rubocop-rails 2.35.3 → 2.35.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a93c373c0dc8f85fb3b81807cd6971588d148c6f02f4baac770c4a842cd59281
-  data.tar.gz: b54098494c0900a297281fed2eb634e38867ed0e3e14f84536765d9ccdc8ed6d
+  metadata.gz: 5620166bbbdcac74d58be7dec4ea307fc841d7cd31ffd9684f422009d00b8754
+  data.tar.gz: 7c156916d1a363419097086b305baf6010361473443602ea477ff03894c5e350
 SHA512:
-  metadata.gz: 9d3a419adf9b427d3cba678db098a08a0bbc69b8e7c5ec668108bede4217bdff67f1b8724e22e674ad653e2512dcb49483933f4b064d3f46a4c676d179bb0265
-  data.tar.gz: e2da63cb8261679f1fd9333f78ef278fc46bd2f06120a66b1ff8f4ddde1562f008f07246cea76cd0cb67ed8ba44c5e575493a44bc9ef43e9050f2258f0039c72
+  metadata.gz: fccc029e306ebaf72e1809005110005d18416b9d314c347b24b2381bdd84fa70c9e2d175633501618881c883e205ae0e79ed9aef3dcee4d4b16f6b02fce51818
+  data.tar.gz: 704f46a2a6c8b53eeeb8ac8ac60bfb25c39aa096e3b99516b132405f604729f48a877066b0531697e6ab8f1f65a9638435013c6610c5be5767e0b955d7d17300

data/lib/rubocop/cop/rails/env.rb

@@ -5,22 +5,34 @@ module RuboCop
     module Rails
       # Checks for usage of `Rails.env` which can be replaced with Feature Flags
       #
+      # The cop does not flag `Rails.env.local?`, the built-in alias for
+      # "development or test" introduced in Rails 7.1. Unlike per-environment
+      # predicates such as `development?` or `production?`, `local?` expresses
+      # the intent of guarding code that must only ever run in development or
+      # test (sanity checks, devtools, seed data) rather than gating an
+      # environment rollout, so a Feature Flag is not a suitable replacement.
+      #
       # @example
       #
       #   # bad
-      #   Rails.env.production? || Rails.env.local?
+      #   Rails.env.production? || Rails.env.development?
       #
       #   # good
       #   if FeatureFlag.enabled?(:new_feature)
       #     # new feature code
       #   end
       #
+      #   # good
+      #   raise 'This should never run in production' unless Rails.env.local?
+      #
       class Env < Base
         MSG = 'Use Feature Flags or config instead of `Rails.env`.'
         RESTRICT_ON_SEND = %i[env].freeze
         # This allow list is derived from:
         # (Rails.env.methods - Object.instance_methods).select { |m| m.to_s.end_with?('?') }
-        # and then removing the environment specific methods like development?, test?, production?, local?
+        # and then removing the environment specific methods like development?, test?, and production?.
+        # `local?` is kept on the allow list because it intentionally expresses
+        # "development or test" rather than a single environment rollout.
         ALLOWED_LIST = Set.new(
           %i[
             unicode_normalized?
@@ -38,6 +50,7 @@ module RuboCop
             valid_encoding?
             ascii_only?
             between?
+            local?
           ]
         ).freeze
 

data/lib/rubocop/cop/rails/save_bang.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+# rubocop:disable Metrics/ClassLength
 module RuboCop
   module Cop
     module Rails
@@ -303,13 +304,20 @@ module RuboCop
         def implicit_return?(node)
           return false unless cop_config['AllowImplicitReturn']
 
-          node = assignable_node(node)
+          node = last_expression_in_begin(assignable_node(node))
           method, sibling_index = find_method_with_sibling_index(node.parent)
           return false unless method&.type?(:def, :any_block)
 
           method.children.size == node.sibling_index + sibling_index
         end
 
+        # A multiline method or block body is wrapped in a `begin` node, so climb
+        # to it when the node is the last expression, to detect the implicit return.
+        def last_expression_in_begin(node)
+          node = node.parent while node.parent&.begin_type? && node.right_sibling.nil?
+          node
+        end
+
         def find_method_with_sibling_index(node, sibling_index = 1)
           return node, sibling_index unless node&.or_type?
 
@@ -348,3 +356,4 @@ module RuboCop
     end
   end
 end
+# rubocop:enable Metrics/ClassLength

data/lib/rubocop/cop/rails/strong_parameters_expect.rb

@@ -23,6 +23,18 @@ module RuboCop
       #   incompatibility introduced for valid reasons by the `expect` method, which aligns better with
       #   strong parameter conventions.
       #
+      #   It is also unsafe because `expect` is stricter about the structure of the parameters than
+      #   `require`/`permit`. Nested attributes that hold an array of records need an extra array wrapper,
+      #   such as `expect(user: [{ pets_attributes: [[:name]] }])`. The cop cannot tell a single nested hash
+      #   from an array of nested hashes, so it always generates the single-hash form, which can turn
+      #   a previously successful request into a failure.
+      #
+      #   It is also unsafe when `params[:key]` is passed to a finder method such as `find`, because
+      #   `find` accepts an array of IDs. `Model.find(params[:id])` loads every record for an array of IDs,
+      #   but the corrected `Model.find(params.expect(:id))` raises `ActionController::ParameterMissing`
+      #   for an array value, since `expect` requires a scalar. The cop cannot tell a scalar ID from
+      #   an array of IDs, so the autocorrection can turn a previously successful request into a failure.
+      #
       # @example
       #
       #   # bad
@@ -62,7 +74,7 @@ module RuboCop
         IGNORED_METHODS = %i[
           ! blank? compact compact! compact_blank compact_blank! deep_merge deep_merge!
           delete delete_if dig each except exclude? extract! fetch has_key? has_value?
-          include? instance_of? is_a? keep_if key? keys kind_of? member? merge merge!
+          include? inspect instance_of? is_a? keep_if key? keys kind_of? member? merge merge!
           nil? presence present? reverse_merge reverse_merge! slice stringify_keys
           to_a to_f to_h to_hash to_i to_s to_unsafe_h to_unsafe_hash
           transform_keys transform_keys! transform_values transform_values! try try!
@@ -76,10 +88,18 @@ module RuboCop
           (send (send nil? :params) :[] $_)
         PATTERN
 
+        # `require` with an array literal expects multiple top-level keys and has no single `expect` equivalent,
+        # so such calls are excluded to avoid generating broken code.
+        # A single dynamic argument to `permit` (such as a method call or variable that may return an array)
+        # has no safe `expect` rewrite, because the cop cannot tell whether the value is a list of attributes
+        # or a nested hash. Such calls are excluded to avoid generating broken code.
         def_node_matcher :params_require_permit, <<~PATTERN
-          $(call
+          [
             $(call
-              (send nil? :params) :require _) :permit _+)
+              $(call
+                (send nil? :params) :require !array) :permit _+)
+            !(call _ :permit {call lvar ivar cvar gvar const})
+          ]
         PATTERN
 
         def_node_matcher :params_permit_require, <<~PATTERN

data/lib/rubocop/rails/version.rb

@@ -4,7 +4,7 @@ module RuboCop
   module Rails
     # This module holds the RuboCop Rails version information.
     module Version
-      STRING = '2.35.3'
+      STRING = '2.35.5'
 
       def self.document_version
         STRING.match('\d+\.\d+').to_s

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-rails
 version: !ruby/object:Gem::Version
-  version: 2.35.3
+  version: 2.35.5
 platform: ruby
 authors:
 - Bozhidar Batsov
@@ -287,7 +287,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Automatic Rails code style checking tool.
 test_files: []