logster 2.21.0 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 032bd6d934543680f2c4a2136ff9d3df2e413a98d9e7d411d59dc8dd2f52a976
-  data.tar.gz: 501ce97ec3873136ef87f9d7ae67e7b259982359fc96e5282382fae099c6df67
+  metadata.gz: 7ee15222be10eab0e2644b91600adc5292a0e6067992e7503dbc1b7dbb286f27
+  data.tar.gz: 5be378ba81106362378fc2250c1d27981ec2d2f70048245f2838970fa640661b
 SHA512:
-  metadata.gz: ec6e3e7127482c0619954f2141d687680a0f92a23414dfeae6c17c2bc3bf51f6cf875ca9331bef660b2c70661f564bfef09f464e7df3dc3a4e6a4ab5c886657a
-  data.tar.gz: 30eeec69d9543d38a2b2ce92c9bf6a1a069e6c18064ee689fb3edf438c9c2c22f3ef30b3df700b5599dce5589ddf7258898a08b7be488ab88187d8c5675162aa
+  metadata.gz: 54ad055675d49b57031ccd7f83f49dd758d255892f83eca32aae62d52905786b2d280d93241428fd5085f6d0e53dbf74af2f76fa59fd3ee6f68f5497233ffeac
+  data.tar.gz: 778ea3c7e74ab0af1dbc41ba8f2db1f80aa907209a5a9abc9b79aea992ba6823c9e3fb0d15860d2856e5bbd48b4dba965683ee6a93b9c33d30df1a939a4e25ae

data/CHANGELOG.md

@@ -1,5 +1,29 @@
 # CHANGELOG
 
+- 2026-10-20: 3.0.1
+
+  - FIX: Show log rows in the sans-serif body font, which fell back to the browser default serif font where Roboto was not installed
+
+- 2026-10-19: 3.0.0
+
+  - BREAKING: Require Ruby 3.3 or newer; support is now focused on maintained Ruby 3.3, 3.4, and 4.0 releases
+  - BREAKING: Drop support for Rails versions before 8.0; Rails 8.0 and 8.1 are now supported
+  - BREAKING: Target Rack 3.1–3.2, redis-rb 6.x, and Redis Open Source 8.10
+  - BREAKING: Require Node.js 24 and pnpm 10 for frontend development, replace Yarn with pnpm, and drop Internet Explorer 11 support
+  - SECURITY: Require the documented HTTP method and `X-Requested-With: XMLHttpRequest` header for mutating viewer endpoints; JavaScript error reports additionally accept browser-verified same-origin requests so `navigator.sendBeacon` remains supported; reject cross-site requests using `Origin` and `Sec-Fetch-Site`
+  - SECURITY: Add the optional `Logster.config.authorize_request` defense-in-depth callback for viewer routes
+  - SECURITY: Add no-store, referrer, content-type, and framing response headers, tighten the viewer Content Security Policy, and remove externally hosted Google Fonts
+  - UX: Improve grouping-pattern creation for grouped or unrelated messages, surface submission errors, and prevent duplicate submissions while saving
+  - UX: Add success and failure feedback when copying messages, support messages without environment data, and fall back for browsers without the Clipboard API
+  - UX: Drive the log search from the `search` query parameter so a search can be linked to and reloaded
+  - FIX: Keep protect and unprotect actions in sync with request results, restoring their previous state when a request fails
+  - FIX: Correct pattern settings state handling for plain JSON arrays and newly created or removed patterns
+  - DEV: Upgrade the client from Ember 3.28 to Ember 7.2 and serve the scripts and stylesheets listed in a manifest generated by the Ember build
+  - DEV: Convert the client components and route templates to Glimmer GJS
+  - DEV: Add a unified `bundle exec rake dev` workflow that installs dependencies, starts the backend and frontend, waits for readiness, and opens the app
+  - DEV: Add a reusable sample-data loader and richer development fixtures, and run the website tests in CI
+  - DEV: Ship only the runtime files and the built frontend assets in the gem, and verify the packaged assets before a release
+
 - 2026-04-29: 2.21.0
   - FEATURE: Allow editing grouping pattern before submitting
 

data/README.md

@@ -1,12 +1,10 @@
-![logster logo](https://raw.githubusercontent.com/discourse/logster/master/website/images/logo-logster-cropped-small.png)
+![logster logo](https://raw.githubusercontent.com/discourse/logster/main/website/images/logo-logster-cropped-small.png)
 
 Logster is an embedded Ruby "exception reporting service" admins can view on live websites, at `http://example.com/logs`
 
 ## Interface
 
-![Screenshot](https://raw.githubusercontent.com/discourse/logster/master/website/images/logster-screenshot.png)
-
-Play with a live demo at [logster.info/logs](http://logster.info/logs).
+![Screenshot](https://raw.githubusercontent.com/discourse/logster/main/website/images/logster-screenshot.png)
 
 ## Installation
 
@@ -27,7 +25,19 @@ constraints lambda { |req| req.session["admin"] } do
 end
 ```
 
-By default, logster will only run in development and production environments.
+By default, Logster will only run in development and production environments.
+
+## Supported versions
+
+Logster supports maintained release series only:
+
+- Ruby 3.3, 3.4, and 4.0
+- Rails 8.0 and 8.1
+- Rack 3.1 and 3.2
+- redis-rb 6.x
+- Redis Open Source 8.10
+
+Support for a release series ends when its upstream security support ends. Ruby head is also tested proactively, and the CI matrix is the source of truth for the combinations tested by Logster.
 
 To run logster in other environments, in `config/application.rb`
 
@@ -40,6 +50,8 @@ Logster.set_environments([:development, :staging, :production])
 Logster can be configured using `Logster.config`:
 
 - `Logster.config.application_version`: set to a unique identifier denoting version of your app. The "solve" function takes this version into account when suppressing errors.
+- `Logster.config.authorize_request` : Optional defense-in-depth authorization callback. It receives the Rack environment and must return a truthy value to allow access. The application must still mount Logster behind its normal administrator authentication constraint.
+
 - `Logster.config.enable_js_error_reporting` : enable js error reporting from clients
 - `Logster.config.rate_limit_error_reporting` : controls automatic 1 minute rate limiting for JS error reporting.
 - `Logster.config.web_title` : `<title>` tag for logster error page.
@@ -60,12 +72,16 @@ Logster can be configured using `Logster.config`:
 
 - `Logster.config.enable_backtrace_links` : Enable/disable the backtrace links feature.
 
-- `Logster.config.gems_dir` : The value of this config is `Gem.dir + "/gems/"` by default. You probably don't need to change this config, but it's available in case your app gems are installed in a different directory. An example where this config is needed is Logster [demo site](http://logster.info/logs/): [https://github.com/discourse/logster/blob/master/website/sample.rb#L77](https://github.com/discourse/logster/blob/master/website/sample.rb#L77).
+- `Logster.config.gems_dir` : The value of this config is `Gem.dir + "/gems/"` by default. You probably don't need to change this config, but it's available in case your application gems are installed in a different directory.
 
 - `Logster.config.back_to_site_link_path` : Path for the backlink to site.
 
 - `Logster.config.back_to_site_link_text` : Text for the backlink to site.
 
+### HTTP endpoint security
+
+Logster's supplied browser client sends mutating viewer requests with their required HTTP methods and the `X-Requested-With: XMLHttpRequest` header. Custom viewer integrations must do the same. JavaScript error reports may use that header or a browser-verified `Sec-Fetch-Site: same-origin` request, which allows same-origin `navigator.sendBeacon` reporting. Cross-site fetch metadata and mismatching origins from clients without same-origin fetch metadata are rejected. Mounting `Logster::Web` behind an administrator authentication constraint remains required; `authorize_request` can add a second authorization check inside the Rack application.
+
 ### Tracking Error Rate
 
 Logster allows you to register a callback when the rate of errors has exceeded
@@ -144,11 +160,10 @@ Logster UI is built using [Ember.js](http://emberjs.com/)
 
 1. Fork it ( https://github.com/discourse/logster/fork )
 2. Create your feature branch (`git checkout -b my-new-feature`)
-3. Run `cd client-app && yarn install`
-4. Run `cd website && bundle install`
-5. In the root directory, run `bundle exec rake client_dev` to start Sinatra server (port 9292) and Ember server (port 4200). Use Ember server for hot reload for client code.
-6. Visit `http://localhost:4200/logs/` (with trailing slash) to test the application. Reload `http://localhost:4200/report_error` to add sample log data.
-7. Once you're done making changes, run `./build_client_app.sh` to make and copy a production build to the assets folder.
-8. Commit your changes (`git commit -am 'Add some feature'`)
-9. Push to the branch (`git push origin my-new-feature`)
-10. Create a new Pull Request
+3. Run `bundle install`
+4. Run `bundle exec rake dev`. This installs any missing frontend and website dependencies, starts both development servers, and opens Logster in your browser.
+5. Visit `http://localhost:9292/report_error` to add sample log data. The Ember app at `http://localhost:4200/logs/` reloads automatically as you make frontend changes.
+6. Once you're done making changes, run `./build_client_app.sh` to make and copy a production build to the assets folder.
+7. Commit your changes (`git commit -am 'Add some feature'`)
+8. Push to the branch (`git push origin my-new-feature`)
+9. Create a new Pull Request