Martin Emde

Add `--gemfile` flag to `bundle pristine`

1

## What was the end-user or developer problem that led to this PR? I just switched computers and my gems needed to be rebuilt. I first tried `bundle pristine --gemfile...

lock_platform directive in Gemfile

9

## What was the end-user or developer problem that led to this PR? There are two problems I aim to solve: #### 1. First deploys can fail because the platform...

Exclude path_params from page_url_for params keys

1

It is possible to add `path_params=val` to the url and cause 500 errors when [this code is invoked by kaminari](https://github.com/rails/rails/blob/main/actionpack/lib/action_dispatch/journey/formatter.rb#L62-L66). Exclude it from params to avoid this problem. I thought...

Add `Parameters#expect`, `allow` and related methods to safely filter params

40

### Motivation / Background I've been hunting around trying to fix the problem with the default, recommended way of handling parameters in Rails. ```ruby user_params = params.require(:user).permit(:name, :age) ``` This...

bin/importmap verify compares vendored files with remotes

4

In rubygems/rubygems.org#4396 we ran into the problem of verifying the provenance of files in vendor/javascript. This is a blocker for us using importmap-rails at this time. In this PR, I...

RFC for bundler checksum verification

3

This is a draft based on the feature work in rubygems/rubygems#6374.

Add title text for verified links, test for verified link

2

There was some confusion about what the checkmarks mean next to links on the gem page. This starts with a title text to explain, though we also probably need documentation...

Don't use nonces in Content-Security-Policy, use hashes.

2

This adds a concern that provides the `inline_script` and `inline_script_content` interface which allows us to declare and then render inline scripts in a way that is compatible with computing hashes....

Show owner list with full names, add an asterisk for mfa disable when you are owner

1

Not quite complete, but looking for feedback. This was much easier than fixing the broken javascript (not that I didn't try) and solves a policy problem in a cleaner way.

As a developer, when I want to do something like "only an organization owner can change the owner of a gem that is also owned by an organization", it's currently...