After a bit of a release hiatus, Merb is back with a release of version 1.0.15 that provides fixes to a few long standing bugs, and adds built-in support for the much improved 0.10.x series of Datamapper.

Fixes to merb-core:

• run_later now works correctly with Phusion Passenger (thanks Hongli!)
• Fixed a potential security hole within cookie sessions. More information available at http://codahale.com/a-lesson-in-timing-attacks/
• Fixed overwriting of config options on rake tasks
• Fixed webrat test helper declaration so specs work correctly in generated apps without webrat installed

Fixes to merb-more:

• Form helpers now create valid html ids (using underscores instead of brackets)
• Cleaner sass integration in merb-haml
• merb-auth now uses the correct config value for overridding password strategies

Fixes to merb.thor:

• Now works correctly on RubyGems 1.3.5
• Gem dependency is now explicit to version 0.9.9 of thor (later versions break the tasks)
• Run `merb-gen thor` in order to update your existing 1.0.x app with these changes

Contributors

Special thanks to the contributors who helped with this release:

• Martin Gamsjaeger (snusnu)
• Pavel Kunc (pk)
• Jacques Crocker (merbjedi)
• Jonathon Stott (namelessjon)
• Oliver Jakubiec (ojak)
• Carl Porth (badcarl)
• Tymon Tobolski (teamon)
• Hongli Lai (Phusion)

A minor spec 1.0 change.

A small fix was required within the spec10 directory. Even though its minor, we promised to document any changes to this directory. Within spec10/public/test/multipart_request_helper_spec.rb, we were using:

file_params[:tempfile].should be_a_kind_of(File)

in order to verify processing of multipart upload. These spec’s worked by accident because of a bug in a previous version of rSpec which incorrectly allowed for this to pass. Newer versions of rSpec rightly cause this assertion to fail. The spec has now been changed to the more accurate:

file_params[:tempfile].should be_a_kind_of(Tempfile)

Upwards and Onwards

Merb 1.1 development has heated up, and a release is tentatively scheduled for mid November (at RubyConf). Major changes will include built-in support for the new Bundler gem (github.com/wycats/bundler), support for ActiveORM, and many other fixes from the Merb lighthouse.