$ the-wire · showcase
Trilogy 2.13.2 closes an escape SQL injection, and Rails moves off cp932
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
Rails bumped trilogy to 2.13.2, which fixes a SQL injection in Trilogy#escape with multibyte encodings and drops the cp932 connection encoding, forcing the adapter's test suite onto ujis.
Bump trilogy to 2.13.2 and use ujis in test_character_set_connection_is_configured rails/rails
trilogy 2.13.2 fixes GHSA-744p-w4gc-m3gh, a SQL injection reachable through Trilogy#escape under multibyte encodings, and drops support for cp932 with ArgumentError: Unsupported encoding: cp932. The character set test now uses ujis, chosen because a multibyte character there never lands a byte where cp932 could.
Fix preloading `source_type` through with conditions on the through table rails/rails
Through associations reached via source_type now eager load their source with conditions on the through table, which previously raised because a polymorphic source cannot be eager loaded at all. ThroughReflection builds a typed non-polymorphic belongs_to as source_type_reflection once, ahead of freezing, so the through query only has to depend on that reflection.
Key the MessageVerifier HMAC once and dup it per message rails/rails
MessageVerifier now keys a single OpenSSL::HMAC on first use and signs each message with a copy of it, instead of having generate_digest construct a key object and signing context per message. Signatures are the same bytes and an unknown digest still raises at signing rather than in initialize; the pattern follows csrf_token_hmac.
Test that a logout during an in-flight request is not undone rails/activerecord-session_store
A test now pins the case where a slow request holding a loaded session finishes after a concurrent reset_session destroyed it: the stale copy, user_id included, must not be written back under a new record and log the user in again. Versions before 2.3.0 did exactly that, since write_session re-looked up the record and created one when missing; 2.3.0 fixed it as a side effect of reusing the orig...
ci: run Ruby 3.1 on ubuntu-24.04 rails/activerecord-session_store
ubuntu-latest began resolving to ubuntu-26.04, where ruby/setup-ruby has no Ruby 3.1 build, so the Ruby 3.1 / Rails 7.2 job failed with "Unavailable version 3.1.7 for ruby on ubuntu-26.04". The matrix now pins Ruby 3.1 to ubuntu-24.04 and leaves the rest on ubuntu-latest; the docs tidying in Action View and the RBI-to-RBS sig import round out a quiet day.
Action items
