grape 3.3.2 → 3.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47f5b2c65d5d4fb054f4b602fd97bd02be043e1ae40ded0d52dc70c2888a4ca7
-  data.tar.gz: f6bb78e2afc50d777dc0edf0447098908b6532c7e523f0291e693aacbff065c6
+  metadata.gz: 0d535091a3993a05695219506182f9259f499ee04379dfc023467c22fb56c47b
+  data.tar.gz: 2f2d84b73bed8ce3425e601f4619ea53b0287a6a466ef8b2a7c2fcb501bb980a
 SHA512:
-  metadata.gz: 910ad023e4cbfca1ba429adcccaa71018e5bad3f88e2195fe8becb26aa4736ed18b5b87f997e71fa11d4211e817f5b6d2aff518fda31ad93105b6e51c6f4d4b7
-  data.tar.gz: 85f489446889da6c3645842672790246e66b636d63af6d3734a8bbaa5163c3ec22086e6e066cda8eac52dfd1c4f4834f4536aab39211585297ab25b1efa4d6d9
+  metadata.gz: f0c882bfce6eef4f8ff9942a60dd06841cea7e01cf93d2b9af1427b766ec86636f14f31941a04c7ea844ff08cef2e4f720bd2d45bf6f61c4d8ccd983ea55bde8
+  data.tar.gz: 8c974d32f17599683db1ca2902c82c793013c87628f3fcd16be105d5c930109a9834fe7445411aec06e94c2e5635bd90441bc93081ceaca11c256c7f4e4f3cbd

data/CHANGELOG.md

@@ -1,9 +1,17 @@
+### 3.3.3 (2026-07-17)
+
+#### Fixes
+
+* [#2794](https://github.com/ruby-grape/grape/pull/2794): Fix `rescue_from Klass, rescue_subclasses: false` never rescuing — base-only handlers were written to and read from different settings stores - [@ericproulx](https://github.com/ericproulx).
+* [#2789](https://github.com/ruby-grape/grape/pull/2789): Escape error messages served with a parameterized `text/html` content-type (e.g. `text/html; charset=utf-8`) and warn when a bare Rack app is mounted under authentication - [@ericproulx](https://github.com/ericproulx).
+* [#2790](https://github.com/ruby-grape/grape/pull/2790): Stop mutating `Grape::Router`'s internal maps at request time for HTTP methods with no routes (data race on JRuby/TruffleRuby and unbounded growth) - [@ericproulx](https://github.com/ericproulx).
+* [#2791](https://github.com/ruby-grape/grape/pull/2791): Build HEAD/OPTIONS/405 helper routes from a copy of the inheritable settings instead of temporarily mutating the shared class-level settings during compilation - [@ericproulx](https://github.com/ericproulx).
+
 ### 3.3.2 (2026-07-05)
 
 #### Fixes
 
 * [#2773](https://github.com/ruby-grape/grape/pull/2773): Fix middleware build crash when a top-level `::Options` constant is in scope - [@ericproulx](https://github.com/ericproulx).
-* Your contribution here.
 
 ### 3.3.1 (2026-06-28)
 

data/README.md

@@ -10,7 +10,7 @@ Grape is a REST-like API framework for Ruby. It's designed to run on Rack or com
 
 ## Stable Release
 
-You're reading the documentation for the stable release of Grape, 3.3.2.
+You're reading the documentation for the stable release of Grape, 3.3.3.
 
 ## Project Resources
 

data/lib/grape/api/instance.rb

@@ -5,6 +5,8 @@ module Grape
     # The API Instance class, is the engine behind Grape::API. Each class that inherits
     # from this will represent a different API instance
     class Instance
+      # Marks this and every mounted instance as a mountable Grape app (see Grape::Mountable).
+      extend Grape::Mountable
       extend Grape::DSL::Settings
       extend Grape::DSL::Desc
       extend Grape::DSL::Validations
@@ -150,14 +152,19 @@ module Grape
         # contain already versioning information when using path versioning.
         all_routes = self.class.endpoints.flat_map(&:routes)
 
-        # Disable versioning so adding a route won't prepend versioning
-        # informations again.
-        without_root_prefix_and_versioning { collect_route_config_per_pattern(all_routes) }
+        # Read the settings the helper routes need from a *copy* with the
+        # root-prefix/versioning keys stripped, so adding these routes won't
+        # prepend versioning information again. This used to delete those keys
+        # from the shared class-level settings and restore them in an ensure;
+        # a request served concurrently on another instance during a runtime
+        # recompile could observe the missing keys (e.g. via #cascade?). A
+        # local copy keeps that mutation off the shared object.
+        namespace_inheritable = self.class.inheritable_setting.namespace_inheritable.to_hash.except(*ROOT_PREFIX_VERSIONING_KEYS)
+        collect_route_config_per_pattern(all_routes, namespace_inheritable)
       end
 
-      def collect_route_config_per_pattern(all_routes)
+      def collect_route_config_per_pattern(all_routes, namespace_inheritable)
         routes_by_regexp = all_routes.group_by(&:pattern_regexp)
-        namespace_inheritable = self.class.inheritable_setting.namespace_inheritable
 
         # Build the configuration based on the first endpoint and the collection of methods supported.
         routes_by_regexp.each_value do |routes|
@@ -177,18 +184,6 @@ module Grape
 
       ROOT_PREFIX_VERSIONING_KEYS = %i[version version_options root_prefix].freeze
       private_constant :ROOT_PREFIX_VERSIONING_KEYS
-
-      # Allows definition of endpoints that ignore the versioning configuration
-      # used by the rest of your API.
-      def without_root_prefix_and_versioning
-        inheritable_setting = self.class.inheritable_setting
-        deleted_values = inheritable_setting.namespace_inheritable.delete(*ROOT_PREFIX_VERSIONING_KEYS)
-        yield
-      ensure
-        ROOT_PREFIX_VERSIONING_KEYS.zip(deleted_values) do |key, value|
-          inheritable_setting.namespace_inheritable[key] = value
-        end
-      end
     end
   end
 end

data/lib/grape/api.rb

@@ -4,6 +4,9 @@ module Grape
   # The API class is the primary entry point for creating Grape APIs. Users
   # should subclass this class in order to build an API.
   class API
+    # Marks this and every subclass as a mountable Grape app (see Grape::Mountable).
+    extend Grape::Mountable
+
     # Class methods that we want to call on the API rather than on the API object
     NON_OVERRIDABLE = %i[base= base_instance? call change! configuration compile! inherit_settings recognize_path reset! routes top_level_setting= top_level_setting].freeze
 

data/lib/grape/content_types.rb

@@ -22,7 +22,19 @@ module Grape
     def mime_types_for(from_settings)
       return MIME_TYPES if from_settings == Grape::ContentTypes::DEFAULTS
 
-      from_settings.invert.transform_keys! { |k| k.include?(';') ? k.split(';', 2).first : k }
+      from_settings.invert.transform_keys! { |k| media_type(k) }
+    end
+
+    # The media type of a content-type header: the part before any `;`
+    # parameters, with surrounding whitespace removed
+    # (e.g. `'text/html'` for `'text/html; charset=utf-8'`). Returns nil for a
+    # nil content type. Skips the split (and its allocation) when there are no
+    # parameters, which is the common case.
+    def media_type(content_type)
+      return if content_type.nil?
+
+      base = content_type.include?(';') ? content_type.split(';', 2).first : content_type
+      base.strip
     end
   end
 end

data/lib/grape/dsl/routing.rb

@@ -133,7 +133,9 @@ module Grape
           end
           in_setting = inheritable_setting
 
-          if app.respond_to?(:inheritable_setting, true)
+          # Past the mount_instance branch above, a Grape app here is an already
+          # instantiated Grape::API::Instance (vs. a bare Rack app).
+          if app.is_a?(Grape::Mountable)
             mount_path = Grape::Util::PathNormalizer.call(path)
             app.top_level_setting.namespace_stackable[:mount_path] = mount_path
 

data/lib/grape/endpoint.rb

@@ -261,6 +261,7 @@ module Grape
 
     def compile!
       @app = config.app || build_stack
+      warn_unauthenticated_mounted_app
       @helpers = build_helpers
       stackable = inheritable_setting.namespace_stackable
       @befores            = stackable[:befores]
@@ -294,6 +295,13 @@ module Grape
       end
     end
 
+    # True when a bare Rack app (anything that isn't a Grape app) is mounted at
+    # this endpoint. Such an app is called directly and matched by path prefix
+    # rather than an anchored route.
+    def bare_rack_app?
+      config.app && !config.app.is_a?(Grape::Mountable)
+    end
+
     def prepare_default_route_attributes(route_options)
       {
         namespace:,
@@ -369,8 +377,8 @@ module Grape
         default_error_formatter: ns_inh[:default_error_formatter],
         error_formatters: ns_stack.namespace_stackable_with_hash(:error_formatters),
         rescue_options: ns_stack.namespace_stackable[:rescue_options]&.last,
-        rescue_handlers:,
-        base_only_rescue_handlers: ns_stack.namespace_stackable_with_hash(:base_only_rescue_handlers),
+        rescue_handlers: merged_reverse_stackable(:rescue_handlers),
+        base_only_rescue_handlers: merged_reverse_stackable(:base_only_rescue_handlers),
         all_rescue_handler: ns_inh[:all_rescue_handler],
         grape_exceptions_rescue_handler: ns_inh[:grape_exceptions_rescue_handler],
         internal_grape_exceptions_rescue_handler: ns_inh[:internal_grape_exceptions_rescue_handler]
@@ -384,6 +392,19 @@ module Grape
       Module.new { helpers.each { |mod_to_include| include mod_to_include } }
     end
 
+    # A bare Rack app mounted with +mount+ is called directly (see +compile!+):
+    # it does not go through +build_stack+, so the API's authentication
+    # middleware never runs and the mount is reachable unauthenticated. Mounted
+    # Grape APIs are unaffected because they rebuild their own stack from the
+    # inherited settings. Warn so this bypass isn't silent.
+    def warn_unauthenticated_mounted_app
+      return unless bare_rack_app?
+      return unless inheritable_setting.namespace_inheritable[:auth]
+
+      warn "Grape: #{config.app} is mounted under an API that declares authentication, but authentication " \
+           'middleware does not wrap mounted Rack applications. Requests to this mount are not authenticated by Grape.'
+    end
+
     def build_response_cookies
       return unless request.cookies?
 
@@ -397,12 +418,16 @@ module Grape
       inheritable_setting.namespace_inheritable[:lint] || Grape.config.lint
     end
 
-    def rescue_handlers
-      rescue_handlers = inheritable_setting.namespace_reverse_stackable[:rescue_handlers]
-      return if rescue_handlers.blank?
+    # Merge a reverse-stackable handler map (as written by +rescue_from+) into a
+    # single Hash. The reverse store lists child-scope handlers before inherited
+    # ones, and the first-wins merge keeps the child's handler for a given
+    # class, so a nested +rescue_from+ overrides an outer one.
+    def merged_reverse_stackable(key)
+      handlers = inheritable_setting.namespace_reverse_stackable[key]
+      return if handlers.blank?
 
-      rescue_handlers.each_with_object({}) do |rescue_handler, result|
-        result.merge!(rescue_handler) { |_k, s1, _s2| s1 }
+      handlers.each_with_object({}) do |handler, result|
+        result.merge!(handler) { |_k, s1, _s2| s1 }
       end
     end
   end

data/lib/grape/middleware/error.rb

@@ -58,10 +58,21 @@ module Grape
       private
 
       def rack_response(status, headers, message)
-        message = Rack::Utils.escape_html(message) if headers[Rack::CONTENT_TYPE] == 'text/html'
+        message = Rack::Utils.escape_html(message) if html_content_type?(headers[Rack::CONTENT_TYPE])
         Rack::Response.new(Array.wrap(message), Rack::Utils.status_code(status), Grape::Util::Header.new.merge(headers))
       end
 
+      # Escaping must key off the media type only, case-insensitively. Comparing
+      # the raw header against 'text/html' would let a parameterized value such
+      # as 'text/html; charset=utf-8' (or a differently-cased 'Text/HTML', which
+      # browsers still treat as HTML) skip escaping and reflect an unescaped
+      # message into an HTML response. Such a header can be set from several
+      # places (a registered content type, or a custom Content-Type passed to
+      # error!/rescue_from), but they all render here.
+      def html_content_type?(content_type)
+        Grape::ContentTypes.media_type(content_type).to_s.casecmp?('text/html')
+      end
+
       def format_message(error)
         current_format = env[Grape::Env::API_FORMAT] || format
         formatter = Grape::ErrorFormatter.formatter_for(current_format, error_formatters, default_error_formatter)

data/lib/grape/mountable.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Grape
+  # Marker module for a mountable Grape application. Both {Grape::API} (the
+  # remountable user-facing class) and {Grape::API::Instance} (the compiled
+  # engine) extend it, so a mounted Grape app can be told apart from a bare
+  # Rack app with `is_a?(Grape::Mountable)` — a single, explicit predicate
+  # rather than duck-typing on an incidental internal method such as
+  # `inheritable_setting`.
+  #
+  # `Grape::API` and `Grape::API::Instance` are not related by inheritance and
+  # do not even respond to the same methods (the former to `mount_instance`,
+  # the latter to `inheritable_setting`/`endpoints`), so there is no common
+  # ancestor to key an `is_a?` check on without this marker.
+  #
+  # It answers identity only ("is this a Grape app?"). Capability checks that
+  # go on to call a stage-specific method — e.g. `respond_to?(:endpoints)`
+  # before reading `endpoints` — must stay as they are, since a `Mountable`
+  # does not necessarily respond to every such method.
+  module Mountable
+  end
+end

data/lib/grape/router.rb

@@ -13,8 +13,11 @@ module Grape
     def initialize
       @neutral_map = []
       @neutral_regexes = []
-      @map = Hash.new { |hash, key| hash[key] = [] }
-      @optimized_map = Hash.new { |hash, key| hash[key] = // }
+      # Plain hashes with no auto-vivifying default: a lookup for an HTTP method
+      # that has no routes must not insert a key. `compile!` freezes both maps,
+      # so request-time reads never mutate shared state (see #match? / #rotation).
+      @map = {}
+      @optimized_map = {}
     end
 
     def compile!
@@ -29,11 +32,13 @@ module Grape
         optimized_map = routes.map.with_index { |route, index| route.to_regexp(index) }
         @optimized_map[method] = Regexp.union(optimized_map)
       end
+      @map.freeze
+      @optimized_map.freeze
       @compiled = true
     end
 
     def append(route)
-      @map[route.request_method] << route
+      (@map[route.request_method] ||= []) << route
     end
 
     def associate_routes(greedy_route)
@@ -73,7 +78,7 @@ module Grape
 
     def rotation(input, method, env, exact_route)
       response = nil
-      @map[method].each do |route|
+      @map[method]&.each do |route|
         next if exact_route == route
         next unless route.match?(input)
 
@@ -139,7 +144,7 @@ module Grape
     end
 
     def match?(input, method)
-      @optimized_map[method].match(input) { |m| @map[method].detect { |route| m[route.regexp_capture_index] } }
+      @optimized_map[method]&.match(input) { |m| @map[method].detect { |route| m[route.regexp_capture_index] } }
     end
 
     def greedy_match?(input)

data/lib/grape/version.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
 module Grape
-  # The current version of Grape.
-  VERSION = '3.3.2'
+  VERSION = '3.3.3'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: grape
 version: !ruby/object:Gem::Version
-  version: 3.3.2
+  version: 3.3.3
 platform: ruby
 authors:
 - Michael Bleigh
@@ -188,6 +188,7 @@ files:
 - lib/grape/middleware/versioner/header.rb
 - lib/grape/middleware/versioner/param.rb
 - lib/grape/middleware/versioner/path.rb
+- lib/grape/mountable.rb
 - lib/grape/namespace.rb
 - lib/grape/params_builder.rb
 - lib/grape/params_builder/base.rb
@@ -281,9 +282,9 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/ruby-grape/grape/issues
-  changelog_uri: https://github.com/ruby-grape/grape/blob/v3.3.2/CHANGELOG.md
-  documentation_uri: https://www.rubydoc.info/gems/grape/3.3.2
-  source_code_uri: https://github.com/ruby-grape/grape/tree/v3.3.2
+  changelog_uri: https://github.com/ruby-grape/grape/blob/v3.3.3/CHANGELOG.md
+  documentation_uri: https://www.rubydoc.info/gems/grape/3.3.3
+  source_code_uri: https://github.com/ruby-grape/grape/tree/v3.3.3
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: