Rails

Action Dispatch comes with host authorization, a security feature that can be enabled in production by populating config.hosts. The DNS rebinding attacks it protects against aren’t covered in the security guide. The guide should cover the relevant security issues, how to protect against them at the app level with config.hosts, and how reverse

Estimation - 1

On reports page we have sections for First response time and Resolution Time. Which plots a graph with time series on the Y axis. But it mentions no unit for the axis. We need to mention the unit on the axis

<img width="1012" alt="Screenshot 2021-08-25 at 11 27 25 PM" src="https://user-images.githubusercontent.com/1277421/130841683-cffbd1a4-6ee7-4c3c-8ed4-864961e7b22d.png"

Problem this feature will solve

Given:

FactoryBot.define do
  user(factory: :author) { association(:author, role: role) }
end

DefinitionProxy#method_missing will declare the [association](https://github.com/thoughtbot/factory_bot/blob

I'm sorry to post an issue that is missing crucial evidence, but some debugging of a recent config loading bug makes me suspect that the react-rails railtie.rb may be modifying the load order of initializers, and preventing the values in Rails.application.config being as expected.

Whether this happens or not appears to be partly dependent on where in the Gemfile the react-rails gem is l

I'm not sure if this is the right approach and maybe I've not understood this new part of the pipeline, yet, but:

Suppose, the major part of the app code lives inside a rails engine including all javascripts. And there are several main apps using that engine. The main apps only contain some layout changes and some minor patches.

Therefore, in order to integrate the webpacker gem into this se

We have a problem: if files aren't loaded/required we don't have branch data. If they are added through track_files we give it 0/0 branches which we show as 100% coverage (all possible branches are covered).

That math is "wrong" though here because there are branches but we don't know what they are. We should probably count total branches here as "unkown" and establish that in our "math unive

A while ago, we converted API controller specs into requests specs, see #2052. But those specs still have references from their old "life" that we can clean a little bit with a small effort.

In fact, their filenames still have the _controller_ part, which makes no sense now. Eg. solidus/api/spec/requests/spree/api/addresses_controller_spec.rb

Also, they contain references to the previo