Logo
Back to News
RubyLESSSQL SinatraPadrinoBootstrap Database DesignAPI DevelopmentCLI DevelopmentFramework DevelopmentWeb DevelopmentBackend DevelopmentBackend Engineering 5 min read

Padrino 0.18.0 Released With New Database Utilities and Security Enhancements

The latest Padrino update introduces new database dumping tasks, security defaults, and removes support for several deprecated ORMs and stylesheet engines.

Padrino 0.18.0, the Ruby web framework built on Sinatra, fixes a long list of bugs in its generators and database rake tasks, makes generated apps safer by default, and adds a rake db:dump task. It also removes four generator components, so some projects need changes before they upgrade. The Ohm, MiniRecord and Dynamoid ORMs and the Less stylesheet engine are gone because their projects no longer work with current gems.

What's new

rake db:dump (also sq:dump and ar:dump) writes a Postgres, MySQL or SQLite database to tmp/<env>_dump.sql, or to a path given with FILE=. It calls pg_dump, mysqldump or sqlite3, which must be on the PATH.

Several database tasks now work as expected. On Active Record 7.1 and later, rake db:create creates a missing Postgres or MySQL database instead of reporting that it exists. sq:create and sq:drop no longer need the createdb and mysql command-line clients. The Sequel migrate tasks also run in a project that has no migrations yet.

Generated apps now set the session cookie to Secure in production. They read the session secret from SESSION_SECRET when it is set. Apps that set Sinatra's host_authorization (Sinatra 4.1 or later) now get that check.

Generator fixes:

  • Re-running padrino g component keeps files the user has edited.
  • Field modifiers work in any order, for example email:string:uniq:index.
  • Sequel references fields become indexed foreign keys.
  • Mongoid models get valid field types.
  • Invalid names and options print a message and exit 1 instead of showing a backtrace.

The generated admin moves from Bootstrap 3.1.0 to 3.4.1.

Fixes in the running app:

  • Editing an ActiveSupport::Concern no longer breaks code reloading until a restart.
  • Apps mounted under a sub-path serve shared assets.
  • A malformed URL returns a 404 instead of a 500.
  • Sending an email no longer changes how erb templates escape output elsewhere in the process.
  • WEBrick shuts down cleanly on TERM.

Breaking changes

Existing apps that use the removed ORMs run as before. But padrino g model, g migration, g admin and g admin_page exit with an error in projects that use Ohm, MiniRecord or Dynamoid. Those projects should switch first, with padrino g component --orm=activerecord, --orm=sequel or --orm=mongoid. Less users can switch with --stylesheet=sass, scss or tailwind. After the switch, the old gems, Rakefile lines and initializers have to be removed by hand, and the models ported to the new ORM.

Other behavior changes:

  • rake ar:create and ar:drop now exit non-zero when a database can't be created or dropped, as Rails does. Scripts that ignored those errors will stop there.
  • SqlHelpers.create_db and drop_db take the app's Sequel connection options. This matters only to Rakefiles that call them directly.
  • An app mounted under a sub-path now serves files from the shared public/ under its prefix when its own public/<app> lacks them. Those files answer before the app's routes. With public/robots.txt in place, an app mounted at /blog serves that file for /blog/robots.txt instead of its own route.
  • An app that sets host_authorization with permitted_hosts now answers 403 for other hosts. Apps that don't set it are unchanged.
  • Without ActiveSupport, singularize keeps words such as status, address and analysis intact. Nested routes with parent: :status now use params[:status_id] instead of :statu_id.

Upgrading from 0.17

Set gem 'padrino', '~> 0.18.0' in the Gemfile and run bundle update padrino. Projects that list the padrino-* gems individually must update each one by name.

Generated files belong to the project, so existing apps keep their old defaults. To adopt the secure cookie, change set :sessions, same_site: :lax to add secure: Padrino.env == :production in every app, including admin/app.rb. The apps share one cookie, so an app without the option rewrites it without Secure. In production the cookie then goes out only over HTTPS, so logins and form posts fail over plain HTTP. Behind a proxy that terminates TLS, the proxy must send X-Forwarded-Proto: https.

To use SESSION_SECRET, set config/apps.rb to read it with ENV.fetch, falling back to the current secret. The value must be at least 64 characters. An empty or shorter value makes every request fail with a 500. padrino rake secret prints a valid one.

Apps that set host_authorization need every served host in permitted_hosts. Behind a proxy that sends X-Forwarded-Host, both that host and the Host the proxy sends must be listed, or the proxy must pass the original Host. Rack::Test requests use example.org, so test environments need it listed or tests will get 403. For apps under a sub-path, any file in the shared public/ that matches one of the app's routes should be renamed or removed. Otherwise the app needs its own public folder that isn't public/<app>.

Padrino 0.18.0 still requires Ruby 2.7.8 or later, Sinatra 4 and Rack 3, the same as 0.17. The release was credited to @achiurizo, with reports from @ssut, @mistergibson, @Quintasan, @postmodern and @scockram behind several of the changes.