chore(deps): upgrade to Rails 7.2.3.2, Ruby 3.4.10 and latest gems

Upgrades Rails from 7.1.6 to 7.2.3.2, Ruby from 3.4.6 to 3.4.10, and
brings the rest of the bundle up to date.

Two things were broken by Rails 7.2 and are fixed here:

* MigrationWaiter called `ActiveRecord::Base.connection.migration_context`,
  which moved to the connection pool in 7.2. This raised NoMethodError on
  boot for any deployment with `migration_waiter.enabled` set, and had no
  test covering it.
* `config.action_dispatch.show_exceptions = false` was deprecated in 7.1
  and removed in 7.2. Now `:none`.

`json` is pinned to < 3. Active Support 7.2 passes `quirks_mode:` to both
`JSON.generate` and `JSON.parse`, and json 3.0 removed that option, so an
unpinned json resolves to 3.x and makes every `to_json` raise - webhook
payloads included. Nothing else in the bundle constrains it. The pin can go
when we reach Rails 8.1, which no longer passes the option.

`dynamic_form` is dropped. It is unmaintained and from 1.3.1 requires Ruby
< 3.4, so it could never be updated again. Ten views used it, so
`error_messages_for` now lives in ErrorMessagesHelper and `f.error_messages`
in a form builder extension. The rendered markup is unchanged apart from a
heading and description the stylesheet had always hidden; the rules that
hid them are removed too.

`execjs` is unpinned. The `< 2.8` constraint dated from the Rails 6.0
upgrade and asset output is byte-identical without it.

Notable gem majors: puma 8, haml 7, secure_headers 7, sentry 7, jwt 3,
prometheus-client 5, highline 3, omniauth-rails_csrf_protection 2,
rspec-rails 8, shoulda-matchers 8, rubocop 1.91. secure_headers 7 changes
X-XSS-Protection from "1; mode=block" to "0", which is the correct modern
default and matches Rails' own.

`config.load_defaults` deliberately stays at 7.0. The pending 7.1 and 7.2
options are listed, commented out, in new_framework_defaults_7_1.rb and
_7_2.rb so they can be adopted in stages - several change the signed cookie
and cache formats and need a staged deploy. The vestigial
new_framework_defaults_7_0.rb is removed, as `load_defaults 7.0` already
applies all of it.

Adds tests for the areas this touched, which were mostly uncovered:
MigrationWaiter, the serialized columns that gate a defaults bump, JSON
encoding, HAML template compilation for all 103 templates, page rendering,
form error rendering and security headers. The assets Gemfile group now
includes :test so the view layer can be exercised at all.
This commit is contained in:
Adam Cooke
2026-09-15 10:27:16 +01:00
parent ced77a3860
commit 5eeed7c023
23 changed files with 1010 additions and 361 deletions
+210 -198
View File
@@ -2,104 +2,98 @@ GEM
remote: https://rubygems.org/
specs:
abbrev (0.1.2)
actioncable (7.1.6)
actionpack (= 7.1.6)
activesupport (= 7.1.6)
actioncable (7.2.3.2)
actionpack (= 7.2.3.2)
activesupport (= 7.2.3.2)
nio4r (~> 2.0)
websocket-driver (>= 0.6.1)
zeitwerk (~> 2.6)
actionmailbox (7.1.6)
actionpack (= 7.1.6)
activejob (= 7.1.6)
activerecord (= 7.1.6)
activestorage (= 7.1.6)
activesupport (= 7.1.6)
mail (>= 2.7.1)
net-imap
net-pop
net-smtp
actionmailer (7.1.6)
actionpack (= 7.1.6)
actionview (= 7.1.6)
activejob (= 7.1.6)
activesupport (= 7.1.6)
mail (~> 2.5, >= 2.5.4)
net-imap
net-pop
net-smtp
actionmailbox (7.2.3.2)
actionpack (= 7.2.3.2)
activejob (= 7.2.3.2)
activerecord (= 7.2.3.2)
activestorage (= 7.2.3.2)
activesupport (= 7.2.3.2)
mail (>= 2.8.0)
actionmailer (7.2.3.2)
actionpack (= 7.2.3.2)
actionview (= 7.2.3.2)
activejob (= 7.2.3.2)
activesupport (= 7.2.3.2)
mail (>= 2.8.0)
rails-dom-testing (~> 2.2)
actionpack (7.1.6)
actionview (= 7.1.6)
activesupport (= 7.1.6)
actionpack (7.2.3.2)
actionview (= 7.2.3.2)
activesupport (= 7.2.3.2)
cgi
nokogiri (>= 1.8.5)
racc
rack (>= 2.2.4)
rack (>= 2.2.4, < 3.3)
rack-session (>= 1.0.1)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6)
actiontext (7.1.6)
actionpack (= 7.1.6)
activerecord (= 7.1.6)
activestorage (= 7.1.6)
activesupport (= 7.1.6)
useragent (~> 0.16)
actiontext (7.2.3.2)
actionpack (= 7.2.3.2)
activerecord (= 7.2.3.2)
activestorage (= 7.2.3.2)
activesupport (= 7.2.3.2)
globalid (>= 0.6.0)
nokogiri (>= 1.8.5)
actionview (7.1.6)
activesupport (= 7.1.6)
actionview (7.2.3.2)
activesupport (= 7.2.3.2)
builder (~> 3.1)
cgi
erubi (~> 1.11)
rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6)
activejob (7.1.6)
activesupport (= 7.1.6)
activejob (7.2.3.2)
activesupport (= 7.2.3.2)
globalid (>= 0.3.6)
activemodel (7.1.6)
activesupport (= 7.1.6)
activerecord (7.1.6)
activemodel (= 7.1.6)
activesupport (= 7.1.6)
activemodel (7.2.3.2)
activesupport (= 7.2.3.2)
activerecord (7.2.3.2)
activemodel (= 7.2.3.2)
activesupport (= 7.2.3.2)
timeout (>= 0.4.0)
activestorage (7.1.6)
actionpack (= 7.1.6)
activejob (= 7.1.6)
activerecord (= 7.1.6)
activesupport (= 7.1.6)
activestorage (7.2.3.2)
actionpack (= 7.2.3.2)
activejob (= 7.2.3.2)
activerecord (= 7.2.3.2)
activesupport (= 7.2.3.2)
marcel (~> 1.0)
activesupport (7.1.6)
activesupport (7.2.3.2)
base64
benchmark (>= 0.3)
bigdecimal
concurrent-ruby (~> 1.0, >= 1.0.2)
concurrent-ruby (~> 1.0, >= 1.3.1)
connection_pool (>= 2.2.5)
drb
i18n (>= 1.6, < 2)
logger (>= 1.4.2)
minitest (>= 5.1)
mutex_m
minitest (>= 5.1, < 6)
securerandom (>= 0.3)
tzinfo (~> 2.0)
addressable (2.8.6)
public_suffix (>= 2.0.2, < 6.0)
tzinfo (~> 2.0, >= 2.0.5)
addressable (2.9.0)
public_suffix (>= 2.0.2, < 8.0)
aes_key_wrap (1.1.0)
annotate (3.2.0)
activerecord (>= 3.2, < 8.0)
rake (>= 10.4, < 14.0)
ast (2.4.2)
ast (2.4.3)
attr_required (1.0.2)
authie (5.0.0)
activerecord (>= 6.1, < 9.0)
autoprefixer-rails (10.4.13.0)
autoprefixer-rails (10.4.21.0)
execjs (~> 2)
base64 (0.3.0)
bcrypt (3.1.20)
bcrypt (3.1.22)
benchmark (0.5.0)
bigdecimal (4.1.2)
bindata (2.5.0)
bigdecimal (4.1.3)
bindata (3.0.0)
builder (3.3.0)
cgi (0.5.1)
cgi (0.5.2)
chronic (0.10.2)
coffee-rails (5.0.0)
coffee-script (>= 2.2.0)
@@ -108,71 +102,74 @@ GEM
coffee-script-source
execjs
coffee-script-source (1.12.2)
concurrent-ruby (1.3.6)
concurrent-ruby (1.3.8)
connection_pool (3.0.2)
crack (1.0.0)
crack (1.0.1)
bigdecimal
rexml
crass (1.0.6)
crass (1.0.7)
database_cleaner-active_record (2.2.2)
activerecord (>= 5.a)
database_cleaner-core (~> 2.0)
database_cleaner-core (2.0.1)
database_cleaner-core (2.1.0)
date (3.5.1)
diff-lcs (1.6.2)
domain_name (0.6.20240107)
dotenv (3.0.2)
domain_name (0.6.20260907)
dotenv (3.2.0)
drb (2.2.3)
dynamic_form (1.2.0)
email_validator (2.2.4)
activemodel
erb (6.0.4)
erb (6.0.7)
erubi (1.13.1)
execjs (2.7.0)
factory_bot (6.4.6)
activesupport (>= 5.0.0)
factory_bot_rails (6.4.3)
factory_bot (~> 6.4)
railties (>= 5.0.0)
faraday (2.9.0)
faraday-net_http (>= 2.0, < 3.2)
faraday-follow_redirects (0.3.0)
execjs (2.10.2)
json (>= 2)
factory_bot (6.6.0)
activesupport (>= 6.1.0)
factory_bot_rails (6.5.1)
factory_bot (~> 6.5)
railties (>= 6.1.0)
faraday (2.14.3)
faraday-net_http (>= 2.0, < 3.5)
json
logger
faraday-follow_redirects (0.5.0)
faraday (>= 1, < 3)
faraday-net_http (3.1.0)
net-http
faraday-net_http (3.4.4)
net-http (~> 0.5)
ffi (1.15.5)
gelf (3.1.0)
json
globalid (1.3.0)
globalid (1.4.0)
activesupport (>= 6.1)
haml (6.3.0)
haml (7.5.1)
prism (>= 1.1.0)
temple (>= 0.8.2)
thor
tilt
hashdiff (1.1.0)
hashie (5.0.0)
highline (2.1.0)
i18n (1.14.8)
hashdiff (1.2.1)
hashie (5.1.0)
logger
highline (3.1.2)
reline
i18n (1.15.2)
concurrent-ruby (~> 1.0)
io-console (0.8.2)
io-console (0.9.2)
irb (1.18.0)
pp (>= 0.6.0)
prism (>= 1.3.0)
rdoc (>= 4.0.0)
reline (>= 0.4.2)
jquery-rails (4.5.1)
jquery-rails (4.6.1)
rails-dom-testing (>= 1, < 3)
railties (>= 4.2.0)
thor (>= 0.14, < 2.0)
json (2.7.1)
json-jwt (1.16.6)
json (2.21.2)
json-jwt (1.17.2)
activesupport (>= 4.2)
aes_key_wrap
base64
bindata
faraday (~> 2.0)
faraday-follow_redirects
jwt (2.8.1)
jwt (3.3.0)
base64
kaminari (1.2.2)
activesupport (>= 4.1.0)
@@ -186,17 +183,19 @@ GEM
activerecord
kaminari-core (= 1.2.2)
kaminari-core (1.2.2)
klogger-logger (1.4.0)
klogger-logger (1.5.0)
concurrent-ruby (>= 1.0, < 2.0)
json
rouge (>= 3.30, < 5.0)
konfig-config (3.0.0)
hashie
language_server-protocol (3.17.0.6)
lint_roller (1.1.0)
logger (1.7.0)
loofah (2.25.1)
loofah (2.25.2)
crass (~> 1.0.2)
nokogiri (>= 1.12.0)
mail (2.9.0)
mail (2.9.1)
logger
mini_mime (>= 0.1.1)
net-imap
@@ -204,19 +203,18 @@ GEM
net-smtp
marcel (1.2.1)
mini_mime (1.1.5)
minitest (6.0.6)
drb (~> 2.0)
prism (~> 1.5)
minitest (5.27.0)
mutex_m (0.3.0)
mysql2 (0.5.6)
net-http (0.4.1)
uri
net-imap (0.6.4)
mysql2 (0.5.7)
bigdecimal
net-http (0.9.1)
uri (>= 0.11.1)
net-imap (0.6.7)
date
net-protocol
net-pop (0.1.2)
net-protocol
net-protocol (0.2.2)
net-protocol (0.3.0)
timeout
net-smtp (0.5.1)
net-protocol
@@ -225,28 +223,28 @@ GEM
activerecord (>= 4.0.0)
activesupport (>= 4.0.0)
nio4r (2.7.5)
nokogiri (1.19.3-aarch64-linux-gnu)
nokogiri (1.19.4-aarch64-linux-gnu)
racc (~> 1.4)
nokogiri (1.19.3-arm64-darwin)
nokogiri (1.19.4-arm64-darwin)
racc (~> 1.4)
nokogiri (1.19.3-x86_64-darwin)
nokogiri (1.19.4-x86_64-darwin)
racc (~> 1.4)
nokogiri (1.19.3-x86_64-linux-gnu)
nokogiri (1.19.4-x86_64-linux-gnu)
racc (~> 1.4)
omniauth (2.1.2)
omniauth (2.1.4)
hashie (>= 3.4.6)
logger
rack (>= 2.2.3)
rack-protection
omniauth-rails_csrf_protection (1.0.1)
omniauth-rails_csrf_protection (2.0.1)
actionpack (>= 4.2)
omniauth (~> 2.0)
omniauth_openid_connect (0.7.1)
omniauth_openid_connect (0.8.0)
omniauth (>= 1.9, < 3)
openid_connect (~> 2.2)
openid_connect (2.3.0)
openid_connect (2.5.0)
activemodel
attr_required (>= 1.0.0)
email_validator
faraday (~> 2.0)
faraday-follow_redirects
json-jwt (>= 1.16)
@@ -257,30 +255,29 @@ GEM
validate_url
webfinger (~> 2.0)
ostruct (0.6.3)
parallel (1.22.1)
parser (3.2.1.1)
parallel (2.2.0)
parser (3.3.12.0)
ast (~> 2.4.1)
pp (0.6.3)
racc
pp (0.6.4)
prettyprint
prettyprint (0.2.0)
prism (1.9.0)
prometheus-client (4.2.2)
psych (5.4.0)
date
stringio
public_suffix (5.0.4)
puma (7.0.4)
prometheus-client (5.0.0)
base64
public_suffix (7.0.5)
puma (8.0.2)
nio4r (~> 2.0)
racc (1.8.1)
rack (3.2.6)
rack-oauth2 (2.2.1)
rack (3.2.7)
rack-oauth2 (2.3.0)
activesupport
attr_required
faraday (~> 2.0)
faraday-follow_redirects
json-jwt (>= 1.11.0)
rack (>= 2.1.0)
rack-protection (4.1.1)
rack-protection (4.2.1)
base64 (>= 0.1.0)
logger (>= 1.6.0)
rack (>= 3.0.0, < 4)
@@ -291,32 +288,32 @@ GEM
rack (>= 1.3)
rackup (2.3.1)
rack (>= 3)
rails (7.1.6)
actioncable (= 7.1.6)
actionmailbox (= 7.1.6)
actionmailer (= 7.1.6)
actionpack (= 7.1.6)
actiontext (= 7.1.6)
actionview (= 7.1.6)
activejob (= 7.1.6)
activemodel (= 7.1.6)
activerecord (= 7.1.6)
activestorage (= 7.1.6)
activesupport (= 7.1.6)
rails (7.2.3.2)
actioncable (= 7.2.3.2)
actionmailbox (= 7.2.3.2)
actionmailer (= 7.2.3.2)
actionpack (= 7.2.3.2)
actiontext (= 7.2.3.2)
actionview (= 7.2.3.2)
activejob (= 7.2.3.2)
activemodel (= 7.2.3.2)
activerecord (= 7.2.3.2)
activestorage (= 7.2.3.2)
activesupport (= 7.2.3.2)
bundler (>= 1.15.0)
railties (= 7.1.6)
railties (= 7.2.3.2)
rails-dom-testing (2.3.0)
activesupport (>= 5.0.0)
minitest
nokogiri (>= 1.6)
rails-html-sanitizer (1.7.0)
loofah (~> 2.25)
rails-html-sanitizer (1.7.1)
loofah (~> 2.25, >= 2.25.2)
nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
railties (7.1.6)
actionpack (= 7.1.6)
activesupport (= 7.1.6)
railties (7.2.3.2)
actionpack (= 7.2.3.2)
activesupport (= 7.2.3.2)
cgi
irb
irb (~> 1.13)
rackup (>= 1.0.0)
rake (>= 12.2)
thor (~> 1.0, >= 1.2.2)
@@ -324,53 +321,62 @@ GEM
zeitwerk (~> 2.6)
rainbow (3.1.1)
rake (13.4.2)
rdoc (7.2.0)
erb
psych (>= 4.0.0)
rbs (4.2.0)
logger
prism (>= 1.6.0)
tsort
regexp_parser (2.7.0)
reline (0.6.3)
rdoc (8.0.0)
erb
prism (>= 1.6.0)
rbs (>= 4.0.0)
tsort
regexp_parser (2.12.0)
reline (0.7.0)
io-console (~> 0.5)
resolv (0.6.2)
resolv (0.7.2)
rexml (3.4.4)
rouge (4.2.0)
rspec (3.13.1)
rouge (4.7.0)
rspec (3.13.2)
rspec-core (~> 3.13.0)
rspec-expectations (~> 3.13.0)
rspec-mocks (~> 3.13.0)
rspec-core (3.13.5)
rspec-core (3.13.6)
rspec-support (~> 3.13.0)
rspec-expectations (3.13.5)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-mocks (3.13.5)
rspec-mocks (3.13.8)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.13.0)
rspec-rails (6.1.1)
actionpack (>= 6.1)
activesupport (>= 6.1)
railties (>= 6.1)
rspec-core (~> 3.12)
rspec-expectations (~> 3.12)
rspec-mocks (~> 3.12)
rspec-support (~> 3.12)
rspec-support (3.13.6)
rubocop (1.48.1)
json (~> 2.3)
parallel (~> 1.10)
parser (>= 3.2.0.0)
rspec-rails (8.0.4)
actionpack (>= 7.2)
activesupport (>= 7.2)
railties (>= 7.2)
rspec-core (>= 3.13.0, < 5.0.0)
rspec-expectations (>= 3.13.0, < 5.0.0)
rspec-mocks (>= 3.13.0, < 5.0.0)
rspec-support (>= 3.13.0, < 5.0.0)
rspec-support (3.13.7)
rubocop (1.91.0)
json (>= 2.3)
language_server-protocol (~> 3.17.0.2)
lint_roller (~> 1.1.0)
parallel (>= 1.10)
parser (>= 3.3.0.2)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.8, < 3.0)
rexml (>= 3.2.5, < 4.0)
rubocop-ast (>= 1.26.0, < 2.0)
regexp_parser (>= 2.9.3, < 3.0)
rubocop-ast (>= 1.49.0, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 2.4.0, < 3.0)
rubocop-ast (1.27.0)
parser (>= 3.2.1.0)
rubocop-rails (2.18.0)
unicode-display_width (>= 2.4.0, < 4.0)
rubocop-ast (1.50.0)
parser (>= 3.3.7.2)
prism (~> 1.7)
rubocop-rails (2.37.0)
activesupport (>= 4.2.0)
lint_roller (~> 1.1)
rack (>= 1.1)
rubocop (>= 1.33.0, < 2.0)
rubocop (>= 1.89.0, < 2.0)
rubocop-ast (>= 1.44.0, < 2.0)
ruby-progressbar (1.13.0)
sass-rails (6.0.0)
sassc-rails (~> 2.1, >= 2.1.1)
@@ -382,32 +388,35 @@ GEM
sprockets (> 3.0)
sprockets-rails
tilt
secure_headers (6.5.0)
secure_headers (7.3.0)
cgi (>= 0.1)
securerandom (0.4.1)
sentry-rails (5.16.1)
railties (>= 5.0)
sentry-ruby (~> 5.16.1)
sentry-ruby (5.16.1)
sentry-rails (7.0.0)
railties (>= 5.2.0)
sentry-ruby (~> 7.0.0)
sentry-ruby (7.0.0)
bigdecimal
concurrent-ruby (~> 1.0, >= 1.0.2)
shoulda-matchers (6.1.0)
activesupport (>= 5.2.0)
sprockets (4.2.0)
concurrent-ruby (~> 1.0)
logger
shoulda-matchers (8.0.1)
activesupport (>= 7.2)
sprockets (4.4.1)
concurrent-ruby (~> 1.1)
logger
rack (>= 2.2.4, < 4)
sprockets-rails (3.4.2)
actionpack (>= 5.2)
activesupport (>= 5.2)
sprockets-rails (3.5.2)
actionpack (>= 6.1)
activesupport (>= 6.1)
sprockets (>= 3.0.0)
stringio (3.2.0)
swd (2.0.3)
activesupport (>= 3)
attr_required (>= 0.0.5)
faraday (~> 2.0)
faraday-follow_redirects
temple (0.10.3)
temple (0.10.7)
thor (1.5.0)
tilt (2.3.0)
timecop (0.9.8)
tilt (2.9.0)
timecop (0.9.11)
timeout (0.6.1)
tsort (0.2.0)
turbolinks (5.2.1)
@@ -415,10 +424,13 @@ GEM
turbolinks-source (5.2.0)
tzinfo (2.0.6)
concurrent-ruby (~> 1.0)
uglifier (4.2.0)
uglifier (4.2.1)
execjs (>= 0.3.0, < 3)
unicode-display_width (2.4.2)
uri (1.0.3)
unicode-display_width (3.2.0)
unicode-emoji (~> 4.1)
unicode-emoji (4.2.0)
uri (1.1.1)
useragent (0.16.11)
validate_url (1.0.15)
activemodel (>= 3.0.0)
public_suffix
@@ -426,16 +438,16 @@ GEM
activesupport
faraday (~> 2.0)
faraday-follow_redirects
webmock (3.20.0)
webmock (3.26.4)
addressable (>= 2.8.0)
crack (>= 0.3.2)
hashdiff (>= 0.4.0, < 2.0.0)
webrick (1.9.1)
websocket-driver (0.8.0)
webrick (1.9.2)
websocket-driver (0.8.2)
base64
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
zeitwerk (2.8.2)
zeitwerk (2.8.3)
PLATFORMS
aarch64-linux
@@ -454,14 +466,14 @@ DEPENDENCIES
database_cleaner-active_record
domain_name
dotenv
dynamic_form
execjs (~> 2.7, < 2.8)
execjs
factory_bot_rails
gelf
haml
hashie
highline
jquery-rails
json (< 3)
jwt
kaminari
klogger-logger
@@ -479,7 +491,7 @@ DEPENDENCIES
prometheus-client
puma
rackup
rails (= 7.1.6)
rails (= 7.2.3.2)
resolv
rspec
rspec-rails