rabl 0.18.0 → 0.19.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14b2f3bca3110dd76fbfa8c05c2dc068ed41719a1ab7c3812450e82869681ed2
-  data.tar.gz: 925dbbbda7e8557f4bafd1d41004783239ba75f1ee0f630debd821a3b9fa3919
+  metadata.gz: f1bfaeaa40af7667acd5ed068e1bd0b54dd5f201ec360bb78dd51fcb42198343
+  data.tar.gz: 5389a879fe511adcf009b51edbf47c77042374cac7582cd287a699ca7560caa8
 SHA512:
-  metadata.gz: d41aacd3750c05a910b0dfeff320b1b3953c7569cfa8326f384e770a81fdb98ef1bd6dc7a57510e4cc31377e4f26cf52c3efbf97b7093f505057813226288a50
-  data.tar.gz: 1026b5def5c394e27dac2fcf15852045ea5d650a37c7734bc1b50d2f4bc83cb89bbe3aa67791b24cf0938841813af95215441b9e11085dcc1352dce121e8b16e
+  metadata.gz: 1071859094149f84a0d9127a9acd99101537278694390bab3d1a2eb1d5b59ac50466e222e7117a627df114fc5c2662eec9b7ea555bbb7b975737d9f979049c3e
+  data.tar.gz: 248bdcc28e051445cf08d4d8c6f5f5911ecb83cc453844514cf5460d240b522b12257e41a4ef82b3b2f47787079142ec56a0626e227306931ebd42764e1b7c09

data/CHANGELOG.md

@@ -1,5 +1,34 @@
 # CHANGELOG
 
+## 0.19.1 (Nov 5, 2026)
+
+### Other changes
+
+* With `camelize_keys` on, a key is camelized once and remembered rather than for each item of a collection: a collection hands the same names out for every item, and camelizing one takes about 0.5 µs and six objects for a one-word name and about twenty for one with three words. Measured on a 50-item collection whose template has three `attributes`, one `node` and one `child`, six key names per item, YJIT off: with `camelize_keys = :lower` the render went from about 582 µs and 4050 allocations to about 457 µs and 2000 on Ruby 3.3.12, about 1.3x, and from about 592 µs and 4054 allocations to about 464 µs and 2004 on Ruby 4.0.7, where the same render without `camelize_keys` takes about 444 µs and 2000 on 3.3.12 and 453 µs and 2004 on 4.0.7 and is unchanged, so a template with more keys per item gains more. The names are kept in two maps, one per case style, so each style keeps its own; a map is emptied when it holds 10,000 names and a name longer than 128 bytes is camelized each time rather than kept, so a template that names keys at runtime (`node(field.key)`, `attribute :as => "field_#{i}"`, a name taken from user input) cannot grow it without bound. A name is kept as a frozen copy, because a Hash keeps an unfrozen String subclass such as `ActiveSupport::SafeBuffer` as it is and a caller that changed such a name in place would file another name under the camelized value; and a name keeps the acronyms it was first camelized with, so an inflection added after a name was first seen doesn't reach that name. The output is otherwise unchanged (@tagliala; change written by DeepSeek Flash)
+
+* A template a collection uses for each item through `extends` or `partial` is now read and resolved once per render rather than once per item. With the default `cache_sources` off, every item ran the whole lookup itself: outside Rails, with a view path passed and one in `Rabl.configuration.view_paths`, which `Rabl::Renderer`'s lookup adds to it, one lookup costs about 117 µs and 62 allocations on Ruby 4.0.7 and about 110 µs on 3.3.12, YJIT off, against 1.8 µs and 4 with `cache_sources` on. The sources a render reads are now collected for the length of that render and dropped when it returns, so a template changed between renders is still read again, one changed while the render runs is not read again until the next render, and a render that raises leaves nothing behind. A render started inside the collection (a `Rabl::Renderer` in a `node`, a nested render under Rails) uses the collection it finds, whose keys are complete, so the render around it keeps its own sources. Outside Rails the collection keys a lookup by the values it depends on (the format, the locale, the default locale and the object its fallbacks come from, the app's views under Sinatra) and not by the numbers `LOOKUP_IDS` and `MANUAL_LOOKUP_IDS` keep for the life of the process, so the collection's keys add nothing to those tables nor to `I18n.fallbacks`. With `cache_sources` on or off, a template with more than one candidate file for a name still asks I18n for the locale's fallbacks when it ranks them, which keeps that locale in `I18n.fallbacks`, as it did before; with `cache_sources` on the tables and `I18n.fallbacks` also gain an entry per locale looked up in, as before. Under Rails the numbers come from the lookup details and view paths Rails itself keeps, so they are used as they are and a view path prepended for one request adds one, as it does to Rails; a Padrino lookup, which depends on the request's controller and content type, is not collected per render. Measured outside Rails on a 50-item collection whose template is three `attributes`, one `node` and one `child` plus `extends "posts/show"` (the same output as one template with all of them), the render went from about 5.8 ms and 7540 allocations to about 0.95 ms and 4456 on Ruby 3.3.12, about 6.2x, and from about 7.0 ms and 7244 allocations to about 1.0 ms and 4454 on Ruby 4.0.7, about 7.0x; a heavier template, with two more `node`s, a `child`, a `glue` and a `partial` per item, went from about 12.1 ms and 16649 allocations to about 2.2 ms and 10480 on 3.3.12, about 5.4x, and from about 13.8 ms and 16103 to about 2.3 ms and 10522 on 4.0.7, about 5.9x, so the gain follows how much of the per-item cost the lookup was. Under Rails 8.1.4 on Ruby 4.0.7, rendering the same collection through `ApplicationController.render` with `cache_sources` off went from about 2.7 ms and 6376 allocations to about 1.9 ms and 5203, about 1.4x, where the same render with `cache_sources` on takes about 1.8 ms either way: Rails repeats a lookup in about 17 µs per item, the difference between that render with `cache_sources` on and off on the same code, against about 117 µs for the manual lookup, so it has less to save. The one-template version of the output is unchanged within the noise, one allocation more (the render's own collection), and a single object using `extends` allocates about ten more objects than before (the render's own collection, and a frozen copy of each lookup's template name and view paths). The output is unchanged (@tagliala; change written by DeepSeek Flash)
+
+* `Rabl::Builder#cache_results` and `Rabl::Engine#cache_results` now ask their cheapest question first: whether `cache_all_output` is on, and whether the template set a cache key, before asking whether caching is configured. Under Rails that second question is `ActionController::Base.perform_caching`, a delegated call that allocates an object and takes about 250 ns on Ruby 4.0.7, Rails 8.1.4, YJIT off; with the defaults (`cache_all_output` off, no `cache` in the template) its answer could not change the guard, and it was computed once per object built and once per engine rendered. On Ruby 4.0.7, where the call allocates one object, a 50-item collection whose template has one `child` (100 builders, 51 engines) saves those 151 allocations and about 40 µs per render, about 1.08x; on Ruby 3.3 it allocates two, so the same collection saves 302. A single object saves 4 allocations and about 1 µs. The output is unchanged; with `cache_all_output` on, the builder runs the same checks in the cheap-first order, and an engine whose template sets no cache key still skips the call. Outside Rails both checks are plain configuration reads, so the difference is inside the noise and the allocation count is unchanged (@tagliala)
+
+## 0.19.0 (Nov 1, 2026)
+
+### Requirements
+
+* Require ActiveSupport 6.1 or newer, and so Rails 6.1 or newer under Rails. The code rabl kept for Rails 2 to 5 (their template handlers, digestors and template lookups) is removed; Rails 6.1 and newer, Sinatra and Padrino render as before. Apps on an older Rails or ActiveSupport can stay on 0.18.x (@nesquena)
+
+### Fixes
+
+* Load rabl's Rails integration on Rails 9 and later: rabl recognised Rails 3 to 8 by the first digit of `Rails.version`, so on a newer Rails the railtie and the `.rabl` template handler never loaded and actions rendered empty responses. rabl no longer checks the Rails version, so its integration loads on every Rails from 6.1 on, with no upper bound; Rails 6.1 to 8 load the same parts as before (@nesquena)
+* Fix rabl defining a top-level `LRU` class for its own cache, which raised `TypeError: superclass mismatch for class LRU` in apps with an `LRU` class of their own; it is now `Rabl::CacheEngine::LRU` (use that name if your code used rabl's `LRU`). Once that cache (used outside Rails) held its 100,000 entries, each write also copied every key to drop the oldest one, about 0.5 ms per write; it now drops the same entries in a few µs (@nesquena)
+* Fix `Rabl::Renderer` and `Rabl.render` raising `NoMethodError` (`undefined method 'underscore' for nil`) for an object, or a collection, whose class has no name, such as a `Struct.new` or `Class.new` object. The renderer sets an instance variable named after the object's class (`@post` for a `Post`); for an unnamed class it now sets none, and the template gets the object as for any other (@nesquena)
+
+### Other changes
+
+* `Rabl::Renderer#process_source` and the JSONP callback check in `Rabl::Engine` answer their yes/no question about a string with `String#include?` and `Regexp#match?` instead of `=~`, which built a `MatchData` neither check read: creating a renderer for a template string is about 1.2x faster and allocates 3 objects fewer, a full render about 2% faster and 3 objects fewer, and a render with `enable_json_callbacks` 3 objects fewer. The output is unchanged, and a source that is not valid in its encoding still raises the same `ArgumentError: invalid byte sequence in UTF-8`, from `Engine#eval_source` when it has a newline and from the template lookup when it doesn't; a source in a non-ASCII-compatible encoding, such as UTF-16LE, still raises `Encoding::CompatibilityError` from the check, now with Ruby's `incompatible character encodings` message rather than `incompatible encoding regexp match` (@tagliala; change written by DeepSeek Flash, reviewed by Claude Opus 5.5 and Claude Fable 5.1)
+* CI now generates fresh Rails 7.2, Rails 8.1 and Sinatra apps that use rabl from the checkout and runs their tests (`test/apps/build_and_test.sh`), in place of the checked-in fixture apps for Rails 2 to 6 and Padrino under `fixtures/`, which CI never ran. No change to the gem (@nesquena)
+* README: a `child` block is passed the child's data (e.g. the posts) and a `glue` block the glued object, not the parent, with examples that run; the partial example passes the post (`:object => post`, not `:post`); the JSON engine is Oj when it is loaded and Ruby's JSON otherwise (yajl isn't used); and under Rails, Rails sets the content type from the template's format. No behaviour change (@nesquena; reported by @nirvdrum in #393 and @adie in #580)
+* The gem's rubygems.org page links the changelog, source code and issue tracker, and pushes to rubygems.org now require MFA (@nesquena)
+
 ## 0.18.0 (Oct 31, 2026)
 
 ### Requirements

data/README.md

@@ -26,6 +26,9 @@ For a breakdown of common misconceptions about RABL, please check out our guide
 
 ## Breaking Changes ##
 
+ * v0.19.0 requires ActiveSupport 6.1 or newer (and so Rails 6.1 or newer under Rails). Apps on an older Rails or
+   ActiveSupport can stay on 0.18.x.
+
  * v0.18.0 requires Ruby 2.7 or newer (older Rubies can stay on 0.17.0). Every cache key changes once: expect a cold
    cache after upgrading. It also fixes several long-standing output bugs in ways that can change existing output. Check the
    [CHANGELOG](https://github.com/nesquena/rabl/blob/master/CHANGELOG.md) before upgrading.
@@ -55,12 +58,12 @@ or add to your Gemfile:
 ```ruby
 # Gemfile
 gem 'rabl'
-# Also add either `oj` or `yajl-ruby` as the JSON parser
+# Optionally add `oj`: RABL encodes JSON with Oj when it is loaded, and with Ruby's JSON library otherwise
 # If using `oj`, Rabl renders with Oj's :compat mode and sets it as Oj's default (with Oj 3.17.7+, only if you haven't configured Oj yet)
 gem 'oj'
 ```
 
-and run `bundle install` to install the dependency. RABL needs Ruby 2.7 or newer.
+and run `bundle install` to install the dependency. RABL needs Ruby 2.7 or newer and ActiveSupport 6.1 or newer (on Rails, Rails 6.1 or newer).
 
 To render XML, also add `gem 'builder'` (Rails apps already include it); RABL loads ActiveSupport's XML conversions itself.
 
@@ -135,7 +138,7 @@ Rabl.configure do |config|
   # config.cache_engine = Rabl::CacheEngine.new # Defaults to Rails cache
   # config.perform_caching = false
   # config.escape_all_output = false
-  # config.json_engine = nil # Class with #dump class method (defaults JSON)
+  # config.json_engine = nil # Class with #dump class method (defaults to Oj when it is loaded, else ::JSON)
   # config.msgpack_engine = nil # Defaults to ::MessagePack
   # config.bson_engine = nil # Defaults to ::BSON
   # config.plist_engine = nil # Defaults to ::Plist::Emit
@@ -369,15 +372,18 @@ child :posts => :foobar do
 end
 ```
 
-You can also pass in the current object:
+The block is passed the child's data (here the user's posts, not the user), and the parent is still
+available as `@user`:
 
 ```ruby
 object @user
-child :posts do |user|
-  attribute :title unless user.suspended?
+child :posts do |posts|
+  attribute :title unless @user.suspended?
 end
 ```
 
+To decide for each post, use a condition, which is passed the post: `attribute :title, :if => lambda { |post| post.published? }`.
+
 ### Gluing Attributes ###
 
 You can also append child attributes back to the root node:
@@ -391,11 +397,11 @@ end
 
 Use glue to add additional attributes to the parent object.
 
-You can also pass in the current object:
+The block is passed the glued object (here `@post`, not the user):
 
 ```ruby
 object @user
-glue(@post) {|user| attribute :title if user.active? }
+glue(@post) { |post| attribute :title if post.published? }
 ```
 
 ### Custom Nodes ###
@@ -481,7 +487,7 @@ collection @posts
 
 extends('posts/show', :locals => { :hide_comments => true })
 # or using partial instead of extends
-# node(false) { |post| partial('posts/show', :object => :post, :locals => { :hide_comments => true })}
+# node(false) { |post| partial('posts/show', :object => post, :locals => { :hide_comments => true })}
 ```
 
 and then access locals in the sub-template:
@@ -622,7 +628,7 @@ entry per viewer, apart from the nil case above. Include `root_object` whenever
 Under Rails, keys include the Rails template digest when the template is rendered through a controller or view. `Rabl.render` and
 `Rabl::Renderer` used outside a request have no view context, so their keys identify the template differently and don't match the keys of
 a request. To render outside a request with the same keys, for example to warm the cache in a background job, render through the
-controller (Rails 5 and newer):
+controller:
 
 ```ruby
 PostsController.render(:show, assigns: { post: post }, formats: [:json])
@@ -673,13 +679,14 @@ node(:title) { locals[:custom_title] }
 
 ### Content Type Headers ###
 
-Currently in RABL, the content-type of your response is not set automatically. This is because RABL is intended
-to work for any Rack-based framework and as agnostic to format as possible.
-Check [this issue](https://github.com/nesquena/rabl/issues/185#issuecomment-4501232) for more
-details, and if you have any ideas or patches please let me know.
+Under Rails, Rails sets the content type from the template's format: `show.json.rabl` is served as
+`application/json` and `show.xml.rabl` as `application/xml`. A template without a format in its name
+(`show.rabl`) is served as `application/json` whatever it renders, so name templates by format when you
+serve more than JSON.
 
-In the meantime, be sure to set the proper content-types if needed. This is usually pretty simple in both
-Rails and Padrino. I recommend a before_filter on that controller or directly specified in an action.
+Outside Rails, RABL doesn't set the content type, as it is intended to work for any Rack-based framework and
+to be as agnostic to format as possible (see [this issue](https://github.com/nesquena/rabl/issues/185#issuecomment-4501232)).
+Set it in your app, e.g. with Sinatra's `content_type :json` in the route or a `before` filter.
 
 ## Resources ##
 
@@ -741,6 +748,8 @@ Check out the [Issues](https://github.com/nesquena/rabl/issues) tab for a full l
 
  * Rigorous benchmarking and performance optimizations
 
+To report a security vulnerability, don't open an issue; see [SECURITY.md](https://github.com/nesquena/rabl/blob/master/SECURITY.md).
+
 ## Authors and Contributors ##
 
 Active Maintainers:

data/SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes go into the latest release line of rabl. Please check that the problem occurs on the latest release.
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately, through GitHub's private vulnerability reporting: on the repository's
+[Security tab](https://github.com/nesquena/rabl/security), choose "Report a vulnerability". Don't open a public issue or
+pull request for a vulnerability.
+
+Include the rabl version, the steps to reproduce the problem and its impact. The discussion continues in the report
+until a fix is released.

data/lib/rabl/builder.rb

@@ -256,7 +256,8 @@ module Rabl
       # Caches the results of the block based on object cache_key
       # cache_results { compile_hash(options) }
       def cache_results(&block)
-        if template_cache_configured? && Rabl.configuration.cache_all_output && @_object.respond_to?(:cache_key)
+        # cheap questions first: template_cache_configured? allocates under Rails
+        if Rabl.configuration.cache_all_output && template_cache_configured? && @_object.respond_to?(:cache_key)
           cache_key = [@_object, @options[:root_name], @options[:format]]
           engine = rabl_template_engine
           if engine
@@ -273,11 +274,9 @@ module Rabl
       end
 
       def create_key(name)
-        if Rabl.configuration.camelize_keys
-          name.to_s.camelize(Rabl.configuration.camelize_keys == :upper ? :upper : :lower).to_sym
-        else
-          name.to_sym
-        end
+        config = Rabl.configuration
+        style = config.camelize_keys
+        style ? config.camelized_key(name, style == :upper) : name.to_sym
       end
   end
 end

data/lib/rabl/cache_engine.rb

@@ -7,29 +7,28 @@
 #     config.cache_engine = AdvancedCacheEngine.new
 #
 
-class LRU < Hash
-  attr_accessor :max_size
+module Rabl
+  class CacheEngine
+    # A Hash holding at most max_size entries, which drops the entries added first
+    class LRU < Hash
+      attr_accessor :max_size
 
-  def initialize
-    super
-    self.max_size = 100_000
-  end
+      def initialize
+        super
+        self.max_size = 100_000
+      end
 
-  def []= k,v
-    r = super
-    limit_size
-    r
-  end
+      def []= k,v
+        r = super
+        limit_size
+        r
+      end
 
-  def limit_size
-    if size > max_size then
-      delete keys.shift while size > max_size
+      def limit_size
+        shift while size > max_size
+      end
     end
-  end
-end
 
-module Rabl
-  class CacheEngine
     def initialize
       unless defined?(Rails)
         @cache = LRU.new

data/lib/rabl/configuration.rb

@@ -122,6 +122,50 @@ module Rabl
       @exclude_nil_values                           = false
       @exclude_empty_values_in_collections          = false
       @camelize_keys                                = false
+      @camelized_keys                               = { false => {}, true => {} }
+    end
+
+    # Names camelized in each style, by whether the first letter is upper case: a collection
+    # builds the same keys for each of its items, and camelizing one takes about 0.5 µs.
+    # ceiling: one entry per distinct key name, so a template that names keys at runtime
+    # (node(field.key)) keeps them for the life of the process until a new name arrives and the
+    # map is already full, when it is emptied; a name over CAMELIZED_KEY_LENGTH_LIMIT bytes isn't
+    # kept at all; and a name keeps the acronyms it was first camelized with, so an inflection
+    # added later doesn't reach a name that was already seen.
+    CAMELIZED_KEYS_LIMIT = 10_000
+    # A name longer than this, in bytes, is camelized each time instead of being kept, so a map
+    # holds at most CAMELIZED_KEYS_LIMIT names of up to this many bytes each
+    CAMELIZED_KEY_LENGTH_LIMIT = 128
+
+    # Files a new name in a style's map: the maps are shared by every thread
+    CAMELIZED_KEYS_LOCK = Mutex.new
+
+    # Returns name camelized in the given style, camelizing each kept name once
+    def camelized_key(name, upper = false)
+      keys = @camelized_keys[upper]
+      cached = keys[name]
+      return cached if cached
+
+      string = name.to_s
+      style = upper ? :upper : :lower
+      return string.camelize(style).to_sym if string.bytesize > CAMELIZED_KEY_LENGTH_LIMIT
+
+      # a Hash freezes a plain String key and copies it, but keeps an unfrozen String subclass,
+      # such as ActiveSupport::SafeBuffer, as it is: a caller that changes the name in place would
+      # file another name under the camelized value, so the key is copied and frozen here
+      # the map is shared by every thread, so a new name is filed under the lock, as in LOOKUP_IDS
+      key = Rabl.frozen_copy(name)
+      CAMELIZED_KEYS_LOCK.synchronize do
+        keys.fetch(key) do
+          keys.clear if keys.size >= camelized_keys_limit
+          keys[key] = string.camelize(style).to_sym
+        end
+      end
+    end
+
+    # How many names a style's map keeps before a new name empties it
+    def camelized_keys_limit
+      CAMELIZED_KEYS_LIMIT
     end
 
     # @return The JSON engine used to encode Rabl templates into JSON

data/lib/rabl/digestor.rb

@@ -3,28 +3,8 @@
 require 'action_view'
 
 module Rabl
+  # Rails' digestor, under rabl's name: rabl.rb defines it only with the rest of the Rails integration, so
+  # Engine#digestor_available? checks for it before adding a template digest to a cache key
   class Digestor < ActionView::Digestor
-    # Override the original digest function to ignore partial which
-    # rabl doesn't use the Rails conventional _ symbol.
-    if Gem::Version.new(Rails.version) >= Gem::Version.new('5.0.0.beta1')
-      require 'rabl/digestor/rails5'
-    elsif Gem::Version.new(Rails.version) >= Gem::Version.new('4.1')
-      require 'rabl/digestor/rails41'
-    else
-      require 'rabl/digestor/rails3'
-    end
-
-    private
-      def dependency_digest
-        template_digests = (dependencies - [template.virtual_path]).collect do |template_name|
-          if Gem::Version.new(Rails.version) >= Gem::Version.new('4.1')
-            Digestor.digest(:name => template_name, :finder => finder)
-          else
-            Digestor.digest(template_name, format, finder)
-          end
-        end
-
-        (template_digests + injected_dependencies).join("-")
-      end
   end
 end

data/lib/rabl/engine.rb

@@ -60,9 +60,7 @@ module Rabl
       # count when no rule matches.
       def singular_rule_rank(word)
         inflections = ActiveSupport::Inflector.inflections
-        uncountables = inflections.uncountables
-        # ActiveSupport < 5 keeps them in a plain Array, checked by the last word
-        return -1 if uncountables.respond_to?(:uncountable?) ? uncountables.uncountable?(word) : uncountables.include?(word.downcase[/\b\w+\Z/])
+        return -1 if inflections.uncountables.uncountable?(word)
 
         rules = inflections.singulars
         rules.index { |(rule, _)| rule.is_a?(Regexp) ? rule.match?(word) : word.include?(rule) } || rules.size
@@ -149,16 +147,7 @@ module Rabl
         if digestor_available? && respond_to?(:lookup_context) && lookup_context
           template = @_options[:template] || @virtual_path
 
-          digest =
-            if Rails.version.to_s =~ /^[678]/
-              Digestor.digest(name: template, finder: lookup_context, format: :rabl)
-            elsif Gem::Version.new(Rails.version) >= Gem::Version.new('4.1')
-              Digestor.digest(:name => template, :finder => lookup_context)
-            else
-              Digestor.digest(template, :rabl, lookup_context)
-            end
-
-          cache_key << digest
+          cache_key << Digestor.digest(name: template, finder: lookup_context, format: :rabl)
           # The digest covers the template source, but not the block that defines this engine
           if @_block_identity
             block, parent = @_block_identity
@@ -187,6 +176,14 @@ module Rabl
       options[:root_name] = determine_object_root(data, root_name, options[:root])
       options[:template_engine] = self
 
+      # A template the collection uses for each item (extends, partial) is read once per render,
+      # not once per item. The render that starts a collection ends it, so a render started inside
+      # this one (a Rabl::Renderer in a node, a nested render under Rails) uses the collection it
+      # finds, whose keys are complete, and the render around it keeps its own sources. A nested
+      # engine renders inside a collection anyway, so it skips the look for one.
+      owns_source_cache = !@_options[:nested] && Rabl.render_source_cache.nil?
+      Rabl.begin_render_source_cache if owns_source_cache
+
       @_rendering = true
       result =
         if is_object?(data) || !data # object @user
@@ -201,6 +198,7 @@ module Rabl
       result
     ensure
       @_rendering = false
+      Rabl.end_render_source_cache if owns_source_cache
     end
 
     def to_dumpable(options = {})
@@ -594,7 +592,7 @@ module Rabl
 
         callback = request_params[:callback]
         return unless callback.is_a?(String) && callback.length <= RABL_JSON_CALLBACK_MAX_LENGTH
-        return unless callback.ascii_only? && callback =~ RABL_JSON_CALLBACK_NAME
+        return unless callback.ascii_only? && callback.match?(RABL_JSON_CALLBACK_NAME)
 
         callback
       end
@@ -638,7 +636,8 @@ module Rabl
       # Caches the results of the block based on object cache_key
       # cache_results { compile_hash(options) }
       def cache_results(&block)
-        return yield unless template_cache_configured? && defined?(@_cache_key)
+        # cheap question first: template_cache_configured? allocates under Rails
+        return yield unless defined?(@_cache_key) && template_cache_configured?
 
         if cache_read_on_render?
           fetch_result_from_cache(cache_key, @_cache_options, &block)
@@ -647,8 +646,9 @@ module Rabl
         end
       end
 
+      # rabl.rb loads Rabl::Digestor with the rest of the Rails integration
       def digestor_available?
-        defined?(Rails) && Rails.version =~ /^[45678]/
+        defined?(::Rabl::Digestor)
       end
 
       def valid_format?(format)

data/lib/rabl/railtie.rb

@@ -5,18 +5,16 @@ module Rabl
     initializer "rabl.initialize" do |app|
       # Force Rails to load view templates even in API mode
       # Stolen shamelessly from jbuilder: https://github.com/rails/jbuilder/blob/master/lib/jbuilder/railtie.rb
-      if Rails::VERSION::MAJOR >= 5
-        module ::ActionController
-          module ApiRendering
-            include ActionView::Rendering
-          end
+      module ::ActionController
+        module ApiRendering
+          include ActionView::Rendering
         end
+      end
 
-        ActiveSupport.on_load :action_controller do
-          if self == ActionController::API
-            include ActionController::Helpers
-            include ActionController::ImplicitRender
-          end
+      ActiveSupport.on_load :action_controller do
+        if self == ActionController::API
+          include ActionController::Helpers
+          include ActionController::ImplicitRender
         end
       end
 
@@ -24,10 +22,8 @@ module Rabl
         Rabl.register!
 
         # Inject dependency tracker for :rabl
-        if Rails.version =~ /^[45678]/
-          require 'action_view/dependency_tracker'
-          ActionView::DependencyTracker.register_tracker :rabl, Rabl::Tracker
-        end
+        require 'action_view/dependency_tracker'
+        ActionView::DependencyTracker.register_tracker :rabl, Rabl::Tracker
       end
     end
   end # Railtie

data/lib/rabl/renderer.rb

@@ -63,24 +63,26 @@ module Rabl
 
       # Returns the source given a relative template path
       def process_source(source)
-        return source if source.is_a?(String) && source =~ /\n/
+        return source if source.is_a?(String) && source.include?("\n")
 
         source, location = engine.fetch_source(source, { :view_path => options[:view_path] })
         options[:source_location] ||= location
         source
       end
 
-      # Internal: Sets an instance variable named after the class of `object`
+      # Internal: Sets an instance variable named after the class of `object`,
+      # unless the class has no name (Struct.new or Class.new)
       #
       # Example:
       #   object.class.name # => User
       #   set_object_instance_variable # => @user == object
       #
       def set_object_instance_variable
-        instance_variable_set(:"@#{object_model_name}", object)
+        name = object_model_name
+        instance_variable_set(:"@#{name}", object) if name
       end
 
-      # Internal: Returns the model name for an object
+      # Internal: Returns the model name for an object, or nil when its class has no name
       #
       # Example:
       #   object.class.name # => User
@@ -92,7 +94,10 @@ module Rabl
         is_collection = item.is_a?(Array)
         item = item.first if is_collection
 
-        name = item.class.name.underscore
+        name = item.class.name
+        return unless name
+
+        name = name.underscore
 
         name = name.pluralize if is_collection
 

data/lib/rabl/sources.rb

@@ -28,7 +28,10 @@ module Rabl
     # fetch_source("show", :view_path => "...") => "...contents..."
     def fetch_source(file, options = {})
       resolver = source_resolver
+      # the process-wide cache keeps a number for each lookup for the life of the process; a
+      # collection that lives for one render only needs the lookup itself
       lookup = source_lookup(resolver) if Rabl.configuration.cache_sources
+      lookup = render_source_lookup(resolver) if lookup.nil? && Rabl.render_source_cache
       # a lookup that can't be told apart from others (see source_lookup) isn't cached
       return resolve_source(file, options, resolver) if lookup == false
 
@@ -85,9 +88,11 @@ module Rabl
       # details such as versioncake's versions) and the view paths; elsewhere the format
       # and locales the manual lookup prefers, and under Sinatra the app's views. Returns
       # false when a view path has no stable name, so the lookup isn't cached.
-      # ceiling: outside Rails the cache (and MANUAL_LOOKUP_IDS) keeps an entry per locale looked
-      # up in, as Rails' details keys do, so it is bounded by I18n.available_locales only while
-      # I18n.enforce_available_locales is on (the default).
+      # ceiling: with cache_sources on, the cache, LOOKUP_IDS and MANUAL_LOOKUP_IDS keep an entry
+      # per distinct set of lookup details and view path list, and per locale looked up in, as
+      # Rails' own registry does, so outside Rails they are bounded by I18n.available_locales only
+      # while I18n.enforce_available_locales is on (the default) and by the locales requests ask
+      # for; under Rails a view path prepended for one request adds one, as it does to Rails.
       def source_lookup(resolver)
         case resolver
         when :rails
@@ -102,6 +107,38 @@ module Rabl
         end
       end
 
+      # Returns the lookup of the per-render collection: the same as source_lookup, without the
+      # numbers LOOKUP_IDS, MANUAL_LOOKUP_IDS and I18n.fallbacks keep for the life of the process.
+      # Outside Rails those gain an entry per locale looked up in, which is bounded only while
+      # I18n.enforce_available_locales is on, and a render that ends drops its collection anyway.
+      # Under Rails the numbers come from the lookup details Rails itself keeps, so they are used as
+      # they are. Padrino's lookup depends on the request too (its controller and content type), so
+      # it is not collected per render, as with cache_sources off.
+      def render_source_lookup(resolver)
+        case resolver
+        when :rails
+          source_lookup(resolver)
+        when :sinatra
+          [context_scope.settings.views, manual_lookup]
+        when :padrino
+          false
+        else
+          manual_lookup
+        end
+      end
+
+      # Returns what the manual lookup depends on, as values rather than as the number standing for
+      # it, and where the locale's fallbacks come from rather than the chain itself: asking I18n for
+      # a locale's fallbacks keeps that locale
+      def manual_lookup
+        format = manual_source_format
+        return [:manual, format] unless defined?(::I18n) && ::I18n.respond_to?(:config)
+
+        config = ::I18n.config
+        fallbacks = ::I18n.fallbacks if ::I18n.respond_to?(:fallbacks)
+        [:manual, format, config.locale, config.default_locale, fallbacks && fallbacks.__id__]
+      end
+
       # Returns the number standing for the format and locales the manual lookup prefers.
       # Nested Hashes of what the locales come from, as this runs on every source cache hit.
       def manual_lookup_id
@@ -189,7 +226,7 @@ module Rabl
         end
       end
 
-      # Returns the format Rails 3.2 and higher look templates up in:
+      # Returns the format Rails looks templates up in:
       # the request's format, or for HTML requests the format being rendered (json for
       # the default handler and for hash), as a Symbol, the only form Rails 7.0 and higher match
       def rails_source_format
@@ -252,26 +289,18 @@ module Rabl
         File.join(view_path.first.to_s, (file_path.to_s + ".rabl"))
       end
 
-      # Returns the rabl template path for Rails, including special lookups for Rails 2 and 3
+      # Returns the rabl template path for Rails, using Rails' own lookup
       def fetch_rails_source(file, options = {})
-        # use Rails template resolution mechanism if possible (find_template)
         source_format = request_format if defined?(request_format)
 
-        if source_format && context_scope.respond_to?(:lookup_context) # Rails 3
+        if source_format && context_scope.respond_to?(:lookup_context)
           lookup_proc = lambda do |partial|
-            if ActionPack::VERSION::MAJOR == 3 && ActionPack::VERSION::MINOR < 2
-              context_scope.lookup_context.find(file, [], partial)
-            else # Rails 3.2 and higher
-              # pull format directly from rails unless it is html
-              context_scope.lookup_context.find(file, [], partial, [], { :formats => [rails_source_format] })
-            end
+            # pull format directly from rails unless it is html
+            context_scope.lookup_context.find(file, [], partial, [], { :formats => [rails_source_format] })
           end
           template = lookup_proc.call(false) rescue nil
           template ||= lookup_proc.call(true) rescue nil
           template.identifier if template
-        elsif source_format && context_scope.respond_to?(:view_paths) # Rails 2
-          template = context_scope.view_paths.find_template(file, source_format, false)
-          template.filename if template
         end
       end
 

data/lib/rabl/template.rb

@@ -22,51 +22,8 @@ if defined?(Tilt)
   Tilt.register 'rabl', RablTemplate
 end
 
-# Rails 2.X Template
-if defined?(ActionView) && defined?(Rails) && Rails.respond_to?(:version) && Rails.version.to_s =~ /^2/
-  require 'action_view/base'
-  require 'action_view/template'
-
-  module ActionView
-    module TemplateHandlers
-      class RablHandler < TemplateHandler
-        include Compilable
-
-        def compile(template) %{
-          ::Rabl::Engine.new(#{template.source.inspect}, { :format => #{template.format.inspect} }).
-            render(self, assigns.merge(local_assigns))
-        } end
-      end
-    end
-  end
-
-  ActionView::Template.register_template_handler :rabl, ActionView::TemplateHandlers::RablHandler
-end
-
-# Rails 3.X / 4.X / 5.X Template
-if defined?(ActionView) && defined?(Rails) && Rails.respond_to?(:version) && Rails.version.to_s =~ /^[345]/
-  module ActionView
-    module Template::Handlers
-      class Rabl
-        class_attribute :default_format
-        self.default_format = Mime[:json]
-
-        def self.call(template)
-          source = template.source
-
-          %{ ::Rabl::Engine.new(#{source.inspect}, :source_location => #{template.identifier.inspect}).
-              apply(self, assigns.merge(local_assigns)).
-              render }
-        end # call
-      end # rabl class
-    end # handlers
-  end
-
-  ActionView::Template.register_template_handler :rabl, ActionView::Template::Handlers::Rabl
-end
-
-# Rails 6.X / 7.X / 8.X Template
-if defined?(ActionView) && defined?(Rails) && Rails.respond_to?(:version) && Rails.version.to_s =~ /^[678]/
+# Rails Template
+if defined?(ActionView) && defined?(Rails) && Rails.respond_to?(:version)
   module ActionView
     module Template::Handlers
       class Rabl

data/lib/rabl/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Rabl
-  VERSION = "0.18.0"
+  VERSION = "0.19.1"
 end

data/lib/rabl.rb

@@ -21,13 +21,17 @@ require 'rabl/cache_engine'
 require 'rabl/template_cache_key'
 
 if defined?(Rails) && Rails.respond_to?(:version)
-  require 'rabl/tracker'  if Rails.version =~ /^[45678]/
-  require 'rabl/digestor' if Rails.version =~ /^[45678]/
-  require 'rabl/railtie'  if Rails.version =~ /^[345678]/
+  require 'rabl/tracker'
+  require 'rabl/digestor'
+  require 'rabl/railtie'
 end
 
 # Rabl.register!
 module Rabl
+  # Fiber-local key of the sources read by the render in progress (see Rabl.begin_render_source_cache)
+  RENDER_SOURCE_CACHE = :_rabl_render_source_cache
+  private_constant :RENDER_SOURCE_CACHE
+
   class << self
 
     # Initialize RABL within an application
@@ -62,14 +66,15 @@ module Rabl
     # everything the lookup depends on (the file, the view path and the lookup details)
     # source_cache("users/index", ["path/to/view"], [:json]) { "/full/path/to/template/users/index" }
     def source_cache(file, view_path, lookup = nil)
-      return yield unless Rabl.configuration.cache_sources
-
-      @_source_cache ||= {}
+      # With cache_sources off, a template the collection uses for each item (extends, partial) is
+      # still read and resolved once per render rather than once per item. That cache belongs to
+      # the render, so a template changed between renders is still read again.
+      cache = Rabl.configuration.cache_sources ? (@_source_cache ||= {}) : render_source_cache
+      return yield unless cache
 
       # stores a frozen copy of the key, so later changes to the caller's strings don't reach it
-      @_source_cache.fetch([file, view_path, lookup]) do
-        @_source_cache[frozen_copy([file, view_path, lookup])] = yield
-      end
+      key = [file, view_path, lookup]
+      cache.fetch(key) { cache[frozen_copy(key)] = yield }
     end
 
     # Resets the RABL source cache
@@ -77,6 +82,23 @@ module Rabl
       @_source_cache = {}
     end
 
+    # The template sources read so far by the render running in this fiber, if any
+    def render_source_cache
+      Thread.current[RENDER_SOURCE_CACHE]
+    end
+
+    # Internal: Starts collecting the sources the render about to run reads (see source_cache).
+    # The render that starts a collection ends it, so a render started inside another collects
+    # its own sources for as long as it runs and the render around it reads again afterwards.
+    def begin_render_source_cache
+      Thread.current[RENDER_SOURCE_CACHE] = {}
+    end
+
+    # Internal: Drops the collection the render that returns from it started.
+    def end_render_source_cache
+      Thread.current[RENDER_SOURCE_CACHE] = nil
+    end
+
     # Returns a copy of value whose Strings and Arrays are frozen, for cache keys that
     # must not change when the caller's objects do
     def frozen_copy(value)
@@ -99,6 +121,4 @@ end
 if defined?(Padrino)
   require 'padrino-core'
   Padrino.after_load { Rabl.register! }
-elsif defined?(Rails.version) && Rails.version =~ /^2/
-  Rabl.register!
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rabl
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.19.1
 platform: ruby
 authors:
 - Nathan Esquenazi
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-31 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.3.14
+        version: '6.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.3.14
+        version: '6.1'
 description: General ruby templating with json, bson, xml and msgpack support
 email:
 - nesquena@gmail.com
@@ -35,14 +35,12 @@ files:
 - CONTRIBUTING.md
 - MIT-LICENSE
 - README.md
+- SECURITY.md
 - lib/rabl.rb
 - lib/rabl/builder.rb
 - lib/rabl/cache_engine.rb
 - lib/rabl/configuration.rb
 - lib/rabl/digestor.rb
-- lib/rabl/digestor/rails3.rb
-- lib/rabl/digestor/rails41.rb
-- lib/rabl/digestor/rails5.rb
 - lib/rabl/engine.rb
 - lib/rabl/helpers.rb
 - lib/rabl/multi_builder.rb
@@ -57,7 +55,11 @@ files:
 homepage: https://github.com/nesquena/rabl
 licenses:
 - MIT
-metadata: {}
+metadata:
+  changelog_uri: https://github.com/nesquena/rabl/blob/master/CHANGELOG.md
+  source_code_uri: https://github.com/nesquena/rabl
+  bug_tracker_uri: https://github.com/nesquena/rabl/issues
+  rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
 require_paths:

data/lib/rabl/digestor/rails3.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-require 'action_view'
-
-module Rabl
-  class Digestor < ActionView::Digestor
-    def self.digest(name, format, finder, options = {})
-      cache_key = [name, format] + Array.wrap(options[:dependencies])
-      @@cache[cache_key.join('.')] ||= begin
-        Digestor.new(name, format, finder, options).digest
-      end
-    end
-  end
-end

data/lib/rabl/digestor/rails41.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-require 'action_view'
-
-module Rabl
-  class Digestor < ActionView::Digestor
-    def self.digest(options = {})
-      cache_key = [options[:name]] + Array.wrap(options[:dependencies])
-      @@cache[cache_key.join('.')] ||= begin
-        Digestor.new({ :name => options[:name], :finder => options[:finder] }.merge!(options)).digest
-      end
-    end
-  end
-end

data/lib/rabl/digestor/rails5.rb

@@ -1,8 +0,0 @@
-# frozen_string_literal: true
-
-require 'action_view'
-
-module Rabl
-  class Digestor < ActionView::Digestor
-  end
-end