Merge branch 'dev' into merge-release/17.3-20260421043240

Author: klaustopher

.buildpacks

@@ -1,2 +1,2 @@
 https://github.com/heroku/heroku-buildpack-nodejs.git#v315
-https://github.com/pkgr/heroku-buildpack-ruby.git#v327-1
+https://github.com/pkgr/heroku-buildpack-ruby.git#v356-1

.github/workflows/cla.yml

@@ -21,7 +21,10 @@ jobs:
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         uses: contributor-assistant/github-action@v2.6.1
         env:
+          # https://github.com/contributor-assistant/github-action?tab=readme-ov-file#environmental-variables
+          # Built-in GitHub token to make the API calls for interacting with GitHub. Does not need to be specified the secrets store.
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Access token for repository where the signatures are stored (see below for remote-repository-name)
           PERSONAL_ACCESS_TOKEN: ${{ secrets.OPENPROJECTCI_GH_LEGAL_TOKEN }}
         with:
           path-to-signatures: "contributor-license-agreement/signatures/version1.json"

.github/workflows/crowdin.yml

@@ -76,12 +76,14 @@ jobs:
           crowdin_branch_name: ${{ steps.vars.outputs.crowdin_branch }}
           # Dont create a PR for the updated translations
           push_translations: false
+          user: auto
         env:
           OPENPROJECT_CROWDIN_PROJECT: ${{ secrets.OPENPROJECT_CROWDINV2_PROJECT }}
           OPENPROJECT_CROWDIN_API_KEY: ${{ secrets.OPENPROJECT_CROWDINV2_API_KEY }}
       - name: "Fix root key in Portuguese crowdin translation files"
-        run: |
-          script/i18n/fix_crowdin_pt_language_root_key
+        run: script/i18n/fix_crowdin_pt_language_root_key
+      - name: "Rewrite crowdin translation files using ruby yaml library"
+        run: script/i18n/rewrite_crowdin_yml_files
       - name: "Commit translations"
         env:
           BRANCH: ${{ matrix.branch }}

.rubocop.yml

@@ -169,6 +169,10 @@ Rails/ContentTag:
 # dynamic finders cop clashes with capybara ID cop
 Rails/DynamicFindBy:
   Enabled: true
+  AllowedMethods:
+    - find_by_id_or_identifier
+    - find_by_id_or_identifier!
+    - find_by_semantic_identifier
   Exclude:
     - "spec/features/**/*.rb"
     - "spec/support/**/*.rb"
@@ -186,6 +190,9 @@ Rails/FindEach:
     - limit
     - select
     - lock
+  Exclude:
+    - "spec/**/*"
+    - "modules/**/spec/**/*"
 
 # The http verbs in Rack::Test do not accept named parameters (params: params)
 Rails/HttpPositionalArguments:
@@ -197,11 +204,13 @@ Rails/I18nLocaleAssignment:
   Enabled: true
   Exclude:
     - "spec/**/*.rb"
+    - "modules/*/spec/**/*.rb"
 
 Rails/I18nLocaleTexts:
   Enabled: true
   Exclude:
     - "spec/**/*.rb"
+    - "modules/*/spec/**/*.rb"
 
 # We have config.active_record.belongs_to_required_by_default = false ,
 # which means, we do have to declare presence validators on belongs_to relations.
@@ -215,6 +224,9 @@ Rails/RequireDependency:
 # Require save! to prevent saving without validation when saving outside of a condition.
 Rails/SaveBang:
   Enabled: true
+  Exclude:
+    - "spec/**/*"
+    - "modules/**/spec/**/*"
 
 # There are valid cases in which to use methods like:
 # * update_all
@@ -321,6 +333,7 @@ RSpec/SpecFilePathFormat:
   CustomTransform:
     OpenIDConnect: openid_connect
     OAuthClients: oauth_clients
+    XWikiProviders: xwiki_providers
   EnforcedInflector: active_support
   IgnoreMethods: true
 
@@ -471,6 +484,11 @@ Style/Proc:
 Style/RaiseArgs:
   Enabled: false
 
+Style/RescueModifier:
+  Exclude:
+    - "spec/**/*"
+    - "modules/**/spec/**/*"
+
 Style/RegexpLiteral:
   Enabled: false
 

.ruby-version

@@ -1 +1 @@
-4.0.1
+4.0.2

Gemfile

@@ -41,10 +41,10 @@ gem "activemodel-serializers-xml", "~> 1.0.1"
 gem "activerecord-import", "~> 2.2.0"
 gem "activerecord-session_store", "~> 2.2.0"
 gem "ox"
-gem "rails", "~> 8.1.2"
+gem "rails", "~> 8.1.3"
 gem "responders", "~> 3.2"
 
-gem "ffi", "~> 1.15"
+gem "ffi", "~> 1.17"
 
 gem "connection_pool", "~> 3.0.2"
 
@@ -72,7 +72,7 @@ gem "awesome_nested_set", "~> 3.9.0"
 gem "closure_tree", "~> 9.6.1"
 gem "rubytree", "~> 2.2.0"
 
-gem "addressable", "~> 2.8.9"
+gem "addressable", "~> 2.9.0"
 
 # Remove whitespace from model input
 gem "auto_strip_attributes", "~> 2.5"
@@ -87,7 +87,7 @@ gem "htmldiff"
 gem "stringex", "~> 2.8.5"
 
 # CommonMark markdown parser with GFM extension
-gem "commonmarker", "~> 2.7.0"
+gem "commonmarker", "~> 2.8.0"
 
 # HTML pipeline for transformations on text formatter output
 # such as sanitization or additional features
@@ -123,11 +123,11 @@ gem "sys-filesystem", "~> 1.5.0", require: false
 
 gem "bcrypt", "~> 3.1.22"
 
-gem "multi_json", "~> 1.19.0"
+gem "multi_json", "~> 1.20.0"
 gem "oj", "~> 3.16.16"
 
 gem "daemons"
-gem "good_job", "~> 4.13.3" # update should be done manually in sync with saas-openproject version.
+gem "good_job", "~> 4.14.2" # update should be done manually in sync with saas-openproject version.
 
 gem "rack-protection", "~> 3.2.0"
 
@@ -161,7 +161,7 @@ gem "ttfunk", "~> 1.7.0" # remove after https://github.com/prawnpdf/prawn/issues
 # prawn implicitly depends on matrix gem no longer in ruby core with 3.1
 gem "matrix", "~> 0.4.3"
 
-gem "mcp", "~> 0.8.0"
+gem "mcp", "~> 0.10.0"
 
 gem "meta-tags", "~> 2.23.0"
 
@@ -204,9 +204,9 @@ gem "carrierwave_direct", "~> 3.0.0"
 gem "ssrf_filter", "~> 1.3"
 gem "fog-aws"
 
-gem "aws-sdk-core", "~> 3.241"
+gem "aws-sdk-core", "~> 3.244"
 # File upload via fog + screenshots on travis
-gem "aws-sdk-s3", "~> 1.213"
+gem "aws-sdk-s3", "~> 1.217"
 
 gem "openproject-token", "~> 8.8.2"
 
@@ -227,7 +227,7 @@ gem "dry-validation"
 gem "store_attribute", "~> 2.0"
 
 # Appsignal integration
-gem "appsignal", "~> 4.7", require: false
+gem "appsignal", "~> 4.8", require: false
 
 # Yabeda integration
 gem "yabeda-activerecord"
@@ -236,11 +236,11 @@ gem "yabeda-puma-plugin"
 gem "yabeda-rails"
 
 # opentelemetry
-gem "opentelemetry-exporter-otlp", "~> 0.32.0", require: false
+gem "opentelemetry-exporter-otlp", "~> 0.33.0", require: false
 gem "opentelemetry-instrumentation-all", "~> 0.91.0", require: false
 gem "opentelemetry-sdk", "~> 1.10", require: false
 
-gem "view_component", "~> 4.5.0"
+gem "view_component", "~> 4.6.0"
 # Lookbook
 gem "lookbook", "2.3.14"
 
@@ -254,7 +254,7 @@ gem "factory_bot_rails", "~> 6.5.0", require: false
 gem "turbo_power", "~> 0.7.0"
 gem "turbo-rails", "~> 2.0.20"
 
-gem "httpx", "~> 1.7.4"
+gem "httpx", "~> 1.7.5"
 
 # Brings actual deep-freezing to most ruby objects
 gem "ice_nine"
@@ -266,7 +266,7 @@ group :test do
 
   # Test prof provides factories from code
   # and other niceties
-  gem "test-prof", "~> 1.5.0"
+  gem "test-prof", "~> 1.6.0"
   gem "turbo_tests", github: "opf/turbo_tests", ref: "with-patches"
 
   gem "rack_session_access"
@@ -334,9 +334,6 @@ group :development do
   gem "spring-commands-rubocop"
 
   gem "colored2"
-
-  # git hooks manager
-  gem "lefthook", require: false
 end
 
 group :development, :test do
@@ -356,6 +353,9 @@ group :development, :test do
   # https://github.com/puma/puma/issues/2835#issuecomment-2302133927
   gem "byebug"
 
+  # Unreleased fix of readline dependency of pry: https://github.com/pry/pry/pull/2366
+  # Once this gets released, the specific dev dependency on pry can be removed
+  gem "pry", github: "pry/pry", ref: "135640262879544c6bfecbf3e78511289bfe956c"
   gem "pry-byebug", "~> 3.12.0", platforms: [:mri]
   gem "pry-rails", "~> 0.3.6"
   gem "pry-rescue", "~> 1.6.0"
@@ -387,7 +387,7 @@ end
 gem "bootsnap", "~> 1.23.0", require: false
 
 # API gems
-gem "grape", "~> 3.1.1"
+gem "grape", "~> 3.2.0"
 gem "grape_logging", "~> 3.0.0"
 gem "roar", "~> 1.2.0"