plutonium 0.62.0 → 0.62.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62c3179e6fc69beaae9e39a5892a478bd41c546fcf0fb580dea6a4aa9680e296
-  data.tar.gz: 94c2ce8570a323536961196170f8cb7187efe724834485edfd210a783147cbe8
+  metadata.gz: 75154d0671bfe1934ecdb6d045b6a0e119be04f3d9faa37740cf8c50eb113dab
+  data.tar.gz: e2dd3963d7a7862918a0ff3f3b482dec18115fec0c54ab5b186178a13006ae05
 SHA512:
-  metadata.gz: 0b9dc172a16b74c0f313606cefe964a661842aacd63c21df3ed3cb9ca20179439d2f302b53658305a375ee2b752aacf056244eb0a6875e2a31e20276b8055a2c
-  data.tar.gz: e1f47b1429392d82253f27e8268309e129d33e5d62716b04c669c13e24cc4e3b34d74728d154189c116124319c7155911e49000be008ea72a2bbdd64fecc3dbd
+  metadata.gz: 9cbfdd419b58dbef8e5f70c91de197065edfdbc108dd93062f407ebff187e61be334c8ff63e96b05a5bee5e4333b51681dfb8403ea294d41c232d4b1885eae38
+  data.tar.gz: 1114c97d24fd9c5341779419b545bb376503d2cc7e6b8b403b35ae8260c63f5c8db0483894c288ef8960ce72420952246e1e15f42f2bdb33e3e4da114130eaa8

data/CHANGELOG.md

@@ -2,6 +2,39 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.62.2] - 2026-07-09
+
+### Bug Fixes
+
+- Match nested paths under the deleted record on destroy redirect
+- Respect all Rails falsey values in boolean inputs
+
+### Testing
+
+- Drop hardcoded Migration[8.1] in dummy migrations
+- Repair stale kanban and show unit tests
+- Make scaffold generator test resilient to leftover state
+
+### Ci
+
+- Switch to advanced setup with paths-ignore
+- Bump actions to v4/v5 to clear deprecation warnings
+
+## [0.62.1] - 2026-07-07
+
+### Bug Fixes
+
+- Split grouped error classes into per-constant files
+- Fall back to index when deleting from the record's own page
+
+### Documentation
+
+- Add SECURITY.md and auto-bump its version series on release
+
+### Miscellaneous Tasks
+
+- Require RubyGems MFA and disable CI auto-release
+
 ## [0.62.0] - 2026-07-04
 
 ### Bug Fixes
@@ -65,16 +98,6 @@ All notable changes to this project will be documented in this file.
 
 - Docs accuracy + completeness audit, plus a per-field Shrine uploader for attachments ([#64](https://github.com/radioactive-labs/plutonium-core/issues/64))
 
-## [0.60.5] - 2026-06-30
-
-### 🐛 Bug Fixes
-
-- *(ui)* Coerce ActiveStorage::Filename to String for HTML title attributes
-
-### ⚙️ Miscellaneous Tasks
-
-- Update yarn.lock and .yarnrc.yml after yarn install
-
 ## [0.60.4] - 2026-06-15
 
 ### Features

data/SECURITY.md

@@ -0,0 +1,57 @@
+# Security Policy
+
+We take the security of Plutonium seriously. Because Plutonium is a framework
+that other applications are built on, a vulnerability here can affect many
+downstream apps. We appreciate your help in disclosing issues responsibly.
+
+## Supported Versions
+
+Plutonium is pre-1.0 and evolving quickly. Security fixes are released against
+the **latest published version** only. If you are running an older release,
+please upgrade before reporting an issue to confirm it still reproduces.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| Latest release (`0.62.x`) | :white_check_mark: |
+| Older releases | :x: |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+discussions, or pull requests.**
+
+Instead, use one of the following private channels:
+
+- **Preferred:** [Open a private vulnerability report](https://github.com/radioactive-labs/plutonium-core/security/advisories/new)
+  via GitHub Security Advisories.
+- **Email:** [sfroelich01@gmail.com](mailto:sfroelich01@gmail.com) with the
+  subject line `[SECURITY] Plutonium`.
+
+To help us triage quickly, please include as much of the following as you can:
+
+- The Plutonium version (and Rails version) affected.
+- A description of the vulnerability and its impact.
+- Steps to reproduce, or a proof-of-concept.
+- Any known workarounds.
+
+## What to Expect
+
+- **Acknowledgement:** We aim to acknowledge your report within **3 business days**.
+- **Assessment:** We will investigate and let you know whether the report is
+  accepted, along with our expected timeline for a fix.
+- **Disclosure:** We follow a coordinated disclosure process. We will work with
+  you to agree on a disclosure date once a fix is available, and we are happy to
+  credit you in the advisory unless you prefer to remain anonymous.
+
+Please give us a reasonable opportunity to address the issue before any public
+disclosure.
+
+## Scope
+
+Security reports about the Plutonium framework code in this repository are in
+scope. Issues in applications *built with* Plutonium, or in third-party
+dependencies, should be reported to their respective maintainers — though if you
+believe a dependency issue is triggered by how Plutonium uses it, we would like
+to hear about it.
+
+Thank you for helping keep Plutonium and its community safe.

data/gemfiles/rails_7.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.60.4)
+    plutonium (0.62.2)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -12,7 +12,7 @@ PATH
       phlex-tabler_icons
       phlexi-display (>= 0.2.0)
       phlexi-field (>= 0.2.0)
-      phlexi-form (>= 0.14.2)
+      phlexi-form (>= 0.14.3)
       phlexi-menu (>= 0.4.1)
       phlexi-table (>= 0.2.0)
       rabl (~> 0.17.0)
@@ -74,6 +74,11 @@ GEM
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
+    active_shrine (0.7.1)
+      activestorage
+      activesupport
+      railties
+      shrine
     activejob (7.2.3)
       activesupport (= 7.2.3)
       globalid (>= 0.3.6)
@@ -138,9 +143,13 @@ GEM
       thor (>= 0.14.6)
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
+    content_disposition (1.0.0)
     crass (1.0.6)
     csv (3.3.5)
     date (3.5.1)
+    down (5.6.0)
+      addressable (~> 2.8)
+      base64 (~> 0.3)
     drb (2.2.3)
     erb (6.0.2)
     erubi (1.13.1)
@@ -253,7 +262,7 @@ GEM
       fiber-local
       phlex (~> 2.0)
       zeitwerk
-    phlexi-form (0.14.2)
+    phlexi-form (0.14.3)
       activesupport
       phlex (~> 2.0)
       phlexi-field (~> 0.2.0)
@@ -392,6 +401,9 @@ GEM
     sequel-activerecord_connection (2.0.1)
       activerecord (>= 5.1)
       sequel (~> 5.38)
+    shrine (3.7.1)
+      content_disposition (~> 1.0)
+      down (~> 5.1)
     sin_lru_redux (2.5.2)
     sqlite3 (2.9.1-aarch64-linux-gnu)
     sqlite3 (2.9.1-aarch64-linux-musl)
@@ -464,6 +476,7 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  active_shrine
   appraisal
   bcrypt
   brakeman

data/gemfiles/rails_8.0.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.60.4)
+    plutonium (0.62.1)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -12,7 +12,7 @@ PATH
       phlex-tabler_icons
       phlexi-display (>= 0.2.0)
       phlexi-field (>= 0.2.0)
-      phlexi-form (>= 0.14.2)
+      phlexi-form (>= 0.14.3)
       phlexi-menu (>= 0.4.1)
       phlexi-table (>= 0.2.0)
       rabl (~> 0.17.0)
@@ -71,6 +71,11 @@ GEM
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
+    active_shrine (0.7.1)
+      activestorage
+      activesupport
+      railties
+      shrine
     activejob (8.0.3)
       activesupport (= 8.0.3)
       globalid (>= 0.3.6)
@@ -135,9 +140,13 @@ GEM
       thor (>= 0.14.6)
     concurrent-ruby (1.3.6)
     connection_pool (3.0.2)
+    content_disposition (1.0.0)
     crass (1.0.6)
     csv (3.3.5)
     date (3.5.1)
+    down (5.6.0)
+      addressable (~> 2.8)
+      base64 (~> 0.3)
     drb (2.2.3)
     erb (6.0.2)
     erubi (1.13.1)
@@ -229,7 +238,7 @@ GEM
       fiber-local
       phlex (~> 2.0)
       zeitwerk
-    phlexi-form (0.14.2)
+    phlexi-form (0.14.3)
       activesupport
       phlex (~> 2.0)
       phlexi-field (~> 0.2.0)
@@ -367,6 +376,9 @@ GEM
     sequel-activerecord_connection (2.0.1)
       activerecord (>= 5.1)
       sequel (~> 5.38)
+    shrine (3.7.1)
+      content_disposition (~> 1.0)
+      down (~> 5.1)
     sin_lru_redux (2.5.2)
     sqlite3 (2.9.1-arm64-darwin)
     standard (1.54.0)
@@ -425,6 +437,7 @@ PLATFORMS
   arm64-darwin
 
 DEPENDENCIES
+  active_shrine
   appraisal
   bcrypt
   brakeman

data/gemfiles/rails_8.1.gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: ..
   specs:
-    plutonium (0.61.0)
+    plutonium (0.62.1)
       action_policy (~> 0.7.0)
       csv
       listen (~> 3.8)
@@ -12,7 +12,7 @@ PATH
       phlex-tabler_icons
       phlexi-display (>= 0.2.0)
       phlexi-field (>= 0.2.0)
-      phlexi-form (>= 0.14.2)
+      phlexi-form (>= 0.14.3)
       phlexi-menu (>= 0.4.1)
       phlexi-table (>= 0.2.0)
       rabl (~> 0.17.0)
@@ -240,7 +240,7 @@ GEM
       fiber-local
       phlex (~> 2.0)
       zeitwerk
-    phlexi-form (0.14.2)
+    phlexi-form (0.14.3)
       activesupport
       phlex (~> 2.0)
       phlexi-field (~> 0.2.0)

data/lib/plutonium/resource/controllers/crud_actions.rb

@@ -212,13 +212,30 @@ module Plutonium
         end
 
         def redirect_url_after_destroy
-          if (return_to = url_from(params[:return_to])) && return_to != request.url
+          if (return_to = url_from(params[:return_to])) && !same_resource_url?(return_to)
             return return_to
           end
 
           resource_url_for(resource_class)
         end
 
+        # A return_to pointing at the just-deleted record's own page — its show,
+        # edit, or any nested resource beneath it — would 404 on the follow-up
+        # request, so treat those as unusable and let the caller fall back to the
+        # index. We compare paths (return_to is the bare record URL while
+        # request.url still carries ?return_to=) and normalize both to a trailing
+        # slash so the prefix test respects segment boundaries: /posts/13/ must
+        # not match /posts/130.
+        def same_resource_url?(return_to)
+          return false unless resource_record?
+
+          target_path = ensure_trailing_slash URI.parse(return_to).path
+          record_path = ensure_trailing_slash URI.parse(resource_url_for(resource_record!)).path
+          target_path.start_with?(record_path)
+        end
+
+        def ensure_trailing_slash(path) = "#{path.chomp("/")}/"
+
         def preferred_action_after_submit
           @preferred_action_after_submit = begin
             if %w[new edit show index].include? params[:commit]

data/lib/plutonium/version.rb

@@ -1,5 +1,5 @@
 module Plutonium
-  VERSION = "0.62.0"
+  VERSION = "0.62.2"
   NEXT_MAJOR_VERSION = VERSION.split(".").tap { |v|
     v[1] = v[1].to_i + 1
     v[2] = 0

data/lib/plutonium/wizard/not_anchored_error.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module Wizard
+    # Raised when a wizard requires an anchor record but none is available.
+    class NotAnchoredError < StandardError; end
+  end
+end

data/lib/plutonium/wizard/{errors.rb → step_error.rb}

@@ -2,14 +2,6 @@
 
 module Plutonium
   module Wizard
-    # Raised when a wizard requires an anchor record but none is available.
-    class NotAnchoredError < StandardError; end
-
-    # Raised when the `wizard_class` route default does not resolve to a
-    # Plutonium::Wizard::Base subclass (a misconfigured mount, or a tampered
-    # path parameter).
-    class UnknownWizardError < StandardError; end
-
     # Raised when a wizard step fails. Carries the attribute the error should be
     # attached to (defaults to +:base+) so it can be surfaced on a form.
     class StepError < StandardError

data/lib/plutonium/wizard/unknown_wizard_error.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Plutonium
+  module Wizard
+    # Raised when the `wizard_class` route default does not resolve to a
+    # Plutonium::Wizard::Base subclass (a misconfigured mount, or a tampered
+    # path parameter).
+    class UnknownWizardError < StandardError; end
+  end
+end

data/lib/plutonium/wizard.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "wizard/errors"
 require_relative "wizard/configuration"
 
 module Plutonium

data/lib/tasks/release.rake

@@ -23,6 +23,7 @@ RELEASE_CLIFF_CONFIG = ".cliff.toml"
 RELEASE_VERSION_FILE = "lib/plutonium/version.rb"
 RELEASE_PACKAGE_JSON = "package.json"
 RELEASE_NPM_PACKAGE = "@radioactive-labs/plutonium"
+RELEASE_SECURITY_FILE = "SECURITY.md"
 
 namespace :release do
   # --- helpers --------------------------------------------------------------
@@ -89,6 +90,21 @@ namespace :release do
     File.write(RELEASE_PACKAGE_JSON, pkg.gsub(/"version":\s*"[\d.]+"/, %("version": "#{version}")))
     puts "✓ #{RELEASE_PACKAGE_JSON}"
 
+    # Bump the supported-version series in SECURITY.md (e.g. `0.62.x`), so the
+    # policy always names the current release series. Skipped if the file or the
+    # expected `X.Y.x` marker is missing — a release must never fail over this.
+    if File.exist?(RELEASE_SECURITY_FILE)
+      series = "#{version.split(".").first(2).join(".")}.x"
+      security = File.read(RELEASE_SECURITY_FILE)
+      updated = security.gsub(/`\d+\.\d+\.x`/, "`#{series}`")
+      if updated == security
+        puts "• #{RELEASE_SECURITY_FILE} — no `X.Y.x` marker found, skipping"
+      else
+        File.write(RELEASE_SECURITY_FILE, updated)
+        puts "✓ #{RELEASE_SECURITY_FILE}"
+      end
+    end
+
     # Changelog — same config CI uses for release notes, so they agree.
     abort "git-cliff not found. Install with: brew install git-cliff" unless git_cliff?
     system("git-cliff", "--config", RELEASE_CLIFF_CONFIG, "--tag", "v#{version}", "-o", "CHANGELOG.md") ||

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@radioactive-labs/plutonium",
-  "version": "0.62.0",
+  "version": "0.62.2",
   "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
   "type": "module",
   "main": "src/js/core.js",

data/plutonium.gemspec

@@ -15,6 +15,9 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 3.2.2"
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"
+  # Require multi-factor auth for privileged RubyGems actions (push, yank,
+  # owner changes). `gem push` will prompt for an OTP at release time.
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   spec.post_install_message = <<~MSG
     ℹ️  Plutonium — breaking change introduced in 0.49.0
@@ -62,7 +65,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "phlex-rails"
   spec.add_dependency "phlex-tabler_icons"
   spec.add_dependency "phlexi-field", ">= 0.2.0"
-  spec.add_dependency "phlexi-form", ">= 0.14.2"
+  spec.add_dependency "phlexi-form", ">= 0.14.3"
   spec.add_dependency "phlexi-table", ">= 0.2.0"
   spec.add_dependency "phlexi-display", ">= 0.2.0"
   spec.add_dependency "phlexi-menu", ">= 0.4.1"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: plutonium
 version: !ruby/object:Gem::Version
-  version: 0.62.0
+  version: 0.62.2
 platform: ruby
 authors:
 - Stefan Froelich
 bindir: exe
 cert_chain: []
-date: 2026-07-04 00:00:00.000000000 Z
+date: 2026-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: zeitwerk
@@ -197,14 +197,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.14.2
+        version: 0.14.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.14.2
+        version: 0.14.3
 - !ruby/object:Gem::Dependency
   name: phlexi-table
   requirement: !ruby/object:Gem::Requirement
@@ -467,6 +467,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- SECURITY.md
 - app/assets/plutonium.css
 - app/assets/plutonium.ico
 - app/assets/plutonium.js
@@ -1289,12 +1290,12 @@ files:
 - lib/plutonium/wizard/data.rb
 - lib/plutonium/wizard/driving.rb
 - lib/plutonium/wizard/dsl.rb
-- lib/plutonium/wizard/errors.rb
 - lib/plutonium/wizard/field_capture.rb
 - lib/plutonium/wizard/field_importer.rb
 - lib/plutonium/wizard/gate.rb
 - lib/plutonium/wizard/instance_key.rb
 - lib/plutonium/wizard/lazy_persisted.rb
+- lib/plutonium/wizard/not_anchored_error.rb
 - lib/plutonium/wizard/resume.rb
 - lib/plutonium/wizard/review_step.rb
 - lib/plutonium/wizard/route_resolution.rb
@@ -1303,10 +1304,12 @@ files:
 - lib/plutonium/wizard/state.rb
 - lib/plutonium/wizard/step.rb
 - lib/plutonium/wizard/step_adapter.rb
+- lib/plutonium/wizard/step_error.rb
 - lib/plutonium/wizard/store/active_record.rb
 - lib/plutonium/wizard/store/base.rb
 - lib/plutonium/wizard/store/memory.rb
 - lib/plutonium/wizard/sweep_job.rb
+- lib/plutonium/wizard/unknown_wizard_error.rb
 - lib/rodauth/features/case_insensitive_login.rb
 - lib/rodauth/plugins.rb
 - lib/tasks/.keep
@@ -1387,6 +1390,7 @@ licenses:
 - MIT
 metadata:
   allowed_push_host: https://rubygems.org
+  rubygems_mfa_required: 'true'
   homepage_uri: https://radioactive-labs.github.io/plutonium-core/
   source_code_uri: https://github.com/radioactive-labs/plutonium-core
 post_install_message: |