Skip to content

Replace usage of CGI::Cookie, fix ruby 3.5 compatibility#2327

Merged
jeremyevans merged 1 commit intorack:mainfrom
Earlopain:cgi-ruby-3.5
May 12, 2025
Merged

Replace usage of CGI::Cookie, fix ruby 3.5 compatibility#2327
jeremyevans merged 1 commit intorack:mainfrom
Earlopain:cgi-ruby-3.5

Conversation

@Earlopain
Copy link
Contributor

In Ruby 3.5, cgi will only contain functions related to escaping/unescaping.

https://bugs.ruby-lang.org/issues/21258

This is not an exact replicate of course, (CGI::Cookie) has some validations and coerces on setters but considering for what purpose this is, they don't seem necessary? During construction of the object rack already does conversions as necessary and setters don't make much sense, and aren't documented/tested for.

Although, for improved backwards compatibility, it wouldn't be much effort to make them attr_accesor instead.

@ioquatix
Copy link
Member

ioquatix commented May 9, 2025

This looks okay to me. @jeremyevans wdyt?

@Earlopain
Copy link
Contributor Author

Earlopain commented May 9, 2025

I've added ruby-head to CI to make sure it's green (or at least not the fault of rack if not). Will remove in a bit again if it looks ok.

Edit: Does ok on protocol-rack and rails tests but then chokes on roda because of something in rdoc that was extracted. Just wanted to make sure I didn't mess something up.

@jeremyevans
Copy link
Contributor

I've added ruby-head to CI to make sure it's green (or at least not the fault of rack if not). Will remove in a bit again if it looks ok.

Edit: Does ok on protocol-rack and rails tests but then chokes on roda because of something in rdoc that was extracted. Just wanted to make sure I didn't mess something up.

I heard rdoc in ruby-head has some issue with psych that could be causing problems. Roda may also need changes for cgi removal.

@Earlopain
Copy link
Contributor Author

I heard rdoc in ruby-head has some issue with psych that could be causing problems. Roda may also need changes for cgi removal.

To pass tests, a bit more is required: tilt for example expects on rdoc but doesn't declare it. Since ruby 3.5, it is just gone and you need to explicitly depend on it

$ RBENV_VERSION=ruby-dev bundle exec ruby -ve 'require "tilt/rdoc"'
ruby 3.5.0dev (2025-05-09T14:24:38Z master f30f0f0a22) +PRISM [x86_64-linux]
/home/user/.rbenv/versions/ruby-dev/lib/ruby/gems/3.5.0+0/gems/tilt-2.6.0/lib/tilt/rdoc.rb:3: warning: rdoc used to be loaded from the standard library, but is not part of the default gems since Ruby 3.5.0.
You can add rdoc to your Gemfile or gemspec to fix this error.
/home/user/.rbenv/versions/ruby-dev/lib/ruby/3.5.0+0/bundled_gems.rb:59:in 'Kernel.require': cannot load such file -- rdoc (LoadError)

OTOH, it does not depends on no template engine right now, so it seems be the responsibility of the consumer to add it to their gemfile instead. Does that sound right?

In regards to cgi, I think it's good. It does already just require cgi/escape, which is fine.

In Ruby 3.5, `cgi` will only contain functions related to escaping/unescaping.

https://bugs.ruby-lang.org/issues/21258

This is not an exact replicate of course, (`CGI::Cookie`) has some validations and coerces on setters but considering
for that purpose this is, they don't seem necessary?
During construction of the object rack already does conversions as necessary and setters don't make much sense, and aren't documented/tested for.

Although, for improved backwards compatibility, it wouldn't be much effort to make them `attr_accesor` instead.
@byroot
Copy link
Contributor

byroot commented May 12, 2025

For the 2.6.0 failure you can bump psych.

Also could we get this moving? It's preventing testing ruby-head against anything that uses rack and given the recent large changes in ruby I'd like to be able to test ruby-head to find potential bugs.

@Earlopain
Copy link
Contributor Author

Probably I can just bust the cache with cache-version from ruby/setup-ruby to pick up the new version if CI needs to be green to merge. Someone let me know if I should do that.

@jeremyevans
Copy link
Contributor

I dropped the related cache entry, but now there is a different problem in psych. Instead of:

NoMethodError: undefined method `const_source_location' for Object:Class
  /home/runner/work/rack/rack/vendor/bundle/ruby/2.6.0/gems/psych-5.2.4/lib/psych/core_ext.rb:23:in `<top (required)>'

We now get:

NoMethodError: undefined method `members' for #<StringIO:0x00005641dd5f2880>
    vendor/bundle/ruby/2.6.0/gems/psych-5.2.5/lib/psych/visitors/yaml_tree.rb:170:in `visit_Data'

This is probably because:

$ ruby26 -r stringio -e 'p StringIO.superclass'
Data

Psych needs to be updated to only assume a Struct-like Data on Ruby 3.2+.

@Earlopain
Copy link
Contributor Author

ruby/psych#729 Unfortunate series of events (https://bugs.ruby-lang.org/issues/3072)

@byroot
Copy link
Contributor

byroot commented May 12, 2025

Psych 5.2.6 is out with the fix.

@jeremyevans
Copy link
Contributor

Deleted the cache entry and reran the job. Specs are now passing, so I'll merge shortly. Thank you @Earlopain for fixing the issue in rack, and @byroot for fixing the issue in psych.

@jeremyevans jeremyevans merged commit 8a4475a into rack:main May 12, 2025
49 of 52 checks passed
@byroot
Copy link
Contributor

byroot commented May 12, 2025

and @byroot for fixing the issue in psych.

Well, credit to @Earlopain here to, I just merged.

@MSP-Greg
Copy link
Contributor

MSP-Greg commented May 16, 2025

I hate to ask, and I'm not sure what the 'blast radius' of this is...

Puma CI hasn't run for a few days, and I just ran it, and this caused all the ruby head builds to fail. I can add cgi to our Gemfile, but wondering if this may warrant a new release?

EDIT: as mentioned above, I may try to use rack/main...

@jeremyevans
Copy link
Contributor

When testing with ruby-head, it would be best to also be testing with rack/main. We'll make sure to release versions of rack with this change before the final release of Ruby 3.5.0.

@byroot
Copy link
Contributor

byroot commented May 16, 2025

before the final release of Ruby 3.5.0.

Not to command you or anything, but ideally compatibility fixes are released quickly so they don't hide subsequent issues.

There was a number of big changes in ruby-head recently, and lots of ruby-head CIs are uterly broken making it hard to notice when a new compatibility issue in introduced.

@MSP-Greg
Copy link
Contributor

When testing with ruby-head, it would be best to also be testing with rack/main.

Thanks. In the past, Puma CI has been stable, but (obviously) significant Ruby head changes can affect things.

For now, I'm changing all of Puma's Ruby head CI jobs so they use rack/main, and they're passing.

There was a number of big changes in ruby-head recently, and lots of ruby-head CIs are utterly broken

When the Ruby 'infrastructure' for GHA was stable, I was often an 'advocate' for testing with Windows and also Ruby head. There was a lot of friction about it, but I believe it's common now. I hope people realize that it's needed to quickly determine the true 'blast radius' of changes, or better to fix it now rather than wait for the December release...

@jeremyevans
Copy link
Contributor

If you are testing the master branch of ruby, and not the latest release, I don't think it is unreasonable to expect you to test with the master branch of other ruby projects, and not the latest release (at least when necessary). Expecting all ruby projects to release new gem versions quickly for all changes in ruby-head that affect them is expecting too much, IMO.

That being said, I don't handle Rack releases. We should probably backport this to Rack 3.1, 3.0, and 2.2, since we'll want them to be compatible with Ruby 3.5. If another Rack committer wants to release new versions with the fixes shortly after that, I have no objections.

@hsbt
Copy link

hsbt commented May 20, 2025

Thanks all 🙏

ericproulx pushed a commit to ericproulx/grape that referenced this pull request Jun 22, 2025
Rack may add `Rack::MockResponse::Cookie` itself: rack/rack#2327
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants