Bump rails to 8.1.x + HEALTHCHECK by 3kh0 · Pull Request #327 · hackclub/auth

3kh0 · 2026-09-06T16:50:16Z

This pull

Brings us up to date on the latest rails security patch
Adds a HEALTHCHECK to the dockerfile so we don't shoot ourselves in the foot
Bumps smaller gems for security patches + parity with the recommended rails list

socket-security · 2026-09-06T16:50:34Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Maintenance
gem/puma@7.2.0 ⏵ 7.2.1	⁺¹	⁺²²
gem/rails@8.0.5.1 ⏵ 8.1.3.1
gem/annotaterb@4.22.0 ⏵ 4.24.0	⁺¹
gem/bootsnap@1.23.0 ⏵ 1.26.0
gem/flipper@1.4.0 ⏵ 1.4.2	⁺¹
gem/thruster@0.1.18 ⏵ 0.1.26
gem/good_job@4.13.3 ⏵ 4.19.2
gem/sentry-ruby@5.28.1 ⏵ 6.7.0	⁺¹
gem/sentry-rails@5.28.1 ⏵ 6.7.0	⁺¹
gem/faker@3.6.1 ⏵ 3.8.0
gem/flipper-ui@1.4.0 ⏵ 1.4.2	⁺¹
gem/webmock@3.26.2 ⏵ 3.26.4	⁺¹
gem/doorkeeper@5.8.2 ⏵ 5.9.6	⁺¹
gem/propshaft@1.3.1 ⏵ 1.3.2	⁺¹
gem/faraday@2.14.1 ⏵ 2.14.3	⁺¹	⁺¹⁷
gem/rspec-rails@7.1.1 ⏵ 8.0.4
npm/@rails/activestorage@8.0.200 ⏵ 8.1.301			⁺⁷
gem/flipper-active_record@1.4.0 ⏵ 1.4.2
gem/doorkeeper-openid_connect@1.8.11 ⏵ 1.10.5
gem/ahoy_matey@5.4.1 ⏵ 5.5.0	⁺¹
gem/lockbox@2.1.0 ⏵ 2.2.0
gem/console1984@0.2.3 ⏵ 0.2.4	⁺¹
gem/acts_as_paranoid@0.10.3 ⏵ 0.11.0
gem/paper_trail@16.0.0 ⏵ 17.0.0	⁺¹
gem/blind_index@2.7.0 ⏵ 2.8.1	⁺¹
gem/bcrypt@3.1.21 ⏵ 3.1.22	⁺¹	⁺²
gem/groupdate@6.7.0 ⏵ 6.8.0

View full report

socket-security · 2026-09-06T16:50:36Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: gem `actionpack` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → `gem/rails_semantic_logger@4.19.0` → `gem/vite_rails@3.0.20` → `gem/public_activity@3.0.2` → `gem/phlex-rails@2.4.0` → `gem/web-console@4.3.0` → `gem/rspec-rails@8.0.4` → `gem/propshaft@1.3.2` → `gem/good_job@4.19.2` → `gem/rails@8.1.3.1` → `gem/sentry-rails@6.7.0` → `gem/doorkeeper@5.9.6` → `gem/premailer-rails@1.12.0` → `gem/wicked@2.0.0` → `gem/letter_opener_web@3.0.0` → `gem/audits1984@0.1.7` → `gem/active_storage_encryption@0.3.0` → `gem/factory_bot_rails@6.5.1` → `gem/cloudflare-rails@7.0.0` → `gem/actionpack@8.1.3.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/actionpack@8.1.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: gem `activerecord` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → `gem/public_activity@3.0.2` → `gem/flipper-active_record@1.4.2` → `gem/good_job@4.19.2` → `gem/annotaterb@4.24.0` → `gem/rails@8.1.3.1` → `gem/kaminari@1.2.2` → `gem/hashid-rails@1.4.1` → `gem/active_storage_encryption@0.3.0` → `gem/paper_trail@17.0.0` → `gem/acts_as_paranoid@0.11.0` → `gem/activerecord@8.1.3.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/activerecord@8.1.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: gem `activerecord` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: Gemfile.lock → `gem/public_activity@3.0.2` → `gem/flipper-active_record@1.4.2` → `gem/good_job@4.19.2` → `gem/annotaterb@4.24.0` → `gem/rails@8.1.3.1` → `gem/kaminari@1.2.2` → `gem/hashid-rails@1.4.1` → `gem/active_storage_encryption@0.3.0` → `gem/paper_trail@17.0.0` → `gem/acts_as_paranoid@0.11.0` → `gem/activerecord@8.1.3.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore gem/activerecord@8.1.3.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Thruster listens on port 80. Without a HEALTHCHECK, Coolify/Traefik treats the web container as having no available server. Skip SSL and domain redirects for /up so the in-container probe (curl http://127.0.0.1:80/up) gets 200 instead of 301.

Stay on the supported line for each gem rather than the newest major: - puma 7.2.1 (not 8.0) - sentry-ruby/rails 6.7.0 (not 7.0) - doorkeeper 5.9.6 + openid_connect 1.10.5 (not 2.0 beta) - good_job 4.19.2 with incremental index migrations - image_processing stays 1.14 (Rails 8.1 template) Also pick up current patches on the same majors (thruster, bootsnap, propshaft, flipper, faraday, nokogiri, loofah, mail, json, erb).

Restore Alpine-driven templates that erb_lint autocorrect truncated, keep schema.rb as a real dump (can_ban, login-code purpose, unique session token index), and skip loopback instead of special-casing /up in DomainRedirect and ssl_options. Fail closed on missing Active Record encryption keys outside local, leave 8.1 defaults opt-in via new_framework_defaults_8_1.rb, and DRY the persona draft find-or-create lock path.

3kh0 force-pushed the main branch from 8b538dd to 1d8f29c Compare September 6, 2026 16:58

3kh0 added 3 commits September 6, 2026 13:17

Bump rails to 8.1.x

2294810

only remove the extras

a9f2259

3kh0 force-pushed the rails-8.1 branch from 83b843b to 840f13f Compare September 6, 2026 17:22

3kh0 changed the title ~~Bump rails to 8.1.x~~ Bump rails to 8.1.x + HEALTHCHECK Sep 6, 2026

3kh0 added 3 commits September 6, 2026 13:34

lint

645e790

Navigation Menu

Bump rails to 8.1.x + HEALTHCHECK - #327

Bump rails to 8.1.x + HEALTHCHECK#327
3kh0 wants to merge 6 commits into
mainfrom
rails-8.1

3kh0 commented Sep 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Sep 6, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

3kh0 commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Sep 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

3kh0 commented Sep 6, 2026 •

edited

Loading

socket-security Bot commented Sep 6, 2026 •

edited

Loading

socket-security Bot commented Sep 6, 2026 •

edited

Loading