v0.7.0

Klaxon lives

This release updates Klaxon's entire stack and completely rebuilds the bookmarklet to avoid CSP errors. In spite of all of this no changes to the database schema have been made. This new release is already live on The Marshall Project's Klaxon instance. If you were running successfully on v0.6.0 like us, your database should be happy with v0.7.0.

Framework & runtime upgrades

• Ruby: 3.1.4 → 3.4.8
• Rails: 7.0 → 8.1
• All gems updated; many unused ones removed

Bookmarklet rewrite

The bookmarklet has been completely rebuilt. The old iframe-based approach was broken for years due to CSP restrictions. It has been replaced with a new implementation that lets users pick an element on the page with visual feedback, then redirects to Klaxon to finish. The selection logic has been vastly improved as well, resulting in shorter/more-optimal selectors when possible.

However, there is one major caveat: Users will need to re-install the bookmarklet after upgrading. It was impossible to make this change backwards-compatible due to how the legacy bookmarklet loaded.

Docker images

Klaxon now automatically builds and publishes Docker images to the GitHub Container Registry (GHCR). Images are built and pushed on every push to main (tagged latest) and on published releases (tagged with the semver version). Images are available at ghcr.io/themarshallproject/klaxon and provide a ready-to-run option.

Klaxon is still BYO database and configuration, however! You will need to prepare an environment to run this Docker image.

Still on Heroku? Read this!

If your Heroku app was created before this release, you need to add the Node.js buildpack once before your next deploy so Heroku can generate the bookmarklet. In Heroku’s Settings tab, add heroku/nodejs above heroku/ruby in the Buildpacks section (or run heroku buildpacks:add --index 1 heroku/nodejs from the CLI). New apps created from the Deploy button already get both buildpacks via app.json.

v0.6.0

This release is mostly focused on dramatically bringing Klaxon up to current Rails standards. This includes an upgrade to Rails 7 and a jump from Ruby 2 to Ruby 3. The biggest benefit here is that this means Klaxon is no longer running on an insecure version of either Rails or Ruby. This also makes it eligible to run on Heroku's latest stack.

We also prioritized getting the codebase in order. There were a number of unused dependencies and files that Klaxon had collected over the years. A mostly thorough audit was done to determine what could be removed from the project.

Finally the biggest change has to do with Docker — almost all of the preexisting Docker setup has been removed. Much of what was here prior had slowly been built-up over the years by multiple contributors. Unfortunately it had reached a point where we did not feel confident about our ability to maintain and/or support it in that state. We are however exploring better paths forward — thanks to the excellent dockerfile-rails project we now have a much better Dockerfile to build off of.

v0.5.1

This version removes the dependency on revoked versions of the mimemagic gem. It also adds a simple task for exporting the contents of a page's snapshots to files on disk.

v0.5.0

This is a fairly minor update, but important for people creating new Klaxon instances on Heroku. Relatedly, we've upgraded to using Ruby 2.7.2. That is the reason for the minor version bump.

There's also a bug fix for an issue that may have been causing some manually entered CSS selectors to not function properly. So it's possible you might start seeing alerts from pages that weren't being properly monitored before.

Thanks to @captn3m0 for the docker patch, and to @harrislapiroff, and @tszumowski for their help in identifying and debugging ongoing Sendgrid issues, some of which is reflected in updates to the documentation.

v0.4.0

This is a small but important update that has the potential to break some setups. If you've been setting the KLAXON_FORCE_SSL environment variable to false in production, you will have trouble using certain browsers (notably chrome) to log in to Klaxon. If you have no idea what I'm talking about, you're probably fine.

In order to fix #377 I've updated all of Klaxon's cookies to use the SameSite=None attribute. In order to accept those cookies, Chrome requires the Secure attribute to also be present, which can only be set on cookies delivered over HTTPS. If you've been using Klaxon without HTTPS (it's on by default in the Heroku setup), I urge you to upgrade to HTTPS for your instance. If that's impractical, please get in touch with me and we can work something out.

Thanks to @immewnity for contributing discord support in this release!

v0.3.4

This minor release includes a whole raft of minor dependency updates and documentation clarifications. In addition you can now preview the (unstyled) html for a snapshot, if you want to take a quick look at a page at a given point in history (h/t @tommeagher).

Thanks to @wktk, @walinchus, @tommeagher, @p53ud0k0d3, @immewnity, and everyone else who contributed code, reported bugs or gave feedback.

As always we welcome any and all feedback and contributions!

v0.3.3

This release includes better docker support (thanks to @AnalogJ, @chriszs and @AlJohri). Special thanks to @AnalogJ who has helped us get a klaxon image up and running on Docker Hub. If you deploy Klaxon through Docker, take a close look at this release. You may need to modify your setup a little bit, especially as it relates to scheduling the rake check:all task.

This release also includes a new feature thanks to @kevinschaul. You can now exclude portions of a matched section of text on a page. This should help in situations where it's easier to specify the parts of a page to ignore than the parts to watch.

This release also includes a number of dependency updates.

v0.3.2

Fixes an issue with deploying new Klaxon instances.

v0.3.0

This version includes a whole raft of dependency updates thanks to @greysteil and @dependabot-bot. There are a few other minor but important bug fixes including #202.

I've made this a minor version bump mostly because of the potential for issues during the upgrade process. Basically every single one of the dependencies (including Ruby) have been bumped. I'm optimistic that everything will go smoothly, but be warned that there is higher than usual potential for issues during upgrade.

v0.2.9

Minor dependency updates to deal with vulnerability in sprockets. More: https://blog.heroku.com/rails-asset-pipeline-vulnerability.