rails-profiler 0.34.2 → 0.34.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6365d7a34d882d20ca0257247629d6099917508ad78cecc96726dc6788c7a75
-  data.tar.gz: e7dffe134ddcac64202aae83bb73963837068ae258b1cdc1d959e78504b31861
+  metadata.gz: 066e4af89b9741273fe1740d6dfbcecaa32df311835699642cafad8e703ca4ec
+  data.tar.gz: 05f65764c8e80a2b61ceea1f164dd85fa1d3d920b71452c3abdd35044698107b
 SHA512:
-  metadata.gz: 8912bad06bc0824942c4e696d9fd408dff3a76238af92faaa7c262815e477e3850fe90c14d9acd6ceced45271180c990c8d6d597cf591d998eae48edf3dc9e11
-  data.tar.gz: aeb7cec816ce9de90ab3dcc72629d36c6f9b1ff69bfa618416e72fa5cbb6301cae5a5d12dd09d6d0a4c247c76095c397777dad9f42a18bbf5aaafa7d375b7248
+  metadata.gz: 7eeb6e60ace7bbfccb32d3a5eeb0d42243a5bd39d551d08aeaefe05ae8cb79a76b91aee3e1e2a5e2edcaba11d1cd99a89d9860c788841915b16a62483bc457bb
+  data.tar.gz: ae5f198e1f98ca9f964b25a1fba4d419d4c2544e5c651d7921f984626be85d64f4afc494501602e4a19e306ff6cacc8d16f9e5c6f2895a45778af1f444c7e3e3

data/CHANGELOG.md

@@ -19,6 +19,26 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.34.3] - 2026-10-15
+
+<!-- stamped -->
+
+### Changed
+
+- **Test suite:** `bundle exec rspec` now measures the line coverage of the gem's Ruby code with
+  SimpleCov, and the CI fails below 92.0%, the level measured on Ruby 3.3 once the MCP
+  tools, the function profiler, the storage base class and the cluster client got specs of their
+  own. A run of a few spec files is held to no floor outside the CI.
+- **Test suite:** The suite loads and passes under any locale, `LANG=C` included: `spec_helper.rb`
+  reads files as UTF-8 whatever the locale, and a `.rspec` file loads it for every spec. The specs
+  of the masking of sensitive data now live together under `spec/redaction/`.
+
+### Fixed
+
+- **Middleware:** The default `skip_paths` are now anchored to the whole path, so a page such as `/users/favicon.ico.html` is no longer skipped by mistake, and the Sprockets assets (`/assets`) and Action Cable (`/cable`) requests are no longer profiled. A `skip_paths` list you set yourself is used as given.
+- **Mailers:** Visiting the mailer previews (`/rails/mailers`) no longer records phantom delivered emails in the profile.
+- **Security:** An `authorize_with` block that raises is now treated as a denial: the error is logged server side and the request is served unprofiled, instead of breaking every request of the application.
+
 ## [0.34.2] - 2026-10-15
 
 <!-- stamped -->

data/lib/profiler/collectors/mailer_collector.rb

@@ -316,8 +316,9 @@ module Profiler
       end
 
       def rails_preview_request?
-        path = Thread.current[:profiler_request_path]
-        path&.start_with?("/rails/mailers")
+        # The profile of the request being served carries its path; the thread-local is kept
+        # for a caller that sets it by hand.
+        [profile&.path, Thread.current[:profiler_request_path]].any? { |path| path.to_s.match?(%r{\A/rails/mailers(/|\z)}) }
       end
 
       def to_path(class_name)

data/lib/profiler/configuration.rb

@@ -65,7 +65,8 @@ module Profiler
       @storage = :memory
       @storage_options = {}
       @collectors = []
-      @skip_paths = [%r{^/_profiler}, /\.well-known/, /favicon\.ico/, /manifest\.json/]
+      @skip_paths = [%r{\A/_profiler}, %r{\A/\.well-known/}, %r{\A/favicon\.ico\z}, %r{\A(?:/[^/]+)*/manifest\.json\z},
+                     %r{\A/assets/}, %r{\A/cable(/|\z)}]
       @slow_query_threshold = 100 # milliseconds
       @max_queries_warning = 50
       # Where each query comes from: :first_and_slow captures the caller the first time a
@@ -284,7 +285,7 @@ module Profiler
         LocalRequest.warn_once(reason)
         false
       when :allow_authorized
-        @authorize_block ? @authorize_block.call(request) : false
+        run_authorize_block(request)
       else
         false
       end
@@ -373,5 +374,16 @@ module Profiler
       raise ArgumentError, "config.mcp_allowed_hosts: #{pattern.inspect} cannot be matched against the whole " \
                            "host name (#{e.message})"
     end
+
+    # An exception in the application's own authorization code is a denial, never an error
+    # for the request: it would otherwise break every request. The detail stays in the log.
+    def run_authorize_block(request)
+      return false unless @authorize_block
+
+      @authorize_block.call(request) ? true : false
+    rescue StandardError => e
+      Profiler.log_error("authorize_with block raised, treating the request as unauthorized", e)
+      false
+    end
   end
 end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.34.2"
+  VERSION = "0.34.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.34.2
+  version: 0.34.3
 platform: ruby
 authors:
 - Sébastien Duplessy
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-15 00:00:00.000000000 Z
+date: 2026-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails