mirror of
https://github.com/we-promise/sure.git
synced 2026-07-11 20:35:17 +00:00
88343002d1
* chore(deps): upgrade Rails 7.2 → 8.1 Rails 7.2 reaches end of life on 2026-08-09. Bump the framework to the current 8.1.x line. - Gemfile: rails "~> 8.0" (resolves 8.1.3); bundle update rails pulls the Rails 8 framework gems plus the bumps it requires — ViewComponent 3.23 → 4.x (Rails 8 support), rails-i18n 7 → 8, rswag, and transitive deps. - app/models/transfer.rb: make Transfer#date nil-safe (inflow_transaction&.entry&.date). Rails 8's date_field evaluates the field default on a new/unpersisted Transfer (the new-transfer form), where the association is nil; without this, TransfersController#new raises "undefined method 'entry' for nil". Matches the &. pattern already used in Transfer#sync_account_later. Framework behavioral defaults are unchanged (config.load_defaults stays as-is). Validated on Rails 8.1.3: zeitwerk:check passes, full suite green (4904 runs, 0 failures, 0 errors), rubocop and brakeman clean. * fix(rails8): style textarea + deterministic property edit system test The Rails 8 gem bump kept config.load_defaults at 7.2, but Rails 8 renamed two ActionView::Helpers::FormBuilder field helpers regardless of defaults: :text_area → :textarea and :check_box → :checkbox. StyledFormBuilder builds its styled helpers from `field_helpers`, so `form.text_area` (e.g. the account "Notes" field) silently fell through to the unstyled base helper and rendered without a label — failing 8 system tests with `Unable to find field "Notes"`. - app/helpers/styled_form_builder.rb: exclude both spellings of the non-text helpers (:check_box and :checkbox) and alias the legacy `text_area` to the Rails 8 `textarea` so existing call sites stay styled. Harmless on Rails 7.2 (old names present instead). - test/system/property_test.rb: open the property edit dialog via the account menu with a retry. The account page issues a Turbo morph refresh shortly after load (turbo_refreshes_with :morph + a family-stream broadcast); opening the modal while that refresh is in flight let the morph re-render the page and wipe the just-loaded #modal turbo-frame. Rails 8 timing made the race deterministic. Retrying once the refresh has settled makes the test stable (confirmed via Turbo frame-load vs full-page morph event traces; 3x green in isolation). - config/brakeman.ignore: the added comment block shifted the pre-existing (already-ignored, Weak) class_eval Dangerous Eval warning from line 5 -> 10, changing its fingerprint. Re-point the existing suppression to the new fingerprint/line so scan_ruby stays green. Validated on Rails 8.1.3: full system suite green (92 runs, 355 assertions, 0 failures, 0 errors), rubocop clean, brakeman 0 warnings, CodeRabbit no findings. * chore(deps): pin rails to the 8.1 minor line (~> 8.1.0) Tighten the constraint from `~> 8.0` to `~> 8.1.0` (>= 8.1.0, < 8.2) so a future `bundle update rails` tracks the 8.1.x line rather than silently jumping to 8.2 when it ships. Matches the upgrade plan's stated intent (target 8.1.x for the EOL runway) and a review note on #2301. No resolved-version changes: bundle install keeps rails at 8.1.3 and every other locked gem unchanged — only the Gemfile.lock DEPENDENCIES constraint line moves. zeitwerk:check still passes; the already-green unit/system suites ran on this exact resolved tree. * chore(rails8): adopt Rails 8.1 framework defaults (config.load_defaults 8.1) The gem bump above kept config.load_defaults at 7.2 so the change set could be reasoned about in stages; this finalizes the upgrade by adopting the modern framework defaults now that the suite is green on Rails 8.1. Rails 8.0 added no new framework defaults (there is no new_framework_defaults_8_0 template), so 7.2 -> 8.1 is the single meaningful step. No incremental new_framework_defaults_8_1.rb opt-in file is needed: the full suites pass with all 8.1 defaults enabled at once. The 8.1 defaults this turns on include action_on_path_relative_redirect=:raise (open-redirect hardening), raise_on_missing_required_finder_order_columns, escape_json_responses=false / escape_js_separators_in_json=false (JSON perf), and Ruby-parser template-dependency tracking. Validated with no application code changes: bin/rails test 4904/0/0, bin/rails test:system 92/0/0, rubocop + brakeman clean. * chore(ci): restore brakeman CheckEOLRails now that the app is on Rails 8.1 config/brakeman.yml existed only to skip brakeman's CheckEOLRails. That check fires on the calendar (it warns 60 days before a framework's EOL and escalates as the date nears), so Rails 7.2's 2026-08-09 EOL turned `bin/brakeman` red (exit 3) on every branch and on main regardless of the diff. The skip carried a TODO to remove it once Sure upgraded off 7.2. This PR puts the app on Rails 8.1 (EOL well in the future), so the skip is obsolete; remove the file (its sole content was the skip) in the same change that makes it unnecessary -- no stale-config window. brakeman auto-loads the file when present and falls back to defaults when absent, and nothing references it explicitly. CheckEOLRuby was already enabled and is unchanged; config/brakeman.ignore is untouched. Validated on Rails 8.1: bin/brakeman runs EOLRails + EOLRuby, 0 warnings, 0 errors, exit 0.
152 lines
2.9 KiB
Ruby
152 lines
2.9 KiB
Ruby
source "https://rubygems.org"
|
|
|
|
ruby file: ".ruby-version"
|
|
|
|
# Rails
|
|
gem "rails", "~> 8.1.0"
|
|
|
|
# Drivers
|
|
gem "pg", "~> 1.5"
|
|
gem "redis", "~> 5.4"
|
|
|
|
# Deployment
|
|
gem "puma", ">= 5.0"
|
|
gem "bootsnap", require: false
|
|
|
|
# Assets
|
|
gem "importmap-rails"
|
|
gem "propshaft"
|
|
gem "tailwindcss-rails"
|
|
gem "lucide-rails"
|
|
|
|
# Hotwire + UI
|
|
gem "stimulus-rails"
|
|
gem "turbo-rails"
|
|
gem "view_component"
|
|
|
|
# https://github.com/lookbook-hq/lookbook/issues/712
|
|
# TODO: Remove max version constraint when fixed
|
|
gem "lookbook", "2.3.11"
|
|
|
|
gem "hotwire_combobox"
|
|
|
|
# Background Jobs
|
|
gem "connection_pool", "~> 2.5" # pin to 2.x; 3.0 breaks sidekiq 8.x
|
|
gem "sidekiq"
|
|
gem "sidekiq-cron"
|
|
gem "sidekiq-unique-jobs"
|
|
|
|
# Monitoring
|
|
gem "vernier"
|
|
gem "rack-mini-profiler"
|
|
gem "sentry-ruby"
|
|
gem "sentry-rails"
|
|
gem "sentry-sidekiq"
|
|
gem "posthog-ruby"
|
|
gem "logtail-rails"
|
|
if ENV["SKYLIGHT_ENABLED"] == "true"
|
|
gem "skylight", group: :development, require: false
|
|
else
|
|
gem "skylight", group: :production
|
|
end
|
|
|
|
# Active Storage
|
|
gem "aws-sdk-s3", "~> 1.208.0", require: false
|
|
gem "google-cloud-storage", "~> 1.59", require: false
|
|
gem "image_processing", ">= 1.2"
|
|
|
|
# Other
|
|
gem "ostruct"
|
|
gem "bcrypt", "~> 3.1"
|
|
gem "jwt"
|
|
gem "ed25519" # For Coinbase CDP API authentication
|
|
gem "jbuilder"
|
|
gem "countries"
|
|
|
|
# OAuth & API Security
|
|
gem "doorkeeper"
|
|
gem "rack-attack", "~> 6.6"
|
|
gem "rack-cors"
|
|
gem "pundit"
|
|
gem "faraday"
|
|
gem "faraday-retry"
|
|
gem "faraday-multipart"
|
|
gem "inline_svg"
|
|
gem "octokit"
|
|
gem "pagy"
|
|
gem "rails-i18n"
|
|
gem "rails-settings-cached"
|
|
gem "tzinfo-data", platforms: %i[windows jruby]
|
|
gem "csv"
|
|
gem "rchardet" # Character encoding detection
|
|
gem "redcarpet"
|
|
gem "stripe"
|
|
gem "plaid"
|
|
gem "snaptrade", "~> 2.0"
|
|
gem "httparty"
|
|
gem "rotp", "~> 6.3"
|
|
gem "rqrcode", "~> 3.0"
|
|
gem "webauthn", "~> 3.4"
|
|
gem "activerecord-import"
|
|
gem "rubyzip", "~> 2.3"
|
|
gem "pdf-reader", "~> 2.12"
|
|
|
|
# OpenID Connect, OAuth & SAML authentication
|
|
gem "omniauth", "~> 2.1"
|
|
gem "omniauth-rails_csrf_protection"
|
|
gem "omniauth_openid_connect"
|
|
gem "omniauth-google-oauth2"
|
|
gem "omniauth-github"
|
|
gem "omniauth-saml", "~> 2.1"
|
|
|
|
# State machines
|
|
gem "aasm"
|
|
gem "after_commit_everywhere", "~> 1.0"
|
|
|
|
# AI
|
|
gem "ruby-openai"
|
|
gem "anthropic", "~> 1.0"
|
|
gem "langfuse-ruby", "~> 0.1.4", require: "langfuse"
|
|
|
|
group :development, :test do
|
|
gem "debug", platforms: %i[mri windows]
|
|
gem "brakeman", require: false
|
|
gem "rubocop-rails-omakase", require: false
|
|
gem "i18n-tasks"
|
|
gem "erb_lint"
|
|
gem "dotenv-rails"
|
|
end
|
|
|
|
if ENV["BENCHMARKING_ENABLED"]
|
|
gem "dotenv-rails", groups: [ :production ]
|
|
end
|
|
|
|
group :development do
|
|
gem "hotwire-livereload"
|
|
gem "letter_opener"
|
|
gem "ruby-lsp-rails"
|
|
gem "web-console"
|
|
gem "faker"
|
|
gem "benchmark-ips"
|
|
gem "stackprof"
|
|
gem "derailed_benchmarks"
|
|
gem "foreman"
|
|
end
|
|
|
|
group :development, :test do
|
|
gem "rspec-rails"
|
|
gem "rswag-api"
|
|
gem "rswag-specs"
|
|
gem "rswag-ui"
|
|
end
|
|
|
|
group :test do
|
|
gem "capybara"
|
|
gem "selenium-webdriver"
|
|
gem "mocha"
|
|
gem "vcr"
|
|
gem "webmock"
|
|
gem "climate_control"
|
|
gem "simplecov", require: false
|
|
end
|