #24924.
2016-05-09 20:23:42 -06:00
Xavier Noria
1eb27fafa9 revises the homepage URL in the gemspecs [ci skip]
References https://github.com/rails/homepage/issues/46.
2016-03-10 07:55:27 +01:00
Rafael Mendonça França
9b5ae716db Revert "Merge pull request #23562 from Azzurrio/patch-1"
This reverts commit 8c3cca5e113213958469b1cec8aa9a664535251a, reversing
changes made to 9dcf67c4da35b165301865d9721da1d552f7e03f.

Reason: https://github.com/rails/rails/pull/23562#issuecomment-181442569
2016-02-08 14:09:29 -02:00
Karim El-Husseiny
ec82c13dd4 Update rails-html-sanitizer version to v1.0.3
rails-html-sanitizer 1.0.2 is vulnerable: https://groups.google.com/d/msg/rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ
2016-02-08 17:04:31 +02:00
Aaron Patterson
51211a94bd point at rack master 2015-08-20 13:45:11 -07:00
Rafael Mendonça França
8aadbeb3de Remove concurrent-ruby from Action Pack gemspec
It is already on Active Support
2015-07-14 15:17:41 -03:00
Jerry D'Antonio
284a9ba8ec Replaced ActiveSupport::Concurrency::Latch with concurrent-ruby.
The concurrent-ruby gem is a toolset containing many concurrency
utilities. Many of these utilities include runtime-specific
optimizations when possible. Rather than clutter the Rails codebase with
concurrency utilities separate from the core task, such tools can be
superseded by similar tools in the more specialized gem. This commit
replaces `ActiveSupport::Concurrency::Latch` with
`Concurrent::CountDownLatch`, which is functionally equivalent.
2015-07-13 15:44:21 -04:00
Jon Atack
32f7491808 Upgrade to Ruby 2.2.2
and fix the grammar in the ruby_version_check.rb user message.
2015-04-14 08:41:56 +05:30
Rafael Mendonça França
2c1f6267f9 Merge pull request #19252 from kaspth/single-escaping-strip-tags
Let strip_tags leave HTML escaping to Rails.
2015-03-10 16:05:47 -03:00
Kasper Timm Hansen
37695b8aab Let strip_tags leave HTML escaping to Rails.
Prevents double escaping errors, such as "&amp;" becoming "&amp;amp;".
2015-03-10 20:04:01 +01:00
Peter Suschlik
f0768eba28 Target Ruby 2.2.1 in gemspecs
This is a follow-up to #19257
2015-03-09 09:56:26 +01:00
eileencodes
e1e2b54e85 Bump rack-test to fix nil values being sent to parse_nested_query
I found that nil values were being incorrectly sent to
`parse_nested_query` in Rack. Originally it was thought that Rails was
doing something incorrect but it was actually rack-test. This was fixed
in brynary/rack-test@4a4b2c1 and is no longer an issue. This commit
bumps rack-test in Rails so changes to Rack don't cause failures.

See rack/rack#813 for more information.
2015-03-01 16:58:15 -05:00
Santiago Pastorino
da175a2b46 Relax Rack dependency
Rack is very carefully released, we should be able to upgrade minor
versions without much effort. We are a bunch of Rails core who are also
Rack core members so there won't be any issue with that. And in case
there's something wrong, we should fix on both sides.
Even though, doesn't seem like we will have a 1.7 version, this will be
useful as an example for when we go with Rack 2.0. We should ~> 2.0.
2015-01-12 15:32:33 -02:00
claudiob
d3b098b828 Require Ruby 2.2 for Rails 5.0
Stems from [this comment](https://github.com/rails/rails/pull/18203#issuecomment-68138096) by @robin850
and by the blog post http://weblog.rubyonrails.org/2014/12/19/Rails-4-2-final
2014-12-26 13:53:09 +01:00