Release notes
For more information and the release video check out the full release page
🎸 Features
- Avo 3 runs on pagy
43, alongside pagy7to9@bruno-costanzo (avo v.3.34.0#4977)
Before you upgrade
Avo 3 no longer sets an upper bound on pagy, so bundle update avo can move your app from pagy 9 to pagy 43. Most apps need nothing else. Add a line to your Gemfile first if one of these applies to your app.
| If your app | Add to your Gemfile
|
|---|---|
| Runs on Rails 8.0, 7.1, 7.0 or 6.1, or on Rails 7.2 below 7.2.4 | gem "json", "< 3" |
Calls pagy in its own code (Pagy::Backend, Pagy::Frontend, pagy_nav) |
gem "pagy", "~> 9.4" |
Follows the REST API integration guide (pagy_get_items, pagy_get_vars) |
gem "pagy", "~> 9.4" |
Runs on Ruby 3.2
|
gem "pagy", "~> 9.4" |
Pagy 43 depends on json, and json 3 makes the JSON encoder of those Rails versions raise ArgumentError. Pagy 43 also removed Pagy::Backend, Pagy::Frontend and the pagy 9 helpers, and it no longer calls pagy_get_items or pagy_get_vars. On Ruby 3.2, Bundler stops at pagy 43.4.4, which is affected by GHSA-2xmw-f8j8-wfxc. Avo's own pagination isn't exposed to it, but your own code might be.
If you ejected Avo::PaginatorComponent, replace helpers.pagy_info and helpers.pagy_nav in your copy with helpers.avo_pagy_info and helpers.avo_pagy_nav. Apps on Ruby 3.1 stay on pagy 9.4 on their own.
The 3.34.0 upgrade guide covers every case in detail.
🚨 Security
- fix: close authorization gaps in update, association lists, charts and has_one routes (GHSA-5qcq-2vq9-62hj) @Paul-Bob (
avo v.3.33.33e4b7c4d6) - fix: authorize the association show route (GHSA-x65r-p6hf-94hv) @Paul-Bob (
avo v.3.33.2be234d8d0) - fix(i18n): validate set_locale and force_locale, store set_locale only after authentication (GHSA-h7x6-9mqf-vgmx) @Paul-Bob (
avo v.3.33.1#4894)
🤖 Maintenance
Dependency changes
- pagy (>= 7.0.0, < 43)
+ pagy (>= 7.0.0)
