Hmm.. ~1 month out from starting alpha testing of my app, do I update now, or later. Decisions..
Rails 4.0: Release Candidate 1 released
11–20 of 58 posts
Re: Rails 4.0: Release Candidate 1 released
#12Hmm.. ~1 month out from starting alpha testing of my app, do I update now, or later. Decisions..
If you're coming from 3.1 or 3.2, I say go for it. I have brought a couple applications from 3.2 -> 4.0rc and both had specs fully passing within 30 minutes of the switch. git checkout -b rails4, it won't hurt to try.
Re: Rails 4.0: Release Candidate 1 released
#13This is a huge step forward to a big release! I myself built a little app with the RC, Ruby 2.0, and deployed it to Heroku yesterday, and that whole stack works just fine. _Please_ give the RC a try, and file any issues you have on the tracker: https://github.com/rails/rails/issues?state=open There's nothing more frustrating as a maintainer than getting regression reports the day after you release when you've done tw…
The issue I keep running into when testing the RCs with larger apps is the number of gems that have strict dependencies on older versions of activesupport, etc.
I am wading through my Gemfile (over 200 gems counting direct and indirect dependencies) at the moment trying to give the RC a shot, but it's going to be difficult to justify spending much more time on it, unfortunately.
Re: Rails 4.0: Release Candidate 1 released
#14This is a huge step forward to a big release! I myself built a little app with the RC, Ruby 2.0, and deployed it to Heroku yesterday, and that whole stack works just fine. _Please_ give the RC a try, and file any issues you have on the tracker: https://github.com/rails/rails/issues?state=open There's nothing more frustrating as a maintainer than getting regression reports the day after you release when you've done tw…
The issue I keep running into when testing the RCs with larger apps is the number of gems that have strict dependencies on older versions of activesupport, etc. I am wading through my Gemfile (over 200 gems counting direct and indirect dependencies) at the moment trying to give the RC a shot, but it's going to be difficult to justify spending much more time on it, unfortunately.
Can you tell me which gems you're having problems with? I'll send a bunch of pull requests this evening.
Re: Rails 4.0: Release Candidate 1 released
#15This is a huge step forward to a big release! I myself built a little app with the RC, Ruby 2.0, and deployed it to Heroku yesterday, and that whole stack works just fine. _Please_ give the RC a try, and file any issues you have on the tracker: https://github.com/rails/rails/issues?state=open There's nothing more frustrating as a maintainer than getting regression reports the day after you release when you've done tw…
How can I see if the issue[1] that caused GitHub tons of issue[2] was fixed on this RC?
Re: Rails 4.0: Release Candidate 1 released
#16Earlier quoted context omitted.
The issue I keep running into when testing the RCs with larger apps is the number of gems that have strict dependencies on older versions of activesupport, etc. I am wading through my Gemfile (over 200 gems counting direct and indirect dependencies) at the moment trying to give the RC a shot, but it's going to be difficult to justify spending much more time on it, unfortunately.
Can you tell me which gems you're having problems with? I'll send a bunch of pull requests this evening.
Sure - so far I've had to update postgres_ext, rails_autolink, redis-rails (part of redis-store package), and marginalia.
I'm currently fighting with redis-rails in particular, as bundler doesn't seem to be seeing the dependency change in a nested gem.
Re: Rails 4.0: Release Candidate 1 released
#17This is a huge step forward to a big release! I myself built a little app with the RC, Ruby 2.0, and deployed it to Heroku yesterday, and that whole stack works just fine. _Please_ give the RC a try, and file any issues you have on the tracker: https://github.com/rails/rails/issues?state=open There's nothing more frustrating as a maintainer than getting regression reports the day after you release when you've done tw…
How can I see if the issue[1] that caused GitHub tons of issue[2] was fixed on this RC? [1] https://github.com/rails/rails/issues/9813 [2] https://github.com/blog/1440-today-s-email-incident
Here's how, normally:
1) You take the commit referenced, like this: https://github.com/rails/rails/commit/f980289fd2c1b9073a94b5...
2) Right below the title, GitHub shows you which branches the commit is in. As you can see with that commit (the one that caused the problem), it's only in 3-2-stable. Therefore, not being in master, it wasn't ever in Rails 4, only in Rails 3.2.
Since this was a security issue, it's possible that the commit was different for Rails 4. So we load up the page for the referenced CVE (cve-2013-1854): http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1854
That page links to the announcement email: https://groups.google.com/group/ruby-security-ann/msg/34e0d7...
The announcement email discusses which versions were affected:
> Versions Affected: 3.2.x, 3.1.x, 2.3.x
But, since Rails 4 wasn't yet released, it wouldn't be there.
To be 100% sure, you can grab a copy of the source, and grep the git log for the CVE number. That brings up this commit: https://github.com/rails/rails/commit/2392535f4085d88186097e...
This commit is in master and v4.0.0rc1, as GitHub shows.
I am not mega super updated on the status of this issue, as I'm not on the security team, but given that it's still open and marked as 'regression,' I would not be sure that this was fixed.
That said, this particular bug is a complex interaction between components, and people haven't mentioned if it affects master or not. Therefore it's possible that even though the fix didn't make it into 3-2-stable yet, it may not have affected master.
So, at the end of all that, I guess the answer is "I'm not 100% sure, I'd ping tenderlove," but I hope that helps you identify which commits have made it into which releases in the future.
Re: Rails 4.0: Release Candidate 1 released
#18Earlier quoted context omitted.
Can you tell me which gems you're having problems with? I'll send a bunch of pull requests this evening.
Sure - so far I've had to update postgres_ext, rails_autolink, redis-rails (part of redis-store package), and marginalia. I'm currently fighting with redis-rails in particular, as bundler doesn't seem to be seeing the dependency change in a nested gem.
Word. I'll try to look into it; I'm about to go get some dinner, but I should have some time tonight or tomorrow.
Re: Rails 4.0: Release Candidate 1 released
#19Hmm.. ~1 month out from starting alpha testing of my app, do I update now, or later. Decisions..
I would do it now; it's not going to get easier later.
I personally have had good luck upgrading small apps very easily from 3.2->4.0. The main thing I've run into with larger apps is going from attr_accessible->strong_params, which I realize I could do simply by adding the gem, but I'd rather go whole hog on it.
Re: Rails 4.0: Release Candidate 1 released
#20Earlier quoted context omitted.
How can I see if the issue[1] that caused GitHub tons of issue[2] was fixed on this RC? [1] https://github.com/rails/rails/issues/9813 [2] https://github.com/blog/1440-today-s-email-incident
Here's how, normally: 1) You take the commit referenced, like this: https://github.com/rails/rails/commit/f980289fd2c1b9073a94b5... 2) Right below the title, GitHub shows you which branches the commit is in. As you can see with that commit (the one that caused the problem), it's only in 3-2-stable. Therefore, not being in master, it wasn't ever in Rails 4, only in Rails 3.2. Since this was a security issue, it's poss…
Thanks Steven! I'll look into it. And thanks for all the great work you've been putting on Rails.