plutonium 0.63.0 → 0.64.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. checksums.yaml +4 -4
  2. data/.standard.yml +1 -1
  3. data/CHANGELOG.md +6 -0
  4. data/SECURITY.md +1 -1
  5. data/gemfiles/rails_7.gemfile.lock +1 -1
  6. data/gemfiles/rails_8.0.gemfile.lock +1 -1
  7. data/gemfiles/rails_8.1.gemfile.lock +1 -1
  8. data/lib/plutonium/version.rb +1 -1
  9. data/package.json +1 -1
  10. data/plutonium.gemspec +11 -29
  11. metadata +8 -16
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 0fb2dd2383544cabcb430a718bf139fa9f374d8d5156f15caadc47978395b112
4
- data.tar.gz: 2927cca706c47e59b1f3c7f69114351430060536dc4db545221043566d80eb35
3
+ metadata.gz: 6abf981b5e375a2c576de8bfe5fe6448b115753356b6c91f1c3b0ae946e66935
4
+ data.tar.gz: b519f55b96e20f592baab81b34a633de562dcd8060dbe2bf65cbff7342ae76dd
5
5
  SHA512:
6
- metadata.gz: f1f4caab482e175f4168c14c4b3930c9434e309a6fc880c4756babc2759081cf61aa95305af5502fb2f4db3b37e63d9fb4ddd1bfa42c7cc0b31d811427bf57c6
7
- data.tar.gz: 9dbb8084dd3cccb38b3426d7990f016a9f6765685e4f7e332ec108ebb3f72680125c5d64abbcd4bc2a7e857ded64fad8ddd0644f5ea25b37e997b55f5c5af52b
6
+ metadata.gz: cbf194184d5d16439031b3802f5fc7b05b7f22b24a2075cac2d03a5e6869160f5332ea6cc4d83d3a580169db7405266435e5f9b7f4f1b42befd334a93a470f53
7
+ data.tar.gz: ec740ece535648156d103872cb0362347b6b2f2823d425aa0b94134f336a32355c807f767d05a673f173670fb1efd572c42240542b48b44f0ab5dc8b23ed63cc
data/.standard.yml CHANGED
@@ -1,4 +1,4 @@
1
1
  # For available configuration options, see:
2
2
  # https://github.com/standardrb/standard
3
3
  ---
4
- ruby_version: 3.2.2
4
+ ruby_version: 3.3
data/CHANGELOG.md CHANGED
@@ -2,6 +2,12 @@
2
2
 
3
3
  All notable changes to this project will be documented in this file.
4
4
 
5
+ ## [0.64.0] - 2026-08-22
6
+
7
+ ### Miscellaneous Tasks
8
+
9
+ - [**breaking**] Drop Ruby 3.2, pin pagy past CVE-2026-54659 ([#79](https://github.com/radioactive-labs/plutonium-core/issues/79))
10
+
5
11
  ## [0.63.0] - 2026-08-22
6
12
 
7
13
  ### Bug Fixes
data/SECURITY.md CHANGED
@@ -12,7 +12,7 @@ please upgrade before reporting an issue to confirm it still reproduces.
12
12
 
13
13
  | Version | Supported |
14
14
  | ------- | ------------------ |
15
- | Latest release (`0.63.x`) | :white_check_mark: |
15
+ | Latest release (`0.64.x`) | :white_check_mark: |
16
16
  | Older releases | :x: |
17
17
 
18
18
  ## Reporting a Vulnerability
data/gemfiles/rails_7.gemfile.lock CHANGED
@@ -5,7 +5,7 @@ PATH
5
5
  action_policy (~> 0.7.0)
6
6
  csv
7
7
  listen (~> 3.8)
8
- pagy (~> 43.0)
8
+ pagy (~> 43.0, >= 43.5.6)
9
9
  phlex (~> 2.0)
10
10
  phlex-rails
11
11
  phlex-slotable (>= 1.0.0)
data/gemfiles/rails_8.0.gemfile.lock CHANGED
@@ -5,7 +5,7 @@ PATH
5
5
  action_policy (~> 0.7.0)
6
6
  csv
7
7
  listen (~> 3.8)
8
- pagy (~> 43.0)
8
+ pagy (~> 43.0, >= 43.5.6)
9
9
  phlex (~> 2.0)
10
10
  phlex-rails
11
11
  phlex-slotable (>= 1.0.0)
data/gemfiles/rails_8.1.gemfile.lock CHANGED
@@ -5,7 +5,7 @@ PATH
5
5
  action_policy (~> 0.7.0)
6
6
  csv
7
7
  listen (~> 3.8)
8
- pagy (~> 43.0)
8
+ pagy (~> 43.0, >= 43.5.6)
9
9
  phlex (~> 2.0)
10
10
  phlex-rails
11
11
  phlex-slotable (>= 1.0.0)
data/lib/plutonium/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  module Plutonium
2
- VERSION = "0.63.0"
2
+ VERSION = "0.64.0"
3
3
  NEXT_MAJOR_VERSION = VERSION.split(".").tap { |v|
4
4
  v[1] = v[1].to_i + 1
5
5
  v[2] = 0
data/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@radioactive-labs/plutonium",
3
- "version": "0.63.0",
3
+ "version": "0.64.0",
4
4
  "description": "Build production-ready Rails apps in minutes, not days. Convention-driven, fully customizable, AI-ready.",
5
5
  "type": "module",
6
6
  "main": "src/js/core.js",
data/plutonium.gemspec CHANGED
@@ -12,35 +12,17 @@ Gem::Specification.new do |spec|
12
12
  "definitions, and portals that make building complex apps faster. Built for the AI era with Claude Code skills."
13
13
  spec.homepage = "https://radioactive-labs.github.io/plutonium-core/"
14
14
  spec.license = "MIT"
15
- # Ruby 3.2 is DEPRECATED and will be dropped in the next release — see the
16
- # post_install_message. Held here for one more release so 3.2 users can
17
- # receive the fixes in this one before support ends; raising it in the same
18
- # release that ships them would strand those users on the old version.
19
- spec.required_ruby_version = ">= 3.2.2"
15
+ # Ruby 3.2 was dropped here, one release after being deprecated in the
16
+ # post_install_message, so 3.2 users had a release that both carried the
17
+ # fixes and still installed for them. See the pagy dependency below for why
18
+ # 3.2 could not be kept.
19
+ spec.required_ruby_version = ">= 3.3"
20
20
 
21
21
  spec.metadata["allowed_push_host"] = "https://rubygems.org"
22
22
  # Require multi-factor auth for privileged RubyGems actions (push, yank,
23
23
  # owner changes). `gem push` will prompt for an OTP at release time.
24
24
  spec.metadata["rubygems_mfa_required"] = "true"
25
25
 
26
- # Prints on EVERY install: only notices still actionable for someone
27
- # installing THIS version.
28
- spec.post_install_message = <<~MSG
29
- ⚠️ Ruby 3.2 support ends in the NEXT release
30
-
31
- This is the last Plutonium release that installs on Ruby 3.2.
32
-
33
- Why: pagy patches CVE-2026-54659 (a path-traversal in
34
- `Pagy::I18n.locale=`) only in >= 43.5.6, and pagy dropped Ruby 3.2 in
35
- 43.5.0. No pagy version is both patched and installable on 3.2, so
36
- continuing to support it means shipping a known-vulnerable dependency.
37
-
38
- Ruby 3.2 reached end-of-life in March 2026.
39
-
40
- Action: upgrade to Ruby 3.3 or newer before your next Plutonium bump.
41
- If you stay on 3.2, `bundle update plutonium` will hold you here.
42
- MSG
43
-
44
26
  spec.metadata["homepage_uri"] = spec.homepage
45
27
  spec.metadata["source_code_uri"] = "https://github.com/radioactive-labs/plutonium-core"
46
28
  # spec.metadata["changelog_uri"] = "https://google.com"
@@ -61,12 +43,12 @@ Gem::Specification.new do |spec|
61
43
  spec.add_dependency "rails", ">= 7.2.3.1"
62
44
  spec.add_dependency "csv" # CSV export; no longer a default gem on Ruby 3.4+
63
45
  spec.add_dependency "listen", "~> 3.8"
64
- # NOT pinned to >= 43.5.6 (which patches CVE-2026-54659) yet: that version
65
- # requires Ruby >= 3.3, so pinning it here would silently drop Ruby 3.2 a
66
- # release early. `~> 43.0` already resolves to a patched 43.6.x on any fresh
67
- # install under Ruby 3.3+, so the exposure is limited to apps holding an old
68
- # pagy in their lockfile. Pin it in the release that drops 3.2.
69
- spec.add_dependency "pagy", "~> 43.0"
46
+ # >= 43.5.6 patches CVE-2026-54659 (Pagy::I18n.locale= used its argument as a
47
+ # path component without validating it). Pinned so an app carrying an older
48
+ # pagy in its lockfile cannot stay on a vulnerable 43.x through a plutonium
49
+ # bump. This pin is what requires Ruby >= 3.3 above: pagy dropped 3.2 in
50
+ # 43.5.0, so no version is both patched and installable on 3.2.
51
+ spec.add_dependency "pagy", "~> 43.0", ">= 43.5.6"
70
52
  spec.add_dependency "rabl", "~> 0.17.0" # TODO: what to do with RABL
71
53
  spec.add_dependency "semantic_range", "~> 3.0"
72
54
  spec.add_dependency "tty-prompt", "~> 0.23.1"
metadata CHANGED
@@ -1,7 +1,7 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: plutonium
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.63.0
4
+ version: 0.64.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Stefan Froelich
@@ -72,6 +72,9 @@ dependencies:
72
72
  - - "~>"
73
73
  - !ruby/object:Gem::Version
74
74
  version: '43.0'
75
+ - - ">="
76
+ - !ruby/object:Gem::Version
77
+ version: 43.5.6
75
78
  type: :runtime
76
79
  prerelease: false
77
80
  version_requirements: !ruby/object:Gem::Requirement
@@ -79,6 +82,9 @@ dependencies:
79
82
  - - "~>"
80
83
  - !ruby/object:Gem::Version
81
84
  version: '43.0'
85
+ - - ">="
86
+ - !ruby/object:Gem::Version
87
+ version: 43.5.6
82
88
  - !ruby/object:Gem::Dependency
83
89
  name: rabl
84
90
  requirement: !ruby/object:Gem::Requirement
@@ -1481,20 +1487,6 @@ metadata:
1481
1487
  rubygems_mfa_required: 'true'
1482
1488
  homepage_uri: https://radioactive-labs.github.io/plutonium-core/
1483
1489
  source_code_uri: https://github.com/radioactive-labs/plutonium-core
1484
- post_install_message: |
1485
- ⚠️ Ruby 3.2 support ends in the NEXT release
1486
-
1487
- This is the last Plutonium release that installs on Ruby 3.2.
1488
-
1489
- Why: pagy patches CVE-2026-54659 (a path-traversal in
1490
- `Pagy::I18n.locale=`) only in >= 43.5.6, and pagy dropped Ruby 3.2 in
1491
- 43.5.0. No pagy version is both patched and installable on 3.2, so
1492
- continuing to support it means shipping a known-vulnerable dependency.
1493
-
1494
- Ruby 3.2 reached end-of-life in March 2026.
1495
-
1496
- Action: upgrade to Ruby 3.3 or newer before your next Plutonium bump.
1497
- If you stay on 3.2, `bundle update plutonium` will hold you here.
1498
1490
  rdoc_options: []
1499
1491
  require_paths:
1500
1492
  - lib
@@ -1502,7 +1494,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
1502
1494
  requirements:
1503
1495
  - - ">="
1504
1496
  - !ruby/object:Gem::Version
1505
- version: 3.2.2
1497
+ version: '3.3'
1506
1498
  required_rubygems_version: !ruby/object:Gem::Requirement
1507
1499
  requirements:
1508
1500
  - - ">="