style_capsule 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 66f1dc7d0d5addb480cfba5b2301305f390e23b8f6d533c69e57d8703fe9bf9d
-  data.tar.gz: 559cb7b3d87328da61419bf7a8ce1f4014a4425e4476966bfa0b129acc2fca26
+  metadata.gz: afc951f02fe29cd319b521b363049d3dba5e607099216e1782f48b4578f06f4b
+  data.tar.gz: 85916b390e95a3109da5a481f6b193a44309864499b5d3cb4ec4a634960c0ccd
 SHA512:
-  metadata.gz: cfa2dd98b0465d2d83145b11801e35b7f7a1f1e8d4d26fb18ae8f2c9af35b4d6d4b58a8d4fed3c66d037c45dd8e1a988091b9d8aef28b50e9981c1a03a3f0807
-  data.tar.gz: 10390d9e96e507b1966a4b31bc4eb490d232eda1034f029a1604d7765d75653c75b1649054aa0170b2b32acba4eca406b5c49922823696e95da3f0da24ce4c40
+  metadata.gz: bf300d946cf83d68e40a16862698bd8354f8c51dd927e2fb4e6cb8fd9e3f1d6c6298bb545233132399ea496985e1a1b45b9279bae7b9467663a525ef4893f530
+  data.tar.gz: 95450d3eeef09959b75dca145f06abfe9f5e59619044d3456e43a1c073adac4e51e1c94e59187ddee72ba823de54c4cc640754d80373fdf1e18316e4b7046bb9

data/CHANGELOG.md

@@ -1,6 +1,14 @@
 # CHANGELOG
 
-## Unreleased
+## 2.0.2 (2026-09-25)
+
+- Fix `HeadInjectionMiddleware` dropping pending stylesheets on bufferable chunked HTML
+- Inject when the Rack body responds to `to_ary`; skip only non-bufferable streaming bodies
+- After rewrite, set `Content-Length` and remove `Transfer-Encoding`
+- Fail closed when CSS would close a style tag before it is written into HTML
+- Escape allowed attributes on the non-Rails stylesheet link fallback
+- Bound the inline stylesheet cache
+- Align documented Ruby and Rails floors with the gemspec
 
 ## 2.0.1 (2026-07-03)
 

data/README.md

@@ -1,9 +1,11 @@
 # style_capsule
 
-[![Gem Version](https://badge.fury.io/rb/style_capsule.svg?v=2.0.0)](https://badge.fury.io/rb/style_capsule) [![Test Status](https://github.com/amkisko/style_capsule.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/style_capsule.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/style_capsule.rb/graph/badge.svg?token=2U6NXJOVVM)](https://codecov.io/gh/amkisko/style_capsule.rb)
+[![Gem Version](https://badge.fury.io/rb/style_capsule.svg?v=2.0.2)](https://badge.fury.io/rb/style_capsule) [![Test Status](https://github.com/amkisko/style_capsule.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/style_capsule.rb/actions/workflows/test.yml) [![codecov](https://codecov.io/gh/amkisko/style_capsule.rb/graph/badge.svg?token=2U6NXJOVVM)](https://app.codecov.io/github/amkisko/style_capsule.rb)
 
 CSS scoping extension for Ruby components. Provides attribute-based style encapsulation for Phlex, ViewComponent, and ERB templates to prevent style leakage between components. Works with Rails and can be used standalone in other Ruby frameworks (Sinatra, Hanami, etc.) or plain Ruby scripts. Includes configurable caching strategies for optimal performance.
 
+Design changes go through `rfcs/` (RFC 0001).
+
 ## Installation
 
 Add to your Gemfile:
@@ -256,7 +258,7 @@ By default, `StyleCapsule::HeadInjectionMiddleware` appends pending request-scop
 config.style_capsule.head_injection_middleware = false
 ```
 
-The middleware skips chunked responses (`Transfer-Encoding: chunked`) and does not buffer the body when no pending request-scoped stylesheets remain. For ActionController::Live, SSE, or other streaming HTML, disable it and inject manually with `StyleCapsule::StylesheetRegistry.inject_pending_head_stylesheets` if needed.
+The middleware only rewrites bufferable bodies (Rack bodies that respond to `to_ary`). Chunked HTML with a bufferable body is injected, then returned with `Content-Length` and without `Transfer-Encoding`. Non-bufferable streaming bodies (ActionController::Live, SSE, and similar) are left alone; disable the middleware and inject manually with `StyleCapsule::StylesheetRegistry.inject_pending_head_stylesheets` if needed. The middleware does not buffer when no pending request-scoped stylesheets remain. When it does rewrite, it holds the full 2xx HTML body in memory.
 
 ## Caching Strategies
 
@@ -317,11 +319,11 @@ StyleCapsule::CssFileWriter.configure(
   filename_pattern: ->(component_class, capsule_id) {
     "capsule-#{capsule_id}.css"
   },
-  fallback_dir: "/tmp/style_capsule"  # Optional, defaults to /tmp/style_capsule
+  fallback_dir: StyleCapsule::CssFileWriter::FALLBACK_OUTPUT_DIR
 )
 ```
 
-**Fallback Directory:** In production environments where the app directory is read-only (e.g., Docker containers), StyleCapsule automatically falls back to writing files to `/tmp/style_capsule` when the default location is not writable. When using the fallback directory, the gem gracefully falls back to inline CSS rendering, keeping the UI fully functional.
+**Fallback Directory:** In production environments where the app directory is read-only (e.g., Docker containers), StyleCapsule automatically falls back to writing files under a per-user directory in `Dir.tmpdir` when the default location is not writable. When using the fallback directory, the gem gracefully falls back to inline CSS rendering, keeping the UI fully functional.
 
 **Precompilation:**
 
@@ -452,9 +454,9 @@ end
 
 ## Requirements
 
-- Ruby >= 3.0
-- Rails >= 6.0, < 9.0 (optional, for Rails integration)
-- ActiveSupport >= 6.0, < 9.0 (optional, for Rails integration)
+- Ruby >= 3.4
+- Rails >= 7.0, < 9.0 (optional, for Rails integration)
+- ActiveSupport >= 7.0, < 9.0 (optional, for Rails integration)
 
 **Note**: The gem can be used without Rails! See [Non-Rails Support](#non-rails-support) below.
 
@@ -478,11 +480,11 @@ bundle install
 bundle exec appraisal install
 
 # Run tests
-bundle exec rspec
+bundle exec polyrun parallel-rspec --workers 5 --merge-failures
 
 # Run tests for all Rails versions
-bundle exec appraisal rails72 rspec
-bundle exec appraisal rails8ruby34 rspec
+bundle exec appraisal rails72 polyrun parallel-rspec --workers 5 --merge-failures
+bundle exec appraisal rails8ruby34 polyrun parallel-rspec --workers 5 --merge-failures
 
 # Linting
 bundle exec standardrb --fix
@@ -513,12 +515,25 @@ gem push style_capsule-*.gem
 
 StyleCapsule includes security protections:
 - Path traversal protection
-- Input validation
+- Capsule id and HTML attribute validation and escaping
 - Size limits (1MB per component)
-- XSS prevention via Rails' HTML escaping
+- Reject CSS that would close a style tag
 
 For detailed security information, see [SECURITY.md](SECURITY.md).
 
+## Links
+
+- [GitHub](https://github.com/amkisko/style_capsule.rb)
+- [GitLab](https://gitlab.com/amkisko/style_capsule.rb)
+- [RubyGems](https://rubygems.org/gems/style_capsule)
+- [Versions Atom](https://rubygems.org/gems/style_capsule/versions.atom) (feed id `9946895197223`)
+- [libraries.io](https://libraries.io/rubygems/style_capsule)
+- [Deps.dev](https://deps.dev/rubygems/style_capsule)
+- [SonarCloud](https://sonarcloud.io/project/overview?id=amkisko_style_capsule.rb)
+- [Snyk](https://snyk.io/test/github/amkisko/style_capsule.rb)
+- [Codecov](https://app.codecov.io/github/amkisko/style_capsule.rb)
+- [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/amkisko/style_capsule.rb)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/SECURITY.md

@@ -2,27 +2,24 @@
 
 ## Reporting a Vulnerability
 
-**Do NOT** open a public GitHub issue for security vulnerabilities.
+Email security details to: security@kiskolabs.com
 
-Email security details to: **security@kiskolabs.com**
-
-Include: description, steps to reproduce, potential impact, and suggested fix (if available).
+Send the report only to that address. Include description, steps to reproduce, potential impact, and a suggested fix when you have one.
 
 ### Response Timeline
 
-- We will acknowledge receipt of your report
-- We will provide an initial assessment
-- We will keep you informed of our progress and resolution timeline
+- We will acknowledge receipt of your report.
+- We will provide an initial assessment.
+- We will keep you informed of our progress and resolution timeline.
 
 ### Disclosure Policy
 
-- We will work with you to understand and resolve the issue
-- We will credit you for the discovery (unless you prefer to remain anonymous)
-- We will publish a security advisory after the vulnerability is patched
-- We will coordinate public disclosure with you
+- We will work with you to understand and resolve the issue.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+- We will publish a security advisory after the vulnerability is patched.
+- We will coordinate public disclosure with you.
 
 ## Automation Security
 
-* **Context Isolation:** It is strictly forbidden to include production credentials, API keys, or Personally Identifiable Information (PII) in prompts sent to third-party LLMs or automation services.
-
-* **Supply Chain:** All automated dependencies must be verified.
+- Keep production credentials, API keys, and personal data out of prompts sent to third-party models or automation services.
+- Verify automated dependencies.

data/docs/changelogs/20260904180000_audit-fixes.md

@@ -0,0 +1,29 @@
+# Audit fixes for style_capsule 2.0.1
+
+Recorded 2026-09-04. Implements the ranked findings from docs/issues/20260904174500_engineering-and-dependency-audit.md. Shipped in product CHANGELOG 2.0.2. json lockfile bump is recorded in docs/dependencies/20260904174500_json-cve-2026-71847.md.
+
+## Decisions
+
+Treat stored CSS as untrusted at the style-tag boundary. CssProcessor.reject_style_element_breakout! matches a case-insensitive style closer and raises ArgumentError. Call it after the size check in scope_selectors and scope_with_nesting, and again in render_inline_stylesheet. Empty CSS still returns early without that check.
+
+Allowlist non-Rails fallback link attributes. Emit only media, title, crossorigin, integrity, nonce, type, id, class, and data-* names. Escape values with CGI.escapeHTML. Never emit option href, rel, or event handlers. Keep href as /assets/#{validated_path}.css.
+
+Cap the inline CSS cache at 256 entries with Hash insertion-order shift. Mutex around cache mutations uses unlocked cleanup internals so cached_inline does not deadlock if a cache proc re-enters. Mutex also wraps register_eager writes and clear_manifest. The process-wide manifest is not capped.
+
+CssFileWriter fallback directory is File.join(Dir.tmpdir, "style_capsule-#{Process.uid}"). Specs compare the FALLBACK_OUTPUT_DIR constant.
+
+Add pull_request to .github/workflows/test.yml. Drop npm and docker from Dependabot. Do not add fake gemfiles Dependabot directories. Remove unused memory_profiler from the gemspec. Do not split stylesheet_registry.rb in this pass.
+
+## Effects
+
+Specs added for style-tag breakout in CssProcessor and render_inline_stylesheet, quote and href and onload options on the non-Rails link fallback, and inline cache eviction of the oldest key. bundle exec rspec: 498 examples, 0 failures. bundle-audit check --no-update is clean on all four lockfiles with json 2.21.2.
+
+README Requirements match the gemspec (Ruby >= 3.4, Rails >= 7.0, < 9.0). Badge uses v=2.0.1. Security section names style-tag closer rejection and capsule id and HTML attribute validation. Middleware docs state that rewrite buffers the full 2xx HTML body.
+
+## Next
+
+stylesheet_registry.rb remains over the house line-count ceiling. Split only if a later change owns that file.
+
+## Source
+
+Parent issue docs/issues/20260904174500_engineering-and-dependency-audit.md. json note docs/dependencies/20260904174500_json-cve-2026-71847.md. Branch patch/audit-fixes. Release 2.0.2.

data/docs/changelogs/20260925094000_head-injection-bufferable-chunked.md

@@ -0,0 +1,25 @@
+# HeadInjectionMiddleware injects bufferable chunked HTML
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+HeadInjectionMiddleware no longer skips every response with Transfer-Encoding chunked. Injection runs when the Rack body responds to to_ary. Non-bufferable streaming bodies are still passed through without calling each. After a successful rewrite, Transfer-Encoding is removed and Content-Length is set to the injected body size.
+
+## Effects
+
+Pending request-scoped stylesheet tags reach head on bufferable chunked HTML. True streaming responses without to_ary stay untouched. README late-head section matches that contract. Specs cover bufferable chunked inject and non-bufferable pass-through.
+
+## Next
+
+Shipped in 2.0.2. Confirm consumers that relied on the old skip still expect streaming bodies without to_ary.
+
+## Source
+
+lib/style_capsule/head_injection_middleware.rb
+spec/style_capsule/head_injection_middleware_spec.rb
+CHANGELOG.md 2.0.2
+README.md Late head injection
+Release 2.0.2.

data/docs/dependencies/20260904174500_json-cve-2026-71847.md

@@ -0,0 +1,37 @@
+# json 2.21.1 CVE-2026-71847 in development lockfiles
+
+Recorded 2026-09-04 during an engineering and dependency audit of style_capsule 2.0.1. Not a drive-by hunt. bundler-audit reported the advisory on every lockfile this repository audits in CI.
+
+## Dependency
+
+Name: json. Locked version: 2.21.1. Constraint in this repo: none in the gemspec. The published gem has no runtime gems. Gemfile.lock shows json as a dependency of activesupport 8.1.3.1 and of rubocop 1.88.2 via json (~> 2.3). The same 2.21.1 pin appears in gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock.
+
+## Symptom
+
+bundle-audit check fails. Title: JSON::ResumableParser#partial_value use-after-free crash on truncated duplicate-key streams. CVE-2026-71847. GHSA-9hj4-r449-hfvc. CVSS 8.7 availability. Affected 2.20.0 through 2.21.1. Solution: >= 2.21.2. StyleCapsule source does not parse JSON. A host that only adds this gem does not get json from this gemspec. Developers and CI that install this lockfile do.
+
+## Evidence
+
+Commands:
+
+bundle-audit update then bundle-audit check --no-update on Gemfile.lock.
+
+bundle-audit check --no-update --gemfile-lock gemfiles/rails72.gemfile.lock
+
+bundle-audit check --no-update --gemfile-lock gemfiles/rails8ruby34.gemfile.lock
+
+bundle-audit check --no-update --gemfile-lock gemfiles/rails8ruby4.gemfile.lock
+
+Observed: advisory database updated 2026-09-04, commit 478717d. All four locks named json 2.21.1 and the CVE above. bundle outdated --strict listed json 2.21.1 with newest 2.21.2. Rubygems versions API: 2.21.1 created 2026-07-13, 2.21.2 created 2026-07-31. GitHub advisory GHSA-9hj4-r449-hfvc. .github/workflows/dependency-audit.yml runs bundle-audit on every Gemfile.lock on push, pull_request, and weekly cron.
+
+## Suggested fix
+
+Upgrade. bundle update json in the root Gemfile and in each appraisal gemfile until lockfiles resolve json >= 2.21.2. Do not add json as a direct dependency only to pin it unless Bundler cannot reach 2.21.2 through activesupport and rubocop. No patch or vendor is needed. An upstream report is already published.
+
+## Next
+
+Lockfiles now pin json 2.21.2. bundle-audit check --no-update is clean on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock. Keep the published gemspec free of json unless a later feature parses JSON on the hot path.
+
+## Source
+
+ruby-advisory-db via bundler-audit, commit 478717d. GHSA-9hj4-r449-hfvc. CVE-2026-71847. Rubygems json 2.21.2. Gemfile.lock activesupport and rubocop entries. .github/workflows/dependency-audit.yml. Parent issue usr/docs/issues/20260904174500_engineering-and-dependency-audit.md.

data/docs/issues/20260904174500_engineering-and-dependency-audit.md

@@ -0,0 +1,47 @@
+# Engineering and dependency audit of style_capsule 2.0.1
+
+Recorded 2026-09-04. Library gem. No product UI, database, queue, or worker. Pipeline is CSS and HTML in, processor and helpers, class and thread caches, optional file writer, stylesheet registry, optional Rack head injection, HTML out.
+
+## Decisions
+
+This pass is an audit only. No code change, no lockfile bump, no workflow edit. Rankings follow engineering-audit order: danger, then certainty, then impact, then fix cost. Dependency-audit ran because the request named both. The published gemspec has no runtime gems. json 2.21.1 is a development lockfile pin from activesupport and rubocop, not a consumer runtime of this gem.
+
+## Effects
+
+Test workflow .github/workflows/test.yml runs on workflow_dispatch and push to main only. Lint and appraisal rspec do not run on pull_request. dependency-audit.yml does run on pull_request and would fail today on json 2.21.1 in Gemfile.lock and gemfiles/*.gemfile.lock.
+
+Inline CSS is interpolated into style tags and marked html_safe. Helpers use raw(scoped_css). README documents Theme#scoped_css from stored CSS and shows raw in ERB. README Security section claims XSS prevention via Rails HTML escaping. Capsule id is validated. CSS body is not sanitized for a style-tag break. Specs cover attribute escaping in StandaloneHelper, not a closing style tag in CSS.
+
+Non-Rails file stylesheet fallback interpolates option keys and values into a link tag. AssetPath rejects path traversal, quotes, angle brackets, and overlong logical paths. It does not reject a javascript: href scheme or quote characters in option values.
+
+StylesheetRegistry @inline_cache and @manifest are process-wide hashes without a mutex. Component CSS cache and helper scope cache cap at 256. File path cache caps at 512 with a mutex. Inline cache only drops entries that have expires_at. Registrations with type proc or no TTL grow for the process lifetime. README claims thread-safe head rendering.
+
+HeadInjectionMiddleware buffers a 2xx HTML body to inject before the first closing head tag. Chunked transfer is skipped. Live and SSE caveats are documented. Impact of the buffer under large HTML is inference. No RSS or timing bench this session.
+
+CssFileWriter falls back to /tmp/style_capsule, writes CSS, then returns nil so the registry can fall back to inline. Shared-host /tmp collision and symlink follow are inference. Fallback specs exist.
+
+README Requirements still say Ruby >= 3.0 and Rails >= 6.0. Gemspec required_ruby_version is >= 3.4. Development Rails gems are >= 7.0, < 9.0. Appraisals cover Rails 7.2 and 8.1 on Ruby 3.4 and 4.0. README badge still uses v=2.0.0. Version constant is 2.0.1.
+
+lib/style_capsule/stylesheet_registry.rb is 827 lines. House guidance prefers around 150 with a 300 ceiling. AssetPath and HeadInjectionMiddleware are already split out.
+
+CssProcessor walks CSS with regex up to 1MB. A comment claims MAX_CSS_SIZE mitigates ReDoS. ReDoS was not proven. Spike was not run.
+
+Dependabot lists npm and docker at directory / with no package.json and no Dockerfile. Bundler updates only directory /. Appraisal lockfiles under gemfiles/ are not a separate Dependabot directory.
+
+memory_profiler is a development gemspec dependency. No spec or lib caller was found this session.
+
+bundle-audit check --no-update on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock all reported json 2.21.1, CVE-2026-71847, GHSA-9hj4-r449-hfvc, fix >= 2.21.2. Advisory database updated 2026-09-04, commit 478717d. Evidence is in usr/docs/dependencies/20260904174500_json-cve-2026-71847.md.
+
+bundle outdated --strict listed erb 6.0.6 to 6.0.7, io-console 0.8.2 to 0.9.2, json 2.21.1 to 2.21.2, polyrun 2.2.2 to 2.2.4, psych 5.4.0 to 5.5.0, rack 3.2.6 to 3.2.7, reline 0.6.3 to 0.7.0, view_component 4.12.0 to 4.15.0, webmock 3.26.2 to 3.26.4, zeitwerk 2.8.2 to 2.8.3. Release-date lag for those three named packages versus latest: json 18 days, polyrun 41 days, view_component 82 days. Full lockfile libyears versus every gem latest date was not computed. rspec was not run.
+
+Modes skipped with reason: product-surface, this gem has no own UI. Privacy, the gem does not collect personal data; host CSS may appear in instrumentation payloads when a subscriber exists. Observability, no product runtime or SLO of its own. Learned systems, none. Resource cheaper-or-greener without a bench stays inference. Identity claims without HAR or log fixtures stay inference.
+
+A later pass on 2026-09-04 implemented the ranked fixes on branch patch/audit-fixes. See usr/docs/changelogs/20260904180000_audit-fixes.md. bundle exec rspec: 498 examples, 0 failures. bundle exec rubocop and bundle exec rbs validate ran after the cop fix in CssProcessor.reject_style_element_breakout!. This file remains the audit record.
+
+## Next
+
+stylesheet_registry.rb remains over the house line-count ceiling. Split only if a later change owns that file. json lockfile bump is tracked in usr/docs/dependencies/20260904174500_json-cve-2026-71847.md.
+
+## Source
+
+engineering-audit and dependency-audit skills in .agents/skills. README Requirements and Security. style_capsule.gemspec. lib/style_capsule/version.rb. lib/style_capsule/stylesheet_registry.rb. lib/style_capsule/helper.rb. lib/style_capsule/standalone_helper.rb. lib/style_capsule/css_file_writer.rb. lib/style_capsule/head_injection_middleware.rb. .github/workflows/test.yml. .github/workflows/dependency-audit.yml. .github/dependabot.yml. Gemfile.lock and gemfiles/*.gemfile.lock. bundle-audit 0.9.x against ruby-advisory-db commit 478717d. bundle outdated --strict. ruby -Ilib require of StyleCapsule::ClassRegistry. Rubygems version API dates for json, polyrun, and view_component. Downstream canvas is outside this repo.

data/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md

@@ -0,0 +1,28 @@
+CI quality failed on a trailing blank line in spec/support/junit_formatter.rb. Test CI also ran bundler-audit or osv-scanner, which fail whenever an advisory lands even when a separate dependency audit already exists.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Drop bundler-audit and security jobs from test.yml so tests no longer wait on advisory freshness.
+- Keep dependency-audit.yml as workflow_dispatch only. Do not run it on push, pull request, or schedule.
+- Disable osv-scanner in Trunk Check.
+- Disable markdownlint MD013 in .markdownlint.yaml. Keep AGENTS.md in Trunk so other markdownlint rules still run.
+- Keep lockfile and spec fixes that were already blocking quality or tests.
+
+## Effects
+
+- Test CI runs lint and specs without an advisory gate.
+- Trunk Check no longer treats dependency CVEs as a required check.
+- Manual dependency-audit remains available on workflow_dispatch.
+
+## Next
+
+- Run dependency audit on demand when a release or a known advisory needs it.
+- Do not reintroduce advisory scanners into test.yml.
+
+## Source
+
+- GitHub Actions test and Trunk Check failures on 2026-09-17

data/lib/style_capsule/css_file_writer.rb

@@ -2,6 +2,7 @@
 
 require "fileutils"
 require "digest/sha1"
+require "tmpdir"
 require_relative "instrumentation"
 
 module StyleCapsule
@@ -12,7 +13,7 @@ module StyleCapsule
   # via Rails asset pipeline.
   #
   # In production environments where the app directory is read-only (e.g., Docker containers),
-  # this class automatically falls back to writing files to /tmp/style_capsule when the
+  # this class automatically falls back to writing files under Dir.tmpdir when the
   # default location is not writable. When using the fallback directory, write_css returns
   # nil, causing StylesheetRegistry to fall back to inline CSS (keeping the UI functional).
   #
@@ -32,7 +33,7 @@ module StyleCapsule
   #   StyleCapsule::CssFileWriter.configure(
   #     output_dir: Rails.root.join(StyleCapsule::CssFileWriter::DEFAULT_OUTPUT_DIR),
   #     filename_pattern: ->(component_class, capsule_id) { "capsule-#{capsule_id}.css" },
-  #     fallback_dir: "/tmp/style_capsule"  # Optional, defaults to /tmp/style_capsule
+  #     fallback_dir: StyleCapsule::CssFileWriter::FALLBACK_OUTPUT_DIR
   #   )
   #
   # @example Usage
@@ -74,7 +75,7 @@ module StyleCapsule
     # Default output directory for CSS files (relative to Rails root)
     DEFAULT_OUTPUT_DIR = "app/assets/builds/capsules"
     # Fallback directory for when default location is read-only (absolute path)
-    FALLBACK_OUTPUT_DIR = "/tmp/style_capsule"
+    FALLBACK_OUTPUT_DIR = File.join(Dir.tmpdir, "style_capsule-#{Process.uid}")
     # Positive cache for resolved asset-relative paths (avoids repeated File.exist? on hot path)
     FILE_PATH_CACHE_MAX = 512
 
@@ -90,7 +91,7 @@ module StyleCapsule
       #   Default: `"capsule-#{capsule_id}.css"` (capsule_id is unique and deterministic)
       # @param enabled [Boolean] Whether file writing is enabled (default: true)
       # @param fallback_dir [String, Pathname, nil] Fallback directory when default location is read-only
-      #   Default: `StyleCapsule::CssFileWriter::FALLBACK_OUTPUT_DIR` (/tmp/style_capsule)
+      #   Default: `StyleCapsule::CssFileWriter::FALLBACK_OUTPUT_DIR`
       # @example
       #   StyleCapsule::CssFileWriter.configure(
       #     output_dir: Rails.root.join(StyleCapsule::CssFileWriter::DEFAULT_OUTPUT_DIR),

data/lib/style_capsule/css_processor.rb

@@ -49,7 +49,7 @@ module StyleCapsule
         raise ArgumentError, "CSS content exceeds maximum size of #{MAX_CSS_SIZE} bytes (got #{css_string.bytesize} bytes)"
       end
 
-      # Validate capsule_id
+      reject_style_element_breakout!(css_string)
       validate_capsule_id!(capsule_id)
 
       # Instrument CSS processing with timing and size metrics
@@ -142,7 +142,7 @@ module StyleCapsule
         raise ArgumentError, "CSS content exceeds maximum size of #{MAX_CSS_SIZE} bytes (got #{css_string.bytesize} bytes)"
       end
 
-      # Validate capsule_id
+      reject_style_element_breakout!(css_string)
       validate_capsule_id!(capsule_id)
 
       # Instrument CSS processing with timing and size metrics
@@ -169,6 +169,20 @@ module StyleCapsule
       css.gsub(/\/\*.*?\*\//m, "")
     end
 
+    # Reject CSS that would close an enclosing HTML style element
+    #
+    # HTML parses style-element content until the first case-insensitive closer,
+    # including sequences inside CSS comments or string literals.
+    #
+    # @param css_string [String, nil] CSS that will be placed inside a style tag
+    # @raise [ArgumentError] If the string contains a style element closer
+    def self.reject_style_element_breakout!(css_string)
+      return if css_string.blank?
+      return unless css_string.match?(%r{</style}i)
+
+      raise ArgumentError, "CSS content must not contain a style element closer"
+    end
+
     # Validate capsule ID to prevent injection attacks
     #
     # @param capsule_id [String] Capsule ID to validate

data/lib/style_capsule/head_injection_middleware.rb

@@ -32,8 +32,11 @@ module StyleCapsule
       injected_body = StylesheetRegistry.inject_pending_head_stylesheets(body, view_context)
       return [status, headers, response] if injected_body.equal?(body)
 
+      close_response(response)
+
       headers = headers.dup
-      headers["Content-Length"] = injected_body.bytesize.to_s if headers.key?("Content-Length")
+      headers.delete("Transfer-Encoding")
+      headers["Content-Length"] = injected_body.bytesize.to_s
 
       [status, headers, [injected_body]]
     end
@@ -41,15 +44,20 @@ module StyleCapsule
     def inject_response?(status, headers, response)
       return false unless SUCCESS_STATUS.cover?(status)
       return false unless html_content_type?(headers["Content-Type"])
-      return false if chunked_response?(headers)
-      return false if response.respond_to?(:to_ary) && response.to_ary == [""]
+      return false unless bufferable_body?(response)
+      return false if empty_body?(response)
 
       true
     end
 
-    def chunked_response?(headers)
-      transfer_encoding = headers["Transfer-Encoding"]
-      transfer_encoding&.match?(/chunked/i)
+    # Rack 3: +to_ary+ means the body may be buffered without changing application behaviour.
+    # Streaming / Live bodies omit +to_ary+; leave those alone even when Transfer-Encoding is chunked.
+    def bufferable_body?(response)
+      response.respond_to?(:to_ary)
+    end
+
+    def empty_body?(response)
+      response.to_ary == [""]
     end
 
     def html_content_type?(content_type)
@@ -64,6 +72,10 @@ module StyleCapsule
       parts.join
     end
 
+    def close_response(response)
+      response.close if response.respond_to?(:close)
+    end
+
     def view_context_for(env)
       controller = env["action_controller.instance"]
       controller&.view_context

data/lib/style_capsule/stylesheet_registry.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
+require "cgi"
 require_relative "instrumentation"
 require_relative "asset_path"
+require_relative "css_processor"
 
 module StyleCapsule
   # Helper to determine the parent class for StylesheetRegistry
@@ -72,14 +74,18 @@ module StyleCapsule
   class StylesheetRegistry < StyleCapsule.stylesheet_registry_parent_class
     # Default namespace for backward compatibility
     DEFAULT_NAMESPACE = :default
+    MAX_INLINE_CACHE_ENTRIES = 256
+    FALLBACK_LINK_OPTION_NAME = /\A(?:media|title|crossorigin|integrity|nonce|type|id|class|data-[a-zA-Z0-9_-]+)\z/
 
     # Process-wide manifest for static file paths (like Propshaft)
     # Organized by namespace: { namespace => { logical_path => { file_path:, options: } } }
     @manifest = {} # rubocop:disable Style/ClassVars, ThreadSafety/MutableClassInstanceVariable
+    @manifest_mutex = Mutex.new
 
     # Process-wide cache for inline CSS (with expiration support)
     # Structure: { cache_key => { css_content: String, cached_at: Time, expires_at: Time } }
     @inline_cache = {} # rubocop:disable Style/ClassVars, ThreadSafety/MutableClassInstanceVariable
+    @inline_cache_mutex = Mutex.new
 
     # Track last cleanup time for lazy cleanup (prevents excessive cleanup calls)
     @last_cleanup_time = nil # rubocop:disable Style/ClassVars
@@ -222,8 +228,10 @@ module StyleCapsule
         inline_size: nil,
         cache_strategy: :none
       ) do
-        @manifest[ns] ||= {}
-        @manifest[ns][path] = {file_path: path, options: options}
+        with_manifest do
+          @manifest[ns] ||= {}
+          @manifest[ns][path] = {file_path: path, options: options}
+        end
       end
     end
 
@@ -350,11 +358,10 @@ module StyleCapsule
     # @param namespace [Symbol] Namespace (for proc strategy)
     # @return [String, nil] Cached CSS content or nil if not cached/expired
     def self.cached_inline(cache_key, cache_strategy:, cache_ttl: nil, cache_proc: nil, css_content: nil, capsule_id: nil, namespace: nil)
-      # Lazy cleanup: remove expired entries if it's been a while (every 5 minutes)
-      # This prevents memory leaks in long-running processes without impacting performance
-      cleanup_expired_cache_if_needed
-
-      cached_entry = @inline_cache[cache_key]
+      cached_entry = with_inline_cache do
+        cleanup_expired_cache_unlocked_if_needed
+        @inline_cache[cache_key]
+      end
       return nil unless cached_entry
 
       # Check expiration based on strategy
@@ -402,11 +409,16 @@ module StyleCapsule
         end
       end
 
-      @inline_cache[cache_key] = {
-        css_content: css_content,
-        cached_at: current_time,
-        expires_at: expires_at
-      }
+      with_inline_cache do
+        unless @inline_cache.key?(cache_key)
+          @inline_cache.shift while @inline_cache.size >= MAX_INLINE_CACHE_ENTRIES
+        end
+        @inline_cache[cache_key] = {
+          css_content: css_content,
+          cached_at: current_time,
+          expires_at: expires_at
+        }
+      end
     end
 
     # Clear inline CSS cache
@@ -414,10 +426,12 @@ module StyleCapsule
     # @param cache_key [String, nil] Specific cache key to clear (nil clears all)
     # @return [void]
     def self.clear_inline_cache(cache_key = nil)
-      if cache_key
-        @inline_cache.delete(cache_key)
-      else
-        @inline_cache.clear
+      with_inline_cache do
+        if cache_key
+          @inline_cache.delete(cache_key)
+        else
+          @inline_cache.clear
+        end
       end
     end
 
@@ -437,13 +451,16 @@ module StyleCapsule
     #   # In a scheduled job or initializer
     #   StyleCapsule::StylesheetRegistry.cleanup_expired_cache
     def self.cleanup_expired_cache
+      with_inline_cache { cleanup_expired_cache_unlocked }
+    end
+
+    def self.cleanup_expired_cache_unlocked
       return 0 if @inline_cache.empty?
 
       now = current_time
       expired_keys = []
 
       @inline_cache.each do |cache_key, entry|
-        # Remove entries that have an expires_at time and it's in the past
         if entry[:expires_at] && now > entry[:expires_at]
           expired_keys << cache_key
         end
@@ -455,23 +472,24 @@ module StyleCapsule
       expired_keys.size
     end
 
-    # Check if cleanup is needed and perform it if so
-    #
-    # Only performs cleanup if it's been more than 5 minutes since the last cleanup.
-    # This prevents excessive cleanup calls while still preventing memory leaks.
-    #
-    # @return [void]
-    # @api private
-    def self.cleanup_expired_cache_if_needed
-      # Cleanup every 5 minutes (300 seconds) to balance memory usage and performance
+    def self.cleanup_expired_cache_unlocked_if_needed
       cleanup_interval = 300
 
       if @last_cleanup_time.nil? || (current_time - @last_cleanup_time) > cleanup_interval
-        cleanup_expired_cache
+        cleanup_expired_cache_unlocked
       end
     end
 
-    private_class_method :cleanup_expired_cache_if_needed
+    def self.with_inline_cache
+      @inline_cache_mutex.synchronize { yield }
+    end
+
+    def self.with_manifest
+      @manifest_mutex.synchronize { yield }
+    end
+
+    private_class_method :cleanup_expired_cache_unlocked, :cleanup_expired_cache_unlocked_if_needed,
+      :with_inline_cache, :with_manifest
 
     # Get all registered file paths from process-wide manifest (organized by namespace)
     #
@@ -540,11 +558,13 @@ module StyleCapsule
     # @param namespace [Symbol, String, nil] Optional namespace to clear (nil clears all)
     # @return [void]
     def self.clear_manifest(namespace: nil)
-      if namespace.nil?
-        @manifest = {}
-      else
-        ns = normalize_namespace(namespace)
-        @manifest.delete(ns)
+      with_manifest do
+        if namespace.nil?
+          @manifest = {}
+        else
+          ns = normalize_namespace(namespace)
+          @manifest.delete(ns)
+        end
       end
     end
 
@@ -564,7 +584,17 @@ module StyleCapsule
     #   If nil, falls back to basic HTML generation
     # @param namespace [Symbol, String, nil] Optional namespace to render (nil/blank renders all namespaces)
     # @return [String] HTML-safe string with stylesheet tags
-    # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity -- renders mixed inline and file registrations
+    def self.render_stylesheet_entries(stylesheets, view_context)
+      stylesheets.map do |stylesheet|
+        if stylesheet[:type] == :inline
+          render_inline_stylesheet(stylesheet, view_context)
+        else
+          render_file_stylesheet(stylesheet, view_context)
+        end
+      end.join("\n").then { |s| safe_string(s) }
+    end
+
+    # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- renders mixed inline and file registrations
     def self.render_head_stylesheets(view_context = nil, namespace: nil)
       if namespace.nil? || namespace.to_s.strip.empty?
         request_files_snapshot = request_file_stylesheets.transform_values { |files| files.keys.dup }
@@ -578,16 +608,9 @@ module StyleCapsule
 
         return safe_string("") if all_stylesheets.empty?
 
-        rendered = all_stylesheets.map do |stylesheet|
-          if stylesheet[:type] == :inline
-            render_inline_stylesheet(stylesheet, view_context)
-          else
-            render_file_stylesheet(stylesheet, view_context)
-          end
-        end.join("\n").then { |s| safe_string(s) }
+        rendered = render_stylesheet_entries(all_stylesheets, view_context)
 
         clear_snapshotted_request_registrations(request_files_snapshot, request_inline_snapshot)
-        rendered
 
       else
         # Render specific namespace
@@ -598,24 +621,19 @@ module StyleCapsule
 
         return safe_string("") if stylesheets.empty?
 
-        rendered = stylesheets.map do |stylesheet|
-          if stylesheet[:type] == :inline
-            render_inline_stylesheet(stylesheet, view_context)
-          else
-            render_file_stylesheet(stylesheet, view_context)
-          end
-        end.join("\n").then { |s| safe_string(s) }
+        rendered = render_stylesheet_entries(stylesheets, view_context)
 
         clear_snapshotted_request_registrations_for_namespace(
           ns,
           file_paths: snapshotted_file_paths,
           snapshotted_inline_stylesheets: snapshotted_inline
         )
-        rendered
 
       end
+
+      rendered
     end
-    # rubocop:enable Metrics/AbcSize, Metrics/PerceivedComplexity
+    # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
     # Check if there are any registered stylesheets
     #
@@ -668,6 +686,7 @@ module StyleCapsule
     end
 
     # @api private
+    # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity -- clears snapshotted request registries per namespace
     def self.clear_snapshotted_request_registrations_for_namespace(namespace, file_paths:, snapshotted_inline_stylesheets:)
       ns = normalize_namespace(namespace)
 
@@ -694,6 +713,7 @@ module StyleCapsule
 
       self.inline_stylesheets = inline_registry
     end
+    # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
 
     # Inject pending request-scoped stylesheets into an HTML document before +</head>+.
     #
@@ -793,20 +813,24 @@ module StyleCapsule
       else
         # Fallback if no view context (logical path validated in .register)
         href = "/assets/#{file_path}.css"
-        tag_options = options.map { |k, v| %(#{k}="#{v}") }.join(" ")
+        tag_options = fallback_link_option_attributes(options)
         safe_string(%(<link rel="stylesheet" href="#{href}"#{" #{tag_options}" unless tag_options.empty?}>))
       end
     end
 
+    def self.fallback_link_option_attributes(options)
+      options.filter_map do |key, value|
+        name = key.to_s
+        next unless name.match?(FALLBACK_LINK_OPTION_NAME)
+
+        %(#{name}="#{CGI.escapeHTML(value.to_s)}")
+      end.join(" ")
+    end
+
     # Render an inline stylesheet
-    def self.render_inline_stylesheet(stylesheet, view_context)
-      # CSS content is already scoped when registered from components
-      # capsule_id is stored for reference but CSS is pre-processed
+    def self.render_inline_stylesheet(stylesheet, _view_context)
       css_content = stylesheet[:css_content]
-
-      # Construct HTML manually to avoid any HTML escaping issues
-      # CSS content should not be HTML-escaped as it's inside a <style> tag
-      # Using string interpolation with html_safe ensures CSS is not escaped
+      CssProcessor.reject_style_element_breakout!(css_content)
       safe_string(%(<style type="text/css">#{css_content}</style>))
     end
 
@@ -822,6 +846,7 @@ module StyleCapsule
       end
     end
 
-    private_class_method :render_file_stylesheet, :render_inline_stylesheet, :safe_string
+    private_class_method :render_file_stylesheet, :render_inline_stylesheet, :safe_string,
+      :fallback_link_option_attributes
   end
 end

data/lib/style_capsule/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StyleCapsule
-  VERSION = "2.0.1"
+  VERSION = "2.0.2"
 end

data/sig/style_capsule.rbs

@@ -9,6 +9,7 @@ module StyleCapsule
     def self.scope_selectors: (String css_string, String capsule_id, ?component_class: Class | String | nil) -> String
     def self.scope_with_nesting: (String css_string, String capsule_id, ?component_class: Class | String | nil) -> String
     def self.strip_comments: (String css) -> String
+    def self.reject_style_element_breakout!: (String | nil css_string) -> void
   end
 
   class CssFileWriter
@@ -24,6 +25,7 @@ module StyleCapsule
   # At runtime inherits Object when ActiveSupport::CurrentAttributes is unavailable.
   class StylesheetRegistry
     DEFAULT_NAMESPACE: Symbol
+    MAX_INLINE_CACHE_ENTRIES: Integer
 
     def self.normalize_namespace: (Symbol | String | nil namespace) -> Symbol
     def self.register: (String file_path, ?namespace: Symbol | String | nil, **Hash[untyped, untyped] options) -> void

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: style_capsule
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Andrei Makarov
@@ -15,7 +15,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -25,7 +25,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -35,7 +35,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -45,7 +45,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '6.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '9.0'
@@ -67,16 +67,16 @@ dependencies:
   name: polyrun
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 2.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.5.0
+        version: 2.2.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -105,48 +105,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '13'
-- !ruby/object:Gem::Dependency
-  name: simplecov
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.22'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-- !ruby/object:Gem::Dependency
-  name: simplecov-cobertura
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3'
 - !ruby/object:Gem::Dependency
   name: standard
   requirement: !ruby/object:Gem::Requirement
@@ -273,20 +231,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2'
-- !ruby/object:Gem::Dependency
-  name: memory_profiler
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1'
 - !ruby/object:Gem::Dependency
   name: rbs
   requirement: !ruby/object:Gem::Requirement
@@ -344,6 +288,11 @@ files:
 - LICENSE.md
 - README.md
 - SECURITY.md
+- docs/changelogs/20260904180000_audit-fixes.md
+- docs/changelogs/20260925094000_head-injection-bufferable-chunked.md
+- docs/dependencies/20260904174500_json-cve-2026-71847.md
+- docs/issues/20260904174500_engineering-and-dependency-audit.md
+- docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md
 - docs/non_rails_support.md
 - lib/style_capsule.rb
 - lib/style_capsule/asset_path.rb
@@ -383,14 +332,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.0'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Attribute-based CSS scoping for Phlex, ViewComponent, and ERB templates.
 test_files: []