mailkick 2.0.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d3592c25635ef911ea75b5bd5f07bbf512cbc3066bda2a7a7deb39e0d969821
-  data.tar.gz: 521daa545720254493b7dbef3806a95e44ac739041e6a9ab4fd33a5ef41881b7
+  metadata.gz: 53b4cfd8b344ad6273e734bad7531baaab340b50777e2e0590f2780b8ba72e96
+  data.tar.gz: 99d9c057e6fba352bc509368d49e4abda33fc6abd996ffef199866943e8625bf
 SHA512:
-  metadata.gz: fb7e324a4812673f7278bb8ce890ea0d67ac74c6e923ae4d43dc0c6e447fa28282a56beeb25c86fe9d5e9e34d3ecda03099d2240773b5d74ca3a940cc4b8c6e5
-  data.tar.gz: ce6f5ba95efec816c0571189a3e2f1a99060fe389927656836110a750f61fe768810b7f2a342325081acb6d5b7e66f1464db1b449fbc5f1467a4e595d9a3c51c
+  metadata.gz: 31c98f092a8fcf4f2deef3b6c2a1d385e1b7cc13df3d05ddaa35b9cd460c9d9fca966972abc59ba5cf20d3ff2442410ad809d109af1ddbb9c178ee14bb934701
+  data.tar.gz: 3b6b152bd2154d13fb88f5fe38d67297a4909c3b7f95b8401f7065020501f59eff2bad0642cd38be980f07df8b26506376c669d87c580886b765b521b59419bd

data/CHANGELOG.md

@@ -1,6 +1,16 @@
+## 3.0.0 (2026-08-08)
+
+See the [upgrade notes](https://github.com/ankane/mailkick?tab=readme-ov-file#30)
+
+- Added `confirm_unsubscribe` option
+- Enabled `headers` by default
+- Improved CSP support
+- Fixed change to key generator hash digest class
+- Dropped support for Ruby < 3.3 and Rails < 7.2
+
 ## 2.0.0 (2025-06-23)
 
-See the [upgrade notes](https://github.com/ankane/mailkick?tab=readme-ov-file#20)
+See the [upgrade notes](https://github.com/ankane/mailkick/blob/v2.0.0/README.md#20)
 
 - Added `prefix` option to `has_subscriptions`
 - Switched to suppressions API for Postmark and changed default stream to `broadcast`

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2014-2025 Andrew Kane
+Copyright (c) 2014-2026 Andrew Kane
 
 MIT License
 

data/README.md

@@ -5,7 +5,7 @@ Email subscriptions for Rails
 - Add one-click unsubscribe links and headers to your emails
 - Fetch bounces and spam reports from your email service
 
-**Mailkick 2.0 was recently released** - see [how to upgrade](#upgrading)
+**Mailkick 3.0 was recently released** - see [how to upgrade](#upgrading)
 
 :postbox: Check out [Ahoy Email](https://github.com/ankane/ahoy_email) for analytics
 
@@ -83,16 +83,20 @@ rails generate mailkick:views
 
 which copies the view into `app/views/mailkick`.
 
+To add a confirmation step to prevent issues with scanners, create `config/initializers/mailkick.rb` with:
+
+```ruby
+Mailkick.confirm_unsubscribe = true
+```
+
 ## Unsubscribe Headers
 
-For one-click unsubscribe headers ([RFC 8058](https://datatracker.ietf.org/doc/html/rfc8058)), create `config/initializers/mailkick.rb` with:
+One-click unsubscribe headers ([RFC 8058](https://datatracker.ietf.org/doc/html/rfc8058)) are automatically added to emails that call `mailkick_unsubscribe_url`. To disable, create `config/initializers/mailkick.rb` with:
 
 ```ruby
-Mailkick.headers = true
+Mailkick.headers = false
 ```
 
-Headers will automatically be added to emails that call `mailkick_unsubscribe_url`.
-
 ## Bounces and Spam Reports
 
 Fetch bounces, spam reports, and unsubscribes from your email service. Create `config/initializers/mailkick.rb` with a method to handle opt outs.
@@ -196,7 +200,7 @@ For more control over services, set them by hand.
 
 ```ruby
 Mailkick.services = [
-  Mailkick::Service::SendGridV2.new(api_key: "API_KEY"),
+  Mailkick::Service::SendGrid.new(api_key: "API_KEY"),
   Mailkick::Service::Mailchimp.new(api_key: "API_KEY", list_id: "LIST_ID")
 ]
 ```
@@ -219,18 +223,20 @@ end
 
 ## Upgrading
 
-### 2.0
+### 3.0
+
+Versions 1.1.0-2.0.0 cause applications to use SHA1 for the key generator hash digest class if `Mailkick.secret_token` is not manually set (due to [this behavior in Rails](https://github.com/rails/rails/issues/56736)).
 
-Unsubscribe links created before version 1.1.1 will no longer work by default. Determine if this is acceptable for your application (for instance, in the US, links must work [for 30 days](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business) after the message is sent). To restore support, [determine the previous secret token](https://github.com/ankane/mailkick/blob/v1.4.0/lib/mailkick/engine.rb#L13-L22) and create an initializer with:
+To avoid breakage when upgrading, add to `config/application.rb`:
 
 ```ruby
-Mailkick.message_verifier.rotate(previous_secret_token, serializer: Marshal)
+config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA1
 ```
 
-If fetching bounces, spam reports, and unsubscribes from Postmark, the suppressions API is now used and the default stream has been changed to `broadcast`. To use `outbound`, create an initializer with:
+Also, one-click unsubscribe headers are enabled by default. To disable, create an initializer with:
 
 ```ruby
-Mailkick.services = [Mailkick::Service::Postmark.new(api_key: api_key, stream_id: "outbound")]
+Mailkick.headers = false
 ```
 
 ## History

data/app/controllers/mailkick/subscriptions_controller.rb

@@ -9,12 +9,16 @@ module Mailkick
     end
 
     def unsubscribe
-      subscription.delete_all
+      defer = Mailkick.confirm_unsubscribe && request.get? && !params[:confirmed]
+
+      subscription.delete_all unless defer
 
       if request.post? && params["List-Unsubscribe"] == "One-Click"
         # must not redirect according to RFC 8058
         # could render show action instead
         render plain: "Unsubscribe successful"
+      elsif defer
+        render :show
       else
         redirect_to subscription_path(params[:id])
       end
@@ -52,14 +56,28 @@ module Mailkick
     end
     helper_method :opted_out?
 
+    def unsubscribing?
+      action_name == "unsubscribe"
+    end
+    helper_method :unsubscribing?
+
     def subscribe_url
       subscribe_subscription_path(params[:id])
     end
     helper_method :subscribe_url
 
+    # custom views created before 3.0 will use GET instead of POST
+    # add confirmed parameter to ensure unsubscribed
     def unsubscribe_url
-      unsubscribe_subscription_path(params[:id])
+      unsubscribe_subscription_path(params[:id], {confirmed: true})
     end
     helper_method :unsubscribe_url
+
+    def style_nonce
+      if request.content_security_policy_nonce_directives&.include?("style-src")
+        content_security_policy_nonce
+      end
+    end
+    helper_method :style_nonce
   end
 end

data/app/views/mailkick/subscriptions/show.html.erb

@@ -3,33 +3,39 @@
   <head>
     <title>Subscriptions</title>
 
-    <style>
+    <%= content_tag :style, nonce: style_nonce do %>
       body {
         padding: 20px;
-        font-family: "Helvetica Neue", Arial, Helvetica, sans-serif;
+        font-family: system-ui, "Helvetica Neue", Arial, Helvetica, sans-serif;
         font-size: 14px;
         line-height: 1.4;
       }
 
-      a {
-        color: blue;
-      }
-
       .container {
         max-width: 500px;
         margin-left: auto;
         margin-right: auto;
       }
-    </style>
+
+      button {
+        cursor: pointer;
+        font: inherit;
+        padding: 5px 10px;
+      }
+    <% end %>
   </head>
   <body>
     <div class="container">
       <% if !subscribed? %>
         <p>You are unsubscribed.</p>
-        <p><%= link_to "Resubscribe", subscribe_url %></p>
+        <p><%= button_to "Resubscribe", subscribe_url %></p>
       <% else %>
-        <p>You are subscribed.</p>
-        <p><%= link_to "Unsubscribe", unsubscribe_url %></p>
+        <% if unsubscribing? %>
+          <p>Click the button below to confirm.</p>
+        <% else %>
+          <p>You are subscribed.</p>
+        <% end %>
+        <p><%= button_to "Unsubscribe", unsubscribe_url %></p>
       <% end %>
     </div>
   </body>

data/config/routes.rb

@@ -7,6 +7,7 @@ end
 Mailkick::Engine.routes.draw do
   resources :subscriptions, only: [:show] do
     match :unsubscribe, on: :member, via: [:get, :post]
-    get :subscribe, on: :member
+    # support GET for custom views created before 3.0
+    match :subscribe, on: :member, via: [:get, :post]
   end
 end

data/lib/mailkick/engine.rb

@@ -5,7 +5,8 @@ module Mailkick
     initializer "mailkick" do |app|
       Mailkick.discover_services unless Mailkick.services.any?
 
-      Mailkick.secret_token ||= app.key_generator.generate_key("mailkick")
+      # avoid app.key_generator due to https://github.com/ankane/ahoy_email/pull/168
+      Mailkick.secret_token ||= ActiveSupport::KeyGenerator.new(app.secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1).generate_key("mailkick")
     end
   end
 end

data/lib/mailkick/version.rb

@@ -1,3 +1,3 @@
 module Mailkick
-  VERSION = "2.0.0"
+  VERSION = "3.0.0"
 end

data/lib/mailkick.rb

@@ -21,13 +21,14 @@ require_relative "mailkick/version"
 require_relative "mailkick/engine" if defined?(Rails)
 
 module Mailkick
-  mattr_accessor :services, :mount, :process_opt_outs_method, :headers
+  mattr_accessor :services, :mount, :process_opt_outs_method, :headers, :confirm_unsubscribe
   mattr_reader :secret_token
   mattr_writer :message_verifier
   self.services = []
   self.mount = true
   self.process_opt_outs_method = ->(_) { raise "process_opt_outs_method not defined" }
-  self.headers = false
+  self.headers = true
+  self.confirm_unsubscribe = false
 
   def self.fetch_opt_outs
     services.each(&:fetch_opt_outs)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mailkick
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 3.0.0
 platform: ruby
 authors:
 - Andrew Kane
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '7.2'
 email: andrew@ankane.org
 executables: []
 extensions: []
@@ -61,14 +61,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Email subscriptions for Rails
 test_files: []