Commit Graph

20303 Commits

Author SHA1 Message Date
dependabot[bot]
0ae4b693c7 Bump autoprefixer-rails from 10.4.19.0 to 10.4.21.0
Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 10.4.19.0 to 10.4.21.0.
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/10.4.19.0...10.4.21.0)

---
updated-dependencies:
- dependency-name: autoprefixer-rails
  dependency-version: 10.4.21.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-06-04 12:29:25 +00:00
Sebastia
28847bfed0 Merge pull request #5977 from consuldemocracy/dependabot/bundler/faraday-retry-2.3.1
Bump faraday-retry from 2.2.1 to 2.3.1
2025-06-04 14:24:25 +02:00
dependabot[bot]
b02901e0e1 Bump faraday-retry from 2.2.1 to 2.3.1
Bumps [faraday-retry](https://github.com/lostisland/faraday-retry) from 2.2.1 to 2.3.1.
- [Release notes](https://github.com/lostisland/faraday-retry/releases)
- [Changelog](https://github.com/lostisland/faraday-retry/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lostisland/faraday-retry/compare/v2.2.1...v2.3.1)

---
updated-dependencies:
- dependency-name: faraday-retry
  dependency-version: 2.3.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-06-02 15:28:52 +00:00
Sebastia
5651cfa358 Merge pull request #5842 from consuldemocracy/dependabot/bundler/capistrano3-puma-6.0.0
Bump capistrano3-puma from 5.2.0 to 6.0.0
2025-06-02 16:46:19 +02:00
Sebastia
afae59e1d4 Merge pull request #5948 from consuldemocracy/dependabot/bundler/image_processing-1.14.0
Bump image_processing from 1.13.0 to 1.14.0
2025-06-02 16:45:47 +02:00
dependabot[bot]
55acd50232 Bump image_processing from 1.13.0 to 1.14.0
Bumps [image_processing](https://github.com/janko/image_processing) from 1.13.0 to 1.14.0.
- [Changelog](https://github.com/janko/image_processing/blob/master/CHANGELOG.md)
- [Commits](https://github.com/janko/image_processing/compare/v1.13.0...v1.14.0)

---
updated-dependencies:
- dependency-name: image_processing
  dependency-version: 1.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-06-02 13:54:35 +00:00
Sebastia
8299769957 Merge pull request #5946 from consuldemocracy/dependabot/bundler/redcarpet-3.6.1
Bump redcarpet from 3.6.0 to 3.6.1
2025-06-02 15:51:44 +02:00
taitus
4cd2d2f794 Define Puma log paths for consistency with installer
capistrano3-puma v6.0.0 updated the defaults for puma_access_log and
puma_error_log to use a single file based on puma_env, like:

> set_if_empty :puma_access_log, -> { File.join(shared_path, 'log', "#{fetch(:puma_env)}.log") }
> set_if_empty :puma_error_log, -> { File.join(shared_path, 'log', "#{fetch(:puma_env)}.log") }

However, our installer expect:
- puma_access.log
- puma_error.log

To keep the existing behavior aligned with the installer, we define
the Puma log paths in config/deploy.rb
2025-06-02 15:39:04 +02:00
taitus
19ab1139b9 Define puma_service_unit_name for consistency with installer
In capistrano3-puma v6.0.0, the default for 'puma_service_unit_name' changed to:
>  "#{application}_puma_#{stage}"

But the installer uses the older convention:
> "puma_#{application}_#{stage}"

To ensure consistency and avoid unit name conflicts when switching between
versions or deploying older branches, we now define the variable explicitly
in config/deploy.rb:

> set :puma_service_unit_name, -> { "puma_#{fetch(:application)}_#{fetch(:stage)}" }
2025-06-02 15:39:01 +02:00
taitus
d1693f06fc Keep After=network.target in Puma systemd unit
We keep After=network.target instead of the new default
After=syslog.target network.target introduced in capistrano3-puma 6.0.0.

Our Puma service doesn't depend on syslog availability because it writes
logs directly to files using:

> StandardOutput=append:...
> StandardError=append:...

So the syslog.target dependency is unnecessary in our case.
2025-06-02 15:38:34 +02:00
taitus
b99d2e43bb Keep SyslogIdentifier=puma for compatibility
We keep using SyslogIdentifier=puma instead of the default
value from capistrano3-puma 6.0.0, which is based on
puma_service_unit_name (usually "<app>_puma_<env>").

This avoids introducing a new config variable in the installer
and is enough for our current use case, where we don't run
multiple environments on the same server.
2025-06-02 15:38:34 +02:00
taitus
7712e7a3cf Set WatchdogSec=0 in Puma systemd unit template
The original template sets WatchdogSec=10, which causes systemd to kill
Puma if it remains silent for more than 10 seconds.

This commit changes WatchdogSec to 0 in our custom puma.service.erb,
disabling the watchdog feature. This prevents unwanted restarts and
avoids errors like:
> consul_puma_staging.service: Failed with result 'watchdog'
2025-06-02 15:38:34 +02:00
taitus
034ecfeacd Copy Puma systemd unit template from capistrano3-puma
This commit copies the default puma.service.erb template from the
capistrano3-puma gem into lib/capistrano/templates. This allows us to
customize the generated systemd unit file during deploy.

Note that we are also removing the `:puma_conf` variable from `config/deploy.rb`,
as the new ExecStart line in the systemd template (based on capistrano3-puma 6.0.0)
does not rely on a separate Puma config file. The command now directly invokes:

  ExecStart=<%= expanded_bundle_command %> exec puma -e <%= fetch(:puma_env) %>

This replaces the older format used in 5.2.0:

  ExecStart=<%= expanded_bundle_command %> exec --keep-file-descriptors puma -C <%= fetch(:puma_conf) %>

which required explicitly setting the Puma config path.
2025-06-02 15:33:36 +02:00
dependabot[bot]
164c3952df Bump redcarpet from 3.6.0 to 3.6.1
Bumps [redcarpet](https://github.com/vmg/redcarpet) from 3.6.0 to 3.6.1.
- [Release notes](https://github.com/vmg/redcarpet/releases)
- [Changelog](https://github.com/vmg/redcarpet/blob/master/CHANGELOG.md)
- [Commits](https://github.com/vmg/redcarpet/compare/v3.6.0...v3.6.1)

---
updated-dependencies:
- dependency-name: redcarpet
  dependency-version: 3.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-06-02 13:15:36 +00:00
taitus
db361d88f1 Restore puma_bind setting removed in capistrano3-puma 6.0.0
In earlier versions of capistrano3-puma, the puma_bind has a default value to:
unix://.../tmp/sockets/puma.sock via set_if_empty in lib/capistrano/puma.rb.

This default was removed in 6.0.0, requiring to explicitly set :puma_bind in deploy.rb.

This caused the following runtime error during deploy:
> Failed to restart consul_puma_staging.service: Unit
> consul_puma_staging.socket has a bad unit file setting.
2025-05-30 15:56:28 +02:00
taitus
cd61228790 Replace removed Puma systemd tasks by supported equivalents
capistrano3-puma 6.0.0 removed the `puma:systemd:config` and
`puma:systemd:enable` tasks. This commit updates the deploy script to use
the new `puma:install` and `puma:enable` tasks instead.
2025-05-30 15:56:28 +02:00
dependabot[bot]
cd72bf42da Bump capistrano3-puma from 5.2.0 to 6.0.0
Note we aren't updating concurrent-ruby (which Dependabot would have
updated) due to an incompatibility with Rails 7.0.

Bumps [capistrano3-puma](https://github.com/seuros/capistrano-puma) from 5.2.0 to 6.0.0.
- [Changelog](https://github.com/seuros/capistrano-puma/blob/master/CHANGELOG.md)
- [Commits](https://github.com/seuros/capistrano-puma/compare/v5.2.0...v6.0.0)

---
updated-dependencies:
- dependency-name: capistrano3-puma
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-30 15:56:28 +02:00
Sebastia
c05f027cfa Merge pull request #5904 from consuldemocracy/dependabot/npm_and_yarn/stylistic/stylelint-plugin-3.1.2
Bump @stylistic/stylelint-plugin from 3.1.1 to 3.1.2
2025-05-30 10:13:31 +02:00
dependabot[bot]
1a3cdb3cd2 Bump @stylistic/stylelint-plugin from 3.1.1 to 3.1.2
Bumps [@stylistic/stylelint-plugin](https://github.com/stylelint-stylistic/stylelint-stylistic) from 3.1.1 to 3.1.2.
- [Release notes](https://github.com/stylelint-stylistic/stylelint-stylistic/releases)
- [Changelog](https://github.com/stylelint-stylistic/stylelint-stylistic/blob/main/CHANGELOG.md)
- [Commits](https://github.com/stylelint-stylistic/stylelint-stylistic/compare/v3.1.1...v3.1.2)

---
updated-dependencies:
- dependency-name: "@stylistic/stylelint-plugin"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-29 12:52:27 +00:00
Sebastia
abc0083ef1 Merge pull request #5902 from consuldemocracy/dependabot/npm_and_yarn/stylelint-scss-6.11.1
Bump stylelint-scss from 6.11.0 to 6.12.0
2025-05-29 14:51:06 +02:00
Sebastia
923333b8b1 Merge pull request #5870 from consuldemocracy/dependabot/bundler/paranoia-3.0.1
Bump paranoia from 3.0.0 to 3.0.1
2025-05-26 15:55:14 +02:00
dependabot[bot]
663b92ba1d Bump stylelint-scss from 6.11.0 to 6.11.1
Bumps [stylelint-scss](https://github.com/stylelint-scss/stylelint-scss) from 6.11.0 to 6.11.1.
- [Release notes](https://github.com/stylelint-scss/stylelint-scss/releases)
- [Changelog](https://github.com/stylelint-scss/stylelint-scss/blob/master/CHANGELOG.md)
- [Commits](https://github.com/stylelint-scss/stylelint-scss/compare/v6.11.0...v6.11.1)

---
updated-dependencies:
- dependency-name: stylelint-scss
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-26 13:44:41 +00:00
dependabot[bot]
39fd024b22 Bump paranoia from 3.0.0 to 3.0.1
Bumps [paranoia](https://github.com/rubysherpas/paranoia) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/rubysherpas/paranoia/releases)
- [Changelog](https://github.com/rubysherpas/paranoia/blob/core/CHANGELOG.md)
- [Commits](https://github.com/rubysherpas/paranoia/compare/v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: paranoia
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-26 13:25:34 +00:00
Sebastia
f607048fd0 Merge pull request #5862 from consuldemocracy/dependabot/bundler/ahoy_matey-5.3.0
Bump ahoy_matey from 5.2.0 to 5.4.0
2025-05-26 15:24:02 +02:00
Sebastia
932222f8ea Merge pull request #5837 from consuldemocracy/dependabot/bundler/caxlsx-4.2.0
Bump caxlsx from 4.1.0 to 4.2.0
2025-05-26 15:11:46 +02:00
dependabot[bot]
252780635d Bump ahoy_matey from 5.2.0 to 5.3.0
Bumps [ahoy_matey](https://github.com/ankane/ahoy) from 5.2.0 to 5.3.0.
- [Changelog](https://github.com/ankane/ahoy/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/ahoy/compare/v5.2.0...v5.3.0)

---
updated-dependencies:
- dependency-name: ahoy_matey
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 14:17:45 +00:00
Sebastia
9bad768ccb Merge pull request #5831 from consuldemocracy/dependabot/bundler/airbrake-13.0.5
Bump airbrake from 13.0.4 to 13.0.5
2025-05-23 16:12:30 +02:00
dependabot[bot]
a1f3cedb44 Bump caxlsx from 4.1.0 to 4.2.0
Bumps [caxlsx](https://github.com/caxlsx/caxlsx) from 4.1.0 to 4.2.0.
- [Changelog](https://github.com/caxlsx/caxlsx/blob/master/CHANGELOG.md)
- [Commits](https://github.com/caxlsx/caxlsx/compare/v4.1.0...v4.2.0)

---
updated-dependencies:
- dependency-name: caxlsx
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 14:06:53 +00:00
Sebastia
aa9ab0f079 Merge pull request #5804 from consuldemocracy/dependabot/bundler/delayed_job_active_record-4.1.11
Bump delayed_job_active_record from 4.1.10 to 4.1.11
2025-05-23 16:04:36 +02:00
Sebastia
87c1632950 Merge pull request #5799 from consuldemocracy/dependabot/bundler/audited-5.8.0
Bump audited from 5.7.0 to 5.8.0
2025-05-23 15:44:15 +02:00
dependabot[bot]
814a12a048 Bump delayed_job_active_record from 4.1.10 to 4.1.11
Bumps [delayed_job_active_record](https://github.com/collectiveidea/delayed_job_active_record) from 4.1.10 to 4.1.11.
- [Release notes](https://github.com/collectiveidea/delayed_job_active_record/releases)
- [Commits](https://github.com/collectiveidea/delayed_job_active_record/compare/v4.1.10...v4.1.11)

---
updated-dependencies:
- dependency-name: delayed_job_active_record
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 13:44:15 +00:00
dependabot[bot]
d35dcf4725 Bump audited from 5.7.0 to 5.8.0
Bumps [audited](https://github.com/collectiveidea/audited) from 5.7.0 to 5.8.0.
- [Changelog](https://github.com/collectiveidea/audited/blob/main/CHANGELOG.md)
- [Commits](https://github.com/collectiveidea/audited/compare/v5.7.0...v5.8.0)

---
updated-dependencies:
- dependency-name: audited
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 13:23:36 +00:00
Sebastia
2156fe5e27 Merge pull request #5785 from consuldemocracy/dependabot/bundler/pg-1.5.9
Bump pg from 1.5.8 to 1.5.9
2025-05-23 15:22:06 +02:00
Sebastia
32b5558bd3 Merge pull request #5939 from consuldemocracy/dependabot/bundler/view_component-3.22.0
Bump view_component from 3.11.0 to 3.23.1
2025-05-23 15:09:59 +02:00
dependabot[bot]
eac1776a1c Bump pg from 1.5.8 to 1.5.9
Bumps [pg](https://github.com/ged/ruby-pg) from 1.5.8 to 1.5.9.
- [Changelog](https://github.com/ged/ruby-pg/blob/master/History.md)
- [Commits](https://github.com/ged/ruby-pg/compare/v1.5.8...v1.5.9)

---
updated-dependencies:
- dependency-name: pg
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 12:56:14 +00:00
dependabot[bot]
56d0cbe690 Bump view_component from 3.11.0 to 3.22.0
Bumps [view_component](https://github.com/viewcomponent/view_component) from 3.11.0 to 3.22.0.
- [Release notes](https://github.com/viewcomponent/view_component/releases)
- [Changelog](https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md)
- [Commits](https://github.com/viewcomponent/view_component/compare/v3.11.0...v3.22.0)

---
updated-dependencies:
- dependency-name: view_component
  dependency-version: 3.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-23 11:36:51 +00:00
Sebastia
d0b1f077eb Merge pull request #5769 from consuldemocracy/dependabot/bundler/wicked_pdf-2.8.2
Bump wicked_pdf from 2.8.1 to 2.8.2
2025-05-21 16:55:14 +02:00
dependabot[bot]
b930a40a4b Bump wicked_pdf from 2.8.1 to 2.8.2
Bumps [wicked_pdf](https://github.com/mileszs/wicked_pdf) from 2.8.1 to 2.8.2.
- [Release notes](https://github.com/mileszs/wicked_pdf/releases)
- [Changelog](https://github.com/mileszs/wicked_pdf/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mileszs/wicked_pdf/commits)

---
updated-dependencies:
- dependency-name: wicked_pdf
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-05-21 12:14:51 +00:00
Javi Martín
3e9d0c04bd Merge pull request #5916 from consuldemocracy/node20
Update Node.js from 18.20.3 to 20.19.2
2025-05-21 12:48:24 +02:00
Javi Martín
372a1dda3b Update Node.js from 18.20.3 to 20.19.2
Node 18 is reaching its end of life on April 30th, 2025, so we're
updating in order to keep using a maintained version after that date.
2025-05-20 18:17:35 +02:00
Javi Martín
1d6f69cfab Merge pull request #5915 from consuldemocracy/ruby3.3
Upgrade Ruby to version 3.3.8
2025-05-20 18:13:20 +02:00
Javi Martín
096023dffb Upgrade Ruby to version 3.3.8 2025-05-20 15:56:13 +02:00
Javi Martín
078ddb7717 Merge pull request #5496 from consuldemocracy/rails7.1
Upgrade to Rails 7.1
2025-05-20 15:54:44 +02:00
Javi Martín
5a5c0a716b Use Rails 7.1 defaults and overwrite them
We're still using YAML to serialize the legislation_annotations ranges
column. I'm not sure whether changing the serializer can have
consequences on existing data, and I'm not sure which serializer we
should provide instead. Quoting the Rails configuration guide [1]:

> Unfortunately there isn't really any suitable defaults available in
> Ruby's standard library. JSON could work as a format, but the json
> gems will cast unsupported types to strings which may lead to bugs.

[1] https://guides.rubyonrails.org/v7.1/configuring.html#config-active-record-default-column-serializer
2025-05-20 15:38:52 +02:00
Javi Martín
3432c385bc Use an HTML5 parser in test helpers
I think this doesn't affect us because we use RSpec instead of Rails
test classes. In any case, if it ever affects us, we'll get notified
when a test fails.
2025-05-20 15:38:52 +02:00
Javi Martín
140619ff00 Log exceptions as :error instead of :fatal
As mentioned in the pull request introducing this change [1]:

> FATAL is documented in the Ruby Logger docs as being for "An
> unhandleable error that results in a program crash.", which does not
> really apply to this case since DebugExceptions is handling the error.

So we're using the new default value, which makes more sense.

[1] Pull request 48575 in https://github.com/rails/rails
2025-05-20 15:38:52 +02:00
Javi Martín
cbf11c2514 Use Rails::HTML5::Sanitizer when sanitizing HTML
Since we use a version of Loofah supporting HTML5 since db2d0bb80, the
`Rails::HTML::Sanitizer.best_supported_vendor` method will return the
HTML5 sanitizer. As mentioned in the pull request introducting this
change [1], the libxml2 maintainer wrote:

> it's still a bad idea to use a 20+ years old, unmaintained HTML 4
> parser to sanitize input for the modern web

So we're going with the new default sanitizer.

Note we aren't uncommenting the `action_text.sanitizer_vendor` option
because we don't use Action Text and so it doesn't affect us , and
uncommeting it will raise an error.

Also note we need to change one test because the new sanitizer handles
whitespace slightly differently.

[1] Pull request 48293 in https://github.com/rails/rails
2025-05-20 15:38:52 +02:00
Javi Martín
0dec47c055 Use just the banner title as the banner link text
We were using an <a> tag wrapping the whole content of the banner in
order to make the whole banner clickable. However, that made the text of
the link less concise, affecting people using screen readers. So,
instead, we're using the `card` mixin, which we introduced in commit
f285dfcba.

We're making this change now because the HTML5 Sanitizer that we're
about to enable in the next commit was handling the whitespace inside
the banner differently, causing one test to fail, and we didn't find a
different way to fix it.
2025-05-20 15:38:52 +02:00
Javi Martín
8dcf66886e Fix broken tags in JavaScript injection tests
This was introduced in commit 5ecbe01d4, probably by accident while
copying a suggestion made in the pull request for that change [1]. This
broken tag introduces issues when sanitizing the HTML text with an HTML5
sanitizer, which we will start using in a couple of commits.

[1] https://github.com/consuldemocracy/consuldemocracy/pull/462#issuecomment-139309289
2025-05-20 15:38:52 +02:00
Javi Martín
82c3c6646d Use Rails 7.1 cache format
Just like we mentioned in commit 001eee3d6, according to the Rails
configuration guide [1], with this format, Rails serializes cache
entries more efficiently. Most importantly:

> All formats are backward and forward compatible, meaning cache entries
> written in one format can be read when using another format. This
> behavior makes it easy to migrate between formats without invalidating
> the entire cache.

[1] https://guides.rubyonrails.org/v7.1/configuring.html#config-active-support-cache-format-version
2025-05-20 15:38:52 +02:00