Search overlay panel for performing site-wide searches

Boost Performance & Scale with Postgres Advanced. Join Pilot Now!

Developer Tools

Buildpacks Go Cloud Native, Turning Source Code into Docker Images

Your Heroku application’s journey to production begins with a buildpack that detects what kind of app you have, what tools you need to run, and how to tune your app for peak performance. In this way, buildpacks reduce your operational burden and let you to spend more time creating value for your customers. That’s why we’re excited to announce a new buildpack initiative with contributions from Heroku and Pivotal.

The Cloud Native Computing Foundation (CNCF) …

VPN Support for Heroku Private Spaces

Today we're excited to announce Site-to-Site Virtual Private Network (VPN) support for Heroku Private Spaces. Heroku customers can now establish secure, site-to-site IPsec connections between Private Spaces on Heroku and their offices, datacenters and deployments on non-AWS clouds.

VPN is a powerful, proven and widely-adopted technology for securely combining multiple networks (or adding individual hosts to a network) over encrypted links that span the public Internet. VPN is well-understood and in use by most enterprise IT departments, and is supported on all major cloud providers and by a range of hardware and software-based systems.

Internal Routing for Private Space Apps

Today we’re announcing a powerful new network control for apps running in Heroku Private Spaces: Internal Routing. Apps with Internal Routing work exactly the same as other Heroku apps, except the web process type is published to an endpoint that’s routable only within the Private Space and on VPC and VPN peered networks (see the Private Space VPN support companion post). Apps with Internal Routing are impossible to access directly from the public internet, improving security and simplifying management and compliance checks for web sites, APIs and services that must not be publicly accessible.

Beyond Web and Worker: Evolution of the Modern Web App on Heroku

This is the first in a series of blog posts examining the evolution of web app architecture over the past 10 years. This post examines the forces that have driven the architectural changes and a high-level view of a new architecture. In future posts, we’ll zoom in to details of specific parts of the system.

The standard web application architecture suitable for many organizations has changed drastically in the past 10 years. Back in Heroku’s …

Rails Asset Pipeline Directory Traversal Vulnerability (CVE-2018-3760)

All previously released versions of Sprockets, the software that powers the Rails asset pipeline, contain a directory traversal vulnerability. This vulnerability has been assigned CVE-2018-3760.

How do I know if I'm affected?

Rails applications are vulnerable if they have this setting enabled in their application:

# config/environments/production.rb config.assets.compile = true # setting to true makes your app vulnerable

Note: The default value of this setting that ships with Rails in production.rb is …

Heroku CLI: Completing Autocomplete

The CLI Team at Heroku strives to create a CLI user experience that is intuitive and productive. We had “build CLI autocomplete” in the icebox of our roadmap for many years. But if we were going to ship it, it had to complement the existing CLI experience. This is challenging because the Heroku CLI is very dynamic: it comprises user installable plugins, and the data needed for completions is behind an API.

Recently, we spent …

Announcing Heroku CLI Autocomplete for Bash and Zsh

Today we're excited to announce that Heroku CLI Autocomplete for Bash and Zsh is generally available. Heroku CLI Autocomplete makes your workflow faster and more seamless by helping you complete command and flag names when you press the tab key. Autocomplete completes all Heroku CLI commands and will automatically support new commands as they are added. You can also complete values for some flags and args—including apps, pipelines and config vars—so you won't need to …

Securing Dependencies for Rails 5.2 Active Storage

The Public Cloud Security (PCS) group at Salesforce partners very closely with Heroku engineering to review and advise on new product features across the platform, from infrastructure to applications. One of the most rewarding aspects about this partnership and working on this team for me is when we not only identify security concerns, but take an active role in building safe solutions.

Heroku recently announced support for Active Storage in Rails 5.2, which introduces the …

Rails 5.2 Active Storage: Previews, Poppler, and Solving Licensing Pitfalls

Rails 5.2 was just released last month with a major new feature: Active Storage. Active Storage provides file uploads and attachments for Active Record models with a variety of backing services (like AWS S3). While libraries like Paperclip exist to do similar work, this is the first time that such a feature has been shipped with Rails. At Heroku, we consider cloud storage a best practice, so we've ensured that it works on our platform. …

Ruby CVE-2017-17405: Vulnerability in Ruby’s FTP Implementation

At Heroku we consistently monitor vulnerability feeds for new issues. Once a new vulnerability drops, we jump into action to triage and determine how our platform and customers may be affected. Part of this process involves evaluating possible attack scenarios not included in the original vulnerability report. We also spend time looking for “adjacent” and similar bugs in other products. The following Ruby vulnerability was identified during this process.

Vulnerability Triage

A vulnerability, CVE-2017-8817, …

Subscribe to the full-text RSS feed for Developer Tools.