thredded | The best Rails forums engine | Collaboration library

In one of my repositories today, I got this security notification:

I have a third party gem, thredded, that tries to access jQuery when I require it in my application.js. When I load it in my application.js as seen below, I get an error.

On my Rails 5.0.7 application I have Thredded (0.15.4) mounted as an engine in a namespace.

We're using Chrome headless with Capybara and Selenium for three js feature tests.

We're having a predictable (only on CI) failure when one specific js test (using xhr) follows another which also uses xhr (see https://github.com/thredded/thredded/tree/separate-out-js-from-non-js-in-ci for the code or https://travis-ci.org/thredded/thredded/jobs/302376004 for a sample run).

The server error is always being surfaced in the next spec "User creates new topic with title and content" but the url is evidently from the previous spec "User replying to a topic starts a quote-reply (js)".

The obvious thing is that there is a race condition between a request that falls off the end of the spec and happens after DatabaseCleaner.clean. However, my understanding is that with Capybara 2.7+ [1] after_each should happen after a reset_session! which should prevent this precise problem. In any case I am pretty sure there is nothing in the page that could be creating this request (we have a specific wait/test for the completion of this ajax request).

This is happening with 3 different databases and 3 different rails versions (4.2, 5.0, 5.1). We've upgraded to latest Capybara.

Have tried disabling turbolinks, adding in a massive (10s) sleep at the end of the offending spec... Have tried manually resetting sessions too.

Must be missing something. Any pointers?

[1] https://github.com/teamcapybara/capybara/pull/1637 referenced from https://bibwild.wordpress.com/2016/02/18/struggling-towards-reliable-capybara-javascript-testing/

UPDATE: Have added references to xhr, as another (new) js spec is having the problem, and that it isn't the first two requests (login form, and post to login) that is surfacing the error, but the first xhr request that surfaces the error. In the new case the xhr that is getting requested is being requested with POST in the subsequent spec even though it was originall requested with GET

Created a Rails 5 app using devise for auth and attempting to add Thredded gem for forums.

The app should load at http://localhost:3000.

After server starts, the following message shows up in the chrome browser where the app should be.

I've been integrated Thredded into my rails app. It is the first forum engine I've tried, and it is cool. Just recently, I am willing to completely remove some messageboards, but the messageboards controller itself does not have the destroy action. I've tried adding it manually, and it leads me to override more and more classes, models, etc, yet with no success.

Any clues would be appreciated!