Skip to content
This repository was archived by the owner on Jul 19, 2022. It is now read-only.

🚨 [security] Update all of rails: 5.0.7 → 5.0.7.2 (minor)#18

Open
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/group/rails-5.0.7.2
Open

🚨 [security] Update all of rails: 5.0.7 → 5.0.7.2 (minor)#18
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/group/rails-5.0.7.2

Conversation

@depfu
Copy link

@depfu depfu bot commented Mar 13, 2019

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

⚠️ No CI detected ⚠️

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

  • Our friends at Travis-CI provide excellent service.
  • Circle CI is good, too, and has a free plan that will cover basic needs.
  • If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
  • If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with depfu/.

🚨 Your version of actionview has known security vulnerabilities 🚨

Advisory: CVE-2019-5419
Disclosed: March 13, 2019
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI

Denial of Service Vulnerability in Action View

There is a potential denial of service vulnerability in actionview.
This vulnerability has been assigned the CVE identifier CVE-2019-5419.

Impact

Specially crafted accept headers can cause the Action View template location
code to consume 100% CPU, causing the server unable to process requests. This
impacts all Rails applications that render views.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Workarounds

This vulnerability can be mitigated by wrapping render calls with
respond_to blocks. For example, the following example is vulnerable:

class UserController < ApplicationController
  def index
    render "index"
  end
end

But the following code is not vulnerable:

class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end

Implicit rendering is impacted, so this code is vulnerable:

class UserController < ApplicationController
  def index
  end
end

But can be changed this this:

class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end

Alternatively to specifying the format, the following monkey patch can be
applied in an initializer:

$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true

ActionDispatch::Request.prepend(Module.new do

def formats

super().select do |format|

format.symbol || format.ref == "/"

end

end

end)

Credits

Thanks to John Hawthorn [email protected] of GitHub


🚨 We recommend to merge and deploy this update as soon as possible! 🚨

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (5.0.7 → 5.0.7.2) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ actioncable (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ actionmailer (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ actionpack (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ actionview (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ activejob (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ activemodel (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ activerecord (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ activesupport (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ concurrent-ruby (indirect, 1.0.5 → 1.1.5) · Repo · Changelog

Release Notes

1.1.5 (from changelog)

concurrent-ruby:

  • fix potential leak of context on JRuby and Java 7

concurrent-ruby-edge:

  • Add finalized Concurrent::Cancellation
  • Add finalized Concurrent::Throttle
  • Add finalized Concurrent::Promises::Channel
  • Add new Concurrent::ErlangActor

1.1.4 (from changelog)

  • (#780) Remove java_alias of 'submit' method of Runnable to let executor service work on java 11
  • (#776) Fix NameError on defining a struct with a name which is already taken in an ancestor

1.1.0

concurrent-ruby:

  • requires at least Ruby 2.0
  • Promises
    are moved from concurrent-ruby-edge to concurrent-ruby
  • Add support for TruffleRuby
    • (#734) Fix Array/Hash/Set construction broken on TruffleRuby
    • AtomicReference fixed
  • fixed documentation and README links
  • fix Set for TruffleRuby and Rubinius
  • CI stabilization
  • remove sharp dependency edge -> core
  • remove warnings
  • documentation updates
  • Exchanger is no longer documented as edge since it was already available in
    concurrent-ruby
  • (#644) Fix Map#each and #each_pair not returning enumerator outside of MRI
  • (#659) Edge promises fail during error handling
  • (#741) Raise on recursive Delay#value call
  • (#727) #717 fix global IO executor on JRuby
  • (#740) Drop support for CRuby 1.9, JRuby 1.7, Rubinius.
  • (#737) Move AtomicMarkableReference out of Edge
  • (#708) Prefer platform specific memory barriers
  • (#735) Fix wrong expected exception in channel spec assertion
  • (#729) Allow executor option in Promise#then
  • (#725) fix timeout check to use timeout_interval
  • (#719) update engine detection
  • (#660) Add specs for Promise#zip/Promise.zip ordering
  • (#654) Promise.zip execution changes
  • (#666) Add thread safe set implementation
  • (#651) #699 #to_s, #inspect should not output negative object IDs.
  • (#685) Avoid RSpec warnings about raise_error
  • (#680) Avoid RSpec monkey patching, persist spec results locally, use RSpec
    v3.7.0
  • (#665) Initialize the monitor for new subarrays on Rubinius
  • (#661) Fix error handling in edge promises

concurrent-ruby-edge:

  • (#659) Edge promises fail during error handling
  • Edge files clearly separated in lib-edge
  • added ReInclude
  • add Promises.zip_futures_over_on

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ crass (indirect, 1.0.3 → 1.0.4) · Repo · Changelog

Release Notes

1.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ globalid (indirect, 0.4.1 → 0.4.2) · Repo · Changelog

Release Notes

0.4.2

  • Allow configuration in initialisers 3c8f909

  • Clear to_global_id memoization on dup #109

  • Adds hash equality #108

Commits: v0.4.1...v0.4.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 20 commits:

↗️ i18n (indirect, 1.0.0 → 1.6.0) · Repo · Changelog

Release Notes

1.2.0

  • Provide a uniform API between Simple, KeyValue and Chain backends - #109 (one of our oldest PRs, and I am pleased that @kidpollo has persisted for all this time!)
  • Support translation hashes with numeric keys in Simple backend - #422
  • Add CacheFile backend module - #423
  • Add JSON backend module - #429
  • Updated README to point to the wiki - #438
  • Added plural rules for oc locale - #440
  • Removed tests from the bundled gem (leading to smaller download sizes) - #441
  • Added a post-install message about fallback breaking change introduced in v1.1.0 - #442

1.1.1

  • Expose translations with an option to perform initialization (if it hasn't been done already) (#353 / #254)
  • Removed un-used Kernel core extension #436
  • Added project metadata for RubyGems #434

1.1.0

  • Simplified default exception handler - #414
  • Fallbacks now exclude default locale - #415, possibly fixes #413 + #338
  • Fixed deprecated use of assert_nothing_raised #417
  • Fixed pluralization behavior for KeyValue backend with subtrees disabled - #419
  • Allow yaml file extension - #421

1.0.1

  • Removed creation of some anonymous objects in I18n - #393
  • Added missing key exception_handler to reserved keys - #412

Thanks to @stereobooster and @tjoyal.

Does any of this look wrong? Please let us know.

↗️ loofah (indirect, 2.2.2 → 2.2.3) · Repo · Changelog

Release Notes

2.2.3

Notably, this release addresses CVE-2018-16468.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ mail (indirect, 2.7.0 → 2.7.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 20 commits:

↗️ method_source (indirect, 0.9.0 → 0.9.2) · Repo

Commits

See the full diff on Github. The new version differs by 12 commits:

↗️ mini_mime (indirect, 1.0.0 → 1.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 12 commits:

↗️ nio4r (indirect, 2.3.0 → 2.3.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 6 commits:

↗️ rack (indirect, 2.0.4 → 2.0.6) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ railties (indirect, 5.0.7 → 5.0.7.2) · Repo · Changelog

↗️ rake (indirect, 12.3.1 → 12.3.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 41 commits:

↗️ sprockets (indirect, 3.7.1 → 3.7.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ thor (indirect, 0.20.0 → 0.20.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 73 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Mar 13, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants