Use the released version of responders v3.1.0

Unfortunately we can't enforce the version in the gemspec because
responders only supports Rails 5.2 now, and Devise still supports
previous versions.

We'll drop support for those in a future major release, so for now I'm
not adding any version.

This also adds a warning in case someone is using an older version of
responders and tries to set the error/redirect statuses via Devise, so
that they know what to do (upgrade responders) in that case.

CHANGELOG.md

@@ -3,8 +3,7 @@
 * enhancements
   * Add support for Ruby 3.1/3.2.
   * Add support for Hotwire + Turbo, default in Rails 7+.
-    * `:turbo_stream` is now treated as a navigational format, so it works like HTML navigation when using Turbo. Note: if you relied on `:turbo_stream` to be treated as a non-navigational format before, you can reconfigure your `navigational_formats` in the Devise initializer file to exclude it.
-    * Devise requires the latest `responders` version, which allows configuring the status used for validation error responses (`error_status`) and for redirects after POST/PUT/PATCH/DELETE requests (`redirect_status`). For backwards compatibility, Devise keeps `error_status` as `:ok` which returns a `200 OK` response, and `redirect_status` to `:found` which returns a `302 Found` response, but you can configure it to return `422 Unprocessable Entity` and `303 See Other` to match the behavior expected by Hotwire/Turbo:
+    * Devise uses the latest `responders` version (v3.1.0 or higher), which allows configuring the status used for validation error responses (`error_status`) and for redirects after POST/PUT/PATCH/DELETE requests (`redirect_status`). For backwards compatibility, Devise keeps `error_status` as `:ok` which returns a `200 OK` response, and `redirect_status` to `:found` which returns a `302 Found` response, but you can configure it to return `422 Unprocessable Entity` and `303 See Other` respectively, to match the behavior expected by Hotwire/Turbo:
 
       ```ruby
       # config/initializers/devise.rb
@@ -16,7 +15,10 @@
       end
       ```
 
-      These configs are already generated by default with new apps, and existing apps may opt-in as described above. Note that these defaults may change in future versions of Devise, to better match the Rails + Hotwire/Turbo defaults across the board.
+      These configs are already generated by default with new apps, and existing apps may opt-in as described above. Trying to set these with an older version of `responders` will issue a warning and have no effect, so please upgrade the `responders` version if you're upgrading Devise for this integration. Note that these defaults may change in future versions of Devise, to better match the Rails + Hotwire/Turbo defaults across the board.
+    * If you have a custom responder set on your application and expect it to affect Devise as well, you may need to override the Devise responder entirely with `config.responder = MyApplicationResponder`, so that it uses your custom one. The main reason Devise uses a custom responder is to be able to configure the statuses as described above, but you can also change that config on your own responder if you want. Check the `responders` readme for more info on that.
+    * If you have created a custom responder and/or failure app just to customize responses for better Hotwire/Turbo integration, they should no longer be necessary.
+    * `:turbo_stream` is now treated as a navigational format, so it works like HTML navigation when using Turbo. Note: if you relied on `:turbo_stream` to be treated as a non-navigational format before, you can reconfigure your `navigational_formats` in the Devise initializer file to exclude it.
     * OmniAuth "Sign in with" links were changed to buttons that generate HTML forms with method=POST, instead of using link + method=POST that required rails/ujs to work. Since rails/ujs is no longer the default for new Rails apps, this allows the OmniAuth buttons to work in any scenario, with or without rails/ujs and/or Turbo. This only affects apps that are using the default `devise/shared/_links.html.erb` partial from Devise with OmniAuth enabled.
 
 ### 4.8.1 - 2021-12-16

Gemfile

@@ -11,7 +11,7 @@ gem "rdoc"
 
 gem "rails-controller-testing", github: "rails/rails-controller-testing"
 
-gem "responders", github: "heartcombo/responders", branch: "main"
+gem "responders", "~> 3.1"
 
 group :test do
   gem "nokogiri", "< 1.13"

Gemfile.lock

@@ -1,12 +1,3 @@
-GIT
-  remote: https://github.com/heartcombo/responders.git
-  revision: fb9f787055a7a842584ce351793b249676290090
-  branch: main
-  specs:
-    responders (3.0.1)
-      actionpack (>= 5.2)
-      railties (>= 5.2)
-
 GIT
   remote: https://github.com/rails/rails-controller-testing.git
   revision: 351c0162df0771c0c48e6a5a886c4c2f0a5d1a74
@@ -198,6 +189,9 @@ GEM
     rake (13.0.6)
     rdoc (6.5.0)
       psych (>= 4.0.0)
+    responders (3.1.0)
+      actionpack (>= 5.2)
+      railties (>= 5.2)
     rexml (3.2.5)
     ruby-openid (2.9.2)
     ruby2_keywords (0.0.5)
@@ -237,7 +231,7 @@ DEPENDENCIES
   rails (~> 7.0.0)
   rails-controller-testing!
   rdoc
-  responders!
+  responders (~> 3.1)
   rexml
   sqlite3 (~> 1.4)
   timecop

README.md

@@ -493,6 +493,8 @@ Devise.setup do |config|
 end
 ```
 
+**Important**: these custom responses require the `responders` gem version to be `3.1.0` or higher, please make sure you update it if you're going to use this configuration.
+
 _Note_: the above statuses configuration may become the default for Devise in a future release.
 
 ### I18n

gemfiles/Gemfile-rails-6-0

@@ -9,7 +9,7 @@ gem "rdoc"
 
 gem "rails-controller-testing", github: "rails/rails-controller-testing"
 
-gem "responders", github: "heartcombo/responders", branch: "main"
+gem "responders", "~> 3.1"
 
 group :test do
   gem "nokogiri", "< 1.13"

gemfiles/Gemfile-rails-6-1

@@ -9,7 +9,7 @@ gem "rdoc"
 
 gem "rails-controller-testing", github: "rails/rails-controller-testing"
 
-gem "responders", github: "heartcombo/responders", branch: "main"
+gem "responders", "~> 3.1"
 
 if RUBY_VERSION >= "3.1"
   gem "net-smtp", require: false

gemfiles/Gemfile-rails-main

@@ -9,7 +9,7 @@ gem "rdoc"
 
 gem "rails-controller-testing", github: "rails/rails-controller-testing"
 
-gem "responders", github: "heartcombo/responders", branch: "main"
+gem "responders", "~> 3.1"
 
 group :test do
   gem "nokogiri", "< 1.13"

lib/devise/controllers/responder.rb

@@ -19,6 +19,16 @@ module Devise
         def self.redirect_status
           :found
         end
+
+        def self.error_status=(*)
+          warn "[DEVISE] Setting the error status on the Devise responder has no effect with this " \
+            "version of `responders`, please make sure you're using a newer version. Check the changelog for more info."
+        end
+
+        def self.redirect_status=(*)
+          warn "[DEVISE] Setting the redirect status on the Devise responder has no effect with this " \
+            "version of `responders`, please make sure you're using a newer version. Check the changelog for more info."
+        end
       end
     end
   end