
Security News
Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Rails eager_load
, includes
, preload
can break when changing table or association names. These breaking changes are often discovered in production due to the tricky nature of testing the existence of all the associations listed in the includes
. Proper testing is error prone because it requires that all of the listed associations are built during the tests. This gem makes it trivial to test that the associations exist so that you can quickly find the includes
to fix when refactoring data models.
Add this line to your application's Gemfile:
gem 'eagerbeaver'
And then execute:
$ bundle
Or install it yourself as:
$ gem install eagerbeaver
The constructor takes the model as the first parameter and the includes
array as the second parameter:
EagerBeaver.new(MyModel, [:association1, :association2, assoc3: { foo: :bar }])
The instance has one public method, .errors
, which returns an array of error messages describing unknown associations.
Imagine we have the following class:
class Lease < ActiveRecord::Base
has_many :lease_terms
has_many :spaces, through: :lease_terms
belongs_to :tenant
end
with the corresponding controller:
class LeasesController < ApplicationController
def index
leases = Lease.all.includes(self.class.lease_includes)
# do some stuff
end
def self.lease_includes
[
:lease_terms,
:spaces,
:tenant,
:foobar
]
end
end
We can ensure that our lease_includes
is valid by testing it:
describe LeasesController do
describe 'includes' do
it 'is valid' do
expect(EagerBeaver.new(Lease, LeasesController.lease_includes).errors).to be_empty
end
end
end
This expectation would fail, because .errors
will return ['foobar is not an association of Lease']
.
EagerBeaver works with nested includes
as well. Check out the specs to see more examples.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that eagerbeaver demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.