phraseapp-in-context-editor-ruby 3.1.1 → 3.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1d26e42fffd5138a7fecf9273413a584f2e0bac55f0c9ec280f2ff3f2c48701b
-  data.tar.gz: 675aa580225c7edf371c0b031a9b4dba485e36c72a71ebdbc991738548eb9ae3
+  metadata.gz: 83395ff81d6ec99ed47ff9ff8edfa58f488ad71b36889007ff64367584ee0957
+  data.tar.gz: dad8bce3674f949005ffdcfa7d5e39b9d2fb30d3c063f4f1d7160c044aaf5684
 SHA512:
-  metadata.gz: 45d475e3a53d156711097c0926df63c9bc89a0ad78ffb56b908e48d11b5db0cc70267ac629edd0d24c7a0835572411fce36ff08b9de021e2787a1c389a11ae7d
-  data.tar.gz: 546bd0fa0eca47a62078b7f20b0e2ed1215fad2c73dcb0367f01c25fe235e64a16c4301d0a48ff665f67ed93a293b5556e5aadeadbe1fc2911f2b419e0ee074a
+  metadata.gz: dcdce2375237d620f718050d773d0354c53a3102dddefa3b7addd8f9be9a848fb8a2b92f71981155376428a8bb95f84672286cf71366968c6f1b9112e85fb51d
+  data.tar.gz: fae9d3c37ccd6dea23ef95130b358722f296f05566867514075ff8cbc97757a9f6f50aab194642ad79907938473eb2eb6f5f5f347dcabfa737ecfc8973564993

data/.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "bundler"
+    directory: "/examples"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "*"
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "npm"
+    directory: "/examples"
+    schedule:
+      interval: "weekly"
+    ignore:
+      - dependency-name: "*"

data/.github/workflows/release.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d
         with:
           node-version: 20
-      - uses: ruby/setup-ruby@250fcd6a742febb1123a77a841497ccaa8b9e939
+      - uses: ruby/setup-ruby@4a9ddd6f338a97768b8006bf671dfbad383215f4
         with:
           ruby-version: "3.2" # Not needed with a .ruby-version file
 

data/.github/workflows/test.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@319066216501fbd5e2d568f14b7d68c19fb67a5d
+      - uses: ruby/setup-ruby@4a9ddd6f338a97768b8006bf671dfbad383215f4
         with:
           ruby-version: ${{ matrix.ruby }}
       - run: bundle install

data/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [3.2.1](https://github.com/phrase/phraseapp-in-context-editor-ruby/compare/v3.2.0...v3.2.1) (2025-09-24)
+
+
+### Bug Fixes
+
+* **SCM-615:** update cdn url ([#123](https://github.com/phrase/phraseapp-in-context-editor-ruby/issues/123)) ([2b1b873](https://github.com/phrase/phraseapp-in-context-editor-ruby/commit/2b1b8735b2a18f314e3cc6e41a06336403697894))
+
+# [3.2.0](https://github.com/phrase/phraseapp-in-context-editor-ruby/compare/v3.1.1...v3.2.0) (2024-07-11)
+
+
+### Features
+
+* Added nonce support ([#86](https://github.com/phrase/phraseapp-in-context-editor-ruby/issues/86)) ([e7df6f7](https://github.com/phrase/phraseapp-in-context-editor-ruby/commit/e7df6f7b279c3823dd8a99f0b5d6e2d025863ca7))
+
 ## [3.1.1](https://github.com/phrase/phraseapp-in-context-editor-ruby/compare/v3.1.0...v3.1.1) (2024-06-14)
 
 

data/CODEOWNERS

@@ -1 +1 @@
-* @phrase/strings-editor
+* @phrase/strings-create-manage

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    phraseapp-in-context-editor-ruby (3.1.0)
+    phraseapp-in-context-editor-ruby (3.2.0)
       i18n (~> 1.0)
       json (~> 2.0)
       request_store (~> 1.2)
@@ -102,7 +102,7 @@ GEM
       fiber-annotation
       fiber-local
     crass (1.0.6)
-    date (3.3.3)
+    date (3.4.1)
     diff-lcs (1.5.0)
     erubi (1.12.0)
     faraday (2.7.10)
@@ -128,7 +128,7 @@ GEM
       concurrent-ruby (~> 1.0)
     io-event (1.3.2)
     json (2.6.3)
-    loofah (2.21.3)
+    loofah (2.24.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.8.1)
@@ -141,19 +141,19 @@ GEM
     mini_mime (1.1.5)
     minitest (5.19.0)
     multi_json (1.15.0)
-    net-imap (0.3.7)
+    net-imap (0.3.9)
       date
       net-protocol
     net-pop (0.1.2)
       net-protocol
-    net-protocol (0.2.1)
+    net-protocol (0.2.2)
       timeout
     net-smtp (0.3.3)
       net-protocol
     nio4r (2.5.9)
-    nokogiri (1.15.4-arm64-darwin)
+    nokogiri (1.18.9-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.15.4-x86_64-linux)
+    nokogiri (1.18.9-x86_64-linux-gnu)
       racc (~> 1.4)
     octokit (4.25.1)
       faraday (>= 1, < 3)
@@ -166,8 +166,8 @@ GEM
       protocol-hpack (~> 1.4)
       protocol-http (~> 0.18)
     public_suffix (5.0.3)
-    racc (1.7.1)
-    rack (2.2.8)
+    racc (1.8.1)
+    rack (2.2.14)
     rack-test (2.1.0)
       rack (>= 1.3)
     rails (7.0.7.2)
@@ -188,9 +188,9 @@ GEM
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.0)
+    rails-html-sanitizer (1.6.1)
       loofah (~> 2.21)
-      nokogiri (~> 1.14)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     railties (7.0.7.2)
       actionpack (= 7.0.7.2)
       activesupport (= 7.0.7.2)
@@ -219,8 +219,8 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
-    thor (1.2.2)
-    timeout (0.4.0)
+    thor (1.4.0)
+    timeout (0.4.3)
     timers (4.3.5)
     traces (0.11.1)
     tzinfo (2.0.6)
@@ -232,6 +232,7 @@ GEM
 
 PLATFORMS
   arm64-darwin-22
+  arm64-darwin-24
   x86_64-linux
 
 DEPENDENCIES

data/README.md

@@ -10,8 +10,8 @@
 
 To use phraseapp-in-context-editor-ruby with your application you have to:
 
-* Sign up for a Phrase account: [https://app.phrase.com/signup](https://app.phrase.com/signup)
-* Use the excellent [i18n](https://github.com/ruby-i18n/i18n) gem also used by [Rails](https://guides.rubyonrails.org/i18n.html) 
+- Sign up for a Phrase account: [https://app.phrase.com/signup](https://app.phrase.com/signup)
+- Use the excellent [i18n](https://github.com/ruby-i18n/i18n) gem also used by [Rails](https://guides.rubyonrails.org/i18n.html)
 
 ### Demo
 
@@ -21,11 +21,13 @@ Login via the demo credentials `demo@phrase.com` / `phrase`
 ### Installation
 
 #### NOTE: You can not use the old version of the ICE with integration versions of >2.0.0, you have to instead use 1.x.x versions as before
+
 #### via Gem
 
 ```bash
 gem install phraseapp-in-context-editor-ruby
 ```
+
 #### via Bundler
 
 Add it to your `Gemfile`
@@ -84,6 +86,7 @@ Old version of the ICE is not available since version 2.0.0. If you still would
 #### Using the US Datacenter with ICE
 
 In addition to the settings in your `config/initializers/phraseapp_in_context_editor.rb`, set the US datacenter to enable the ICE to work with the US endpoints.
+
 ```ruby
   config.enabled = true
   config.project_id = "YOUR_PROJECT_ID"
@@ -91,6 +94,18 @@ In addition to the settings in your `config/initializers/phraseapp_in_context_ed
   config.datacenter = "us"
 ```
 
+#### Using with CSP
+
+The script will automatically get the nonce from `content_security_policy_nonce`
+The content_security_policy.rb has to have `:strict_dynamic` for `policy.script_src` since we are loading more scripts dynamically because of our way of deploying
+
+```ruby
+  policy.script_src :self, :https, :strict_dynamic
+  policy.style_src :self, :https
+```
+
+The `config.content_security_policy_nonce_directives = %w[script-src style-src]` can include `style-src` but this _might_ break some styling in some cases
+
 ### Browser support
 
 This library might not work out of the box for some older browser or IE11. We recommend to add [Babel](https://github.com/babel/babel) to the build pipeline if those browser need to be supported.

data/examples/demo/Gemfile.lock

@@ -1,10 +1,10 @@
 PATH
   remote: ../..
   specs:
-    phraseapp-in-context-editor-ruby (2.0.0)
-      i18n (>= 1.0)
-      json (>= 2.0)
-      request_store (>= 1.2)
+    phraseapp-in-context-editor-ruby (3.2.0)
+      i18n (~> 1.0)
+      json (~> 2.0)
+      request_store (~> 1.2)
 
 GEM
   remote: https://rubygems.org/
@@ -76,13 +76,9 @@ GEM
       tzinfo (~> 2.0)
     addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
-    autoprefixer-rails (10.4.13.0)
-      execjs (~> 2)
     bindex (0.8.1)
     bootsnap (1.16.0)
       msgpack (~> 1.2)
-    bootstrap-sass (3.2.0.4)
-      sass (~> 3.2)
     builder (3.2.4)
     capybara (3.39.2)
       addressable
@@ -100,8 +96,6 @@ GEM
       irb (>= 1.5.0)
       reline (>= 0.3.1)
     erubi (1.12.0)
-    execjs (2.8.1)
-    ffi (1.15.5)
     globalid (1.2.0)
       activesupport (>= 6.1)
     i18n (1.14.1)
@@ -141,15 +135,17 @@ GEM
     net-smtp (0.3.3)
       net-protocol
     nio4r (2.5.9)
-    nokogiri (1.15.4-arm64-darwin)
+    nokogiri (1.18.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.18.4-x86_64-linux-gnu)
       racc (~> 1.4)
     psych (5.1.0)
       stringio
     public_suffix (5.0.3)
     puma (5.6.7)
       nio4r (~> 2.0)
-    racc (1.7.1)
-    rack (2.2.8)
+    racc (1.7.3)
+    rack (2.2.14)
     rack-test (2.1.0)
       rack (>= 1.3)
     rails (7.0.7.2)
@@ -181,9 +177,6 @@ GEM
       thor (~> 1.0)
       zeitwerk (~> 2.5)
     rake (13.0.6)
-    rb-fsevent (0.11.2)
-    rb-inotify (0.10.1)
-      ffi (~> 1.0)
     rdoc (6.5.0)
       psych (>= 4.0.0)
     regexp_parser (2.8.1)
@@ -193,11 +186,6 @@ GEM
       rack (>= 1.4)
     rexml (3.2.6)
     rubyzip (2.3.2)
-    sass (3.7.4)
-      sass-listen (~> 4.0.0)
-    sass-listen (4.0.0)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
     selenium-webdriver (4.10.0)
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
@@ -210,6 +198,7 @@ GEM
       activesupport (>= 5.2)
       sprockets (>= 3.0.0)
     sqlite3 (1.6.4-arm64-darwin)
+    sqlite3 (1.6.4-x86_64-linux)
     stimulus-rails (1.2.2)
       railties (>= 6.0.0)
     stringio (3.0.8)
@@ -240,11 +229,11 @@ GEM
 
 PLATFORMS
   arm64-darwin-22
+  arm64-darwin-24
+  x86_64-linux
 
 DEPENDENCIES
-  autoprefixer-rails
   bootsnap
-  bootstrap-sass (~> 3.2.0)
   capybara
   debug
   importmap-rails

data/examples/demo/app/views/layouts/application.html.erb

@@ -6,7 +6,7 @@
     <%= csrf_meta_tags %>
     <%= csp_meta_tag %>
 
-    <%= stylesheet_link_tag "application", "data-turbo-track": "reload" %>
+    <%= stylesheet_link_tag "application", "data-turbo-track": "reload", nonce: true %>
     <%= javascript_importmap_tags %>
     <%= load_in_context_editor %>
   </head>

data/examples/demo/config/initializers/content_security_policy.rb

@@ -4,22 +4,22 @@
 # See the Securing Rails Applications Guide for more information:
 # https://guides.rubyonrails.org/security.html#content-security-policy-header
 
-# Rails.application.configure do
-#   config.content_security_policy do |policy|
-#     policy.default_src :self, :https
-#     policy.font_src    :self, :https, :data
-#     policy.img_src     :self, :https, :data
-#     policy.object_src  :none
-#     policy.script_src  :self, :https
-#     policy.style_src   :self, :https
-#     # Specify URI for violation reports
-#     # policy.report_uri "/csp-violation-report-endpoint"
-#   end
-#
-#   # Generate session nonces for permitted importmap and inline scripts
-#   config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
-#   config.content_security_policy_nonce_directives = %w(script-src)
-#
-#   # Report violations without enforcing the policy.
-#   # config.content_security_policy_report_only = true
-# end
+Rails.application.configure do
+  config.content_security_policy do |policy|
+    policy.default_src :self, :https
+    policy.font_src :self, :https, :data
+    policy.img_src :self, :https, :data
+    policy.object_src :none
+    policy.script_src :self, :https, :strict_dynamic
+    policy.style_src :self, :https
+    # Specify URI for violation reports
+    # policy.report_uri "/csp-violation-report-endpoint"
+  end
+
+  # Generate session nonces for permitted importmap and inline scripts
+  config.content_security_policy_nonce_generator = ->(request) { request.session.id.to_s }
+  config.content_security_policy_nonce_directives = %w[script-src style-src]
+
+  # Report violations without enforcing the policy.
+  # config.content_security_policy_report_only = true
+end

data/lib/phraseapp-in-context-editor-ruby/version.rb

@@ -1,3 +1,3 @@
 module PhraseappInContextEditor
-  VERSION = "3.1.1"
+  VERSION = "3.2.1"
 end

data/lib/phraseapp-in-context-editor-ruby/view_helpers.rb

@@ -22,13 +22,13 @@ module PhraseApp
         }.merge(opts)
 
         snippet = <<-EOS
-        <script>
+        <script nonce='#{content_security_policy_nonce}'>
           window.PHRASEAPP_CONFIG = #{configuration.to_json};
           (function() {
             let phraseapp = document.createElement('script');
             phraseapp.type = 'module';
             phraseapp.async = true;
-            phraseapp.src = "https://d2bgdldl6xit7z.cloudfront.net/latest/ice/index.js";
+            phraseapp.src = "https://cdn.phrase.com/strings/plugins/editor/latest/ice/index.js";
             let script = document.getElementsByTagName('script')[0];
             script.parentNode.insertBefore(phraseapp, script);
           })();

data/package-lock.json

@@ -684,12 +684,13 @@
       }
     },
     "node_modules/braces": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "fill-range": "^7.0.1"
+        "fill-range": "^7.1.1"
       },
       "engines": {
         "node": ">=8"
@@ -1230,10 +1231,11 @@
       }
     },
     "node_modules/fill-range": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "to-regex-range": "^5.0.1"
       },
@@ -1691,6 +1693,7 @@
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
       "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
       "dev": true,
+      "license": "MIT",
       "engines": {
         "node": ">=0.12.0"
       }
@@ -6347,6 +6350,7 @@
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
       "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
         "is-number": "^7.0.0"
       },

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: phraseapp-in-context-editor-ruby
 version: !ruby/object:Gem::Version
-  version: 3.1.1
+  version: 3.2.1
 platform: ruby
 authors:
 - Phrase
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-14 00:00:00.000000000 Z
+date: 2025-09-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -103,6 +103,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/ISSUE_TEMPLATE/bug_report.md"
+- ".github/dependabot.yml"
 - ".github/workflows/close_inactive_issues.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/test.yml"
@@ -224,7 +225,7 @@ homepage: https://phrase.com
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -239,8 +240,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.3.6
 requirements: []
-rubygems_version: 3.4.10
-signing_key: 
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: Translation management solution for web and mobile applications
 test_files: []