From 09beec06e52fb544a2cad98f34e2f359f8dc935f Mon Sep 17 00:00:00 2001 From: "A. Wilcox" Date: Tue, 24 Feb 2026 17:36:04 -0600 Subject: [PATCH] Update remaining Gems to current versions Notable changes: * Rack 3.x sends all HTTP headers uncapital. I don't like it either, but that's the way it is. Any case-sensitive header matching will need to be updated accordingly. * Puma 4.x doesn't slot into Rack 3.x, so we are now on Puma 7. There are no configuration differences between them, and it seems to even run a little faster. * Rubocop added more checks; the only one that caught anything was `RSpecRails/HttpStatusNameConsistency`, where we were using the deprecated `:unprocessable_entity` symbol instead of `:unprocessable_content`. * Selenium 4 removes the ability to specify Chrome logging parameters the way we were doing it. There is a (slightly more complex) way to do it, but `ALL` seems to be the default now anyway, so just remove this for now. * Brakeman 8 brings full Rails 8 compatibility. * Lots of other security, bug, and QOI improvements. Closes: AP-270 --- .idea/altmedia.iml | 155 ++++++------ .rubocop.yml | 15 ++ Gemfile | 3 +- Gemfile.lock | 225 +++++++++--------- .../location_requests_controller.rb | 2 +- .../proxy_borrower_forms_controller.rb | 4 +- spec/capybara_helper.rb | 7 +- .../proxy_borrower_forms_request_spec.rb | 2 +- 8 files changed, 214 insertions(+), 199 deletions(-) diff --git a/.idea/altmedia.iml b/.idea/altmedia.iml index 59b3ebfb..2494db99 100644 --- a/.idea/altmedia.iml +++ b/.idea/altmedia.iml @@ -42,10 +42,9 @@ - + - @@ -55,83 +54,82 @@ - + - - + + - + - - - - + + + - + - + - - + + - + - - - - + + + - - - - + + + + - - + + - - - - - + + + + + - + - + - + - + - + - + - + + - + - - - + + + @@ -139,92 +137,90 @@ - + - - - + + + - + - + - - + + - - - + + + - + - + - + - - + + - + - + - + - + - + - - + - + - - + + - - + + - + - - + + - - - - + + + - + @@ -416,11 +412,6 @@ - - - - - diff --git a/.rubocop.yml b/.rubocop.yml index 29690ec1..148ed7b3 100644 --- a/.rubocop.yml +++ b/.rubocop.yml @@ -1,5 +1,6 @@ plugins: - rubocop-rails + - rubocop-rspec_rails AllCops: UseCache: false @@ -578,3 +579,17 @@ Rails/WhereNotWithMultipleConditions: # new in 2.17 Enabled: true Rails/WhereRange: # new in 2.25 Enabled: true +RSpecRails/AvoidSetupHook: # new in 2.4 + Enabled: true +RSpecRails/HaveHttpStatus: # new in 2.12 + Enabled: true +RSpecRails/HttpStatusNameConsistency: # new in 2.32 + Enabled: true +RSpecRails/InferredSpecType: # new in 2.14 + Enabled: true +RSpecRails/MinitestAssertions: # new in 2.17 + Enabled: true +RSpecRails/NegationBeValid: # new in 2.23 + Enabled: true +RSpecRails/TravelAround: # new in 2.19 + Enabled: true diff --git a/Gemfile b/Gemfile index d3bb23f6..b5663dac 100644 --- a/Gemfile +++ b/Gemfile @@ -30,9 +30,10 @@ gem 'omniauth-cas', '~> 3.0' gem 'omniauth-rails_csrf_protection', '~> 1.0' gem 'pg', '~> 1.2' gem 'prawn', '~> 2.4' -gem 'puma', '~> 4.3', '>= 4.3.12' +gem 'puma', '~> 7.2' gem 'rails', '~> 8.0.4' gem 'recaptcha', '~> 4.13' +gem 'sassc-rails' gem 'sprockets', '~> 4.0' gem 'tzinfo-data', platforms: %i[windows jruby] diff --git a/Gemfile.lock b/Gemfile.lock index 9c26dd6f..ca96e380 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -72,12 +72,10 @@ GEM securerandom (>= 0.3) tzinfo (~> 2.0, >= 2.0.5) uri (>= 0.13.1) - addressable (2.8.1) - public_suffix (>= 2.0.2, < 6.0) + addressable (2.8.8) + public_suffix (>= 2.0.2, < 8.0) amazing_print (1.8.1) ast (2.4.3) - autoprefixer-rails (10.4.7.0) - execjs (~> 2) base64 (0.3.0) benchmark (0.5.0) berkeley_library-alma (0.1.1) @@ -119,34 +117,34 @@ GEM berkeley_library-logging (~> 0.3) rest-client (~> 2.1) typesafe_enum (~> 0.3) - bigdecimal (3.2.2) + bigdecimal (3.3.1) bindex (0.8.1) - bootstrap (5.2.2) - autoprefixer-rails (>= 9.1.0) - popper_js (>= 2.11.6, < 3) - sassc-rails (>= 2.0.0) - brakeman (5.3.1) + bootstrap (5.3.8) + popper_js (>= 2.11.8, < 3) + brakeman (8.0.2) + racc builder (3.3.0) - bundle-audit (0.1.0) + bundle-audit (0.2.0) bundler-audit - bundler-audit (0.9.1) - bundler (>= 1.2.0, < 3) + bundler-audit (0.9.3) + bundler (>= 1.2.0) thor (~> 1.0) - byebug (11.1.3) - capybara (3.38.0) + byebug (13.0.0) + reline (>= 0.6.0) + capybara (3.40.0) addressable matrix mini_mime (>= 0.1.3) - nokogiri (~> 1.8) + nokogiri (~> 1.11) rack (>= 1.6.0) rack-test (>= 0.6.3) regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) - childprocess (4.1.0) colorize (1.1.0) - concurrent-ruby (1.3.5) + concurrent-ruby (1.3.6) connection_pool (3.0.2) - crack (0.4.5) + crack (1.0.1) + bigdecimal rexml crass (1.0.6) csv (3.2.9) @@ -155,64 +153,70 @@ GEM database_cleaner-core (~> 2.0) database_cleaner-core (2.0.1) date (3.5.1) - diff-lcs (1.5.0) - docile (1.4.0) + diff-lcs (1.6.2) + docile (1.4.1) domain_name (0.6.20240107) dotenv (2.8.1) dotenv-rails (2.8.1) dotenv (= 2.8.1) railties (>= 3.2) drb (2.2.3) - erb (6.0.1) + erb (6.0.2) erubi (1.13.1) et-orbi (1.4.0) tzinfo - execjs (2.8.1) - faraday (2.7.0) - faraday-net_http (>= 2.0, < 3.1) - ruby2_keywords (>= 0.0.4) - faraday-net_http (3.0.2) - ffi (1.15.5) + faraday (2.14.1) + faraday-net_http (>= 2.0, < 3.5) + json + logger + faraday-net_http (3.4.2) + net-http (~> 0.5) + ffi (1.17.3-aarch64-linux-gnu) + ffi (1.17.3-arm64-darwin) + ffi (1.17.3-x86_64-linux-gnu) fugit (1.12.1) et-orbi (~> 1.4) raabro (~> 1.4) - globalid (1.2.1) + globalid (1.3.0) activesupport (>= 6.1) - good_job (4.13.2) + good_job (4.13.3) activejob (>= 6.1.0) activerecord (>= 6.1.0) concurrent-ruby (>= 1.3.1) fugit (>= 1.11.0) railties (>= 6.1.0) thor (>= 1.0.0) - hashdiff (1.0.1) - hashie (5.0.0) + hashdiff (1.2.1) + hashie (5.1.0) + logger http-accept (1.7.0) - http-cookie (1.0.8) + http-cookie (1.1.0) domain_name (~> 0.5) - i18n (1.14.7) + i18n (1.14.8) concurrent-ruby (~> 1.0) ice_nine (0.11.2) io-console (0.8.2) ipaddress (0.8.3) - irb (1.16.0) + irb (1.17.0) pp (>= 0.6.0) + prism (>= 1.3.0) rdoc (>= 4.0.0) reline (>= 0.4.2) - jaro_winkler (1.5.5) - jquery-rails (4.5.1) + jaro_winkler (1.5.6) + jquery-rails (4.6.1) rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) - jquery-ui-rails (6.0.1) + jquery-ui-rails (8.0.0) railties (>= 3.2.16) - json (2.7.2) + json (2.18.1) jsonpath (0.5.8) multi_json jwt (1.5.6) language_server-protocol (3.17.0.5) lint_roller (1.1.0) - listen (3.9.0) + listen (3.10.0) + logger rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) logger (1.7.0) @@ -221,7 +225,7 @@ GEM activesupport (>= 4) railties (>= 4) request_store (~> 1.0) - loofah (2.24.1) + loofah (2.25.0) crass (~> 1.0.2) nokogiri (>= 1.12.0) mail (2.9.0) @@ -230,20 +234,24 @@ GEM net-imap net-pop net-smtp - marc (1.3.0) + marc (1.4.0) nokogiri (~> 1.0) rexml marcel (1.0.4) - matrix (0.4.2) + matrix (0.4.3) mime-types (3.7.0) logger mime-types-data (~> 3.2025, >= 3.2025.0507) - mime-types-data (3.2025.0722) + mime-types-data (3.2026.0224) mini_mime (1.1.5) - minitest (5.25.5) + minitest (6.0.2) + drb (~> 2.0) + prism (~> 1.5) multi_json (1.19.1) mutex_m (0.3.0) - net-imap (0.6.2) + net-http (0.9.1) + uri (>= 0.11.1) + net-imap (0.6.3) date net-protocol net-pop (0.1.2) @@ -252,17 +260,17 @@ GEM timeout net-smtp (0.5.1) net-protocol - net-ssh (7.0.1) + net-ssh (7.3.0) netaddr (1.5.3) netrc (0.11.0) - nio4r (2.7.4) - nokogiri (1.18.9-aarch64-linux-gnu) + nio4r (2.7.5) + nokogiri (1.19.1-aarch64-linux-gnu) racc (~> 1.4) - nokogiri (1.18.9-arm64-darwin) + nokogiri (1.19.1-arm64-darwin) racc (~> 1.4) - nokogiri (1.18.9-x86_64-linux-gnu) + nokogiri (1.19.1-x86_64-linux-gnu) racc (~> 1.4) - oj (3.16.11) + oj (3.16.15) bigdecimal (>= 3.0) ostruct (>= 0.2) okcomputer (1.19.1) @@ -283,39 +291,43 @@ GEM ougai (2.0.0) oj (~> 3.10) parallel (1.27.0) - parser (3.3.8.0) + parser (3.3.10.2) ast (~> 2.4.1) racc parslet (2.0.0) - pdf-core (0.9.0) - pg (1.4.4) - popper_js (2.11.6) + pdf-core (0.10.0) + pg (1.6.3-aarch64-linux) + pg (1.6.3-arm64-darwin) + pg (1.6.3-x86_64-linux) + popper_js (2.11.8) pp (0.6.3) prettyprint - prawn (2.4.0) - pdf-core (~> 0.9.0) - ttfunk (~> 1.7) + prawn (2.5.0) + matrix (~> 0.4) + pdf-core (~> 0.10.0) + ttfunk (~> 1.8) prettyprint (0.2.0) - prism (1.4.0) + prism (1.9.0) psych (5.3.1) date stringio - public_suffix (5.0.1) - puma (4.3.12) + public_suffix (7.0.2) + puma (7.2.0) nio4r (~> 2.0) raabro (1.4.0) racc (1.8.1) - rack (2.2.17) - rack-protection (3.2.0) + rack (3.2.5) + rack-protection (4.2.1) + base64 (>= 0.1.0) + logger (>= 1.6.0) + rack (>= 3.0.0, < 4) + rack-session (2.1.1) base64 (>= 0.1.0) - rack (~> 2.2, >= 2.2.4) - rack-session (1.0.2) - rack (< 3) + rack (>= 3.0.0) rack-test (2.2.0) rack (>= 1.3) - rackup (1.0.1) - rack (< 3) - webrick + rackup (2.3.1) + rack (>= 3) rails (8.0.4) actioncable (= 8.0.4) actionmailbox (= 8.0.4) @@ -334,8 +346,8 @@ GEM activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.6.2) - loofah (~> 2.21) + rails-html-sanitizer (1.7.0) + loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) railties (8.0.4) actionpack (= 8.0.4) @@ -347,18 +359,18 @@ GEM tsort (>= 0.2) zeitwerk (~> 2.6) rainbow (3.1.1) - rake (13.3.0) + rake (13.3.1) rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rchardet (1.9.0) - rdoc (7.1.0) + rchardet (1.10.0) + rdoc (7.2.0) erb psych (>= 4.0.0) tsort recaptcha (4.14.0) json - regexp_parser (2.10.0) + regexp_parser (2.11.3) reline (0.6.3) io-console (~> 0.5) request_store (1.7.0) @@ -369,7 +381,7 @@ GEM mime-types (>= 1.16, < 4.0) netrc (~> 0.8) rexml (3.4.4) - roo (2.9.0) + roo (2.10.1) nokogiri (~> 1) rubyzip (>= 1.3.0, < 3.0.0) rspec (3.13.2) @@ -392,7 +404,7 @@ GEM rspec-expectations (~> 3.13) rspec-mocks (~> 3.13) rspec-support (~> 3.13) - rspec-support (3.13.6) + rspec-support (3.13.7) rspec_junit_formatter (0.6.0) rspec-core (>= 2, < 4, != 2.12.0) rubocop (1.77.0) @@ -406,9 +418,9 @@ GEM rubocop-ast (>= 1.45.1, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 4.0) - rubocop-ast (1.46.0) + rubocop-ast (1.49.0) parser (>= 3.3.7.2) - prism (~> 1.4) + prism (~> 1.7) rubocop-rails (2.32.0) activesupport (>= 4.2.0) lint_roller (~> 1.1) @@ -418,7 +430,7 @@ GEM rubocop-rspec (3.6.0) lint_roller (~> 1.1) rubocop (~> 1.72, >= 1.72.1) - rubocop-rspec_rails (2.31.0) + rubocop-rspec_rails (2.32.0) lint_roller (~> 1.1) rubocop (~> 1.72, >= 1.72.1) rubocop-rspec (~> 3.5) @@ -428,7 +440,6 @@ GEM typesafe_enum (~> 0.3) ruby-prof (1.3.2) ruby-progressbar (1.13.0) - ruby2_keywords (0.0.5) rubyXL (3.4.34) nokogiri (>= 1.10.8) rubyzip (~> 2.4) @@ -442,16 +453,17 @@ GEM sprockets-rails tilt securerandom (0.4.1) - selenium-webdriver (4.6.1) - childprocess (>= 0.5, < 5.0) + selenium-webdriver (4.41.0) + base64 (~> 0.2) + logger (~> 1.4) rexml (~> 3.2, >= 3.2.5) - rubyzip (>= 1.2.2, < 3.0) + rubyzip (>= 1.2.2, < 4.0) websocket (~> 1.0) simplecov (0.22.0) docile (~> 1.1) simplecov-html (~> 0.11) simplecov_json_formatter (~> 0.1) - simplecov-html (0.12.3) + simplecov-html (0.13.2) simplecov-rcov (0.3.7) simplecov (>= 0.4.1) simplecov_json_formatter (0.1.4) @@ -459,45 +471,45 @@ GEM spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) - sprockets (4.1.1) + sprockets (4.2.2) concurrent-ruby (~> 1.0) - rack (> 1, < 3) - sprockets-rails (3.4.2) - actionpack (>= 5.2) - activesupport (>= 5.2) + logger + rack (>= 2.2.4, < 4) + sprockets-rails (3.5.2) + actionpack (>= 6.1) + activesupport (>= 6.1) sprockets (>= 3.0.0) stringio (3.2.0) - thor (1.4.0) - tilt (2.0.11) + thor (1.5.0) + tilt (2.7.0) timeout (0.6.0) tsort (0.2.0) - ttfunk (1.7.0) + ttfunk (1.8.0) + bigdecimal (~> 3.1) typesafe_enum (0.3.1) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - unicode-display_width (3.1.4) - unicode-emoji (~> 4.0, >= 4.0.4) - unicode-emoji (4.0.4) + unicode-display_width (3.2.0) + unicode-emoji (~> 4.1) + unicode-emoji (4.2.0) uri (1.1.1) useragent (0.16.11) - web-console (4.2.0) - actionview (>= 6.0.0) - activemodel (>= 6.0.0) + web-console (4.3.0) + actionview (>= 8.0.0) bindex (>= 0.4.0) - railties (>= 6.0.0) - webmock (3.18.1) + railties (>= 8.0.0) + webmock (3.26.1) addressable (>= 2.8.0) crack (>= 0.3.2) hashdiff (>= 0.4.0, < 2.0.0) - webrick (1.8.1) - websocket (1.2.9) + websocket (1.2.11) websocket-driver (0.8.0) base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.7.3) + zeitwerk (2.7.5) PLATFORMS aarch64-linux-gnu @@ -539,7 +551,7 @@ DEPENDENCIES omniauth-rails_csrf_protection (~> 1.0) pg (~> 1.2) prawn (~> 2.4) - puma (~> 4.3, >= 4.3.12) + puma (~> 7.2) rails (~> 8.0.4) recaptcha (~> 4.13) roo (~> 2.8) @@ -551,6 +563,7 @@ DEPENDENCIES rubocop-rspec (~> 3.6.0) rubocop-rspec_rails ruby-prof (~> 1.3.0) + sassc-rails selenium-webdriver (~> 4.0) simplecov (~> 0.22) simplecov-rcov (~> 0.3.7) diff --git a/app/controllers/location_requests_controller.rb b/app/controllers/location_requests_controller.rb index 9014b68a..9073c3bf 100644 --- a/app/controllers/location_requests_controller.rb +++ b/app/controllers/location_requests_controller.rb @@ -34,7 +34,7 @@ def create flash[:success] = 'Location request scheduled.' redirect_to location_request_url(@location_request) else - render :new, status: :unprocessable_entity + render :new, status: :unprocessable_content end end diff --git a/app/controllers/proxy_borrower_forms_controller.rb b/app/controllers/proxy_borrower_forms_controller.rb index 86c01344..d2c2e277 100644 --- a/app/controllers/proxy_borrower_forms_controller.rb +++ b/app/controllers/proxy_borrower_forms_controller.rb @@ -39,7 +39,7 @@ def process_dsp_request @form.submit! render 'result', status: :created else - render 'dsp_form', status: :unprocessable_entity + render 'dsp_form', status: :unprocessable_content end end @@ -55,7 +55,7 @@ def process_faculty_request render 'result', status: :created else # Failed to save - rerender the faculty form: - render 'faculty_form', status: :unprocessable_entity + render 'faculty_form', status: :unprocessable_content end end diff --git a/spec/capybara_helper.rb b/spec/capybara_helper.rb index 94ce3d5d..2436d6fd 100644 --- a/spec/capybara_helper.rb +++ b/spec/capybara_helper.rb @@ -113,12 +113,7 @@ def configure_capybara! Capybara.register_driver(driver_name) do |app| capabilities = [ - chrome_options, - ::Selenium::WebDriver::Remote::Capabilities.chrome( - 'goog:loggingPrefs' => { - browser: 'ALL', driver: 'ALL' - } - ) + chrome_options ] options = { capabilities: }.merge(driver_opts) Capybara::Selenium::Driver.new(app, **options) diff --git a/spec/request/proxy_borrower_forms_request_spec.rb b/spec/request/proxy_borrower_forms_request_spec.rb index 50f172f4..ffcc6dbd 100644 --- a/spec/request/proxy_borrower_forms_request_spec.rb +++ b/spec/request/proxy_borrower_forms_request_spec.rb @@ -189,7 +189,7 @@ renewal: '' } }) - expect(response).to have_http_status :unprocessable_entity + expect(response).to have_http_status :unprocessable_content expect(response.body).to match(/Please correct these and resubmit the form/) end