roda 3.109.0 → 3.110.0

data/lib/roda/plugins/error_handler.rb

@@ -3,26 +3,19 @@
 #
 class Roda
   module RodaPlugins
-    # The error_handler plugin adds an error handler to the routing,
+    # The error_handler plugin adds an error handler to the routing tree,
     # so that if routing the request raises an error, a nice error
-    # message page can be returned to the user.
+    # message page (or API response) can be returned to the user.
     # 
-    # You can provide the error handler as a block to the plugin:
+    # You should provide the error handler as a block to the plugin:
     #
     #   plugin :error_handler do |e|
     #     "Oh No!"
     #   end
     #
-    # Or later via the +error+ class method:
-    #
-    #   plugin :error_handler
-    #
-    #   error do |e|
-    #     "Oh No!"
-    #   end
-    #
-    # In both cases, the exception instance is passed into the block,
-    # and the block can return the request body via a string.
+    # If an error occurs, the exception instance is passed into the block,
+    # and the block can return the request body via a string (or another
+    # configured block result).
     #
     # If an exception is raised, a new response will be used, with the
     # default status set to 500, before executing the error handler.
@@ -32,40 +25,40 @@ class Roda
     # processing of that response occurs, except that an exception during
     # after processing is logged to <tt>env['rack.errors']</tt> but
     # otherwise ignored. This avoids recursive calls into the
-    # error_handler.  Note that if the error_handler itself raises
+    # error handler.  Note that if the error handler itself raises
     # an exception, the exception will be raised without normal after
     # processing.  This can cause some after processing to run twice
-    # (once before the error_handler is called and once after) if
+    # (once before the error handler is called and once after) if
     # later after processing raises an exception.
     #
     # By default, this plugin handles StandardError and ScriptError.
-    # To override the exception classes it will handle, pass a :classes
-    # option to the plugin:
+    # To override the exception classes it will handle, pass a +classes+
+    # argument to the plugin:
     #
     #   plugin :error_handler, classes: [StandardError, ScriptError, NoMemoryError]
     module ErrorHandler
       DEFAULT_ERROR_HANDLER_CLASSES = [StandardError, ScriptError].freeze
 
-      # If a block is given, automatically call the +error+ method on
-      # the Roda class with it.
-      def self.configure(app, opts={}, &block)
-        app.opts[:error_handler_classes] = (opts[:classes] || app.error_handler_classes || DEFAULT_ERROR_HANDLER_CLASSES).dup.freeze
+      # If a block is given, use it to setup the error handler.
+      def self.configure(app, opts=(no_positional_opts = true; OPTS), classes: opts[:classes], **kw, &block)
+        RodaPlugins.check_keywords("the error_handler plugin", no_positional_opts, opts, kw)
+        app.opts[:error_handler_classes] = (classes || app.error_handler_classes || DEFAULT_ERROR_HANDLER_CLASSES).dup.freeze
 
         if block
-          app.error(&block)
+          app.class_exec do
+            define_method(:handle_error, &block)
+            alias_method(:handle_error, :handle_error)
+            private :handle_error
+          end
         end
       end
 
       module ClassMethods
         RodaPlugins.opt_attr_reader(self, :error_handler_classes)
 
-        # Install the given block as the error handler, so that if routing
-        # the request raises an exception, the block will be called with
-        # the exception in the scope of the Roda instance.
         def error(&block)
-          define_method(:handle_error, &block)
-          alias_method(:handle_error, :handle_error)
-          private :handle_error
+          RodaPlugins.warn("The error class method is deprecated, switch to passing the block when loading the error_handler plugin", uplevel: 1)
+          plugin(:error_handler, &block)
         end
       end
 
@@ -98,7 +91,7 @@ class Roda
         private
 
         # Default empty implementation of _roda_after, usually
-        # overridden by Roda.def_roda_before.
+        # overridden by Roda.def_roda_after.
         def _roda_after(res)
         end
 
@@ -121,9 +114,8 @@ class Roda
           res
         end
 
-        # By default, have the error handler reraise the error, so using
-        # the plugin without installing an error handler doesn't change
-        # behavior.
+        # By default, have the error handler reraise the error, so loading
+        # the plugin without a block doesn't change behavior.
         def handle_error(e)
           raise e
         end

data/lib/roda/plugins/error_mail.rb

@@ -5,8 +5,8 @@ require 'mail'
 class Roda
   module RodaPlugins
     # The error_mail plugin adds an +error_mail+ instance method that
-    # send an email related to the exception.  This is most useful if you are
-    # also using the error_handler plugin:
+    # send an email related to the exception.  This is designed to be used
+    # with the error_handler plugin:
     #
     #   plugin :error_mail, to: 'to@example.com', from: 'from@example.com'
     #   plugin :error_handler do |e|
@@ -21,13 +21,13 @@ class Roda
     #
     # Options:
     #
-    # :filter :: Callable called with the key and value for each parameter, environment
-    #            variable, and session value.  If it returns true, the value of the
-    #            parameter is filtered in the email.
-    # :from :: The From address to use in the email (required)
-    # :headers :: A hash of additional headers to use in the email (default: empty hash)
-    # :prefix :: A prefix to use in the email's subject line (default: no prefix)
-    # :to :: The To address to use in the email (required)
+    # +:filter+ :: Callable called with the key and value for each parameter, environment
+    #              variable, and session value.  If it returns true, the value of the
+    #              parameter is filtered in the email.
+    # +:from+ :: The From address to use in the email (required)
+    # +:headers+ :: A hash of additional headers to use in the email (default: empty hash)
+    # +:prefix+ :: A prefix to use in the email's subject line (default: no prefix)
+    # +:to+ :: The To address to use in the email (required)
     #
     # The subject of the error email shows the exception class and message.
     # The body of the error email shows the backtrace of the error and the
@@ -42,16 +42,27 @@ class Roda
       DEFAULT_FILTER = lambda{|k,v| false}
       private_constant :DEFAULT_FILTER
 
+      PLUGIN_ARGUMENTS = %i[to from headers prefix filter].freeze 
+      private_constant :PLUGIN_ARGUMENTS
+
+      Config = Struct.new(*PLUGIN_ARGUMENTS)
+      private_constant :Config
+
       # Set default opts for plugin.  See ErrorEmail module RDoc for options.
       def self.configure(app, opts=OPTS)
+        RodaPlugins.check_supported_opts("the error_mail plugin", opts, PLUGIN_ARGUMENTS)
+
         app.opts[:error_mail] = email_opts = (app.error_mail_opts || {:filter=>DEFAULT_FILTER}).merge(opts).freeze
         unless email_opts[:to] && email_opts[:from]
           raise RodaError, "must provide :to and :from options to error_mail plugin"
         end
+
+        app.opts[:error_mail_config] = Config.new(*email_opts.values_at(*Config.members)).freeze
       end
 
       module ClassMethods
         RodaPlugins.opt_attr_reader(self, :error_mail, name: :error_mail_opts)
+        RodaPlugins.opt_attr_reader(self, :error_mail_config)
       end
 
       module InstanceMethods
@@ -71,14 +82,14 @@ class Roda
         private
 
         def _error_mail(e)
-          email_opts = self.class.error_mail_opts
+          config = self.class.error_mail_config
           subject = if e.respond_to?(:message)
             "#{e.class}: #{e.message}"
           else
             e.to_s
           end
-          subject = "#{email_opts[:prefix]}#{subject}"
-          filter = email_opts[:filter]
+          subject = "#{config.prefix}#{subject}"
+          filter = config.filter
 
           format = lambda do |h|
             h = h.map{|k, v| "#{k.inspect} => #{filter.call(k, v) ? 'FILTERED' : v.inspect}"}
@@ -133,12 +144,12 @@ END
 
 
           Mail.new do
-            from email_opts[:from]
-            to email_opts[:to]
+            from config.from
+            to config.to
             subject subject
             body message
 
-            if headers = email_opts[:headers]
+            if headers = config.headers
               headers.each do |k,v|
                 header[k] = v
               end

data/lib/roda/plugins/exception_page.rb

@@ -3,7 +3,7 @@
 #
 class Roda
   module RodaPlugins
-    # The exception_page plugin provides an exception_page method that is designed
+    # The exception_page plugin provides an +exception_page+ method that is designed
     # to be called inside the error handler to provide a page to the developer
     # with debugging information. It should only be used in developer environments
     # with trusted clients, as it can leak source code and other information that
@@ -21,29 +21,29 @@ class Roda
     # differences:
     #
     # * Not a middleware, so it doesn't handle exceptions itself, and has no effect
-    #   on the callstack unless the exception_page method is called.
+    #   on the callstack unless the +exception_page+ method is called.
     # * Supports external javascript and stylesheets, allowing context toggling to
     #   work in applications that use a content security policy to restrict inline
-    #   javascript and stylesheets (:assets, :css_file, and :js_file options).
-    # * Has fewer dependencies (does not require ostruct and erb).
+    #   javascript and stylesheets (+assets+, +css_file+, and +js_file+ arguments).
+    # * Has fewer dependencies (does not require erb).
     # * Sets the Content-Type for the response, and returns the body string, but does
     #   not modify other headers or the response status.
-    # * Supports a configurable amount of context lines in backtraces (:context option).
-    # * Supports optional JSON formatted output, if used with the json plugin (:json option).
+    # * Supports a configurable amount of context lines in backtraces (+context+ argument).
+    # * Supports optional JSON formatted output, if used with the json plugin (+json+ argument).
     #
-    # To use the external javascript and stylesheets, you can call +r.exception_page_assets+
-    # in your routing tree:
+    # To handle requests for the external javascript and stylesheets, you can call
+    # +r.exception_page_assets+ in your routing tree:
     #
     #   route do |r|
     #     # ...
     #
     #     # serve GET /exception_page.{css,js} requests
-    #     # Use with assets: true +exception_page+ option
+    #     # Use with exception_page assets: true argument
     #     r.exception_page_assets
     #     
     #     r.on "static" do
     #       # serve GET /static/exception_page.{css,js} requests
-    #       # Use with assets: '/static' +exception_page+ option
+    #       # Use with exception_page assets: '/static' option
     #       r.exception_page_assets
     #     end
     #   end
@@ -175,29 +175,37 @@ END
         # is not accepted, then just show a plain text page with the exception
         # class, message, and backtrace.
         #
-        # Options:
+        # Arguments:
         # 
-        # :assets :: If +true+, sets :css_file to +/exception_page.css+ and :js_file to
-        #            +/exception_page.js+, assuming that +r.exception_page_assets+ is called
-        #            in the route block to serve the exception page assets.  If a String,
-        #            uses the string as a prefix, assuming that +r.exception_page_assets+
-        #            is called in a nested block inside the route block. If false, doesn't
-        #            use any CSS or JS.
-        # :context :: The number of context lines before and after each line in
-        #             the backtrace (default: 7).
-        # :css_file :: A path to the external CSS file for the HTML exception page. If false,
-        #              doesn't use any CSS.
-        # :js_file :: A path to the external javascript file for the HTML exception page. If
-        #             false, doesn't use any JS.
-        # :json :: Return a hash of exception information.  The hash will have
-        #          a single key, "exception", with a value being a hash with
-        #          three keys, "class", "message", and "backtrace", which
-        #          contain information derived from the given exception.
-        #          Designed to be used with the +json+ exception, which will
-        #          automatically convert the hash to JSON format.
-        def exception_page(exception, opts=OPTS)
+        # +assets+ :: If +true+, sets :css_file to +/exception_page.css+ and :js_file to
+        #             +/exception_page.js+, assuming that +r.exception_page_assets+ is called
+        #             in the route block to serve the exception page assets.  If a String,
+        #             uses the string as a prefix, assuming that +r.exception_page_assets+
+        #             is called in a nested block inside the route block. If false, doesn't
+        #             use any CSS or JS.
+        # +context+ :: The number of context lines before and after each line in
+        #              the backtrace (default: 7).
+        # +css_file+ :: A path to the external CSS file for the HTML exception page. If false,
+        #               doesn't use any CSS.
+        # +js_file+ :: A path to the external javascript file for the HTML exception page. If
+        #              false, doesn't use any JS.
+        # +json+ :: Return a hash of exception information.  The hash will have
+        #           a single key, <tt>"exception"</tt>, with a value being a hash with
+        #           three keys, <tt>"class"</tt>, <tt>"message"</tt>, and <tt>"backtrace"</tt>, which
+        #           contain information derived from the given exception.
+        #           Designed to be used with the +json+ plugin, which will
+        #           automatically convert the hash to JSON format.
+        def exception_page(exception, opts=(no_positional_opts = true; OPTS),
+            assets: opts[:assets],
+            context: opts[:context],
+            css_file: opts[:css_file],
+            js_file: opts[:js_file],
+            json: opts[:json],
+            **kw)
+          RodaPlugins.check_keywords(__callee__, no_positional_opts, opts, kw)
+
           message = exception_page_exception_message(exception)
-          if opts[:json]
+          if json
             @_response[RodaResponseHeaders::CONTENT_TYPE] = "application/json"
             {
               "exception"=>{
@@ -209,11 +217,9 @@ END
           elsif env['HTTP_ACCEPT'] =~ /text\/html/
             @_response[RodaResponseHeaders::CONTENT_TYPE] = "text/html"
 
-            context = opts[:context] || 7
-            css_file = opts[:css_file]
-            js_file = opts[:js_file]
+            context ||= 7
 
-            case prefix = opts[:assets]
+            case prefix = assets
             when false
               css_file = false if css_file.nil?
               js_file = false if js_file.nil?

data/lib/roda/plugins/filter_common_logger.rb

@@ -26,15 +26,17 @@ class Roda
       end
 
       def self.configure(app, &block)
-        app.send(:define_method, :_common_log_request?, &block)
-        app.send(:private, :_common_log_request?)
-        app.send(:alias_method, :_common_log_request?, :_common_log_request?)
+        app.class_exec do
+          define_method(:_common_log_request?, &block)
+          private :_common_log_request?
+          alias _common_log_request? _common_log_request?
+        end
       end
 
       module InstanceMethods
         private
 
-        # Log request/response information in common log format to logger.
+        # Do common logging only if configured to do so.
         def _roda_after_90__common_logger(result)
           super if result && _common_log_request?(result)
         end

data/lib/roda/plugins/flash.rb

@@ -4,14 +4,12 @@ require 'delegate'
 
 class Roda
   module RodaPlugins
-    # The flash plugin adds a +flash+ instance method to Roda,
-    # for typical web application flash handling, where values
-    # set in the current flash hash are available in the next
-    # request.
+    # The flash plugin adds a +flash+ instance method, for typical web
+    # application flash handling, where values set in the current flash
+    # hash are available in the next request loading the flash.
     #
-    # With the example below, if a POST request is submitted,
-    # it will redirect and the resulting GET request will
-    # return 'b'.
+    # With the example below, if a +POST+ request is submitted, it will
+    # redirect and the resulting +GET+ request will return <tt>'b'</tt>.
     #
     #   plugin :flash
     #
@@ -23,7 +21,7 @@ class Roda
     #
     #       r.post do
     #         flash['a'] = 'b'
-    #         r.redirect('')
+    #         r.redirect
     #       end
     #     end
     #   end
@@ -35,11 +33,16 @@ class Roda
     #     flash.now['a'] = 'b'
     #     flash['a'] # = >'b'
     #   end
+    #
+    # The flash is saved in the session, so it has the same restrictions
+    # as other data saved in the session. If the session does not support
+    # symbols (e.g. when using the sessions plugin), you should not use
+    # symbols as flash keys.
     module Flash
       SCOPE_INSTANCE_VARIABLES = [:@_flash].freeze
 
-      # Simple flash hash, where assiging to the hash updates the flash
-      # used in the following request.
+      # Hash-like flash, where assigning to the object updates the data
+      # accessed in the following request.
       class FlashHash < DelegateClass(Hash)
         # The flash hash for the next request.  This
         # is what gets written to by #[]=.
@@ -48,8 +51,8 @@ class Roda
         # The flash hash for the current request
         alias now __getobj__
 
-        # Setup the next hash when initializing, and handle treat nil
-        # as a new empty hash.
+        # Setup the next hash when initializing, and treat nil
+        # argument as a new empty hash.
         def initialize(hash={})
           super(hash||{})
           @next = {}
@@ -93,7 +96,7 @@ class Roda
         # Access the flash hash for the current request, loading
         # it from the session if it is not already loaded.
         def flash
-          # :_flash to support transparent upgrades from previous key
+          # RODA4: Remove fallback to checking :_flash
           @_flash ||= FlashHash.new(session['_flash'] || (session['_flash'] = session.delete(:_flash)))
         end
 

data/lib/roda/plugins/freeze_request_response.rb

@@ -0,0 +1,24 @@
+# frozen-string-literal: true
+
+#
+class Roda
+  module RodaPlugins
+    # The freeze_request_response plugin freezes the RodaRequest and
+    # RodaResponse classes when freezing the Roda class. This will
+    # become the default behavior in Roda 4.
+    module FreezeRequestResponse
+      module ClassMethods
+        # Freeze the RodaRequest and RodaResponse classes when freezing the Roda class.
+        def freeze
+          super
+          # RODA4: make this behavior the default
+          self::RodaRequest.freeze
+          self::RodaResponse.freeze
+          self
+        end
+      end
+    end
+
+    register_plugin(:freeze_request_response, FreezeRequestResponse)
+  end
+end

data/lib/roda/plugins/hash_routes.rb

@@ -241,7 +241,7 @@ class Roda
           end
         end
 
-        [:get, :post, :delete, :head, :options, :link, :patch, :put, :trace, :unlink].each do |meth|
+        %i[get post delete head options link patch put trace unlink query].each do |meth|
           define_method(meth) do |path, &block|
             verb(meth, path, &block)
           end

data/lib/roda/plugins/permissions_policy.rb

@@ -34,13 +34,13 @@ class Roda
     #     # ...
     #   end
     #
-    # You can use the :default plugin option to set the default for all settings.
+    # You can use the +:default+ plugin argument to set the default for all settings.
     # For example, to disallow all access for each setting by default:
     #
     #   plugin :permissions_policy, default: :none
     #
     # The following methods are available for configuring the permissions policy,
-    # which specify the setting (substituting _ with -): 
+    # which specify the setting (substituting +_+ with +-+): 
     #
     # * accelerometer
     # * ambient_light_sensor
@@ -73,12 +73,12 @@ class Roda
     # All of these methods support any number of arguments, and each argument should
     # be one of the following values:
     #
-    # :all :: Grants permission to all domains (must be only argument)
-    # :none :: Does not allow permission at all (must be only argument)
-    # :self :: Allows feature in current document and any nested browsing contexts
-    #          that use the same domain as the current document.
-    # :src :: Allows feature in current document and any nested browsing contexts
-    #         that use the same domain as the src of the iframe.
+    # +:all+ :: Grants permission to all domains (must be only argument)
+    # +:none+ :: Does not allow permission at all (must be only argument)
+    # +:self+ :: Allows feature in current document and any nested browsing contexts
+    #            that use the same domain as the current document.
+    # +:src+ :: Allows feature in current document and any nested browsing contexts
+    #           that use the same domain as the src of the iframe.
     # String :: Specifies origin domain where access is allowed
     #
     # When calling a method with no arguments, the setting is removed from the policy instead
@@ -88,7 +88,7 @@ class Roda
     # Calling the method overrides any previous setting.  Each of the methods has +add_*+ and
     # +get_*+ methods defined. The +add_*+ method appends to any existing setting, and the +get_*+ method
     # returns the current value for the setting (this will be +:all+ if all domains are allowed, or
-    # any array of strings/:self/:src).
+    # any array of strings/+:self+/+:src+).
     #
     #   permissions_policy.fullscreen :self, 'https://example.com'
     #   # fullscreen (self "https://example.com")
@@ -99,7 +99,7 @@ class Roda
     #   permissions_policy.get_fullscreen
     #   # => [:self, "https://example.com", "https://*.example.com"]
     #
-    # The clear method can be used to remove all settings from the policy. Empty policies
+    # The +clear+ method can be used to remove all settings from the policy. Empty policies
     # do not set any headers. You can use +response.skip_permissions_policy!+ to skip
     # setting a policy.  This is faster than calling +permissions_policy.clear+, since
     # it does not duplicate the default policy.
@@ -175,16 +175,13 @@ class Roda
           end
         end
 
-        def initialize
-          clear
-        end
-
         # Clear all settings, useful to remove any inherited settings.
         def clear
           @opts = {}
           @report_only = nil
           @header_value = nil
         end
+        alias initialize clear
 
         # Do not allow future modifications to any settings.
         def freeze
@@ -279,14 +276,15 @@ class Roda
       end
 
       # Yield the current Permissions Policy to the block.
-      def self.configure(app, opts=OPTS)
+      def self.configure(app, opts=(no_positional_opts = true; OPTS), default: opts[:default], **kw)
+        RodaPlugins.check_keywords("the permissions_policy plugin", no_positional_opts, opts, kw)
         policy = app.opts[:permissions_policy] = if policy = app.permissions_policy
           policy.dup
         else
           Policy.new
         end
 
-        if default = opts[:default]
+        if default
           SUPPORTED_SETTINGS.each do |setting|
             policy.send(setting.tr('-', '_'), *default)
           end

data/lib/roda/plugins/public.rb

@@ -140,10 +140,20 @@ class Roda
             s, h, b = public_serve(server, path)
             headers = response.headers
             headers.replace(h)
+            public_add_vary(headers)
             halt [s, headers, b]
           end
         end
 
+        # When encodings are used, the response depends on the Accept-Encoding
+        # request header, so add it to the Vary header for caches.
+        def public_add_vary(headers)
+          unless roda_class.public_encodings.empty?
+            headers[RodaResponseHeaders::VARY] = (vary = headers[RodaResponseHeaders::VARY]) ? "#{vary}, Accept-Encoding" : 'Accept-Encoding'
+          end
+          nil
+        end
+
         # Serve the compressed file if it exists.  This should only
         # be called if the client will accept the related encoding.
         def public_serve_compressed(server, path, suffix, encoding)
@@ -158,6 +168,7 @@ class Roda
               headers[RodaResponseHeaders::CONTENT_TYPE] = ::Rack::Mime.mime_type(::File.extname(path), 'text/plain')
               headers[RodaResponseHeaders::CONTENT_ENCODING] = encoding
             end
+            public_add_vary(headers)
 
             halt [s, headers, b]
           end

data/lib/roda/plugins/recheck_precompiled_assets.rb

@@ -48,27 +48,37 @@ class Roda
       end
 
       def self.load_dependencies(app)
-        unless app.respond_to?(:assets_opts) && app.assets_opts[:precompiled]
+        unless app.respond_to?(:assets_config) && app.assets_config.precompiled
           raise RodaError, "must load assets plugin with precompiled option before loading recheck_precompiled_assets plugin"
         end
+        # Set mutex before overriding a method that uses it
+        app::RodaRequest.instance_variable_set(:@_precompiled_assets_mutex, Mutex.new)
       end
 
       def self.configure(app)
-        precompiled_file = app.assets_opts[:precompiled]
+        precompiled_file = app.assets_config.precompiled
         prev_mtime = ::File.mtime(precompiled_file)
+
+        request_class = app::RodaRequest
+        mutex = request_class.instance_variable_get(:@_precompiled_assets_mutex)
+        # Unset the assets matchers, in case a frozen value is already set
+        request_class.instance_variable_set(:@assets_matchers, nil)
+        # Ensure the assets matchers is set and an unfrozen array, and get the underlying value
+        request_class.assets_matchers
+        assets_matchers = request_class.instance_variable_get(:@assets_matchers)
+
         app.instance_exec do
-          opts[:assets] = assets_opts.merge(:compiled=>_compiled_assets_initial_hash.replace(assets_opts[:compiled])).freeze
+          _update_compiled_assets(_compiled_assets_initial_hash.replace(assets_config.compiled))
 
           define_singleton_method(:recheck_precompiled_assets) do
             new_mtime = ::File.mtime(precompiled_file)
             if new_mtime != prev_mtime
               prev_mtime = new_mtime
-              assets_opts[:compiled].replace(_precompiled_asset_metadata(precompiled_file))
+              assets_config.compiled.replace(_precompiled_asset_metadata(precompiled_file))
 
-              # Unset the cached asset matchers, so new ones will be generated.
-              # This is needed in case the new precompiled metadata uses
-              # different files.
-              app::RodaRequest.instance_variable_set(:@assets_matchers, nil)
+              # Replace the asset matchers, in case the new precompiled metadata uses different files.
+              new_assets_matchers = request_class.send(:_build_assets_matchers)
+              mutex.synchronize{assets_matchers.replace(new_assets_matchers)}
             end
           end
           singleton_class.send(:alias_method, :recheck_precompiled_assets, :recheck_precompiled_assets)
@@ -91,8 +101,20 @@ class Roda
       end
 
       module RequestClassMethods
+        # Synchronize access and return a dup, so that replacements of the
+        # assets matchers at runtime doesn't cause thread safety issues.
+        def assets_matchers
+          @_precompiled_assets_mutex.synchronize{super.dup}
+        end
+
         private
 
+        # Use a unfrozen array for the assets matchers, so they can be replaced
+        # at runtime.
+        def _build_assets_matchers
+          super.dup
+        end
+
         # Use a regexp that matches any digest.  When the precompiled asset metadata
         # file is updated, this allows requests for a previous precompiled asset to
         # still work.

data/lib/roda/plugins/render.rb

@@ -583,6 +583,9 @@ class Roda
           opts = subclass.opts[:render] = subclass.render_opts.dup
           if COMPILED_METHOD_SUPPORT
             opts[:template_method_cache] = (opts[:cache_class] || RodaCache).new
+            compiled_templates_module = Module.new
+            subclass.send(:include, compiled_templates_module)
+            subclass.const_set(:RodaCompiledTemplates, compiled_templates_module)
           end
           opts[:cache] = opts[:cache].dup
           opts.freeze

data/lib/roda/plugins/render_locals.rb

@@ -76,7 +76,7 @@ class Roda
 
           plugin_locals = render_locals
           if locals = opts[:locals]
-            plugin_locals = Hash[plugin_locals].merge!(locals)
+            plugin_locals = plugin_locals.merge(locals)
           end
           opts[:locals] = plugin_locals
           opts