Bump github/codeql-action from 2 to 3

.circleci/config.yml

@@ -1,16 +1,20 @@
 ---
-version: 2.1
+version: "2.1"
 
 orbs:
-  browser-tools: circleci/browser-tools@1.2.4
+  browser-tools: circleci/browser-tools@1.4.3
 
 commands:
   shared_steps:
     steps:
-      - browser-tools/install-chrome
+      - checkout
+
+      - browser-tools/install-chrome:
+          chrome-version: 114.0.5735.90
+          replace-existing: true
       - browser-tools/install-chromedriver
 
-      - checkout
+      - run: google-chrome --version
 
       # Install bundler
       - run: gem install bundler:2.3.5
@@ -35,16 +39,14 @@ commands:
 
       # Setup the environment
       - run: cp .sample.env .env
+      - run: cp spec/example_app/config/database.yml.sample spec/example_app/config/database.yml
 
       # Setup the database
       - run: bundle exec rake db:setup
 
       # Run the tests
       - run: bundle exec rspec
 
-      # Check vulnerabilities
-      - run: bundle exec rake bundler:audit
-
 default_job: &default_job
   working_directory: ~/administrate
 
@@ -55,19 +57,16 @@ jobs:
       - shared_steps
       # Run the tests against the versions of Rails that support Ruby 2.7
       - run: bundle exec appraisal install
-      - run: bundle exec appraisal rails50 rspec
-      - run: bundle exec appraisal rails51 rspec
-      - run: bundle exec appraisal rails52 rspec
       - run: bundle exec appraisal rails60 rspec
       - run: bundle exec appraisal rails61 rspec
       - run: bundle exec appraisal rails70 rspec
     docker:
-      - image: circleci/ruby:2.7
+      - image: cimg/ruby:2.7-browsers
         environment:
           PGHOST: localhost
           PGUSER: administrate
           RAILS_ENV: test
-      - image: postgres:10.1-alpine
+      - image: cimg/postgres:15.1
         environment:
           POSTGRES_USER: administrate
           POSTGRES_DB: ruby27
@@ -83,12 +82,12 @@ jobs:
       - run: bundle exec appraisal rails61 rspec
       - run: bundle exec appraisal rails70 rspec
     docker:
-      - image: circleci/ruby:3.0
+      - image: cimg/ruby:3.0-browsers
         environment:
           PGHOST: localhost
           PGUSER: administrate
           RAILS_ENV: test
-      - image: postgres:10.1-alpine
+      - image: cimg/postgres:15.1
         environment:
           POSTGRES_USER: administrate
           POSTGRES_DB: ruby30
@@ -108,16 +107,37 @@ jobs:
           PGHOST: localhost
           PGUSER: administrate
           RAILS_ENV: test
-      - image: postgres:10.1-alpine
+      - image: cimg/postgres:15.1
         environment:
           POSTGRES_USER: administrate
           POSTGRES_DB: ruby31
           POSTGRES_PASSWORD: ""
 
+  ruby-32:
+    <<: *default_job
+    steps:
+      - shared_steps
+      # Run the tests against the versions of Rails that support Ruby 3.2
+      - run: bundle exec appraisal install
+      - run: bundle exec appraisal rails61 rspec
+      - run: bundle exec appraisal rails70 rspec
+    docker:
+      - image: cimg/ruby:3.2-browsers
+        environment:
+          PGHOST: localhost
+          PGUSER: administrate
+          RAILS_ENV: test
+      - image: cimg/postgres:15.1
+        environment:
+          POSTGRES_USER: administrate
+          POSTGRES_DB: ruby32
+          POSTGRES_PASSWORD: ""
+
 workflows:
   version: 2
   multiple-rubies:
     jobs:
+      - ruby-32
       - ruby-31
       - ruby-30
       - ruby-27

.github/dependabot.yml

@@ -1,8 +1,16 @@
+---
 version: 2
 
 updates:
-- package-ecosystem: bundler
-  directory: "/"
-  schedule:
-    interval: daily
-  open-pull-requests-limit: 10
+  - package-ecosystem: bundler
+    directory: "/"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      time: '02:00'
+      timezone: 'Etc/UTC'

.github/workflows/bundle-audit.yml

@@ -0,0 +1,13 @@
+---
+name: Bundler Audit
+on: [push]
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: 'Bundler Audit'
+        uses: andrewmcodes/bundler-audit-action@main
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,36 @@
+---
+name: "CodeQL"
+
+on:
+  push:
+  schedule:
+    - cron: '44 6 * * 4'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['javascript', 'ruby']
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

.gitignore

@@ -17,6 +17,7 @@
 !/spec/example_app/tmp/.keep
 /spec/example_app/public/system
 /spec/example_app/public/assets
+/spec/example_app/config/database.yml
 /tags
 pkg
 *.ipr

.ruby-version

@@ -1 +1 @@
-2.7.5
+3.2.2

Appraisals

@@ -1,35 +1,3 @@
-appraise "rails50" do
-  gem "actionpack", "~> 5.0.0"
-  gem "actionview", "~> 5.0.0"
-  gem "activerecord", "~> 5.0.0"
-  gem "pg", "0.21.0"
-
-  group :development, :test do
-    gem "rspec-rails"
-  end
-end
-
-appraise "rails51" do
-  gem "actionpack", "~> 5.1.0"
-  gem "actionview", "~> 5.1.0"
-  gem "activerecord", "~> 5.1.0"
-  gem "pg", "0.21.0"
-
-  group :development, :test do
-    gem "rspec-rails"
-  end
-end
-
-appraise "rails52" do
-  gem "actionpack", "~> 5.2.0"
-  gem "actionview", "~> 5.2.0"
-  gem "activerecord", "~> 5.2.0"
-
-  group :development, :test do
-    gem "rspec-rails"
-  end
-end
-
 appraise "rails60" do
   gem "rails", "~> 6.0.3.4"
 end
@@ -39,5 +7,9 @@ appraise "rails61" do
 end
 
 appraise "rails70" do
-  gem "rails", "~> 6.1"
+  gem "rails", "~> 7.0"
+end
+
+appraise "pundit21" do
+  gem "pundit", "~> 2.1.0"
 end

CHANGELOG.md

@@ -17,6 +17,145 @@
 
 ## Changes
 
+### 0.19.0 (July 18, 2023)
+
+Once again, a big catchup release with lots of miscellaneous compatibility
+improvements, bug fixes and some nice new feature improvements. Thanks to
+everyone who contributed the PRs below!
+
+The following templates have changed since v0.18.0:
+
+  app/views/administrate/application/_collection.html.erb
+  app/views/administrate/application/_index_header.html.erb
+  app/views/administrate/application/_navigation.html.erb
+  app/views/administrate/application/_pagination.html.erb
+  app/views/administrate/application/edit.html.erb
+  app/views/administrate/application/new.html.erb
+  app/views/administrate/application/show.html.erb
+  app/views/fields/has_many/_show.html.erb
+  app/views/fields/select/_form.html.erb
+  app/views/layouts/administrate/application.html.erb
+
+If your application overrides any of them, make sure to review your
+custom templates to ensure that they remain compatible.
+
+* [COMPAT] [#2399] Fix Rails 6.0 `load_server` incompatibility
+* [DOC] [#2377] Add a script to generate a draft CHANGELOG update
+* [COMPAT] [#2395] Upgrade Rails from 7.0.4.3 to 7.0.5.1
+* [FEATURE] [#2391] Field::Polymorphic accepts a call-able for the classes
+  option
+* [BUGFIX] [#2379] Use pundit policy_namespace in controllers
+* [DOC] [#2390] Update documentation URL to correct Heroku URL
+* [BUGFIX] [#2383] Fix backward compatible Pundit include
+* [FEATURE] [#2375] Add order option to Field::HasOne documentation
+* [COMPAT] [#2367] Update to Ruby 3.2.2
+* [COMPAT] [#2371] Adapt to deprecations in the Faker API
+* [BUGFIX] [#2348] Field::Select to handle ActiveRecord enums correctly
+* [COMPAT] [#2324] Update to Rails 7
+* [FEATURE] [#2356] make permitted_attributes support action
+* [FEATURE] [#2325] Enable ordering by HasOne fields
+* [DOC] [#2350] Fix link to demo app on customise_search.md
+* [BUGFIX] [#2292] Use correct key in unconventional associations
+* [DOC] [#2346] Better description for option
+* [COMPAT] [#2341] Bump Rails dependencies to 6.1.7.3
+* [I18n] [#2327] Make Japanese translations more natural
+* [COMPAT] [#2323] Start testing Ruby 3.2 on CircleCI
+* [COMPAT] [#2322] Switch from pry-rails to pry
+* [COMPAT] [#2318] Bump Rails dependencies to 6.1.7.2
+* [COMPAT] [#2319] Fix Selenium deprecation warnings on headless/opts
+* [COMPAT] [#2321] Switch to testing against Postgres 15
+* [COMPAT] [#2316] Checkout first to avoid failure due to ChromeDriver file in
+  target dir
+* [FEATURE] [#2308] Make overriding create resource easier
+* [BUGFIX] [#2304] Set empty string param values to nil
+* [COMPAT] [#2299] Update minimum supported Rails version on
+  docs/getting_started.md
+* [BUGFIX] [#2289] Fix behaviour of has_many pagination
+* [I18n] [#2280] Titleize the column not the user defined locale
+* [FEATURE] [#2274] Allow disabling pagination for has_many
+* [FEATURE] [#2260] Allow search filters with special characters
+* [BUGFIX] [#2275] Provide a better error message for NotAuthorizedErrors with
+  Modules
+* [BUGFIX] [#2261] Avoid singularizing namespace in
+  Administrate::ResourceResolver
+* [BUGFIX] [#2258] Handle custom pagination for has_many
+* [UI] [#2250] Make the select box has same style as has_many box
+* [FEATURE] [#2238] pass associated_class to collection from show
+* [I18n] [#2245] remove redundant ARIA roles from elements with implicit role
+
+### 0.18.0 (August 12, 2022)
+
+This is a general catchup release. We've added `dart-sass` compatibility,
+improved a i18n handling, dropped support for Rails 5.x and Ruby 2.6, dropped
+`datetime_picker_rails` because now browser support is good enough, plus many
+others.
+
+The following templates have changed since v0.17.0:
+
+  app/views/administrate/application/_collection.html.erb
+  app/views/administrate/application/_collection_header_actions.html.erb
+  app/views/administrate/application/_collection_item_actions.html.erb
+  app/views/administrate/application/_index_header.html.erb
+  app/views/administrate/application/_navigation.html.erb
+  app/views/administrate/application/_pagination.html.erb
+  app/views/administrate/application/edit.html.erb
+  app/views/administrate/application/index.html.erb
+  app/views/administrate/application/show.html.erb
+  app/views/fields/belongs_to/_index.html.erb
+  app/views/fields/belongs_to/_show.html.erb
+  app/views/fields/date/_form.html.erb
+  app/views/fields/date_time/_form.html.erb
+  app/views/fields/has_many/_index.html.erb
+  app/views/fields/has_one/_form.html.erb
+  app/views/fields/has_one/_index.html.erb
+  app/views/fields/has_one/_show.html.erb
+  app/views/fields/polymorphic/_index.html.erb
+  app/views/fields/polymorphic/_show.html.erb
+  app/views/fields/time/_form.html.erb
+  app/views/fields/url/_index.html.erb
+  app/views/fields/url/_show.html.erb
+
+If your application overrides any of them, make sure to review your
+custom templates to ensure that they remain compatible.
+
+* [DOC] [#2154] Ensure we read from sanitised paths
+* [FEATURE] [#2154] Try out GitHub's code scanning tool
+* [DOC] [#2243] Add guide on how to scope has_many relations
+* [UI] [#2239] Move pagination into partial
+* [FEATURE] [#2237] Move bundle-audit to GitHub Actions
+* [i18n] [#2200] Fix HasOne association translations
+* BUGFIX] [#2235] Guess correct name for namespaced associations
+* [BUGFIX] [#2215] Fix typos and formatting in hiding dashboard docs
+* [FEATURE] [#1941] Unify Action Checks
+* [FEATURE] [#2181] Allow overriding the sample app database config
+* [COMPAT] [#2201] Drop support for Rails 5.x
+* [DOC] [#2225] Document how to customize Field::Select option labels
+* [SECURITY] [#2227] Update Rails out of CVE-2022-32224
+* [FEATURE] [#2216] Move pagination into private method for overriding
+* [FEATURE] [#2208] Enable ordering the BelongsTo fields by using `order` option.
+* [i18n] [#2219] Add Slovenian translations
+* [FEATURE] [#2211] Improve index eager load performance
+* [COMPAT] [#2198] Dart-sass compatibility
+* [COMPAT] [#2194] Drop support for Ruby 2.6, which reached EOL
+* [i18n] [#2186] Correct grammar on German error messages
+* [i18n] [#2183] Only include locales when bundling
+* [OPTIM] [#2182] Change ApplicationController's routes's class to Set to speed up "valid_action?"
+* [DOC] [#2153] How to customise the search
+* [BUGFIX] [#2164] Use field.name rather than resource_name for has_one relationships
+* [BUGFIX] [#2163] Check the routes before render link in collection.html
+* [COMPAT] [#2161] Bump Rails dependencies from 6.1.4.6 to 6.1.5
+* [FEATURE] [#2133] Sort dashboard attributes
+* [BUGFIX] [#2152] Fix typos in example view for Adding Controllers
+* [UI] [#2146] Add destroy link in the show template
+* [BUGFIX] [#2145] Fix table header classes of has_many field
+* [COMPAT] [#2141] Fix Pundit >2.2.0 include
+* [UI] [#2139] Add HTML options to the URL field
+* [COMPAT] [#2144] Update Rails to 6.1.4.6
+* [UI] [#2136] Drop datetime_picker_rails and use browser fields
+* [CHANGE] [#2138] Provide a stylelint config that we can tweak
+* [CHANGE] [#2096] Make search easier to override and adapt to custom use cases
+* [i18n] [#2114] Add i18n support for Field::HasMany
+
 ### 0.17.0 (January 31, 2022)
 
 This release incorporates nearly a year of minor changes, starts testing