plutonium 0.62.0 → 0.62.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62c3179e6fc69beaae9e39a5892a478bd41c546fcf0fb580dea6a4aa9680e296
-  data.tar.gz: 94c2ce8570a323536961196170f8cb7187efe724834485edfd210a783147cbe8
+  metadata.gz: 1bf12b730a106a86a4944705ef1bfffe79d245e56b2585906f3b7787db9ead84
+  data.tar.gz: da3e1fc7f6d708abb473e1e18b53ea612181c2637480781b4423ce8af3d4e7e4
 SHA512:
-  metadata.gz: 0b9dc172a16b74c0f313606cefe964a661842aacd63c21df3ed3cb9ca20179439d2f302b53658305a375ee2b752aacf056244eb0a6875e2a31e20276b8055a2c
-  data.tar.gz: e1f47b1429392d82253f27e8268309e129d33e5d62716b04c669c13e24cc4e3b34d74728d154189c116124319c7155911e49000be008ea72a2bbdd64fecc3dbd
+  metadata.gz: 49e628c86ad4fe1bcdb032bbcd773c4c26b4ad98626e977d1ae573e4c024245275f988609815b0ac0599d4a3077a1d2c0704b473a5c3b9f2a74491cb65cd6a12
+  data.tar.gz: df9ba22d2a3e1c1e3504f06c1c435ecccc22fc2712b651e03458677794edc3ee7c53ed64b40666a0278fc8e016dd1e71883011ddd4a3b8d519267b592b5bfdff

data/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.62.1] - 2026-07-07
+
+### Bug Fixes
+
+- Split grouped error classes into per-constant files
+- Fall back to index when deleting from the record's own page
+
+### Documentation
+
+- Add SECURITY.md and auto-bump its version series on release
+
+### Miscellaneous Tasks
+
+- Require RubyGems MFA and disable CI auto-release
+
 ## [0.62.0] - 2026-07-04
 
 ### Bug Fixes
@@ -67,11 +82,11 @@ All notable changes to this project will be documented in this file.
 
 ## [0.60.5] - 2026-06-30
 
-### 🐛 Bug Fixes
+### Bug Fixes
 
-- *(ui)* Coerce ActiveStorage::Filename to String for HTML title attributes
+- Coerce ActiveStorage::Filename to String for HTML title attributes
 
-### ⚙️ Miscellaneous Tasks
+### Miscellaneous Tasks
 
 - Update yarn.lock and .yarnrc.yml after yarn install
 

data/SECURITY.md

@@ -0,0 +1,57 @@
+# Security Policy
+
+We take the security of Plutonium seriously. Because Plutonium is a framework
+that other applications are built on, a vulnerability here can affect many
+downstream apps. We appreciate your help in disclosing issues responsibly.
+
+## Supported Versions
+
+Plutonium is pre-1.0 and evolving quickly. Security fixes are released against
+the **latest published version** only. If you are running an older release,
+please upgrade before reporting an issue to confirm it still reproduces.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| Latest release (`0.62.x`) | :white_check_mark: |
+| Older releases | :x: |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+discussions, or pull requests.**
+
+Instead, use one of the following private channels:
+
+- **Preferred:** [Open a private vulnerability report](https://github.com/radioactive-labs/plutonium-core/security/advisories/new)
+  via GitHub Security Advisories.
+- **Email:** [sfroelich01@gmail.com](mailto:sfroelich01@gmail.com) with the
+  subject line `[SECURITY] Plutonium`.
+
+To help us triage quickly, please include as much of the following as you can:
+
+- The Plutonium version (and Rails version) affected.
+- A description of the vulnerability and its impact.
+- Steps to reproduce, or a proof-of-concept.
+- Any known workarounds.
+
+## What to Expect
+
+- **Acknowledgement:** We aim to acknowledge your report within **3 business days**.
+- **Assessment:** We will investigate and let you know whether the report is
+  accepted, along with our expected timeline for a fix.
+- **Disclosure:** We follow a coordinated disclosure process. We will work with
+  you to agree on a disclosure date once a fix is available, and we are happy to
+  credit you in the advisory unless you prefer to remain anonymous.
+
+Please give us a reasonable opportunity to address the issue before any public
+disclosure.
+
+## Scope
+
+Security reports about the Plutonium framework code in this repository are in
+scope. Issues in applications *built with* Plutonium, or in third-party
+dependencies, should be reported to their respective maintainers — though if you
+believe a dependency issue is triggered by how Plutonium uses it, we would like
+to hear about it.
+
+Thank you for helping keep Plutonium and its community safe.

data/lib/plutonium/resource/controllers/crud_actions.rb

@@ -212,13 +212,25 @@ module Plutonium
         end
 
         def redirect_url_after_destroy
-          if (return_to = url_from(params[:return_to])) && return_to != request.url
+          if (return_to = url_from(params[:return_to])) && !same_resource_url?(return_to)
             return return_to
           end
 
           resource_url_for(resource_class)
         end
 
+        # A return_to pointing at the just-deleted record's own show/edit page
+        # would 404 on the follow-up request, so treat those as unusable and let
+        # the caller fall back to the index. We compare paths because return_to
+        # is the bare record URL while request.url still carries ?return_to=.
+        def same_resource_url?(return_to)
+          return false unless resource_record?
+
+          target_path = URI.parse(return_to).path
+          record_path = URI.parse(resource_url_for(resource_record!)).path
+          target_path == record_path || target_path == "#{record_path}/edit"
+        end
+
         def preferred_action_after_submit
           @preferred_action_after_submit = begin
             if %w[new edit show index].include? params[:commit]

data/lib/plutonium/version.rb

@@ -1,5 +1,5 @@
 module Plutonium
-  VERSION = "0.62.0"
+  VERSION = "0.62.1"
   NEXT_MAJOR_VERSION = VERSION.split(".").tap { |v|
     v[1] = v[1].to_i + 1
     v[2] = 0

data/lib/plutonium/wizard/not_anchored_error.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module Wizard
+    # Raised when a wizard requires an anchor record but none is available.
+    class NotAnchoredError < StandardError; end
+  end
+end

data/lib/plutonium/wizard/{errors.rb → step_error.rb}

@@ -2,14 +2,6 @@
 
 module Plutonium
   module Wizard
-    # Raised when a wizard requires an anchor record but none is available.
-    class NotAnchoredError < StandardError; end
-
-    # Raised when the `wizard_class` route default does not resolve to a
-    # Plutonium::Wizard::Base subclass (a misconfigured mount, or a tampered
-    # path parameter).
-    class UnknownWizardError < StandardError; end
-
     # Raised when a wizard step fails. Carries the attribute the error should be
     # attached to (defaults to +:base+) so it can be surfaced on a form.
     class StepError < StandardError

data/lib/plutonium/wizard/unknown_wizard_error.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module Wizard
+    # Raised when the `wizard_class` route default does not resolve to a
+    # Plutonium::Wizard::Base subclass (a misconfigured mount, or a tampered
+    # path parameter).
+    class UnknownWizardError < StandardError; end
+  end
+end

data/lib/plutonium/wizard.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "wizard/errors"
 require_relative "wizard/configuration"
 
 module Plutonium

data/lib/tasks/release.rake

@@ -23,6 +23,7 @@ RELEASE_CLIFF_CONFIG = ".cliff.toml"
 RELEASE_VERSION_FILE = "lib/plutonium/version.rb"
 RELEASE_PACKAGE_JSON = "package.json"
 RELEASE_NPM_PACKAGE = "@radioactive-labs/plutonium"
+RELEASE_SECURITY_FILE = "SECURITY.md"
 
 namespace :release do
   # --- helpers --------------------------------------------------------------
@@ -89,6 +90,21 @@ namespace :release do
     File.write(RELEASE_PACKAGE_JSON, pkg.gsub(/"version":\s*"[\d.]+"/, %("version": "#{version}")))
     puts "✓ #{RELEASE_PACKAGE_JSON}"
 
+    # Bump the supported-version series in SECURITY.md (e.g. `0.62.x`), so the
+    # policy always names the current release series. Skipped if the file or the
+    # expected `X.Y.x` marker is missing — a release must never fail over this.
+    if File.exist?(RELEASE_SECURITY_FILE)
+      series = "#{version.split(".").first(2).join(".")}.x"
+      security = File.read(RELEASE_SECURITY_FILE)
+      updated = security.gsub(/`\d+\.\d+\.x`/, "`#{series}`")
+      if updated == security
+        puts "• #{RELEASE_SECURITY_FILE} — no `X.Y.x` marker found, skipping"
+      else
+        File.write(RELEASE_SECURITY_FILE, updated)
+        puts "✓ #{RELEASE_SECURITY_FILE}"
+      end
+    end
+
     # Changelog — same config CI uses for release notes, so they agree.
     abort "git-cliff not found. Install with: brew install git-cliff" unless git_cliff?
     system("git-cliff", "--config", RELEASE_CLIFF_CONFIG, "--tag", "v#{version}", "-o", "CHANGELOG.md") ||

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radioactive-labs/plutonium",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
   "type": "module",
   "main": "src/js/core.js",

data/plutonium.gemspec

@@ -15,6 +15,9 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 3.2.2"
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  # Require multi-factor auth for privileged RubyGems actions (push, yank,
+  # owner changes). `gem push` will prompt for an OTP at release time.
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.post_install_message = <<~MSG
     ℹ️  Plutonium — breaking change introduced in 0.49.0

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: plutonium
 version: !ruby/object:Gem::Version
-  version: 0.62.0
+  version: 0.62.1
 platform: ruby
 authors:
 - Stefan Froelich
 bindir: exe
 cert_chain: []
-date: 2026-07-04 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: zeitwerk
@@ -467,6 +467,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- SECURITY.md
 - app/assets/plutonium.css
 - app/assets/plutonium.ico
 - app/assets/plutonium.js
@@ -1289,12 +1290,12 @@ files:
 - lib/plutonium/wizard/data.rb
 - lib/plutonium/wizard/driving.rb
 - lib/plutonium/wizard/dsl.rb
-- lib/plutonium/wizard/errors.rb
 - lib/plutonium/wizard/field_capture.rb
 - lib/plutonium/wizard/field_importer.rb
 - lib/plutonium/wizard/gate.rb
 - lib/plutonium/wizard/instance_key.rb
 - lib/plutonium/wizard/lazy_persisted.rb
+- lib/plutonium/wizard/not_anchored_error.rb
 - lib/plutonium/wizard/resume.rb
 - lib/plutonium/wizard/review_step.rb
 - lib/plutonium/wizard/route_resolution.rb
@@ -1303,10 +1304,12 @@ files:
 - lib/plutonium/wizard/state.rb
 - lib/plutonium/wizard/step.rb
 - lib/plutonium/wizard/step_adapter.rb
+- lib/plutonium/wizard/step_error.rb
 - lib/plutonium/wizard/store/active_record.rb
 - lib/plutonium/wizard/store/base.rb
 - lib/plutonium/wizard/store/memory.rb
 - lib/plutonium/wizard/sweep_job.rb
+- lib/plutonium/wizard/unknown_wizard_error.rb
 - lib/rodauth/features/case_insensitive_login.rb
 - lib/rodauth/plugins.rb
 - lib/tasks/.keep
@@ -1387,6 +1390,7 @@ licenses:
 - MIT
 metadata:
   allowed_push_host: https://rubygems.org
+  rubygems_mfa_required: 'true'
   homepage_uri: https://radioactive-labs.github.io/plutonium-core/
   source_code_uri: https://github.com/radioactive-labs/plutonium-core
 post_install_message: |