...any Linux distribution and any OS X machine. This allows Ruby app developers to bundle these binaries with their Ruby app, so that they can distribute a single package to...
...You need to wrap them inside --cucumber-options option of parallel_cucumber. DISPLAY=:17 bundle exec parallel_cucumber --cucumber-options '--tags @solo' features See more details in the docs...
...you'd like to preview the crontab that whenever will deploy, run the following: bundle exec whenever This will print the cron syntax without modifying your local crontab...
When you load a with a nonce, that script can await import() additional sources from any hostname. The nonce is propagated automatically for the one purpose of importing more scripts. This is not related to strict-dynamic, which propagates nonces for any propose not limited to imports (e.g. inserting elements). Example We have a restrictive CSP that only allows nonces: Content-Security-Policy: default-src 'none'; script-src 'nonce-secret123' Our HTML loads script.js using that nonce: Our script.js imports other.js without a nonce: let other = await import('other.js') console.log("Look, script.js has imported %o", other) The import succeeds without a nonce, due to implicit nonce propagation. Why this is useful In modern build pipelines, code splitting (chunking) is implemented using dynamic imports. Nonce propagation allows us to use automatic chunking with restrictive, nonce-based CSPs without using strict-dynamic. E.g. esbuild automatically groups dynamically imported modules into chunks, and writes that chunk to disk. The compiled build has an await import('assets/chunk-NAXSMFJV.js'). There's no way to inject a nonce into that import(), but implicit nonce propagation still allows the request. Should I worry about this? It would require some truly strange code for user input to make it into an import() argument. I wouldn't lose sleep over this. Is this a browser bug? It is by design. Here are some sources: HTML Spec Section 8 (Web Application APIs) (search for "descendant script fetch options") Chromium test ensuring none propagation Firefox bug implementing nonce propagation CSP issue: Someone concerned about propagation being a vulnerability CSP issue: Proposal for import-src that went nowhere Are other CSP sources also propagated? No, only nonces. In particular host-based CSPs do not propagate trust. For example, you only allow scripts from our own host (no nonces): Content-Security-Policy: default-src 'none'; script-src 'self' Our HTML loads script.js from our own host: Our script.js imports other.js from a different host: let other = await import('https://other-host.com/other.js') This fails with a CSP violation: Executing inline script violates the following Content Security Policy directive 'script-src 'self''
Building application assets with esbuild is the new way to do it, and it's great, especially in combination with...
Option 1: JSON dump In config/webpack/environment.js you can get inspect environment which includes all webpack config options set for the...
Mise is a tool that can manage your Ruby and Node.js versions. It replaces rbenv and nvm in that regard...
Remember How to skip Sprockets asset compile during Capistrano deployment and Automatically skipping asset compilation when assets have not changed...
Angular-xeditable is a bundle of AngularJS directives that allows you to create editable elements. Such technique is also known as click-to-edit or edit-in-place.
Rails' I18n API keeps user-facing strings, formats and error messages in locale files. This lesson covers how to use...
Terser is a really good minifier ("compressor") for JavaScript code. I'm often surprised by the thoughtfulness of its compressed...
We recently migrated a Rails application from yarn to npm. We decided to go this step instead of upgrading to...
.../.rbenv/plugins/rbenv-aliases rbenv alias --auto Install rbenv-default-gems (set it up to automatically install bundler): git clone https://github.com/rbenv/rbenv-default-gems.git ~/.rbenv/plugins/rbenv-default-gems Then you can install the required ruby versions:
Webpack is the future. We're using it in our latest Rails applications. For tests, we want to compile assets...
Issue: You have an app using jsbundling-rails and esbuild. After deploy, the assets built by esbuild are missing in...
...Jeweler is deprecated these days because you can now cut gems more easily using Bundler. Easy mode Check out a repository from Github like git clone git@github.com:makandra/aegis.git
After upgrading to Rails 6.1.7.2 one of our apps printed a wall of warnings while booting: /var/www/app/shared/bundle/ruby/2.6.0/gems/net-protocol-0.2.1/lib/net/protocol.rb:68: warning: already...
Bundler::GemRequireError: There was an error while trying to load the gem 'mysql2'. Gem Load Error is: Incorrect MySQL client library version! This gem was compiled for 5.5.46 but the...
Installing SSL certificates usually implies additionally using intermediate certificates. If one of them is missing, some SSL client implementations might...
...Gemfile in the :development group: gem 'guard-livereload', :require => false gem 'rack-livereload' Run bundle install. Add the middleware, by adding the following to your config/environments/development.rb: config.middleware.insert_after(ActionDispatch::Static...
I was experiencing the following problem: It seems your ruby installation is missing psych (for YAML output). To eliminate this...
The httpclient gem comes with a custom SSL cert store. While an customizable, application-level cert store is great when...
If you turn on stylesheet caching, it might happen that stylesheets from different locations with different relative pathes will be...
The mysql2 gem in version 0.3.13 might break while compiling on older patch releases of Ruby 1.9.3 within rvm: