From ef0f0ba723cf5b6fdd60bf069e21704a668c93c4 Mon Sep 17 00:00:00 2001 From: Joel Hawksley Date: Fri, 27 Mar 2026 09:57:22 -0600 Subject: [PATCH] Ignoring vendor directory considered harmful By default, Herb currently ignores the `vendor` directly. This is potentially quite harmful, as it could expose consuming applications to runtime exceptions. For example. We vendor https://github.com/primer/view_components in our application. The dependency includes ViewComponents with ERB files, including a few that will not compile with Herb. If we don't compile the templates in our test environment, those Herb compilation errors will not be caught. I see similar risks for other gems that provide UI, such as as dashboards mounted via an engine. We thankfully discovered this issue and manually added `vendor/**/*.erb` to our `include` configuration, but I'm wary of blankly excluding the directory silently by default, especially when we describe the behavior of `herb analyze` as `Running herb analyze without arguments now defaults to the current directory`. This could make one believe that all subdirectories are being analyzed based on the config in the user's `.herb.yml` file, but in fact it is the combination of `defaults.yml` and the user's configuration. Signed-off-by: Joel Hawksley --- lib/herb/defaults.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/herb/defaults.yml b/lib/herb/defaults.yml index 3c08b6e21..25c7411d5 100644 --- a/lib/herb/defaults.yml +++ b/lib/herb/defaults.yml @@ -14,7 +14,6 @@ files: - "node_modules/**/*" - "storage/**/*" - "tmp/**/*" - - "vendor/**/*" engine: validators: