From 38b5d4197d4997cdd2e18b3d10986c686a2f0291 Mon Sep 17 00:00:00 2001 From: Leo Wilkin Date: Mon, 19 Oct 2026 03:46:08 +0100 Subject: [PATCH 1/2] get lint and brakeman green again MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit both were already failing on main: - rubocop: missing spaces inside the array brackets in backup_code.rb - brakeman: bin/brakeman runs --ensure-latest, so 8.1.0 coming out failed every PR. bumped to 8.1.0, which raised two new warnings: - a weak XSS on the email typo banner. it was already escaped, but switching to an _html translation key lets rails do the escaping and drops the manual html_escape + html_safe - rails 8.0 EOL on 2026-11-07. ignored with a note — the 8.1 upgrade needs its own PR before then --- Gemfile.lock | 2 +- app/models/identity/backup_code.rb | 2 +- app/views/identities/new.html.erb | 2 +- config/brakeman.ignore | 19 +++++++++++++++++++ config/locales/en.yml | 2 +- 5 files changed, 23 insertions(+), 4 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index eb316d54..9e8a35a5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -147,7 +147,7 @@ GEM block_cipher_kit (0.0.4) bootsnap (1.23.0) msgpack (~> 1.2) - brakeman (8.0.6) + brakeman (8.1.0) racc browser (6.2.0) builder (3.3.0) diff --git a/app/models/identity/backup_code.rb b/app/models/identity/backup_code.rb index d8c1b6ba..1d4e4fc3 100644 --- a/app/models/identity/backup_code.rb +++ b/app/models/identity/backup_code.rb @@ -27,7 +27,7 @@ class Identity::BackupCode < ApplicationRecord end end event :mark_discarded do - transitions from: [:active, :previewed], to: :discarded + transitions from: [ :active, :previewed ], to: :discarded end end diff --git a/app/views/identities/new.html.erb b/app/views/identities/new.html.erb index 34b18b28..14465ea9 100644 --- a/app/views/identities/new.html.erb +++ b/app/views/identities/new.html.erb @@ -34,7 +34,7 @@ - <%= t(".email_typo", suggested: ERB::Util.html_escape(@identity.suggested_email)).html_safe %> + <%= t(".email_typo_html", suggested: @identity.suggested_email) %>