Are there plans to release version 4.0.0?

[pedrofurtado]

@rafaelfranca @schneems

Are there plans to release version 4.0.0? This version is in beta since 2016. It will be a great feature to support ES6 🎉

[rafaelfranca]

I actually don't remember if we have blockers, but I guess we should release it.

[pedrofurtado]

@rafaelfranca @schneems Thats a great news!

[MicahBrown]

When will this be released? We're looking forward to the source map support.

[schneems]

Right now i'm the blocker. It's fine to release

[MicahBrown]

@schneems Okay, great! Thanks for your guys' work on this!

[SeanRoy]

Is there any status on this?
Fetching gem metadata from https://rubygems.org/.................
Could not find gem 'sprockets (~> 4.0) java' in any of the gem sources listed in
your Gemfile.

[scarroll32]

Today I am getting security errors for sprockets from GitHub .. .and the recommendation is to downgrade to 2.7.1 (probably because 4x is beta)

[scarroll32]

Workaround is to use the beta

gem 'sprockets', '~> 4.0.0.beta8'

[deivid-rodriguez]

Getting 4.0 out would be great, but this one seems like a false positive from Github? This CVE is from 2014 and only versions before 3.0.0.beta.3 were affected in the 3.x series, it seems?

[tgaff]

Seconding that this might be a false positive. From the CVE (emphasis mine):

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3

[rafaelfranca]

Yes. GitHub is wrong. Please report to them that this vulnerability is invalid.

[deivid-rodriguez]

I think they already fixed it? At least I no longer see the alert, happily :)

[krisleech]

Also sprockets 3.x depends on sass which is EOL in January. See #588.

[floriank]

I am currently building a new version of our backoffice and my frontend developers force me to consider a newer JavaScript Version.

I think they have learned how to build weapons. They know the terrain.

Please hurry.

I am sca

[scarroll32]

I think they have learned how to build weapons. They know the terrain.

hilarious !

[DeeDeeG]

I think this blocks the sass-rails gem from supporting sassc, from looking at this Pull Request: rails/sass-rails#349

This depends on sprockets master (#148)

(I suppose they can't publish to rubygems.org with a dependency on git master of sprockets.)

[ahorek]

Why don't you use https://github.com/sass/sassc-rails ?

[DeeDeeG]

Not to get too off-topic, but lots of folks are on sass-rails currently, and it's pretty much the default option (owned by the Rails GitHub org account), so basically my concern is toward improving the default Rails infrastructure and ensuring ease of transition over to Sassc for other app maintainers (and myself I suppose).

But yeah, we (edit to clarify: "we" meaning the project I work on, which is not affiliated with Rails or Sprockets) are looking into using sassc-rails.

[schneems]

Sprockets 4 also depends on sass FWIW.

[DeeDeeG]

I think Sprockets only needs Ruby Sass during development?
https://rubygems.org/gems/sprockets/versions/4.0.0.beta8

I have sprockets in my project's Gemfile.lock, but sprockets isn't pulling in sass to my project.

[jaredbeck]

Given that @schneems hurt his hand (https://twitter.com/schneems/status/1115328034989584385) is there anyone else who can finish this release? @rafaelfranca ?

[dometto]

This would be great, especially because since #592 this gem allows sprockets users to update to sassc (and the sass gem is deprecated)!

[freesteph]

Any updates on this release? 🙏

[ahorek]

for me the main blocker is #581 sass/sassc-ruby#133
sassc / sass-rails is the only supported option for ruby & sass right now. So I hope that this could be fixed before the final release.

[dometto]

Monthly ping @schneems :)

[wlipa]

I've been using the 4.0 beta in production for coming up on two years. It's just as stable as anything else. If there is a purpose served by keeping it in beta for so long, I am not sure what it is.

[schneems]

I put an entry on my calendar to release it on October 9th.

…

On Fri, Sep 27, 2019 at 3:16 PM Bill Lipa ***@***.***> wrote: I've been using the 4.0 beta in production for coming up on three years. It's just as stable as anything else. If there is a purpose served by keeping it in beta for so long, I am not sure what it is. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#565?email_source=notifications&email_token=AAAOSYHIE3U4XJT4GCL6RBDQLZS2BA5CNFSM4FNBNGBKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7Z7OOI#issuecomment-536082233>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAOSYGEQ6LN6SNMNPE2M53QLZS2BANCNFSM4FNBNGBA> .

-- Richard Schneeman https://www.schneems.com

[schneems]

4.0.0 is out, use it now