rubocop-gusto 10.6.0 → 10.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8312e221e4e60856991b5771855411eda476845804f95a1b890944880a72c107
-  data.tar.gz: 48247a74fe3523f5d813fc1b36fe9f56782c166347bd1f45997876047d5a9bf4
+  metadata.gz: a5ad5381e46b28ac74b61ba851caa498b964314ad364503d887bdb44908eace6
+  data.tar.gz: 9dc15d64da91e12a36ff62f122ca7bc57a47251f2e6e12dc128fe27d7d4d6419
 SHA512:
-  metadata.gz: b2b908c4b1f5f921371e6368956f57bce33995ab5127f346a59d4958909fd03469a8efde3ab035b52457c67bae2f8fc14efcb3c83250810ade31fe872b60948f
-  data.tar.gz: 5e0ce03d855c35c66a70fd0bbd3f940d3661e6d665fcac97d5c73c4fd57b10a3b5842b170ac9838d46fe6cec9ff042aedcc2e0950dfcfd231e035d3077fd9c27
+  metadata.gz: ecb903c72b7a302c2c9627d4e30d77fcbb5e736d8d82e581cf810e3c64ef3a2ccddd57200e204d22092a194d50773ba4181d0ff7172358ac429ee96fed6f9f2d
+  data.tar.gz: ab58cc3ea05f13ba3ad600921ef6cf128e5e848d9a4762aac1112ff4cd493636cf69a13f76c59b8c961f464cd9a9ddad43b358eed6d56791e18230817cb91def

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 ## Pending
 
 
+## 10.7.0
+
+- Improve `Rack/LowercaseHeaderKeys` for Rack 3 migration
+- Change `Style/StringLiterals` `EnforcedStyle` from `always` to `always_true`
+
 ## 10.6.0
 
 - Add `Rack/LowercaseHeaderKeys` cop to detect and autocorrect uppercase HTTP response header keys

data/config/default.yml

@@ -430,14 +430,19 @@ RSpec/SubjectStub:
   Enabled: false
 
 Rack/LowercaseHeaderKeys:
-  Description: 'HTTP response header keys should be lowercase for consistency and compatibility with HTTP/2.'
+  Description: 'HTTP response header keys should be lowercase for HTTP/2 and modern web standards compatibility.'
   Enabled: true
   Include:
     - 'lib/middleware/**/*.rb'
     - 'app/middleware/**/*.rb'
     - 'app/controllers/**/*.rb'
+    - 'app/public/**/*controller*.rb'
+    - 'app/helpers/**/*.rb'
     - 'packs/**/middleware/**/*.rb'
     - 'packs/**/controllers/**/*.rb'
+    - 'packs/**/app/public/**/*controller*.rb'
+    - 'packs/**/app/helpers/**/*.rb'
+    - 'packs/**/lib/**/*_app.rb'
     - 'components/**/middleware/**/*.rb'
     - 'components/**/controllers/**/*.rb'
     - 'config/initializers/**/*.rb'
@@ -565,7 +570,7 @@ Style/FormatStringToken:
   EnforcedStyle: template
 
 Style/FrozenStringLiteralComment:
-  EnforcedStyle: always
+  EnforcedStyle: always_true
   Enabled: true
 
 # This can make lines longer and impair readability

data/lib/rubocop/cop/rack/lowercase_header_keys.rb

@@ -4,91 +4,111 @@ module RuboCop
   module Cop
     module Rack
       # Detects HTTP response headers with uppercase characters.
-      # HTTP response header keys should be lowercase for consistency
-      # and compatibility with HTTP/2 and modern web standards.
+      # HTTP response header keys should be lowercase for compatibility
+      # with HTTP/2 and modern web standards.
+      #
+      # HTTP/2 (RFC 9113) requires all header field names to be lowercase.
+      # Using lowercase keys ensures compatibility across HTTP versions
+      # and Rack implementations.
       #
       # @example
       #   # bad
       #   headers['Content-Type'] = 'application/json'
       #   response.headers['Location'] = '/redirect'
+      #   response.set_header('X-Custom', 'value')
+      #   response.headers['Content-Security-Policy'] += policy
       #
       #   # good
       #   headers['content-type'] = 'application/json'
       #   response.headers['location'] = '/redirect'
+      #   response.set_header('x-custom', 'value')
+      #   response.headers['content-security-policy'] += policy
       #
       class LowercaseHeaderKeys < Base
         extend AutoCorrector
 
         MSG = "HTTP response header keys should be lowercase. Use `%{downcased}` instead of `%{original}`."
-        RESTRICT_ON_SEND = %i([]=).freeze
-
-        # Known HTTP headers (case-insensitive check)
-        KNOWN_HEADERS = Set.new(
-          %w(
-            Accept Accept-Charset Accept-Encoding Accept-Language Accept-Ranges
-            Access-Control-Allow-Credentials Access-Control-Allow-Headers
-            Access-Control-Allow-Methods Access-Control-Allow-Origin
-            Access-Control-Allow-Private-Network Access-Control-Expose-Headers
-            Access-Control-Max-Age Access-Control-Request-Headers
-            Access-Control-Request-Method Age Allow Authorization
-            Cache-Control Connection Content-Disposition Content-Encoding
-            Content-Language Content-Length Content-Location Content-Range
-            Content-Security-Policy Content-Security-Policy-Report-Only
-            Content-Type Cookie Date ETag Expect
-            Expires Forwarded From Host If-Match If-Modified-Since
-            If-None-Match If-Range If-Unmodified-Since Last-Modified
-            Link Location Max-Forwards Origin Pragma Proxy-Authenticate
-            Proxy-Authorization Range Referer Referrer-Policy Retry-After
-            Server Set-Cookie SOAPAction Strict-Transport-Security TE Trailer
-            Transfer-Encoding Upgrade User-Agent Vary Via Warning
-            WWW-Authenticate X-Content-Type-Options X-Frame-Options
-            X-XSS-Protection X-Forwarded-For X-Forwarded-Host X-Forwarded-Proto
-            X-Real-IP X-Request-ID X-Request-Start X-Requested-With
-          ).map(&:downcase)
-        ).freeze
+        RESTRICT_ON_SEND = %i([]= [] set_header get_header delete_header has_header?).freeze
+
+        # @!method response_header_method?(node)
+        def_node_matcher :response_header_method?, <<~PATTERN
+          (send
+            {
+              (send nil? :response)
+              (lvar :response)
+              (self)
+            }
+            {:set_header :get_header :delete_header :has_header?}
+            (str _)
+            ...
+          )
+        PATTERN
 
         def on_send(node)
-          return unless headers_assignment?(node)
+          if node.method?(:[]=) || node.method?(:[])
+            check_bracket_access(node)
+          elsif response_header_method?(node)
+            check_header_method(node)
+          end
+        end
+        alias_method :on_csend, :on_send
 
-          key_node = node.first_argument
-          return unless key_node.str_type?
+        # Handle compound assignment: headers['Key'] += val
+        # Ruby parses this as an op_asgn node, not a []= send
+        def on_op_asgn(node)
+          lhs = node.children[0]
+          return unless lhs.send_type? && lhs.method?(:[])
 
-          key_value = key_node.value
-          return unless uppercase_known_header?(key_value)
+          receiver = lhs.receiver
+          return unless receiver.send_type? && response_headers_receiver?(receiver)
 
-          add_offense_for_header(key_node, key_value)
+          key_node = lhs.first_argument
+          return unless key_node.str_type?
+
+          check_key(key_node)
         end
-        alias_method :on_csend, :on_send
 
         private
 
-        def uppercase_known_header?(key)
-          return false if key.empty?
-          return false if key == key.downcase
+        def check_bracket_access(node)
+          receiver = node.receiver
+          return unless receiver.send_type? && response_headers_receiver?(receiver)
+
+          key_node = node.first_argument
+          return unless key_node.str_type?
 
-          KNOWN_HEADERS.include?(key.downcase)
+          check_key(key_node)
         end
 
-        # Matches:
-        #   headers['...'] = value (bare method call in controller)
-        #   response.headers['...'] = value
-        # Does NOT match:
-        #   conn.headers, request.headers, client.headers, etc.
-        def headers_assignment?(node)
-          receiver = node.receiver
-          # RESTRICT_ON_SEND ensures we only see []=, which always has a receiver
-          return false unless receiver.send_type?
+        def check_header_method(node)
+          key_node = node.first_argument
+          check_key(key_node)
+        end
 
-          headers_method_receiver?(receiver)
+        def check_key(key_node)
+          key_value = key_node.value
+          return if key_value.empty?
+          return if key_value == key_value.downcase
+
+          add_offense_for_header(key_node, key_value)
         end
 
-        def headers_method_receiver?(receiver)
+        # Matches headers receivers that are response-related:
+        #   headers (bare method call in controller)
+        #   response.headers
+        #   self.headers
+        # Does NOT match:
+        #   conn.headers, request.headers, client.headers, etc.
+        def response_headers_receiver?(receiver)
           return false unless receiver.method?(:headers)
 
           inner = receiver.receiver
           if inner.nil?
             # Bare `headers` method call (Rails controller helper)
             true
+          elsif inner.self_type?
+            # `self.headers`
+            true
           elsif inner.send_type? && inner.receiver.nil? && inner.method?(:response)
             # `response.headers`
             true

data/lib/rubocop/gusto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Gusto
-    VERSION = "10.6.0"
+    VERSION = "10.7.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-gusto
 version: !ruby/object:Gem::Version
-  version: 10.6.0
+  version: 10.7.0
 platform: ruby
 authors:
 - Gusto Engineering
 bindir: exe
 cert_chain: []
-date: 2026-02-25 00:00:00.000000000 Z
+date: 2026-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: lint_roller