Replace require_dependency with fully qualified superclasses (#4687)

Mihai-Munteanu · claude · Paul-Bob · web-flow · commit 8f95ab6fa4cb · 2026-08-04T11:47:33.000+03:00
Co-authored-by: Claude Opus 5 (1M context) &lt;noreply@anthropic.com&gt;
Co-authored-by: Paul Bob &lt;paul.ionut.bob@gmail.com&gt;
diff --git a/app/controllers/avo/actions_controller.rb b/app/controllers/avo/actions_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/application_controller"
-
 module Avo
-  class ActionsController < ApplicationController
+  class ActionsController < Avo::ApplicationController
     before_action :set_resource_name, :set_resource
     before_action :set_query, :set_record, :set_action, :verify_authorization, only: [:show, :handle]
     before_action :set_fields, only: :handle
diff --git a/app/controllers/avo/appearance_settings_controller.rb b/app/controllers/avo/appearance_settings_controller.rb
@@ -1,5 +1,5 @@
 module Avo
-  class AppearanceSettingsController < ApplicationController
+  class AppearanceSettingsController < Avo::ApplicationController
     def update
       appearance = Avo.configuration.appearance
 
diff --git a/app/controllers/avo/array_controller.rb b/app/controllers/avo/array_controller.rb
@@ -1,5 +1,5 @@
 module Avo
-  class ArrayController < BaseController
+  class ArrayController < Avo::BaseController
     def set_query
       @query ||= @resource.fetch_records
     end
diff --git a/app/controllers/avo/associations_controller.rb b/app/controllers/avo/associations_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/base_controller"
-
 module Avo
-  class AssociationsController < BaseController
+  class AssociationsController < Avo::BaseController
     before_action :set_record, only: [:show, :index, :new, :create, :destroy]
     before_action :set_related_resource_name
     before_action :set_related_resource, only: [:show, :index, :new, :create, :destroy]
diff --git a/app/controllers/avo/attachments_controller.rb b/app/controllers/avo/attachments_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/application_controller"
-
 module Avo
-  class AttachmentsController < ApplicationController
+  class AttachmentsController < Avo::ApplicationController
     before_action :set_resource_name, only: [:destroy, :create]
     before_action :set_resource, only: [:destroy, :create]
     before_action :set_record, only: [:destroy, :create]
diff --git a/app/controllers/avo/base_controller.rb b/app/controllers/avo/base_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/application_controller"
-
 module Avo
-  class BaseController < ApplicationController
+  class BaseController < Avo::ApplicationController
     include Avo::Concerns::FiltersSessionHandler
     include Avo::Concerns::AssociationQueryScope
     include Avo::Concerns::SafeCall
diff --git a/app/controllers/avo/charts_controller.rb b/app/controllers/avo/charts_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/base_controller"
-
 module Avo
-  class ChartsController < BaseController
+  class ChartsController < Avo::BaseController
     # Summarizable charts reuse the index query pipeline (including policy scope via
     # `query_scope`). They were never meant to require `distribution_chart?` /
     # `distribution_chart_full?` policy methods — those only surfaced once
diff --git a/app/controllers/avo/debug_controller.rb b/app/controllers/avo/debug_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/application_controller"
-
 module Avo
-  class DebugController < ApplicationController
+  class DebugController < Avo::ApplicationController
     before_action :authenticate_developer_or_admin!
 
     def status
diff --git a/app/controllers/avo/home_controller.rb b/app/controllers/avo/home_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/application_controller"
-
 module Avo
-  class HomeController < ApplicationController
+  class HomeController < Avo::ApplicationController
     def index
       if Avo.configuration.home_path.present?
         # If the home_path is a block run it, if not, just use it
diff --git a/app/controllers/avo/media_library_controller.rb b/app/controllers/avo/media_library_controller.rb
@@ -1,5 +1,5 @@
 module Avo
-  class MediaLibraryController < ApplicationController
+  class MediaLibraryController < Avo::ApplicationController
     include Pagy::Method
 
     before_action :authorize_access!
diff --git a/app/controllers/avo/private_controller.rb b/app/controllers/avo/private_controller.rb
@@ -1,7 +1,5 @@
-require_dependency "avo/application_controller"
-
 module Avo
-  class PrivateController < ApplicationController
+  class PrivateController < Avo::ApplicationController
     before_action :authenticate_developer_or_admin!
 
     def design
diff --git a/app/controllers/avo/resources_controller.rb b/app/controllers/avo/resources_controller.rb
@@ -1,6 +1,4 @@
-require_dependency "avo/base_controller"
-
 module Avo
-  class ResourcesController < BaseController
+  class ResourcesController < Avo::BaseController
   end
 end
diff --git a/app/controllers/avo/search_controller.rb b/app/controllers/avo/search_controller.rb
@@ -3,10 +3,8 @@
 # This controller is currently only used for searchable fields, it keeps the old search controller without any changes
 # Possibly have much more logic that it uses, but it's not worth the effort to refactor it since we're going to replace it with a new searchable fields way
 
-require_dependency "avo/application_controller"
-
 module Avo
-  class SearchController < ApplicationController
+  class SearchController < Avo::ApplicationController
     include Rails.application.routes.url_helpers
     include ActionView::Helpers::TextHelper
 
diff --git a/avo.gemspec b/avo.gemspec
@@ -28,7 +28,7 @@ Gem::Specification.new do |spec|
       "public gem pushes."
   end
 
-  spec.required_ruby_version = ">= 3.0.0"
+  spec.required_ruby_version = ">= 3.2.0"
   spec.post_install_message = "Thank you for using Avo 💪  Docs are available at https://docs.avohq.io"
 
   # NOTE: `public/` is rejected below — Avo 4 ships precompiled assets from
diff --git a/spec/lib/avo/autoloading_spec.rb b/spec/lib/avo/autoloading_spec.rb
@@ -0,0 +1,52 @@
+require "rails_helper"
+
+# `require_dependency` was deprecated in Rails 8.2 and is removed in Rails 9.
+# See https://github.com/rails/rails/pull/56992 and AVO-1105.
+#
+# Avo's controllers used it to force-load their parent class before Ruby
+# resolved the superclass constant. That was only ever needed under the classic
+# autoloader; Zeitwerk registers `Avo::ApplicationController` up front, so the
+# lookup can no longer fall through to the host app's top-level
+# `ApplicationController`.
+RSpec.describe "Avo autoloading" do
+  describe "require_dependency" do
+    it "is not used anywhere in app/ or lib/" do
+      offenders = Dir.glob(Avo::Engine.root.join("{app,lib}", "**", "*.rb")).select do |path|
+        File.foreach(path).any? { |line| line.match?(/^\s*require_dependency\b/) }
+      end
+
+      relative = offenders.map { |path| Pathname.new(path).relative_path_from(Avo::Engine.root).to_s }
+
+      expect(relative).to be_empty,
+        "require_dependency is removed in Rails 9. Delete it and fully qualify the superclass instead:\n" \
+        "#{relative.map { |path| "  #{path}" }.join("\n")}"
+    end
+  end
+
+  # This is the assertion that actually has teeth. The dummy app defines its own
+  # top-level `ApplicationController`, which is exactly the constant a relative
+  # superclass reference inside `module Avo` would silently fall through to.
+  describe "controller inheritance" do
+    it "has a host-app ApplicationController available to be resolved by mistake" do
+      expect(defined?(::ApplicationController)).to eq("constant")
+      expect(::ApplicationController).not_to eq(Avo::ApplicationController)
+    end
+
+    {
+      "Avo::ActionsController" => "Avo::ApplicationController",
+      "Avo::AttachmentsController" => "Avo::ApplicationController",
+      "Avo::BaseController" => "Avo::ApplicationController",
+      "Avo::DebugController" => "Avo::ApplicationController",
+      "Avo::HomeController" => "Avo::ApplicationController",
+      "Avo::PrivateController" => "Avo::ApplicationController",
+      "Avo::SearchController" => "Avo::ApplicationController",
+      "Avo::AssociationsController" => "Avo::BaseController",
+      "Avo::ChartsController" => "Avo::BaseController",
+      "Avo::ResourcesController" => "Avo::BaseController"
+    }.each do |controller, expected_parent|
+      it "resolves #{controller} to #{expected_parent}, not the host app's" do
+        expect(controller.constantize.superclass).to eq(expected_parent.constantize)
+      end
+    end
+  end
+end
