Update Rails to main

[rubys]

Moves Campfire's Rails pin from main as of 2025-12-01 (1a02651) to current main (e3d5c569). Campfire loads the 8.2 framework defaults, so the defaults added since then take effect too.

Changes the bump needed

• Minitest 6 has no minitest/unit, so test/test_helper.rb no longer requires it.
• Rack::Sendfile is no longer in the middleware stack. ActionDispatch::DebugLocks now goes before ActionDispatch::Executor, as the threading guide now says.
• Time::DATE_FORMATS is deprecated. :epoch is registered through ActiveSupport::TimeFormats.register.
• Channel tests: subscription.streams is now private, so the unread rooms test uses stream_names.
• Action Cable and Sentry: sentry-rails declares its handle_open/handle_close wrappers private, and Rails 8.2 calls them from outside the connection, so no /cable connection succeeded. That's ActionCable instrumentation breaks all /cable connections on Rails 8.2 / main (private handle_open called publicly by Server::Socket) getsentry/sentry-ruby#2975; the fix, [on-hold] fix(rails): make Action Cable handle_open/handle_close overrides public for Rails 8.2 getsentry/sentry-ruby#2972, is on hold until an 8.2 beta. config/initializers/sentry.rb makes the two wrappers public until it ships.
• Lexxy and mentions: Lexxy renders editor content through Rails' new editor adapter when Rails has one, which asks a mention for its editor partial. That defaulted to a nonexistent users/_user, so editing a message with a mention raised. User::Mentionable#to_editor_content_attachment_partial_path returns users/mention, the partial the mention prompt already inserts.
• Propshaft moves to its current main, which no longer reads the deprecated Mime::EXTENSION_LOOKUP.
• redis-client moves to 0.30.1. Rails main's Redis cache store, which production uses, requires 0.28.0 or later, so assets:precompile in the Docker build aborted on 0.25.2. The test environment doesn't use that store, so only the image build showed it.

8.2 defaults that switch on

• Forgery protection checks headers only (Sec-Fetch-Site, then Origin), with no tokens.
• HTML templates compile through Herb in strict mode.
• strict_accept_header, the new default security headers, active_storage.analyze = :immediately and enqueue_after_transaction_commit.

The suites pass with all of them. The two I'd watch on a real deploy are forgery protection, for plain-HTTP installs and older browsers, and immediate blob analysis.

Herb

Herb's strict mode rejects four of Campfire's templates. This branch includes #302 (two unmatched </span> in the layout, which would take every page down) and #303 (the PWA partials' one-tag case/when, and the account settings checkbox). Merging those first shrinks this to two commits. The last commit adds a bin/rails herb:check job to CI; drop it if you'd rather not.

Verification

• bin/rails test: 413 runs, 0 failures, 1 skip, no deprecation warnings
• bin/rails test:system: 22 runs, 0 failures
• bin/rails herb:check: all templates compile
• bin/rubocop: no offenses
• bin/brakeman: no warnings

The same bump has been running CI on roundhouse-rb/once-campfire's preview branch, which also carries the other open PRs.

🤖 Generated with Claude Code

[Copilot]

Copilot review overview

🔵 Needs a closer look

Framework security and upload defaults need deployment-specific validation, and redundant attachment analysis remains unresolved.

Review effort: Balanced
Findings: None

What changed in this PR

Updates Campfire to current Rails main and adapts application code, templates, and tests to Rails 8.2 behavior.

Changes:

• Updates Rails, Propshaft, and related dependencies.
• Fixes compatibility with framework APIs and Herb template compilation.
• Adds rendering coverage and a Herb CI check.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
test/​test_helper.rb	Removes obsolete Minitest require.
test/​controllers/​rooms_controller_test.rb	Tests platform-specific notification help.
test/​controllers/​accounts_controller_test.rb	Tests restriction checkbox rendering.
test/​channels/​unread_rooms_channel_test.rb	Uses public stream inspection API.
Gemfile.lock	Updates framework and dependencies.
config/​initializers/​time_formats.rb	Migrates time-format registration.
config/​initializers/​sentry.rb	Adjusts Action Cable wrapper visibility.
config/​environments/​development.rb	Updates debug middleware placement.
app/​views/​pwa/​_system_settings.html.erb	Separates Herb-incompatible ERB tags.
app/​views/​pwa/​_install_instructions.html.erb	Separates Herb-incompatible ERB tags.
app/​views/​pwa/​_browser_settings.html.erb	Separates Herb-incompatible ERB tags.
app/​views/​layouts/​application.html.erb	Removes unmatched closing tags.
app/​views/​accounts/​edit.html.erb	Generates checkbox through tag helper.
app/​models/​user/​mentionable.rb	Defines mention editor partial.
.github/​workflows/​ci.yml	Adds Herb compilation check.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[rosa]

Thanks @rubys!