2.7.0 Release

[jtannas]

What's Changed

• drop support for EOL ruby + rails versions by @jtannas in drop support for EOL ruby + rails versions #542
• update ChangeLog to replect contents of latest release by @jtannas in update ChangeLog to replect contents of latest release #549
• Make the docker user non-root for easier volume sharing by @jtannas in Make the docker user non-root for easier volume sharing #550
• Update json-schema dependency version constraint by @mustardnoise in Update json-schema dependency version constraint #517
• Fix Style/SingleArgumentDig rubocop issues in swagger_formatter by @rnestler in Fix Style/SingleArgumentDig rubocop issues in swagger_formatter #486
• Update base path configuration for OpenAPI 3 by @romanblanco in Update base path configuration for OpenAPI 3 #547
• make rspec-core dependency explicit by @jtannas in make rspec-core dependency explicit #554
• add deprecation notices for EOL Ruby & RSpec by @jtannas in add deprecation notices for EOL Ruby & RSpec #552
• Add Test Coverage Tooling by @jtannas in Add Test Coverage Tooling #551
• Override Content Security Policy for Swagger UI Compat by @eric-hemasystems in Override Content Security Policy for Swagger UI Compat #263
• Update spec file path by @remy727 in Update spec file path #557
• Add ADDITIONAL_RSPEC_OPTS ENV var for rswag:specs:swaggerize by @asavageiv in Add ADDITIONAL_RSPEC_OPTS ENV var for rswag:specs:swaggerize #556
• chore: Update Url and QueryParam in cspell.json by @Jason3S in chore: Update Url and QueryParam in cspell.json #560

New Contributors

• @mustardnoise made their first contribution in Update json-schema dependency version constraint #517
• @rnestler made their first contribution in Fix Style/SingleArgumentDig rubocop issues in swagger_formatter #486
• @romanblanco made their first contribution in Update base path configuration for OpenAPI 3 #547
• @eric-hemasystems made their first contribution in Override Content Security Policy for Swagger UI Compat #263
• @remy727 made their first contribution in Update spec file path #557
• @Jason3S made their first contribution in chore: Update Url and QueryParam in cspell.json #560

Full Changelog: 2.6.0...2.7.0

---

This discussion was created from the release 2.7.0 Release Candidate.

[jtannas]

I've been wrapped for the last week with moving and still will be through this weekend.
Afaik the code on master is releasable but I haven't done any testing on it yet, so I've created a 2.7.0 git tag for the release candidate.

@sergioisidoro @romanblanco @RomainKoszyk
If you'd be willing to help test it out then I'll publish once everything seems fine. Otherwise, I'll get to it soon™.

[tdeo]

So I was just able to test it out, seems to work pretty well, I'm seeing a CSP violation with an image in the footer originating from there: https://github.com/swagger-api/swagger-ui/blob/32b3b97ae33635946d31711a3fcc94a6092b4e23/src/core/components/online-validator-badge.jsx#L58

Refused to load the image 'https://validator.swagger.io/validator?url=xxx' because it violates the following Content Security Policy directive: "img-src 'self' data:".

[eric-hemasystems]

My original PR had a allowance for that validator image but when I tested it against the latest code in master (which is using a newer version of swagger) that image seemed gone so I removed it from the CSP when updating the PR.

Does rswag still render the older swagger interface for folks using the older swagger spec? If so we might need to add that allowance back.

[tdeo]

That's the image I'm not seeing on the very bottom right corner of the page:

[eric-hemasystems]

Hmmm... that's a different URL. I didn't see that when I ran the test app but sounds like there might be some situation where that shows up so perhaps we need to add it?

[romanblanco]

I'm testing this in RedHatInsights/compliance-backend#1455.

So far I have not noticed anything unexpected in the output 👍

Only @remy727's change makes me wonder why was the path in README.md chaned.
In our project, the spec files are in spec/integration, so I'm thinking if we need to change something.

[gayatri-umesh]

Am having the issue with swagger UI rendering a blank page because of the CSP in our rails app being more restrictive than what swagger UI needs. I have updated rswag to 2.7.0 and still get the issue.

Do I need to make changes in application.rb to use the middleware?

[eric-hemasystems]

You should already being mounting the middleware via the routes.rb file. Something like:

mount Rswag::Ui::Engine => '/api-docs'
mount Rswag::Api::Engine => '/api-docs'

Unless you are serving the UI as static content but in that case the Rails CSP won't be an issue since the Rails CSP wouldn't be used.

[gayatri-umesh]

You should already being mounting the middleware via the routes.rb file. Something like:

mount Rswag::Ui::Engine => '/api-docs'
mount Rswag::Api::Engine => '/api-docs'

Unless you are serving the UI as static content but in that case the Rails CSP won't be an issue since the Rails CSP wouldn't be used.

Yes am already doing that (have a custom one as below).

mount Rswag::Ui::Engine => '/custom-api-docs'
mount Rswag::Api::Engine => '/custom-api-docs'

Still dont see the tag with the CSP applied when the index.html renders with the latest version 2.7.0. Any other suggestions?

<html lang="en">
<head>
 <meta charset="UTF-8">
 <title>Swagger UI</title>
 <link href="https://fonts.googleapis.com

One thing to point out is we use the secure_headers gem.

[eric-hemasystems]

I don't know how secure_headers is implemented so that may be the reason. The way the CSP works in Rails is the CSP is only added if the response doesn't already have done. My patch had made it so rswag always provides one and therefore Rails doesn't need to add it's own.

secure_headers may not work that way. It may unconditionally add the CSP overwriting what rswag is doing. You would have to dig into the source code of secure_headers to know for sure.

[gayatri-umesh]

I don't know how secure_headers is implemented so that may be the reason. The way the CSP works in Rails is the CSP is only added if the response doesn't already have done. My patch had made it so rswag always provides one and therefore Rails doesn't need to add it's own.

secure_headers may not work that way. It may unconditionally add the CSP overwriting what rswag is doing. You would have to dig into the source code of secure_headers to know for sure.

Yes my understanding is the same that secure_headers is overwriting and returning the application csp. With secure headers there is a way to override, though, am not sure where to apply that in the rswag flow (usually applied in the controller layer). let me try if i could do it in rswag_ui.rb or rswag_api.rb to address this. I will reach out if I need any help. Thanks for helping with this.

[akaJSaunders]

@gayatri-umesh Im having the same issue that you are reporting here, have you made any progress in finding a solution?

[sthirugn]

hello folks, Is it possible to release 2.7.0 version soon? we have been waiting for a bugfix on this release, it will be very helpful if you can release this soon. Any help is much appreciated.

[asavageiv]

It was already released.

[sthirugn]

ah nice, I missed seeing it. Thanks @asavageiv for the info. Much appreciated.

[gayatri-umesh]

Hello Juliano, I resolved the issue by moving the content security policy config from `secure_headers` to rails CSP. Hope this helps! Thanks and Regards, Gayatri

…

On Fri, Nov 11, 2022 at 11:45 AM Juliano Saunders ***@***.***> wrote: @gayatri-umesh <https://github.com/gayatri-umesh> Im having the same issue that you are reporting here, have you found a solution? — Reply to this email directly, view it on GitHub <#561 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AYDG6RBEMW2XSALXDEZH3NDWHZZ2HANCNFSM6AAAAAAQ6W7JS4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[epugh]

maybe just me, but on github, the most recent one that shows up on the homepage is 2.6????

[epugh]

ahh... looks like 2.7 and 2.8 have a prerelease tag, which is why the homepage refers to 2.6!