gitlab-exporter 16.10.0 → 17.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3a3b7fa869eab272c352626dfd0f8acc2cbcc3fb2df46da92ea0387471282d2b
-  data.tar.gz: fc2f8a0a213b2a97a92ed5f417a5856f181c9f422cbbc4640c9cce45d86e4fcf
+  metadata.gz: 15b0fdb50984859832e6a21dcb76c31dfbfb68f28e5601f2c1389782ea4b5f2f
+  data.tar.gz: a02d8bda949c2d5f94981d50123ff845e73d958306d0bcf9e3ca0cfd4c8107e5
 SHA512:
-  metadata.gz: 2f6603c161ae6c9346d5b3ecd919f4df54bceb8232e588db181d1142eedc2e90231039b15a357ceed1ae62ae735b7540567e2717bbacadcea5e83ddd5b366fb2
-  data.tar.gz: 760580b43d2290a933842a4ffbd4182fe60660b401d03e9df6a7c8d85f6c3363054124b9aba2fd5a4983fb1989a11f2df28cf2f3cbdf7ca67e653bde4be95bf7
+  metadata.gz: ab40fc6975a31c6175cb3139dd1e576a06f7f1a6b598efc387f76228e68413a47b7902d7aca1682128ee77dd76ee4f2e178fec7bed8dc027676ec2e614289490
+  data.tar.gz: e749cdfd3a8db77f8a594ad7007db5dc919003defa0afb7c3691a461b78d0bcdf459e8bce6d5106809f0cdc567323a968fe1d8de88c990a2c5074339b6c38343

data/.gitlab-ci.yml

@@ -32,7 +32,7 @@ default:
      # to avoid https://github.com/rubygems/rubygems/issues/5380 use an
      # older Bundler version.
      case ${RUBY_VERSION} in
-       "3.0"|"3.1")
+       "3.1")
            export BUNDLER_VERSION="2.4.20"
            ;;
      esac
@@ -53,7 +53,7 @@ rspec:
   before_script: *before_scripts
   parallel:
     matrix:
-      - RUBY_VERSION: ["3.0", "3.1", "3.2", "3.3", "3.4"]
+      - RUBY_VERSION: ["3.1", "3.2", "3.3", "3.4", "4.0"]
 
 rspec_integration:
   script:
@@ -88,7 +88,7 @@ rspec_integration:
     REDIS_SENTINEL_PASSWORD: "my-sentinel-password"
   parallel:
     matrix:
-      - RUBY_VERSION: ["3.0", "3.1", "3.2", "3.3", "3.4"]
+      - RUBY_VERSION: ["3.1", "3.2", "3.3", "3.4", "4.0"]
 
 rubocop:
   script:

data/.rubocop.yml

@@ -1,7 +1,7 @@
 inherit_from: .rubocop_todo.yml
 
 AllCops:
-  TargetRubyVersion: 3.0
+  TargetRubyVersion: 3.1
   DisplayCopNames: true
 
 # Just use double quotes please

data/.ruby-version

@@ -1 +1 @@
-3.0.7
+3.1.7

data/AGENTS.md

@@ -0,0 +1,75 @@
+# gitlab-exporter — AI agent guidelines
+
+gitlab-exporter is a Prometheus web exporter (a Ruby gem) that collects GitLab
+production metrics via custom probes and exposes them over HTTP for a Prometheus
+scraper. See `README.md` for the probe catalog.
+
+## Project layout
+
+- `lib/gitlab_exporter/` — probes and the exporter runtime
+- `lib/gitlab_exporter/version.rb` — the gem version; bumping this on `master`
+  triggers a release (see below)
+- `bin/gitlab-exporter` — executable entry point
+- `spec/` — RSpec tests (`-t integration` marks integration specs that need Redis/PG)
+
+## Development commands
+
+```sh
+bundle install
+bundle exec rspec spec           # unit tests
+bundle exec rspec spec -t integration   # integration tests (needs Redis/Postgres)
+bundle exec rubocop              # lint
+```
+
+## Commit messages
+
+Follow the [GitLab commit message guidelines](https://docs.gitlab.com/development/contributing/merge_request_workflow/#commit-messages-guidelines).
+
+- Subject: imperative mood, capitalized, no trailing period, ≤ 72 chars
+  ("Add Zoekt probe", not "Added Zoekt probe").
+- Body: explain *why*, wrap at 72 chars. Reference issues/MRs with full URLs,
+  not short references (`#123`).
+
+## Changelog trailer (required for user-facing changes)
+
+Releases are cut by the `gem-release` CI component, which builds the release
+notes from GitLab's changelog generator. That generator **only includes commits
+that carry a `Changelog:` git trailer** — commits without one are dropped, which
+is why a release can end up saying "No changes." and produce an empty changelog
+in downstream projects (e.g. omnibus-gitlab's Renovate MRs).
+
+Add the trailer as a **separate block at the end of the commit message**,
+preceded by a blank line (the blank line is required for git to parse it as a
+trailer; without it the changelog generator silently drops the commit):
+
+```
+Changelog: <type>
+```
+
+Valid types: `added`, `fixed`, `changed`, `deprecated`, `removed`, `security`,
+`performance`, `other`.
+
+**Include a trailer for:** new or changed probes/metrics, behavior changes,
+bug fixes, dependency bumps that affect users, security fixes.
+
+**Skip the trailer for:** test-only changes, documentation-only changes, CI/
+tooling-only changes, and pure internal refactors with no user-visible effect.
+
+Example:
+
+```
+Add remote mirror staleness metric
+
+Exposes project_remote_mirror_last_successful_update_time_seconds so
+operators can alert on mirrors that have stopped syncing.
+
+Changelog: added
+```
+
+## Releasing
+
+A release happens when `lib/gitlab_exporter/version.rb` changes on `master`.
+The CI pipeline then generates the changelog from the `Changelog:` trailers
+since the previous tag, creates the GitLab Release, and publishes the gem to
+RubyGems. Keeping trailers accurate on every merged commit is what makes those
+release notes meaningful.

data/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

data/Gemfile.lock

@@ -1,24 +1,23 @@
 PATH
   remote: .
   specs:
-    gitlab-exporter (16.10.0)
+    gitlab-exporter (17.0.1)
+      base64 (= 0.3.0)
       connection_pool (= 2.5.5)
       deep_merge (~> 1.2.2)
       faraday (= 2.14.3)
       pg (= 1.6.3)
-      puma (= 8.0.2)
       quantile (= 0.2.1)
       redis (= 4.8.1)
       redis-namespace (= 1.11.0)
       sidekiq (= 6.5.12)
-      sinatra (~> 3.2.0)
       webrick (~> 1.9)
 
 GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.3)
-    base64 (0.2.0)
+    base64 (0.3.0)
     connection_pool (2.5.5)
     deep_merge (1.2.2)
     diff-lcs (1.5.0)
@@ -31,23 +30,15 @@ GEM
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
     logger (1.7.0)
-    mustermann (3.0.3)
-      ruby2_keywords (~> 0.0.1)
-    nio4r (2.7.4)
     parallel (1.27.0)
     parser (3.3.9.0)
       ast (~> 2.4.1)
       racc
     pg (1.6.3)
     prism (1.9.0)
-    puma (8.0.2)
-      nio4r (~> 2.0)
     quantile (0.2.1)
     racc (1.8.1)
     rack (2.2.15)
-    rack-protection (3.2.0)
-      base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
     rainbow (3.1.1)
     redis (4.8.1)
     redis-namespace (1.11.0)
@@ -66,11 +57,11 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.12.0)
     rspec-support (3.12.0)
-    rubocop (1.84.2)
+    rubocop (1.89.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
@@ -81,20 +72,13 @@ GEM
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)
-    ruby2_keywords (0.0.5)
     sidekiq (6.5.12)
       connection_pool (>= 2.2.5, < 3)
       rack (~> 2.0)
       redis (>= 4.5.0, < 5)
-    sinatra (3.2.0)
-      mustermann (~> 3.0)
-      rack (~> 2.2, >= 2.2.4)
-      rack-protection (= 3.2.0)
-      tilt (~> 2.0)
-    tilt (2.6.0)
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
+    unicode-emoji (4.2.0)
     webrick (1.9.1)
 
 PLATFORMS
@@ -107,4 +91,4 @@ DEPENDENCIES
   rubocop (~> 1.0)
 
 BUNDLED WITH
-   2.7.1
+  4.0.10

data/config/gitlab-exporter.yml.example

@@ -6,7 +6,6 @@ db_common: &db_common
 
 # Web server config
 server:
-  name: webrick # cf. https://github.com/sinatra/sinatra#available-settings
   listen_address: 0.0.0.0
   listen_port: 9168
   # Maximum amount of memory to use in megabytes, after which the process is killed

data/gitlab-exporter.gemspec

@@ -20,18 +20,20 @@ Gem::Specification.new do |s|
   s.homepage      = "https://gitlab.com/gitlab-org/ruby/gems/gitlab-exporter"
   s.license       = "MIT"
 
-  s.required_ruby_version = Gem::Requirement.new(">= 3.0")
+  s.required_ruby_version = Gem::Requirement.new(">= 3.1")
 
+  # base64 is required by sidekiq but not declared by it, and is no longer a
+  # default gem as of Ruby 3.4. It used to be pulled in transitively via
+  # sinatra -> rack-protection; declare it directly now that those are gone.
+  s.add_runtime_dependency "base64", "0.3.0"
   s.add_runtime_dependency "connection_pool", "2.5.5"
   s.add_runtime_dependency "deep_merge", "~> 1.2.2"
   s.add_runtime_dependency "faraday", "2.14.3"
   s.add_runtime_dependency "pg", "1.6.3"
-  s.add_runtime_dependency "puma", "8.0.2"
   s.add_runtime_dependency "quantile", "0.2.1"
   s.add_runtime_dependency "redis", "4.8.1"
   s.add_runtime_dependency "redis-namespace", "1.11.0"
   s.add_runtime_dependency "sidekiq", "6.5.12"
-  s.add_runtime_dependency "sinatra", "~> 3.2.0"
   s.add_runtime_dependency "webrick", "~> 1.9"
 
   s.add_development_dependency "rspec", "~> 3.12.0"

data/lib/gitlab_exporter/database/tuple_stats.rb

@@ -35,8 +35,6 @@ module GitLab
 
           result.each do |table_name, tuple_stats|
             tuple_stats.each do |column_name, value|
-              next if value.is_a?(Numeric)
-
               @metrics.add("gitlab_database_stat_table_#{column_name}",
                            value.to_f,
                            table_name: table_name)

data/lib/gitlab_exporter/version.rb

@@ -1,5 +1,5 @@
 module GitLab
   module Exporter
-    VERSION = "16.10.0".freeze
+    VERSION = "17.0.1".freeze
   end
 end

data/lib/gitlab_exporter/web_exporter.rb

@@ -1,146 +1,138 @@
-require "sinatra/base"
+require "webrick"
 require "English"
 require "cgi"
+require "stringio"
 
-require_relative "rack_vulndb_255039_patch"
 require_relative "tls_helper"
 
 module GitLab
   module Exporter
-    # Metrics web exporter
-    class WebExporter < Sinatra::Base
-      # A middleware to kill the process if we exceeded a certain threshold
-      class MemoryKillerMiddleware
-        def initialize(app, memory_threshold)
-          @app = app
-          @memory_threshold = memory_threshold.to_i * 1024
-        end
-
-        def call(env)
-          if memory_usage > @memory_threshold
-            puts "Memory usage of #{memory_usage} exceeded threshold of #{@memory_threshold}, signalling KILL"
-            Process.kill("KILL", $PID)
-          end
-
-          @app.call(env)
-        end
-
-        private
-
-        def memory_usage
-          io = IO.popen(%W[ps -o rss= -p #{$PID}])
-
-          mem = io.read
-          io.close
-
-          return 0 unless $CHILD_STATUS.to_i.zero?
-
-          mem.to_i
-        end
-      end
-
-      # Performs a major GC after each request. We found that this helps to free up
-      # several MB of memory in conjunction with sricter malloc config.
-      # See https://gitlab.com/gitlab-org/gitlab/-/issues/297241
-      class RunGC
-        def initialize(app)
-          @app = app
-        end
-
-        def call(env)
-          @app.call(env).tap do
-            GC.start
-          end
-        end
-      end
+    # Metrics web exporter backed directly by WEBrick (no Sinatra/Rack).
+    class WebExporter
+      DEFAULT_WEB_SERVER = "webrick".freeze
+      DEFAULT_LISTEN_ADDRESS = "0.0.0.0".freeze
+      DEFAULT_LISTEN_PORT = 9168
+      DEFAULT_MEMORY_THRESHOLD = 1024
+
+      # Security response headers previously added by Sinatra's Rack::Protection
+      # middleware, which is gone now that we serve directly via WEBrick. Kept for
+      # parity so scanners and consumers see the same headers as before.
+      SECURITY_HEADERS = {
+        "X-Content-Type-Options" => "nosniff",
+        "X-Frame-Options" => "SAMEORIGIN",
+        "X-XSS-Protection" => "1; mode=block"
+      }.freeze
 
       class << self
         include TLSHelper
 
-        DEFAULT_WEB_SERVER = "webrick".freeze
-
         def setup(config)
-          setup_server(config[:server])
-          setup_probes(config[:probes])
+          server_config = config[:server] || {}
 
-          memory_threshold = (config[:server] && config[:server][:memory_threshold]) || 1024
-          use MemoryKillerMiddleware, memory_threshold
-          use Rack::Logger
-          use RunGC
+          memory_threshold = server_config.fetch(:memory_threshold, DEFAULT_MEMORY_THRESHOLD)
+          @memory_threshold = memory_threshold.to_i * 1024
+
+          @server = build_server(server_config)
+          mount_probes(config[:probes])
 
           # Defrag heap after everything is loaded into memory.
           GC.compact
         end
 
-        def logger
-          request.logger
+        def run!
+          trap_signals
+          @server.start
         end
 
-        def setup_server(config)
-          config ||= {}
+        private
 
-          set(:server, config.fetch(:name, DEFAULT_WEB_SERVER))
-          set(:port, config.fetch(:listen_port, 9168))
+        def build_server(config)
+          warn_deprecated_server(config[:name])
+
+          options = {
+            Port: config.fetch(:listen_port, DEFAULT_LISTEN_PORT),
+            BindAddress: config.fetch(:listen_address, DEFAULT_LISTEN_ADDRESS)
+          }
 
-          # Depending on whether TLS is enabled or not, bind string
-          # will be different.
           if config.fetch(:tls_enabled, "false").to_s == "true"
-            set_tls_config(config)
-          else
-            set(:bind, config.fetch(:listen_address, "0.0.0.0"))
+            validate_tls_config(config)
+            options.merge!(webrick_tls_config(config))
           end
+
+          WEBrick::HTTPServer.new(**options)
         end
 
-        def set_tls_config(config) # rubocop:disable Naming/AccessorMethodName
-          validate_tls_config(config)
+        # The web server used to be configurable (e.g. Puma) via the `server.name`
+        # setting when the exporter ran on top of Sinatra. It now always uses WEBrick,
+        # so the setting is ignored. Warn operators whose config still sets it.
+        #
+        # TODO: This is step one of a two-step deprecation. In a future major release,
+        # raise instead of warning so the ignored `server.name` setting fails loudly.
+        def warn_deprecated_server(name)
+          return if name.nil? || name.to_s == DEFAULT_WEB_SERVER
+
+          warn "DEPRECATION: `server.name` (#{name.inspect}) is no longer supported and is ignored; " \
+               "the exporter now always uses WEBrick. Please remove `server.name` from your config."
+        end
 
-          web_server = config.fetch(:name, DEFAULT_WEB_SERVER)
-          if web_server == "webrick"
-            set_webrick_tls(config)
-          elsif web_server == "puma"
-            set_puma_tls(config)
-          else
-            fail "TLS not supported for web server `#{web_server}`."
+        def mount_probes(probes)
+          (probes || {}).each do |probe_name, params|
+            opts =
+              if params.delete(:multiple)
+                params
+              else
+                { probe_name => params }
+              end
+
+            @server.mount_proc("/#{probe_name}") do |_request, response|
+              handle_probe(response, opts)
+            end
           end
         end
 
-        def set_webrick_tls(config) # rubocop:disable Naming/AccessorMethodName
-          server_settings = {}
-          server_settings.merge!(webrick_tls_config(config))
+        def handle_probe(response, opts)
+          # A memory killer that kills the process if we exceeded a certain threshold.
+          check_memory_threshold!
 
-          set(:bind, config.fetch(:listen_address, "0.0.0.0"))
-          set(:server_settings, server_settings)
-        end
+          prober = Prober.new(metrics: PrometheusMetrics.new(include_timestamp: false), logger: @server.logger, **opts)
+          prober.probe_all
+
+          buffer = StringIO.new
+          prober.write_to(buffer)
 
-        def set_puma_tls(config) # rubocop:disable Naming/AccessorMethodName
-          listen_address = config.fetch(:listen_address, "0.0.0.0")
-          listen_port = config.fetch(:listen_port, 8443)
-          tls_cert_path = CGI.escape(config.fetch(:tls_cert_path))
-          tls_key_path = CGI.escape(config.fetch(:tls_key_path))
+          SECURITY_HEADERS.each do |header, value|
+            response[header] = value
+          end
+          response.content_type = "text/plain; version=0.0.4; charset=utf-8"
+          response.body = buffer.string
+        ensure
+          # Performs a major GC after each request. We found that this helps to free up
+          # several MB of memory in conjunction with stricter malloc config.
+          # See https://gitlab.com/gitlab-org/gitlab/-/issues/297241
+          GC.start
+        end
 
-          bind_string = "ssl://#{listen_address}:#{listen_port}?cert=#{tls_cert_path}&key=#{tls_key_path}"
+        def check_memory_threshold!
+          usage = memory_usage
+          return if usage <= @memory_threshold
 
-          set(:bind, bind_string)
+          puts "Memory usage of #{usage} exceeded threshold of #{@memory_threshold}, signalling KILL"
+          Process.kill("KILL", $PID)
         end
 
-        def setup_probes(config)
-          (config || {}).each do |probe_name, params|
-            opts =
-              if params.delete(:multiple)
-                params
-              else
-                { probe_name => params }
-              end
+        def memory_usage
+          # Use the block form so the pipe is closed automatically even if the
+          # read raises, avoiding a file-descriptor leak.
+          mem = IO.popen(%W[ps -o rss= -p #{$PID}], &:read)
 
-            get "/#{probe_name}" do
-              content_type "text/plain; version=0.0.4; charset=utf-8"
-              prober = Prober.new(metrics: PrometheusMetrics.new(include_timestamp: false), logger: logger, **opts)
+          return 0 unless $CHILD_STATUS.to_i.zero?
 
-              prober.probe_all
-              prober.write_to(response)
+          mem.to_i
+        end
 
-              response
-            end
+        def trap_signals
+          %w[INT TERM].each do |signal|
+            trap(signal) { @server.shutdown }
           end
         end
       end

data/spec/database/tuple_stats_spec.rb

@@ -0,0 +1,40 @@
+require "spec_helper"
+require "gitlab_exporter/database/tuple_stats"
+
+describe GitLab::Exporter::Database::TuplesProber do
+  let(:opts) { { connection_string: "" } }
+  let(:metrics) { double("PrometheusMetrics", add: nil) }
+  let(:collector) { double("TupleStatsCollector", run: data) }
+
+  before do
+    allow(GitLab::Exporter::Database::TupleStatsCollector).to receive(:new).and_return(collector)
+  end
+
+  describe "#probe_db" do
+    subject { described_class.new(metrics: metrics, **opts).probe_db }
+
+    context "when the connection casts columns to native Integer (PG::BasicTypeMapForResults)" do
+      let(:data) { { "projects" => { "seq_tup_read" => 42, "n_dead_tup" => 0 } } }
+
+      it "still records a metric for every column" do
+        expect(metrics).to receive(:add)
+          .with("gitlab_database_stat_table_seq_tup_read", 42.0, table_name: "projects")
+        expect(metrics).to receive(:add)
+          .with("gitlab_database_stat_table_n_dead_tup", 0.0, table_name: "projects")
+
+        subject
+      end
+    end
+
+    context "when the connection returns unmapped string values" do
+      let(:data) { { "projects" => { "seq_tup_read" => "42" } } }
+
+      it "records a metric" do
+        expect(metrics).to receive(:add)
+          .with("gitlab_database_stat_table_seq_tup_read", 42.0, table_name: "projects")
+
+        subject
+      end
+    end
+  end
+end

data/spec/web_exporter_spec.rb

@@ -0,0 +1,127 @@
+require "spec_helper"
+require "gitlab_exporter/web_exporter"
+require "net/http"
+require "timeout"
+
+describe GitLab::Exporter::WebExporter do
+  # Each test builds a fresh server via `.setup`; drop the reference afterwards
+  # so class-level state does not leak between examples.
+  after do
+    described_class.instance_variable_set(:@server, nil)
+  end
+
+  describe ".setup" do
+    let(:probes) { {} }
+
+    it "builds a WEBrick server with the configured port and bind address" do
+      options = capture_server_options(server: { listen_address: "127.0.0.1", listen_port: 12_345 })
+
+      expect(options).to include(Port: 12_345, BindAddress: "127.0.0.1")
+    end
+
+    it "falls back to the default port and bind address" do
+      options = capture_server_options({})
+
+      expect(options).to include(Port: 9168, BindAddress: "0.0.0.0")
+    end
+
+    it "mounts a handler for each configured probe" do
+      server = instance_double(WEBrick::HTTPServer)
+      allow(WEBrick::HTTPServer).to receive(:new).and_return(server)
+
+      expect(server).to receive(:mount_proc).with("/ruby")
+
+      described_class.setup(server: {}, probes: { ruby: { methods: %w[probe_gc], opts: {} } })
+    end
+
+    it "raises when TLS is enabled but no certificate is configured" do
+      expect {
+        described_class.setup(server: { tls_enabled: true }, probes: probes)
+      }.to raise_error(/tls_cert_path not specified/)
+    end
+
+    # Capture the keyword options passed to WEBrick without binding a real socket.
+    def capture_server_options(config)
+      captured = nil
+      allow(WEBrick::HTTPServer).to receive(:new) do |**options|
+        captured = options
+        instance_double(WEBrick::HTTPServer)
+      end
+
+      described_class.setup(config.merge(probes: {}))
+      captured
+    end
+  end
+
+  describe "deprecating the server.name setting" do
+    it "warns when a non-WEBrick server is requested" do
+      expect {
+        described_class.send(:warn_deprecated_server, "puma")
+      }.to output(/DEPRECATION.*no longer supported/).to_stderr
+    end
+
+    it "does not warn when the server is webrick" do
+      expect { described_class.send(:warn_deprecated_server, "webrick") }.not_to output.to_stderr
+    end
+
+    it "does not warn when no server name is set" do
+      expect { described_class.send(:warn_deprecated_server, nil) }.not_to output.to_stderr
+    end
+  end
+
+  describe "serving probe requests" do
+    let(:config) do
+      {
+        server: { listen_address: "127.0.0.1", listen_port: 0 },
+        probes: { ruby: { methods: %w[probe_gc], opts: {} } }
+      }
+    end
+
+    let(:server) { described_class.instance_variable_get(:@server) }
+    let(:base_uri) { "http://127.0.0.1:#{server.listeners.first.addr[1]}" }
+
+    before do
+      # WEBrick binds its logger and access log to $stderr at construction time
+      # and emits a startup banner; silence $stderr around setup so the log
+      # device is a throwaway buffer and the test output stays clean.
+      original_stderr = $stderr
+      $stderr = StringIO.new
+      begin
+        described_class.setup(config)
+      ensure
+        $stderr = original_stderr
+      end
+
+      @server_thread = Thread.new { server.start }
+      Timeout.timeout(5) { sleep 0.01 until server.status == :Running }
+    end
+
+    after do
+      server.shutdown
+      @server_thread&.join(5)
+    end
+
+    it "returns Prometheus metrics for a known probe" do
+      response = Net::HTTP.get_response(URI("#{base_uri}/ruby"))
+
+      expect(response.code).to eq("200")
+      expect(response.content_type).to eq("text/plain")
+      expect(response["Content-Type"]).to include("version=0.0.4")
+      expect(response.body).to match(/ruby_gc_stat_count \d+/)
+    end
+
+    it "sets the security headers previously provided by Rack::Protection" do
+      response = Net::HTTP.get_response(URI("#{base_uri}/ruby"))
+
+      expect(response["X-Content-Type-Options"]).to eq("nosniff")
+      expect(response["X-Frame-Options"]).to eq("SAMEORIGIN")
+      expect(response["X-XSS-Protection"]).to eq("1; mode=block")
+    end
+
+    it "returns 404 for unknown paths" do
+      response = Net::HTTP.get_response(URI("#{base_uri}/does-not-exist"))
+
+      expect(response.code).to eq("404")
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-exporter
 version: !ruby/object:Gem::Version
-  version: 16.10.0
+  version: 17.0.1
 platform: ruby
 authors:
 - Pablo Carranza
@@ -10,6 +10,20 @@ bindir: bin
 cert_chain: []
 date: 2016-07-27 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: connection_pool
   requirement: !ruby/object:Gem::Requirement
@@ -66,20 +80,6 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 1.6.3
-- !ruby/object:Gem::Dependency
-  name: puma
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 8.0.2
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 8.0.2
 - !ruby/object:Gem::Dependency
   name: quantile
   requirement: !ruby/object:Gem::Requirement
@@ -136,20 +136,6 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 6.5.12
-- !ruby/object:Gem::Dependency
-  name: sinatra
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.2.0
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.2.0
 - !ruby/object:Gem::Dependency
   name: webrick
   requirement: !ruby/object:Gem::Requirement
@@ -205,6 +191,8 @@ files:
 - ".rubocop.yml"
 - ".rubocop_todo.yml"
 - ".ruby-version"
+- AGENTS.md
+- CLAUDE.md
 - CONTRIBUTING.md
 - Gemfile
 - Gemfile.lock
@@ -233,7 +221,6 @@ files:
 - lib/gitlab_exporter/prober.rb
 - lib/gitlab_exporter/process.rb
 - lib/gitlab_exporter/prometheus.rb
-- lib/gitlab_exporter/rack_vulndb_255039_patch.rb
 - lib/gitlab_exporter/ruby.rb
 - lib/gitlab_exporter/sidekiq.rb
 - lib/gitlab_exporter/tls_helper.rb
@@ -245,6 +232,7 @@ files:
 - spec/database/ci_builds_spec.rb
 - spec/database/pg_sequences_spec.rb
 - spec/database/row_count_spec.rb
+- spec/database/tuple_stats_spec.rb
 - spec/database/zoekt_spec.rb
 - spec/elasticsearch_spec.rb
 - spec/fixtures/config.yml
@@ -258,6 +246,7 @@ files:
 - spec/sidekiq_spec.rb
 - spec/spec_helper.rb
 - spec/util_spec.rb
+- spec/web_exporter_spec.rb
 homepage: https://gitlab.com/gitlab-org/ruby/gems/gitlab-exporter
 licenses:
 - MIT
@@ -270,7 +259,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -287,6 +276,7 @@ test_files:
 - spec/database/ci_builds_spec.rb
 - spec/database/pg_sequences_spec.rb
 - spec/database/row_count_spec.rb
+- spec/database/tuple_stats_spec.rb
 - spec/database/zoekt_spec.rb
 - spec/elasticsearch_spec.rb
 - spec/fixtures/config.yml
@@ -300,3 +290,4 @@ test_files:
 - spec/sidekiq_spec.rb
 - spec/spec_helper.rb
 - spec/util_spec.rb
+- spec/web_exporter_spec.rb

data/lib/gitlab_exporter/rack_vulndb_255039_patch.rb

@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-if Gem.loaded_specs["rack"].version >= Gem::Version.new("3.0.0")
-  fail <<~ERR
-    This patch is unnecessary in Rack versions 3.0.0 or newer.
-    Please remove this file and the associated spec.
-
-    See https://github.com/rack/rack/blob/main/CHANGELOG.md#security (issue #1733)
-  ERR
-end
-
-# Patches a cache poisoning attack vector in Rack by not allowing semicolons
-# to delimit query parameters.
-# See https://github.com/rack/rack/issues/1732.
-#
-# Solution is taken from the same issue.
-#
-# The actual patch is due for release in Rack 3.0.0.
-module Rack
-  class Request # rubocop:disable Style/Documentation
-    Helpers.module_eval do
-      # rubocop: disable Naming/MethodName
-      def GET
-        if get_header(RACK_REQUEST_QUERY_STRING) == query_string
-          get_header(RACK_REQUEST_QUERY_HASH)
-        else
-          query_hash = parse_query(query_string, "&") # only allow ampersand here
-          set_header(RACK_REQUEST_QUERY_STRING, query_string)
-          set_header(RACK_REQUEST_QUERY_HASH, query_hash)
-        end
-      end
-      # rubocop: enable Naming/MethodName
-    end
-  end
-end