rails_error_dashboard 0.12.1 → 0.14.0

data/app/views/layouts/rails_error_dashboard.html.erb

@@ -744,9 +744,54 @@ dd { color: var(--text-primary); }
 }
 .red-stat-grid > * { min-width: 0; }
 
-/* Error detail responsive grid */
+/* Error detail hero
+   Same failure as the stat grids above: an inline `display: flex` cannot carry
+   a media query. The action row held `flex-shrink: 0` while the title column
+   was plain `flex: 1`, so at 390px up to five buttons kept their full width
+   and the title absorbed every pixel of the squeeze — "NoMethodError" wrapped
+   to roughly one character per line, making a very tall header before the
+   backtrace on the one screen an on-call engineer actually reads.
+
+   `flex: 1 1 260px` is the load-bearing part: the 260px basis stops the text
+   column collapsing toward zero. Dropping flex-shrink from the actions lets
+   them wrap onto their own line instead. */
+.red-error-hero {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: var(--space-4);
+  flex-wrap: wrap;
+}
+.red-error-hero-text { flex: 1 1 260px; min-width: 0; }
+.red-error-hero-actions { display: flex; gap: 6px; flex-wrap: wrap; }
+@media (max-width: 575.98px) {
+  /* Full-width buttons once stacked: a wrapped row of five reads as rubble. */
+  .red-error-hero-actions { width: 100%; }
+  .red-error-hero-actions .btn { flex: 1 1 auto; }
+}
+
+/* Error detail responsive grid
+   The single-column rule below stacks the panels, but `1fr` is min-content by
+   default, so a track still refused to shrink below its widest child: at 390px
+   the grid measured 334px while its content needed 419px, and the page scrolled
+   sideways independently of the hero. Same fix as the stat grids: minmax's 0
+   floor lets the track shrink, and min-width:0 lets its children do the same. */
 .red-detail-grid { display: grid; grid-template-columns: 1fr 260px; gap: var(--space-4); }
-@media (max-width: 1023.98px) { .red-detail-grid { grid-template-columns: 1fr; } }
+.red-detail-grid > * { min-width: 0; }
+@media (max-width: 1023.98px) { .red-detail-grid { grid-template-columns: minmax(0, 1fr); } }
+
+/* Detail tables inside those panels (Request Context, Metadata).
+   Their label column is a fixed `width="200"` and their values are URLs and
+   JSON, so the table's intrinsic width stayed ~416px however narrow the panel
+   became — the last thing still pushing the detail page sideways on a phone
+   once the grid and the hero were fixed. Below the stacking breakpoint the
+   label column narrows and long values wrap on any character, so the table
+   fits its panel instead of widening the page. */
+@media (max-width: 1023.98px) {
+  .red-detail-grid .card-body > .table { table-layout: fixed; width: 100%; }
+  .red-detail-grid .card-body > .table th { width: 40%; }
+  .red-detail-grid .card-body > .table td { overflow-wrap: anywhere; }
+}
 
 /* Env badge */
 .red-env-badge {
@@ -1182,10 +1227,18 @@ tr[data-red-row-href]:hover .sev-bar { opacity: 1 !important; }
               <i class="bi bi-layout-sidebar-inset"></i>
             </button>
             <!-- Search -->
-            <div style="position: relative;">
+            <%# A plain GET form to the errors index, using the same "search"
+                parameter as the index's own field. Hand-written rather than
+                form_with: a GET form must not put an authenticity token or a
+                utf8 field into the query string. Only String parameters are
+                echoed back; a nested one is ignored. %>
+            <form action="<%= errors_path %>" method="get" role="search" style="position: relative; margin: 0;">
               <i class="bi bi-search" style="position: absolute; left: 10px; top: 50%; transform: translateY(-50%); font-size: 13px; color: var(--text-tertiary);"></i>
-              <input class="red-search-input" placeholder="<%= red_t("red.navbar.search_placeholder") %>" id="globalSearch" />
-            </div>
+              <input class="red-search-input" type="text" name="search" value="<%= params[:search] if params[:search].is_a?(String) %>" placeholder="<%= red_t("red.navbar.search_placeholder") %>" aria-label="<%= red_t("red.navbar.search_placeholder") %>" id="globalSearch" />
+              <% if params[:application_id].is_a?(String) && params[:application_id].present? %>
+                <input type="hidden" name="application_id" value="<%= params[:application_id] %>" />
+              <% end %>
+            </form>
           </div>
           <div style="display: flex; align-items: center; gap: var(--space-3);">
             <!-- Application Switcher (multi-app) -->

data/app/views/rails_error_dashboard/errors/_discussion.html.erb

@@ -1,4 +1,7 @@
 <% has_linked_issue = error.respond_to?(:external_issue_url) && error.external_issue_url.present? %>
+<%# nil when the stored value is not plain http(s); the button is then omitted
+    (the issue card explains why). See safe_external_url. %>
+<% discussion_issue_url = has_linked_issue ? safe_external_url(error.external_issue_url) : nil %>
 <% has_audit_comments = error.respond_to?(:comments) && error.comments.any? %>
 <% platform_comments = @platform_comments || [] %>
 <% issue_tracking_enabled = RailsErrorDashboard.configuration.enable_issue_tracking %>
@@ -30,9 +33,11 @@
           <span class="badge bg-secondary ms-2"><%= platform_comments.size %></span>
         <% end %>
       </h5>
-      <a href="<%= error.external_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
-        <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.reply_on", provider: discussion_provider) %>
-      </a>
+      <% if discussion_issue_url %>
+        <a href="<%= discussion_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
+          <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.reply_on", provider: discussion_provider) %>
+        </a>
+      <% end %>
     </div>
     <div class="card-body p-0">
       <% if platform_comments.any? %>
@@ -40,14 +45,14 @@
           <% platform_comments.each_with_index do |comment, index| %>
             <div class="px-3 py-3 <%= index < platform_comments.size - 1 ? 'border-bottom' : '' %>">
               <div class="d-flex align-items-start gap-2 mb-2">
-                <% if comment[:avatar_url].present? %>
-                  <img src="<%= comment[:avatar_url] %>" alt="<%= comment[:author] %>" width="24" height="24" class="rounded-circle" style="flex-shrink: 0;">
+                <% if (avatar = safe_external_url(comment[:avatar_url])) %>
+                  <img src="<%= avatar %>" alt="<%= comment[:author] %>" width="24" height="24" class="rounded-circle" style="flex-shrink: 0;">
                 <% else %>
                   <i class="bi bi-person-circle" style="font-size: 1.3em; flex-shrink: 0;"></i>
                 <% end %>
                 <div>
                   <strong class="text-primary"><%= comment[:author] || red_t("red.common.unknown") %></strong>
-                  <small class="text-muted ms-2"><%= comment[:created_at] ? Time.parse(comment[:created_at]).strftime(red_time_format(:datetime)) : "" %></small>
+                  <small class="text-muted ms-2"><%= local_time(safe_parse_time(comment[:created_at]), format: :datetime, fallback: "") %></small>
                 </div>
               </div>
               <div class="ms-4 text-break" style="font-size: 0.9em;">
@@ -68,7 +73,7 @@
             <div class="d-flex justify-content-between align-items-start">
               <div>
                 <small class="text-primary fw-bold"><i class="bi bi-person-circle"></i> <%= comment.author_name %></small>
-                <small class="text-muted ms-2"><%= comment.formatted_time %></small>
+                <small class="text-muted ms-2"><%= local_time(comment.created_at, format: :datetime) %></small>
               </div>
             </div>
             <small class="text-muted text-break"><%= simple_format(h(comment.body), {}, wrapper_tag: "span") %></small>
@@ -84,9 +89,11 @@
       <h5 class="mb-0">
         <i class="bi bi-chat-dots"></i> <%= red_t("red.errors.discussion.title") %>
       </h5>
-      <a href="<%= error.external_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
-        <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.start_on", provider: discussion_provider) %>
-      </a>
+      <% if discussion_issue_url %>
+        <a href="<%= discussion_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
+          <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.start_on", provider: discussion_provider) %>
+        </a>
+      <% end %>
     </div>
     <div class="card-body text-center py-3">
       <p class="text-muted small mb-0"><%= red_t("red.errors.discussion.empty", provider: discussion_provider_lc) %></p>
@@ -106,7 +113,7 @@
           <div class="d-flex justify-content-between align-items-start">
             <div>
               <small class="text-primary fw-bold"><i class="bi bi-person-circle"></i> <%= comment.author_name %></small>
-              <small class="text-muted ms-2"><%= comment.formatted_time %></small>
+              <small class="text-muted ms-2"><%= local_time(comment.created_at, format: :datetime) %></small>
             </div>
           </div>
           <small class="text-muted text-break"><%= simple_format(h(comment.body), {}, wrapper_tag: "span") %></small>

data/app/views/rails_error_dashboard/errors/_issue_section.html.erb

@@ -5,8 +5,10 @@
         <i class="bi bi-link-45deg me-2"></i>
         <%= red_t("red.errors.issue_section.title") %>
       </h5>
-      <% if @error.external_issue_url.present? %>
-        <a href="<%= @error.external_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
+      <%# nil unless the stored value is plain http(s) — see safe_external_url. %>
+      <% issue_url = safe_external_url(@error.external_issue_url) %>
+      <% if issue_url %>
+        <a href="<%= issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
           <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.issue_section.view_issue") %>
         </a>
       <% end %>
@@ -23,6 +25,15 @@
                    end %>
         <% issue = @platform_issue %>
 
+        <% unless issue_url %>
+          <%# Stored, but not plain http(s): shown as text, never as a link. %>
+          <div class="alert alert-warning py-2 px-3 mb-3" style="font-size: 0.85em;">
+            <i class="bi bi-exclamation-triangle me-1"></i>
+            <%= red_t("red.errors.issue_section.unsafe_link") %>
+            <code class="d-block text-break mt-1"><%= @error.external_issue_url.to_s.truncate(200) %></code>
+          </div>
+        <% end %>
+
         <!-- Issue badge + status -->
         <div class="d-flex align-items-center gap-2 mb-3">
           <span class="badge bg-success">
@@ -50,8 +61,8 @@
                 <div class="d-flex align-items-center gap-2 flex-wrap">
                   <% issue[:assignees].each do |assignee| %>
                     <span class="d-inline-flex align-items-center gap-1 border rounded-pill px-2 py-1" style="font-size: 0.85em;">
-                      <% if assignee[:avatar_url].present? %>
-                        <img src="<%= assignee[:avatar_url] %>" width="18" height="18" class="rounded-circle">
+                      <% if (avatar = safe_external_url(assignee[:avatar_url])) %>
+                        <img src="<%= avatar %>" width="18" height="18" class="rounded-circle">
                       <% end %>
                       <%= assignee[:login] %>
                     </span>
@@ -68,8 +79,9 @@
               <% if issue[:labels].present? && issue[:labels].any? %>
                 <div class="d-flex align-items-center gap-1 flex-wrap">
                   <% issue[:labels].each do |label| %>
-                    <% bg_color = label[:color].present? ? "##{label[:color]}" : "#6c757d" %>
-                    <% text_color = label[:color].present? && label[:color].scan(/../).map { |c| c.to_i(16) }.sum > 382 ? "#000" : "#fff" %>
+                    <%# Third-party value going into style=: validated, never interpolated raw. %>
+                    <% bg_color = safe_label_color(label[:color]) %>
+                    <% text_color = label_text_color(bg_color) %>
                     <span class="badge rounded-pill" style="background-color: <%= bg_color %>; color: <%= text_color %>; font-size: 0.78em;">
                       <%= label[:name] %>
                     </span>
@@ -118,10 +130,12 @@
     </div>
   </div>
 
-  <% if flash[:new_issue_url].present? %>
+  <%# The URL comes from the forge's API response; window.open would run a
+      javascript: target, so it gets the same http(s) check as the links. %>
+  <% if (new_issue_url = safe_external_url(flash[:new_issue_url])) %>
     <script<%= " nonce=\"#{red_csp_nonce}\"".html_safe if red_csp_nonce %>>
       (function() {
-        window.open('<%= j flash[:new_issue_url] %>', '_blank');
+        window.open(<%= js_safe_json(new_issue_url) %>, '_blank');
       })();
     </script>
   <% end %>

data/app/views/rails_error_dashboard/errors/_request_context.html.erb

@@ -30,6 +30,8 @@
                       <div><small class="text-muted"><%= red_t("red.errors.request_context.snapshot_fidelity_lite") %></small></div>
                     <% when "minimal" %>
                       <div><small class="text-muted"><%= red_t("red.errors.request_context.snapshot_fidelity_minimal") %></small></div>
+                    <% when "partial" %>
+                      <div><small class="text-muted"><%= red_t("red.errors.request_context.snapshot_fidelity_partial") %></small></div>
                     <% end %>
                   <% end %>
                 </td>

data/app/views/rails_error_dashboard/errors/_sidebar_metadata.html.erb

@@ -72,7 +72,7 @@
 
           <% if error.respond_to?(:environment) && error.environment.present? %>
             <div class="mb-3">
-              <small class="metadata-label d-block mb-1"><%= red_t("red.errors.sidebar.environment") %></small>
+              <small class="metadata-label d-block mb-1"><%= red_t("red.errors.sidebar.environment.title") %></small>
               <%= link_to errors_path(environment: error.environment, unresolved: '0'), class: "text-decoration-none", title: red_t("red.errors.sidebar.view_all_environment", environment: error.environment) do %>
                 <span class="badge badge-api" data-environment-badge="<%= error.environment %>"><i class="bi bi-hdd-stack"></i> <%= error.environment %></span>
               <% end %>
@@ -106,12 +106,21 @@
                     The <a> is built here rather than living in the key. The key
                     is _html and therefore html_safe, so a raw URL interpolated
                     into an href inside it would not be escaped and a crafted
-                    external_issue_url could inject an event handler. link_to
-                    escapes the URL. %>
-                <% if error.respond_to?(:external_issue_url) && error.external_issue_url.present? %>
+                    external_issue_url could inject an event handler.
+
+                    link_to escapes the URL, which stops attribute BREAKOUT. It
+                    does not reject a scheme: link_to("x", "javascript:...")
+                    is a working link. That protection comes from
+                    safe_external_url, which returns nil for anything that is
+                    not plain http(s). %>
+                <% stored_issue_url = error.respond_to?(:external_issue_url) ? error.external_issue_url : nil %>
+                <% sidebar_issue_url = safe_external_url(stored_issue_url) %>
+                <% if sidebar_issue_url %>
                   <%= red_t("red.errors.sidebar.issue_tracking_linked_html",
                         link: link_to(red_t("red.errors.sidebar.issue_tracking_link_text"),
-                              error.external_issue_url, target: "_blank", rel: "noopener")) %>
+                              sidebar_issue_url, target: "_blank", rel: "noopener")) %>
+                <% elsif stored_issue_url.present? %>
+                  <%= red_t("red.errors.issue_section.unsafe_link") %>
                 <% else %>
                   <%= red_t("red.errors.sidebar.issue_tracking_unlinked") %>
                 <% end %>
@@ -504,7 +513,7 @@
                   <% if health[:job_queue] %>
                     <% jq = health[:job_queue] %>
                     <div class="mb-1">
-                      <small class="text-muted">Job Queue (<%= jq[:adapter] %>):</small>
+                      <small class="text-muted"><%= red_t("red.errors.sidebar.health.job_queue", adapter: jq[:adapter]) %></small>
                       <code class="ms-1">
                         <% case jq[:adapter] %>
                         <% when "sidekiq" %>

data/app/views/rails_error_dashboard/errors/analytics.html.erb

@@ -70,7 +70,7 @@
       <script<%= " nonce=\"#{red_csp_nonce}\"".html_safe if red_csp_nonce %>>
         document.addEventListener('DOMContentLoaded', function() {
           const colors = window.getChartColors();
-          new Chartkick.LineChart("errors-over-time-chart", <%= raw @errors_over_time.to_json %>, {
+          new Chartkick.LineChart("errors-over-time-chart", <%= js_safe_json(@errors_over_time) %>, {
             color: "#DC2626",
             curve: false,
             points: true,
@@ -122,7 +122,7 @@
                   "#EF4444"  // Red - iOS
                 ];
 
-                new Chartkick.PieChart("errors-by-platform-chart", <%= raw @errors_by_platform.to_json %>, {
+                new Chartkick.PieChart("errors-by-platform-chart", <%= js_safe_json(@errors_by_platform) %>, {
                   colors: platformColors,
                   height: "300px",
                   legend: "bottom",
@@ -173,7 +173,7 @@
                 const colors = window.getChartColors();
                 const environmentColors = ["#EF4444", "#F59E0B", "#2563EB", "#10B981", "#8B5CF6", "#6B7280"];
 
-                new Chartkick.PieChart("errors-by-environment-chart", <%= raw environment_counts.to_json %>, {
+                new Chartkick.PieChart("errors-by-environment-chart", <%= js_safe_json(environment_counts) %>, {
                   colors: environmentColors,
                   height: "300px",
                   legend: "bottom",
@@ -217,7 +217,7 @@
           <script<%= " nonce=\"#{red_csp_nonce}\"".html_safe if red_csp_nonce %>>
             document.addEventListener('DOMContentLoaded', function() {
               const colors = window.getChartColors();
-              new Chartkick.BarChart("errors-by-type-chart", <%= raw @errors_by_type.to_json %>, {
+              new Chartkick.BarChart("errors-by-type-chart", <%= js_safe_json(@errors_by_type) %>, {
                 color: "#EF4444",
                 height: "400px",
                 library: {
@@ -260,7 +260,7 @@
           <script<%= " nonce=\"#{red_csp_nonce}\"".html_safe if red_csp_nonce %>>
             document.addEventListener('DOMContentLoaded', function() {
               const colors = window.getChartColors();
-              new Chartkick.ColumnChart("errors-by-hour-chart", <%= raw @errors_by_hour.to_json %>, {
+              new Chartkick.ColumnChart("errors-by-hour-chart", <%= js_safe_json(@errors_by_hour) %>, {
                 color: "#DC2626",
                 height: "300px",
                 library: {
@@ -469,7 +469,7 @@
             <div id="errors-by-version-chart"></div>
             <script<%= " nonce=\"#{red_csp_nonce}\"".html_safe if red_csp_nonce %>>
               document.addEventListener('DOMContentLoaded', function() {
-                const versionData = <%= raw @errors_by_version.transform_values { |v| v[:count] }.to_json %>;
+                const versionData = <%= js_safe_json(@errors_by_version.transform_values { |v| v[:count] }) %>;
                 const colors = window.getChartColors();
 
                 new Chartkick.ColumnChart("errors-by-version-chart", versionData, {
@@ -608,7 +608,7 @@
               document.addEventListener('DOMContentLoaded', function() {
                 const colors = window.getChartColors();
                 new Chartkick.BarChart("mttr-by-platform-chart",
-                  <%= raw @mttr_by_platform.to_json %>, {
+                  <%= js_safe_json(@mttr_by_platform) %>, {
                   suffix: '<%= red_js_t("red.ui_js.charts.suffix_hours") %>',
                   height: "200px",
                   colors: ["#8B5CF6"],
@@ -661,7 +661,7 @@
               document.addEventListener('DOMContentLoaded', function() {
                 const colors = window.getChartColors();
                 new Chartkick.LineChart("mttr-trend-chart",
-                  <%= raw @mttr_stats[:mttr_trend].to_json %>, {
+                  <%= js_safe_json(@mttr_stats[:mttr_trend]) %>, {
                   suffix: '<%= red_js_t("red.ui_js.charts.suffix_hours") %>',
                   height: "250px",
                   colors: ["#10B981"],

data/app/views/rails_error_dashboard/errors/diagnostic_dumps.html.erb

@@ -49,7 +49,7 @@
         <div class="card text-center">
           <div class="card-body">
             <%
-              latest = @dumps.first
+              latest = @latest_dump
               latest_data = begin; JSON.parse(latest.dump_data); rescue; {}; end if latest
               thread_count = latest_data&.dig("system_health", "thread_count")
             %>

data/app/views/rails_error_dashboard/errors/index.html.erb

@@ -2,7 +2,12 @@
 
 <!-- Subscribe to Turbo Stream updates (only if Turbo Streams + ActionCable pubsub are available) -->
 <% if defined?(Turbo::StreamsHelper) && defined?(ActionCable) && respond_to?(:turbo_stream_from) && RailsErrorDashboard::Services::ErrorBroadcaster.available? %>
-  <%= turbo_stream_from "error_list" %>
+  <%# Names come from ErrorBroadcaster (one source for both ends): this page's
+      application or the global streams, without the new-row stream when a
+      filter, a sort or a later page means a new row does not belong on top. %>
+  <% (@live_streams || []).each do |stream| %>
+    <%= turbo_stream_from stream %>
+  <% end %>
 <% end %>
 
 <%

data/app/views/rails_error_dashboard/errors/overview.html.erb

@@ -16,6 +16,18 @@
     </div>
   <% end %>
 
+  <%# A storm episode degraded without writing its time buckets, so the
+      time-window figures below rest on each group's first-seen timestamp
+      rather than on per-event records. The COUNTS are still exact -- only
+      their placement in time is approximate, and saying so beats presenting
+      a figure of unknown completeness as fact. %>
+  <% if @stats[:event_timing_incomplete] %>
+    <div class="alert-warning" style="display: flex; align-items: center; gap: 10px; padding: 10px var(--space-5); background: var(--status-warning-bg); border-radius: var(--radius-md); border: 1px solid var(--status-warning); margin-bottom: var(--space-6); font-size: 13px; color: var(--status-warning);">
+      <i class="bi bi-clock-history"></i>
+      <strong><%= red_t("red.errors.overview_page.event_timing_incomplete") %></strong>
+    </div>
+  <% end %>
+
   <!-- Spike / Critical Alerts Banner -->
   <% if @critical_alerts.any? %>
     <%

data/app/views/rails_error_dashboard/errors/platform_comparison.html.erb

@@ -313,10 +313,10 @@
     new Chart(errorRateCtx, {
       type: 'bar',
       data: {
-        labels: <%= raw @error_rate_by_platform.keys.map { |k| k.to_s.capitalize }.to_json %>,
+        labels: <%= js_safe_json(@error_rate_by_platform.keys.map { |k| k.to_s.capitalize }) %>,
         datasets: [{
           label: '<%= red_js_t("red.ui_js.charts.series_total_errors") %>',
-          data: <%= raw @error_rate_by_platform.values.to_json %>,
+          data: <%= js_safe_json(@error_rate_by_platform.values) %>,
           backgroundColor: 'rgba(37, 99, 235, 0.5)', // Blue with transparency
           borderColor: '#2563EB', // Blue
           borderWidth: 1
@@ -338,14 +338,14 @@
   // Daily Trend Chart
   const dailyTrendCtx = document.getElementById('dailyTrendChart');
   if (dailyTrendCtx) {
-    const datasets = <%= raw @daily_trends.map { |platform, data|
+    const datasets = <%= js_safe_json(@daily_trends.map { |platform, data|
       {
         label: platform.to_s.capitalize,
         data: data.values,
         platform: platform.to_s.downcase,
         tension: 0.4
       }
-    }.to_json %>;
+    }) %>;
 
     // Apply platform-specific colors
     datasets.forEach(ds => {
@@ -358,7 +358,7 @@
     new Chart(dailyTrendCtx, {
       type: 'line',
       data: {
-        labels: <%= raw @daily_trends.values.first&.keys&.map { |d| red_chart_date(d) }&.to_json || [].to_json %>,
+        labels: <%= js_safe_json(@daily_trends.values.first&.keys&.map { |d| red_chart_date(d) } || []) %>,
         datasets: datasets
       },
       options: {
@@ -377,8 +377,8 @@
   // Resolution Time Chart
   const resolutionTimeCtx = document.getElementById('resolutionTimeChart');
   if (resolutionTimeCtx) {
-    const platforms = <%= raw @resolution_times.keys.map { |k| k.to_s.capitalize }.to_json %>;
-    const times = <%= raw @resolution_times.values.map { |v| v || 0 }.to_json %>;
+    const platforms = <%= js_safe_json(@resolution_times.keys.map { |k| k.to_s.capitalize }) %>;
+    const times = <%= js_safe_json(@resolution_times.values.map { |v| v || 0 }) %>;
 
     new Chart(resolutionTimeCtx, {
       type: 'bar',

data/app/views/rails_error_dashboard/errors/releases.html.erb

@@ -43,7 +43,7 @@
     </div>
   <% else %>
     <%
-      current_release = @releases.find { |r| r[:current] }
+      current_release = @current_release
     %>
 
     <!-- Summary Cards -->
@@ -76,7 +76,7 @@
         <div class="card text-center">
           <div class="card-body">
             <%
-              problematic_count = @releases.count { |r| r[:problematic] }
+              problematic_count = @problematic_release_count
             %>
             <div class="display-6 <%= problematic_count > 0 ? 'text-danger' : 'text-success' %>"><%= problematic_count %></div>
             <small class="text-muted"><%= red_t("red.analytics.releases.summary.problematic") %></small>

data/app/views/rails_error_dashboard/errors/settings.html.erb

@@ -47,6 +47,8 @@
       color: "info",
       settings: {
         notification_environments: { type: :array },
+        notification_burst_limit: { type: :integer },
+        notification_burst_window_seconds: { type: :integer, unit: :seconds },
         enable_slack_notifications: { type: :boolean },
         slack_webhook_url: { type: :url, show_if: :enable_slack_notifications },
         enable_email_notifications: { type: :boolean },

data/app/views/rails_error_dashboard/errors/show.html.erb

@@ -13,8 +13,8 @@
   </div>
 
   <!-- Hero card -->
-  <div style="display: flex; align-items: flex-start; justify-content: space-between; gap: var(--space-4); padding: var(--space-6); background: var(--surface-primary); border-radius: var(--radius-md); border: 1px solid var(--border-primary); margin-bottom: var(--space-4);">
-    <div style="flex: 1; min-width: 0;">
+  <div class="red-error-hero" style="padding: var(--space-6); background: var(--surface-primary); border-radius: var(--radius-md); border: 1px solid var(--border-primary); margin-bottom: var(--space-4);">
+    <div class="red-error-hero-text">
       <div style="display: flex; align-items: center; gap: 8px; margin-bottom: 6px;">
         <span class="badge bg-<%= severity_color(@error.severity) %>" style="display: inline-flex; align-items: center; gap: 4px;">
           <span style="width: 6px; height: 6px; border-radius: 50%; background: currentColor;"></span>
@@ -75,7 +75,7 @@
         <span><%= red_t("red.errors.show.hero.last_seen_html", time: local_time_ago(@error.last_seen_at)) %></span>
       </div>
     </div>
-    <div style="display: flex; gap: 6px; flex-shrink: 0;">
+    <div class="red-error-hero-actions">
       <% unless @error.resolved? %>
         <button type="button" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#resolveModal" style="font-weight: 600;">
           <%= red_t("red.errors.show.actions.resolve") %>

data/config/locales/de.yml

@@ -420,6 +420,7 @@ de:
       issue_section:
         title: Issue-Tracker
         view_issue: Issue ansehen
+        unsafe_link: "Dieser Issue-Link ist keine http(s)-URL, daher wird er als Text angezeigt und kann nicht geöffnet werden."
         linked: Verknüpft
         issue_reference: "%{provider} #%{number}"
         states:
@@ -582,6 +583,7 @@ de:
         snapshot_stale: aus einem früheren Auftreten — spätere lieferten keinen Kontext
         snapshot_fidelity_lite: reduzierte Erfassung (der Storm-Schutz hat die Kontext-Payloads verworfen)
         snapshot_fidelity_minimal: während eines Storms gezählt — es wurde kein Kontext erfasst
+        snapshot_fidelity_partial: gemischter Snapshot — einige Felder stammen aus einem früheren Vorkommen
         snapshot_unknown: erfasst, bevor RED die Herkunft von Momentaufnahmen aufzeichnete
       similar_errors:
         title: Ähnliche Fehler
@@ -939,6 +941,7 @@ de:
         rate_per_hour: "%{value}/Std."
         affected_users_incomplete: mindestens — der Storm-Schutz hat Detaildaten pro Ereignis verworfen
         data_unavailable: Statistiken sind derzeit nicht verfügbar — die Zahlen unten sind keine Messung.
+        event_timing_incomplete: "Zeitangaben sind unvollständig — der Sturmschutz hat Zeitstempel verworfen; die Gesamtzahlen stimmen."
         unresolved: Offen
         unresolved_hint: Behebung ausstehend
         resolution_rate: Behebungsquote
@@ -972,6 +975,16 @@ de:
         types:
           one: "%{count} Typ"
           other: "%{count} Typen"
+    errors_page:
+      csrf:
+        title: "Ihr Sitzungstoken ist abgelaufen"
+        message: "Gehen Sie zurück, laden Sie die Seite neu und versuchen Sie es erneut. Es wurde nichts geändert."
+      bad_request:
+        title: "Diese Anfrage konnte nicht verarbeitet werden"
+        message: "Ein erforderlicher Wert fehlte oder war fehlerhaft. Gehen Sie zurück und versuchen Sie es erneut."
+      not_acceptable:
+        title: "Dieses Format ist nicht verfügbar"
+        message: "Das Dashboard kann das angeforderte Format nicht erzeugen."
     settings:
       title: Einstellungen
       version: v%{version}
@@ -1086,6 +1099,8 @@ de:
           gesetzt)
         environment: Umgebung, der Fehler zugeordnet werden (Rails.env, falls nicht
           gesetzt)
+        notification_burst_limit: "Benachrichtigungen über neue Fehler pro Zeitfenster und Prozess (0 = keine Obergrenze)"
+        notification_burst_window_seconds: "Länge des Zeitfensters für Benachrichtigungen über neue Fehler"
         notification_environments: Nur für diese Umgebungen benachrichtigen (alle,
           falls nicht gesetzt)
         database: Aktive Datenbank für Fehlerprotokolle
@@ -1193,6 +1208,16 @@ de:
         linked: Issue erfolgreich verknüpft
         create_failed: 'Issue konnte nicht erstellt werden: %{reason}'
         link_failed: 'Issue konnte nicht verknüpft werden: %{reason}'
+      status:
+        updated: "Status geändert zu %{status}"
+        invalid_transition: "Der Status kann nicht von %{from} zu %{to} geändert werden"
+        unknown: "Diesen Status gibt es nicht"
+      snooze:
+        invalid_hours: "Die Zurückstelldauer muss eine ganze Zahl von Stunden zwischen 1 und %{max} sein"
+      priority:
+        invalid: "Diese Prioritätsstufe gibt es nicht"
+      assign:
+        blank: "Geben Sie einen Namen ein, dem dieser Fehler zugewiesen werden soll"
       not_enabled: "%{feature} ist nicht aktiviert. Aktivieren Sie es in %{file}"
       not_enabled_plural: "%{feature} sind nicht aktiviert. Aktivieren Sie sie in
         %{file}"
@@ -1238,6 +1263,7 @@ de:
         not_configured: Issue-Tracking ist nicht konfiguriert
         already_linked: 'Der Fehler hat bereits ein verknüpftes Issue: %{url}'
         url_required: Die Issue-URL ist erforderlich
+        url_invalid: Die Issue-URL muss mit http:// oder https:// beginnen
       error_not_found: 'Fehler nicht gefunden: %{id}'
       batch_failed:
         mute:
@@ -1362,6 +1388,10 @@ de:
           one: "%{value} Fehler"
           other: "%{value} Fehler"
         view_in_dashboard: Im Dashboard ansehen
+      burst:
+        suppressed: "In %{application} wurden innerhalb von %{window} Sekunden mehr als %{limit} neue Fehler gemeldet."
+        still_recorded: "Benachrichtigungen über weitere neue Fehler sind bis zum Ende dieses Zeitfensters pausiert; jeder Fehler wird weiterhin erfasst."
+        dashboard: "Dashboard: %{url}"
       storm:
         detected: Fehlersturm in %{application} um %{started_at} erkannt.
         mode: