v0.4.2

v0.4.2 — the dashboard renders on every host

Changed

• No library changes. Development-dependency and CI bumps (sqlite3 2.9.6 — clears GHSA-mwm8-39rw-8826 in the dummy app, thruster 0.1.25, brakeman 8.0.6, CodeQL and release-gem action pins).
• Release housekeeping: 0.4.1 shipped to RubyGems with the dashboard CSP fix, but its GitHub release page was lost to the repository's immutable-release rule during the cut and its tag points at a pre-squash commit (tree-identical to main). 0.4.2 consolidates: this tag is on main and this release page carries 0.4.1's notes below.

From 0.4.1 (RubyGems-only release, same code)

Fixed

• Stop the dashboard's Content Security Policy from blocking the host application's own stylesheets, scripts, and self-hosted webfonts. The 0.4.0 policy declared default-src 'none' with script-src/style-src reduced to the per-request nonce, but Rails only stamps that nonce onto stylesheet_link_tag/javascript_include_tag when the host application sets content_security_policy_nonce_auto (off by default, and not something an engine can enable for its host). Any application rendering its normal layout on engine pages got an unstyled, inert dashboard with no server-side error. The default policy now trusts same-origin scripts, styles, and fonts, adds font-src, and allows https: images, while keeping the nonce, default-src 'self', base-uri 'none', object-src 'none', frame-ancestors 'none', frame-src 'none', form-action 'self', and connect-src 'self'.
• Stop generated install and authentication-index migrations from carrying an unreachable migration_version instance method; the generator already renders the Active Record version into each migration superclass.

Added

• config.dashboard_content_security_policy selects the policy the mounted dashboard declares: :default (new default, hardened but compatible with a normal host layout), :strict (the 0.4.0 nonce-only policy, unchanged), or false/nil to declare nothing and leave the host application's policy alone. The setting is resolved per request and validated on assignment.

Upgrade notes

• Applications that relied on the 0.4.0 nonce-only dashboard policy should set config.dashboard_content_security_policy = :strict to keep it. That policy requires a layout that serves nothing un-nonced on engine pages; the gem's built-in layout satisfies it, and host layouts additionally need config.content_security_policy_nonce_auto = true.

Maintenance

• Move SimpleCov startup/reporting into the test helper and replace deprecated filtering/tracking APIs so the enforced line and branch coverage gates remain compatible with future SimpleCov releases.

What we learned

A gem cannot enable content_security_policy_nonce_auto for its host, so a nonce-only policy is only correct when the host layout serves nothing un-nonced — which almost no host does. The engine's own bundled layout is nonce-clean, so the gem's suite never saw the failure; it only surfaced in a host rendering its normal layout, where the dashboard came up with no CSS, no fonts, no JS and no server-side error. Rule: an engine's default policy must be safe under a normal host layout; the strict variant is opt-in.