Rails

Action Dispatch comes with host authorization, a security feature that can be enabled in production by populating config.hosts. The DNS rebinding attacks it protects against aren’t covered in the security guide. The guide should cover the relevant security issues, how to protect against them at the app level with config.hosts, and how reverse

The list seems to be broken in the dashboard UI. Numbers are not visible.

To reproduce

Create a message with an ordered list using the rich content editor. Check whether the list is rendered properly or not.

Problem this feature will solve

Given:

FactoryBot.define do
  user(factory: :author) { association(:author, role: role) }
end

DefinitionProxy#method_missing will declare the [association](https://github.com/thoughtbot/factory_bot/blob

I'm sorry to post an issue that is missing crucial evidence, but some debugging of a recent config loading bug makes me suspect that the react-rails railtie.rb may be modifying the load order of initializers, and preventing the values in Rails.application.config being as expected.

Whether this happens or not appears to be partly dependent on where in the Gemfile the react-rails gem is l

I'm not sure if this is the right approach and maybe I've not understood this new part of the pipeline, yet, but:

Suppose, the major part of the app code lives inside a rails engine including all javascripts. And there are several main apps using that engine. The main apps only contain some layout changes and some minor patches.

Therefore, in order to integrate the webpacker gem into this se

We have a problem: if files aren't loaded/required we don't have branch data. If they are added through track_files we give it 0/0 branches which we show as 100% coverage (all possible branches are covered).

That math is "wrong" though here because there are branches but we don't know what they are. We should probably count total branches here as "unkown" and establish that in our "math unive

A while ago, we converted API controller specs into requests specs, see #2052. But those specs still have references from their old "life" that we can clean a little bit with a small effort.

In fact, their filenames still have the _controller_ part, which makes no sense now. Eg. solidus/api/spec/requests/spree/api/addresses_controller_spec.rb

Also, they contain references to the previo