ci: add brakeman and bundler audit checks to script/ci/run - #1211
Open
mediafinger wants to merge 20 commits into
Open
mediafinger wants to merge 20 commits into
mediafinger wants to merge 20 commits into
Conversation
Before the change the following was thrown: DEPRECATION WARNING: Support for the pre-Ruby 2.4 behavior of to_time has been deprecated and will be removed in Rails 8.0.
Remove outdated gems
test: add system specs for authentication and event registration # Missing specs, system specs and request instead of controller specs > **Motivation:** > In case you are open to modernizing on_ruby, more specs will be more helpful. Btw: the diff might be big, but it's almost exclusively new specs. ## New system specs * added Capybara configuration * added spec for GitHub & Google OAuth * added spec for email registration * ensure new email user has a name set _(the only functional change)_ * added spec to ensure event attend button works * added specs for the admin and super admin area ## Replaced the (outdated) controller specs with `request` specs 1. **Realistic Authentication:** Instead of mocking `controller.current_user` (which bypassed authentication middleware and session cookies), [`login_as(user)`](file:///Users/andy/Dropbox/www/RubyAndFriends/on_ruby/spec/support/authentication_helper.rb#L27) uses the real OmniAuth callback route to establish a genuine session cookie that persists across requests in the test. 2. **True Full-Stack Requests:** HTTP status codes (`be_ok`, `have_http_status(:unprocessable_entity)`), response headers, template rendering, and redirects (`redirect_to(login_path)`) are tested through the complete Rack middleware pipeline. 3. **Dependency Cleanup:** Enabled the removal of legacy gems `rails-controller-testing` and `rspec-collection_matchers` from the `Gemfile`. 4. **Clean Matchers:** Replaced outdated `have(n).errors_on(...)` with a lightweight [`ValidationHelper#errors_on`](file:///Users/andy/Dropbox/www/RubyAndFriends/on_ruby/spec/support/validation_helper.rb#L5) for model specs. ## Modernize timezone handling and the post-login / RSVP flows This branch is mostly a test-suite migration (controller specs → request/system specs). The changes below are the parts that are **not** tests. ## Timezone / Local time handling > DEPRECATION WARNING: Support for the pre-Ruby 2.4 behavior of to_time has been deprecated and will be removed in Rails 8.0. - **Remove `ActiveSupport.to_time_preserves_timezone = false`** from `config/initializers/new_framework_defaults.rb`. This opts into the Rails 7.2 default (`to_time` keeps the receiver's zone) **and drops a setting that no longer exists in Rails 8 — a prerequisite for that upgrade.** - **`Event.current` / `Event.latest`** now compute the "today" boundary with `Date.current.beginning_of_day` instead of `Date.today.to_time`. The old form derived the cutoff from the process's system clock and system zone (and from the setting removed above); the new form uses the configured application zone (`Europe/Berlin`). This fixes events scheduled for "today" appearing or disappearing from the landing page depending on the server's UTC offset (e.g. a UTC production box vs. a developer machine in Berlin). - **`Event.infer_next_date_from`** uses `Time.current` instead of `Time.now`. - **`Usergroup#next_event_date`** is unchanged, but gains a `NOTE` comment documenting that it still relies on `Date.today` / `Time.new` (host clock and host zone) and how that behaves differently on a UTC server vs. a local machine. Left as-is deliberately to keep this change reviewable; a follow-up can standardize it on `Date.current` / `Time.zone.local`. ## Post-login flow `SessionsController#create` now redirects users whose name is still unset (`missing_name?` — every fresh email-auth user, and any OAuth provider that returned no name) to `edit_user_path` so they complete their profile, instead of dropping them at `omniauth.origin` / the site root. ## RSVP controls `EventsHelper#participation_link` renders the *attend* / *cancel* actions with `button_to` instead of `link_to ... method: :post/:delete`. Those links relied on rails-ujs / JavaScript to issue the non-GET request; `button_to` emits a real form, so the flow works without JavaScript (and is now exercisable under `rack_test` in system specs). Visual note: the control is now wrapped in `<form class="button_to">`, which may want a CSS tweak. ## Tooling - Drop `rails-controller-testing` and `rspec-collection_matchers` — unused after the controller → request spec migration. - Add `capybara` for the new system specs. - RuboCop config updated for the new spec layout. ## Before ``` Finished in 7.96 seconds (files took 2.17 seconds to load) 414 examples, 0 failures ``` ## After ``` Finished in 8.94 seconds (files took 1.95 seconds to load) 499 examples, 0 failures ``` ## TODO * [ ] test in browser: register via email without name set _(unclear how to test this in development)_ * [x] test in browser: styling of Event `attend` / `cancel` button
Updating ruby-advisory-db ... From https://github.com/rubysec/ruby-advisory-db * branch master -> FETCH_HEAD Already up to date. Updated ruby-advisory-db ruby-advisory-db: advisories: 1237 advisories last updated: 2026-08-31 08:01:03 -0400 commit: 0a02e5f06a8a7d02f2e067ee6489e511b67c06f7 Name: actionview Version: 7.2.3 CVE: CVE-2026-33168 GHSA: GHSA-v55j-83pf-r9cq Criticality: Unknown URL: GHSA-v55j-83pf-r9cq Title: Rails has a possible XSS vulnerability in its Action View tag helpers Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activestorage Version: 7.2.3 CVE: CVE-2026-33173 GHSA: GHSA-qcfx-2mfw-w4cg Criticality: Unknown URL: GHSA-qcfx-2mfw-w4cg Title: Rails Active Storage has possible content type bypass via metadata in direct uploads Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activestorage Version: 7.2.3 CVE: CVE-2026-33174 GHSA: GHSA-r46p-8f7g-vvvg Criticality: Unknown URL: GHSA-r46p-8f7g-vvvg Title: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activestorage Version: 7.2.3 CVE: CVE-2026-33195 GHSA: GHSA-9xrj-h377-fr87 Criticality: Unknown URL: GHSA-9xrj-h377-fr87 Title: Rails Active Storage has possible Path Traversal in DiskService Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activestorage Version: 7.2.3 CVE: CVE-2026-33202 GHSA: GHSA-73f9-jhhh-hr5m Criticality: Unknown URL: GHSA-73f9-jhhh-hr5m Title: Rails Active Storage has possible glob injection in its DiskService Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activestorage Version: 7.2.3 CVE: CVE-2026-33658 GHSA: GHSA-p9fm-f462-ggrg Criticality: Medium URL: GHSA-p9fm-f462-ggrg Title: Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activestorage Version: 7.2.3 CVE: CVE-2026-66066 GHSA: GHSA-xr9x-r78c-5hrm Criticality: Unknown URL: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066 Title: Possible arbitrary file read and remote code execution in Active Storage variant processing Solution: update to '~> 7.2.3, >= 7.2.3.2', '~> 8.0.5, >= 8.0.5.1', '>= 8.1.3.1' Name: activesupport Version: 7.2.3 CVE: CVE-2026-33169 GHSA: GHSA-cg4j-q9v8-6v38 Criticality: Unknown URL: GHSA-cg4j-q9v8-6v38 Title: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activesupport Version: 7.2.3 CVE: CVE-2026-33170 GHSA: GHSA-89vf-4333-qx8v Criticality: Unknown URL: GHSA-89vf-4333-qx8v Title: Rails Active Support has a possible XSS vulnerability in SafeBuffer#% Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: activesupport Version: 7.2.3 CVE: CVE-2026-33176 GHSA: GHSA-2j26-frm8-cmj9 Criticality: Unknown URL: GHSA-2j26-frm8-cmj9 Title: Rails Active Support has a possible DoS vulnerability in its number helpers Solution: update to '~> 7.2.3, >= 7.2.3.1', '~> 8.0.4, >= 8.0.4.1', '>= 8.1.2.1' Name: puma Version: 6.5.0 CVE: CVE-2026-47736 GHSA: GHSA-qpgp-93vx-g8v8 Criticality: High URL: https://www.cve.org/CVERecord?id=CVE-2026-47736 Title: Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion Solution: update to '~> 7.2.1', '>= 8.0.2' Name: puma Version: 6.5.0 CVE: CVE-2026-47737 GHSA: GHSA-2vqw-3mp8-cgmx Criticality: High URL: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-47737 Title: Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections Solution: update to '~> 7.2.1', '>= 8.0.2'
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keep safe!
script/ci/runis now running more checks!bundler audit
7.2.3->7.2.3.26.5.0->8.0.2brakeman