where_is_waldo 0.1.7 → 0.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0daa39b5301b15f20943db48e10565bb18c7a33e12917551d6f9bea954311e20
-  data.tar.gz: 4ffb5a45341e48e9d4bc5f8dd08c9cf5a970dc0939de4e6e869d8a8bfa14c99b
+  metadata.gz: 96f9fb4253fa91bfaa947711aff7e9de6cf6511029c34fe4d24bcaa92be9958d
+  data.tar.gz: f441dacf17ca081d1974d08e3eb3460dce8ca5423772689c72e730c58746b8e9
 SHA512:
-  metadata.gz: 59dfa8c1cfb8c29b53dde974da7db16a3f8c16fd4ba24e7adcf1dedac260ec6bad7618d718e161dd7d11b466a3f06b87a8168cabaf0deabeca21c0d00ae71ba0
-  data.tar.gz: 27ad4732f42cc5257c1c9f39cbff46a6d21570e1c7c8fb695da6a9caabdf9ff92742f3e82633b793dfdce786beff64e8933839be6c3d850b5465d31326a86859
+  metadata.gz: df11e85496b2ae55c928695e1dad936a82b0d0b3abbcf8df7160932cf221f0ab4ab7c1cb8830cc5b710bbbab029cb82dfdb6d719292b0dc1863767151baf406c
+  data.tar.gz: 3412d9fd5475df5fe17a29c8dbd910f3c920db8260971492aa479ab23797d98d0c726549328aa27bdbef675646ae750f948c30ac810c96eaadddf6d8e1badcdf

data/CHANGELOG.md

@@ -3,6 +3,56 @@
 Notable changes to where_is_waldo. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com/).
 
+## 0.1.9
+
+Security/maintenance release — dependency bumps only, no library code changes.
+
+### Security
+
+- **Rails 8.1.3.1** — fixes the ActiveStorage RCE (CVE-2026-66066).
+- **sqlite3 2.9.5** — fixes two use-after-free issues.
+
+### Changed
+
+- Bumped transitive/build dependencies: `undici` 7.28.0 → 7.29.0,
+  `rollup` 4.62.2 → 4.62.4, `js-yaml` → 4.3.1 and `postcss` → 8.5.26
+  (via resolutions).
+
+## 0.1.8
+
+### Fixed
+
+- **`WhereIsWaldo.subject_online?`, `.sessions_for_subject`, `.session_status`
+  no longer raise `uninitialized constant` when called.** These three methods
+  were defined with ActiveSupport's `delegate :method, to: :PresenceService`
+  inside a `class << self` block. `delegate` generates the method body via
+  `class_eval` with a **string**, and a string-eval'd body's `Module.nesting`
+  is just the target class — for the WhereIsWaldo module's singleton class,
+  that's `[#<Class:WhereIsWaldo>]`, *without* the enclosing `WhereIsWaldo`.
+  Constant lookup for `PresenceService` inside the generated method then
+  couldn't walk up to the enclosing module and failed with:
+
+  ```
+  uninitialized constant #<Class:WhereIsWaldo>::PresenceService (NameError)
+  ```
+
+  Replaced the three `delegate` calls with plain `def` methods matching the
+  pattern of the other class methods on the module (`.connect`, `.online`,
+  `.online_ids`, `.cleanup`, etc.), which inherit the correct lexical scope
+  and resolve `PresenceService` as `WhereIsWaldo::PresenceService`.
+
+  Waldo's own internal code (`PresenceChannel`, `Roster`) references
+  `PresenceService` at its fully-qualified name from correctly-scoped
+  modules, so this bug never affected the actual presence flow — only host
+  code that calls the top-level convenience wrappers. Affects every
+  released version up to and including `0.1.7`.
+
+### Tests
+
+- Added `spec/where_is_waldo_spec.rb` exercising every top-level convenience
+  method at the public boundary — the only place a `class_eval`-scope
+  regression in the wrapper can be caught, since internal callers bypass it.
+
 ## 0.1.7
 
 ### Added

data/README.md

@@ -238,7 +238,8 @@ See `docs/PRESENCE_ROSTER_PLAN.md` for the full mode matrix and tradeoffs.
 their live sessions (multiple browser tabs, mobile, etc.):
 
 ```
-{ id: 7, status: "active", devices: { web: "idle", mobile: "active" } }
+{ id: 7, status: "active", devices: { web: "idle", mobile: "active" },
+  last_activity: "2026-07-27T15:23:04Z" }
 ```
 
 - `status` — highest activity across devices (the "active anywhere?" answer):
@@ -248,6 +249,11 @@ their live sessions (multiple browser tabs, mobile, etc.):
   - `offline` — no live sessions
 - `devices[platform]` — that platform's own status (answers "active on
   **mobile**?" vs. "active at all?").
+- `last_activity` — ISO8601 timestamp of the most recent input across **all**
+  the subject's live sessions (`null` when offline). The roster only
+  broadcasts on `status` transitions, so subtract against your own clock to
+  derive seconds-idle and apply client-side thresholds without a server
+  `timeout` change: `(Date.now() - new Date(m.last_activity)) / 1000`.
 
 #### Configure
 

data/VERSION

@@ -1 +1 @@
-0.1.7
+0.1.9

data/lib/where_is_waldo.rb

@@ -55,11 +55,25 @@ module WhereIsWaldo
       PresenceService.all_online_ids(timeout: timeout)
     end
 
-    delegate :subject_online?, to: :PresenceService
+    # NOTE: don't use ActiveSupport's `delegate` here. `delegate` generates
+    # the method via `class_eval` with a STRING, and a string-eval'd body's
+    # `Module.nesting` is just the target class — for a `class << self` inside
+    # `module WhereIsWaldo`, that's `[#<Class:WhereIsWaldo>]`, WITHOUT
+    # `WhereIsWaldo` itself. Constant lookup for `PresenceService` inside the
+    # generated method then can't walk up to the enclosing module and raises
+    # `uninitialized constant #<Class:WhereIsWaldo>::PresenceService`. A plain
+    # `def` inherits the enclosing lexical nesting and resolves correctly.
+    def subject_online?(...)
+      PresenceService.subject_online?(...)
+    end
 
-    delegate :sessions_for_subject, to: :PresenceService
+    def sessions_for_subject(...)
+      PresenceService.sessions_for_subject(...)
+    end
 
-    delegate :session_status, to: :PresenceService
+    def session_status(...)
+      PresenceService.session_status(...)
+    end
 
     def cleanup(timeout: nil)
       PresenceService.cleanup(timeout: timeout)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: where_is_waldo
 version: !ruby/object:Gem::Version
-  version: 0.1.7
+  version: 0.1.9
 platform: ruby
 authors:
 - Scott Gibson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-27 00:00:00.000000000 Z
+date: 2026-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails