govuk_app_config 7.2.0 → 8.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ff17509787cf7ef0c402ec905d5769897a04a6b6baa79e0924956b71bbf0b372
-  data.tar.gz: a6f3ef4a3cb964f3c326717ed373678330fa190147414b2ecbdd1771a1af7a92
+  metadata.gz: c1dd070d1b3a41bd0eb7345fa619c18b3c611d279e6688c8e3565c3dbdc92a2e
+  data.tar.gz: 14e16cb4227f681a38e36abceb7e693d0fec5db388d5d87ec195942be0e325d9
 SHA512:
-  metadata.gz: a07f29e10a85c266b758a2841392de8e769c3d3bf612c3e639c58cffa445d49b4eac0cb1c0af403a6a26a4be26c811e29ba0eb46966dadd10b803134bd020848
-  data.tar.gz: 84cfb71180c318d40a7026ae81bc8bab265a938e896462e0b1912fb2703a1ea8b79066bd2944c13fe04766e07a598796569fac0cae8fdced9c70034fd521db19
+  metadata.gz: 0c16cc5b73d5ffb2d1c5ec1ed0b6479f32a781b9747864454799f08302a719840bdc816317a78c76c9cbeeb8eec90c79958c3fbd9fac7a008bab828fe4a9a852
+  data.tar.gz: 11b23903b16b594015f04d00f6bfff838ce7e89d1dd25bcc15cea50f65cc2c36dbe910acf1cc0c3cc31786f2059d5560f968a1804546082c6f4c88aba1dca213

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+# 8.0.0
+
+* BREAKING: Content Security Policy forbids the use of inline style attributes.
+
+# 7.2.1
+
+* Allow prometheus binding to fail with a warning rather than a crash ([#294](https://github.com/alphagov/govuk_app_config/pull/294))
+
 # 7.2.0
 
 * Suppress noisy Puma::HttpParserError errors ([#292](https://github.com/alphagov/govuk_app_config/pull/292))

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -56,17 +56,10 @@ module GovukContentSecurityPolicy
                       "www.youtube-nocookie.com"
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
-    # Note: we purposely don't include `data:` or `unsafe-eval` because
+    # Note: we purposely don't include `data:`, `unsafe-inline` or `unsafe-eval` because
     # they are security risks, if you need them for a legacy app please only apply them at
     # an app level.
-    policy.style_src :self,
-                     *GOOGLE_STATIC_DOMAINS,
-                     # This allows `style=""` attributes and `<style>` elements.
-                     # As of January 2023 our intentions to remove this were scuppered
-                     # by Govspeak [1] using inline styles on tables. Until that
-                     # is resolved we'll keep unsafe_inline
-                     # [1]: https://github.com/alphagov/govspeak/blob/5642fcc4231f215d1c58ad7feb30ca42fb8cfb91/lib/govspeak/html_sanitizer.rb#L72-L73
-                     :unsafe_inline
+    policy.style_src :self, *GOOGLE_STATIC_DOMAINS
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
     # Note: we purposely don't include data here because it produces a security risk.

data/lib/govuk_app_config/govuk_prometheus_exporter.rb

@@ -34,15 +34,19 @@ module GovukPrometheusExporter
       end
     end
 
-    server = PrometheusExporter::Server::WebServer.new bind: "0.0.0.0", port: 9394
-    server.start
+    begin
+      server = PrometheusExporter::Server::WebServer.new bind: "0.0.0.0", port: 9394
+      server.start
 
-    if defined?(Rails)
-      Rails.application.middleware.unshift PrometheusExporter::Middleware
-    end
+      if defined?(Rails)
+        Rails.application.middleware.unshift PrometheusExporter::Middleware
+      end
 
-    if defined?(Sinatra)
-      Sinatra.use PrometheusExporter::Middleware
+      if defined?(Sinatra)
+        Sinatra.use PrometheusExporter::Middleware
+      end
+    rescue Errno::EADDRINUSE
+      warn "Warning: Could not connect to Prometheus Server"
     end
   end
 end

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "7.2.0".freeze
+  VERSION = "8.0.0".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 7.2.0
+  version: 8.0.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-05-10 00:00:00.000000000 Z
+date: 2023-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstasher