🚨 [security] Upgrade simple_form: 3.3.1 → 5.0.0 (major)

[depfu]

---

🚨 Your version of simple_form has known security vulnerabilities 🚨

Advisory: CVE-2019-16676
Disclosed: September 27, 2019
URL: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx

simple_form Gem for Ruby Incorrect Access Control for forms based on user input

Simple Form before 5.0 has Incorrect Access Control in file_method? in lib/simple_form/form_builder.rb,
because a user-supplied string is invoked as a method call.

This only happens for pages that build forms based on user input.

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ simple_form (3.3.1 → 5.0.0) · Repo · Changelog

Release Notes

5.0.0 (from changelog)

Enhancements

• Set multiple attribute for grouped selects also. @ollym
• Removes or renames label classes. Abduvakilov
• Support to label custom classes for inline collections. @feliperenan
• Update bootstrap generator template to match v4.3.x. @m5o
• Allow "required" attribute in generated select elements of PriorityInput. @mcountis

Bug fix

• Do not call #send in form object to check whether the attribute is a file input. @tegon

Deprecations

• The config SimpleForm.file_methods is deprecated and it has no effect. Simple Form now supports automatically discover of file inputs for the following Gems: activestorage, carrierwave, paperclip, refile and shrine. If you are using a custom method that is not from one of the supported Gems, please change your forms to pass the input type explicitly:

 <%= form.input :avatar, as: :file %>

See http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676 for more information.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.0.5 → 1.1.5) · Repo · Changelog

Release Notes

1.1.5 (from changelog)

concurrent-ruby:

• fix potential leak of context on JRuby and Java 7

concurrent-ruby-edge:

• Add finalized Concurrent::Cancellation
• Add finalized Concurrent::Throttle
• Add finalized Concurrent::Promises::Channel
• Add new Concurrent::ErlangActor

1.1.4 (from changelog)

• (#780) Remove java_alias of 'submit' method of Runnable to let executor service work on java 11
• (#776) Fix NameError on defining a struct with a name which is already taken in an ancestor

1.1.0

concurrent-ruby:

• requires at least Ruby 2.0
• Promises
  are moved from concurrent-ruby-edge to concurrent-ruby
• Add support for TruffleRuby
  • (#734) Fix Array/Hash/Set construction broken on TruffleRuby
  • AtomicReference fixed
• fixed documentation and README links
• fix Set for TruffleRuby and Rubinius
• CI stabilization
• remove sharp dependency edge -> core
• remove warnings
• documentation updates
• Exchanger is no longer documented as edge since it was already available in
  concurrent-ruby
• (#644) Fix Map#each and #each_pair not returning enumerator outside of MRI
• (#659) Edge promises fail during error handling
• (#741) Raise on recursive Delay#value call
• (#727) #717 fix global IO executor on JRuby
• (#740) Drop support for CRuby 1.9, JRuby 1.7, Rubinius.
• (#737) Move AtomicMarkableReference out of Edge
• (#708) Prefer platform specific memory barriers
• (#735) Fix wrong expected exception in channel spec assertion
• (#729) Allow executor option in Promise#then
• (#725) fix timeout check to use timeout_interval
• (#719) update engine detection
• (#660) Add specs for Promise#zip/Promise.zip ordering
• (#654) Promise.zip execution changes
• (#666) Add thread safe set implementation
• (#651) #699 #to_s, #inspect should not output negative object IDs.
• (#685) Avoid RSpec warnings about raise_error
• (#680) Avoid RSpec monkey patching, persist spec results locally, use RSpec
  v3.7.0
• (#665) Initialize the monitor for new subarrays on Rubinius
• (#661) Fix error handling in edge promises

concurrent-ruby-edge:

• (#659) Edge promises fail during error handling
• Edge files clearly separated in lib-edge
• added ReInclude
• add Promises.zip_futures_over_on

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ crass (indirect, 1.0.3 → 1.0.4) · Repo · Changelog

Release Notes

1.0.4

• Fixed whitespace warnings. (#7 - @yahonda)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• chore: Release 1.0.4
• chore: Enable warnings when running tests
• Address `warning: mismatched indentations at 'when' with 'case'`
• Merge pull request #6 from nicolasleger/patch-1
• [CI] Test against Ruby 2.5

↗️ i18n (indirect, 1.0.0 → 1.6.0) · Repo · Changelog

Release Notes

1.2.0

• Provide a uniform API between Simple, KeyValue and Chain backends - #109 (one of our oldest PRs, and I am pleased that @kidpollo has persisted for all this time!)
• Support translation hashes with numeric keys in Simple backend - #422
• Add CacheFile backend module - #423
• Add JSON backend module - #429
• Updated README to point to the wiki - #438
• Added plural rules for oc locale - #440
• Removed tests from the bundled gem (leading to smaller download sizes) - #441
• Added a post-install message about fallback breaking change introduced in v1.1.0 - #442

1.1.1

• Expose translations with an option to perform initialization (if it hasn't been done already) (#353 / #254)
• Removed un-used Kernel core extension #436
• Added project metadata for RubyGems #434

1.1.0

• Simplified default exception handler - #414
• Fallbacks now exclude default locale - #415, possibly fixes #413 + #338
• Fixed deprecated use of assert_nothing_raised #417
• Fixed pluralization behavior for KeyValue backend with subtrees disabled - #419
• Allow yaml file extension - #421

1.0.1

• Removed creation of some anonymous objects in I18n - #393
• Added missing key exception_handler to reserved keys - #412

Thanks to @stereobooster and @tjoyal.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ loofah (indirect, 2.2.2 → 2.3.0) · Repo · Changelog

Release Notes

2.3.0 (from changelog)

Features

• Expand set of allowed protocols to include tel: and line:. [#104, #147]
• Expand set of allowed CSS functions. [related to #122]
• Allow greater precision in shorthand CSS values. [#149] (Thanks, @danfstucky!)
• Allow CSS property list-style [#162] (Thanks, @jaredbeck!)
• Allow CSS keywords thick and thin [#168] (Thanks, @georgeclaghorn!)
• Allow HTML property contenteditable [#167] (Thanks, @andreynering!)

Bug fixes

• CSS hex values are no longer limited to lowercase hex. Previously uppercase hex were scrubbed. [#165] (Thanks, @asok!)

Deprecations / Name Changes

The following method and constants are hereby deprecated, and will be completely removed in a future release:

• Deprecate Loofah::Helpers::ActionView.white_list_sanitizer, please use Loofah::Helpers::ActionView.safe_list_sanitizer instead.
• Deprecate Loofah::Helpers::ActionView::WhiteListSanitizer, please use Loofah::Helpers::ActionView::SafeListSanitizer instead.
• Deprecate Loofah::HTML5::WhiteList, please use Loofah::HTML5::SafeList instead.

Thanks to @JuanitoFatas for submitting these changes in #164 and for making the language used in Loofah more inclusive.

2.2.3

Notably, this release addresses CVE-2018-16468.

Does any of this look wrong? Please let us know.

↗️ minitest (indirect, 5.11.3 → 5.12.2) · Repo · Changelog

Release Notes

5.12.2 (from changelog)

• 1 bug fix:

  • After chatting w/ @y-yagi and others, decided to lower support to include ruby 2.2.

5.12.1 (from changelog)

• 1 minor enhancement:

  • Added documentation for Reporter classes. (sshaw)

• 3 bug fixes:

  • Avoid using 'match?' to support older ruby versions. (y-yagi)

  • Fixed broken link to reference on goodness-of-fit testing. (havenwood)

  • Update requirements in readme and Rakefile/hoe spec.

5.12.0 (from changelog)

• 8 minor enhancements:

  • Added a descriptive error if assert_output or assert_raises called without a block. (okuramasafumi)

  • Changed mu_pp_for_diff to make having both n and \n easier to debug.

  • Deprecated $N for specifying number of parallel test runners. Use MT_CPU.

  • Deprecated use of global expectations. To be removed from MT6.

  • Extended Assertions#mu_pp to encoding validity output for strings to improve diffs.

  • Extended Assertions#mu_pp to output encoding and validity if invalid to improve diffs.

  • Extended Assertions#mu_pp_for_diff to make escaped newlines more obvious in diffs.

  • Fail gracefully when expectation used outside of `it`.

• 3 bug fixes:

  • Check `option` klass before match. Fixes 2.6 warning. (y-yagi)

  • Fixed Assertions#diff from recalculating if set to nil

  • Fixed spec section of readme to not use deprecated global expectations. (CheezItMan)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 34 commits:

• prepped for release
• - After chatting w/ @y-yagi and others, decided to lower support to include ruby 2.2.
• prepped for release
• - Fixed broken link to reference on goodness-of-fit testing. (havenwood)
• Added mini-apivore to readme.
• - Update requirements in readme and Rakefile/hoe spec.
• + Added documentation for Reporter classes. (sshaw)
• Added minitest-global_expectations to readme. (jeremyevans)
• - Avoid using 'match?' to support older ruby versions. (y-yagi)
• Tweaked multithreading section of README. (iHiD)
• prepped for release
• Reworked the \n vs \\n mu_pp_for_diff situation.
• Extended assert_mu_pp and assert_mu_pp_for_diff to auto-quote strings to make tests more grokkable.
• minor editing to comment
• Turn off parallelism on stub and spec meta tests because they hit class methods (globals)
• Added mutant-minitest to readme. (mjb)
• + Add a descriptive error if assert_output or assert_raises called without a block. (okuramasafumi)
• - Check `option[:filter]` klass before match. Fixes 2.6 warning. (y-yagi)
• Fixed 2.6 warning in test_refute_match_matcher_object by adding explicit =~ method. (y-yagi)
• Added doco for using Rake::TestTask. (schneems)
• Added minitest-mock_expectations to readme. (bogdanvlviv)
• - Fixed spec section of readme to not use deprecated global expectations. (CheezItMan)
• minor rearrangement of requires
• Added tests for message and using message/lambad w/ assertions.
• + Changed mu_pp_for_diff to make having both \n and \\n easier to debug.
• Overhauled and sorted test_minitest_assertions.rb in prep for new mu_pp_for_diff changes.
• Split tests out into test_minitest_assertions.rb
• - Fixed Assertions#diff from recalculating if set to nil
• + Deprecated $N for specifying number of parallel test runners. Use MT_CPU.
• + Extended Assertions#mu_pp to encoding validity output for strings to improve diffs.
• + Deprecated use of global expectations. To be removed from MT6.
• + Fail gracefully when expectation used outside of `it`.
• Converted all minitest/spec tests over to use _ to avoid deprecation warnings.
• Avoid teardown assertion check if test is skipped

↗️ rack (indirect, 2.0.4 → 2.0.7) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 14 commits:

• Bumping to 2.0.7 for release
• Merge pull request #1343 from larsxschneider/ls/forward-fix
• Preserve forwarded IP address for trusted proxy chains
• Merge pull request #1201 from janko-m/make-multipart-parsing-work-for-chunked-requests
• Bumping version for release
• Whitelist http/https schemes
• Reduce buffer size to avoid pathological parsing
• Merge tag '2.0.5' into 2-0-stable
• Merge pull request #1296 from tomelm/fix-prefers-plaintext
• Bump version for release
• Merge pull request #1268 from eileencodes/forwardport-pr-1249-to-2-0-stable
• Merge pull request #1249 from mclark/handle-invalid-method-parameters
• Stick with a passing version of Rubygems and bundler
• Leahize

↗️ rails-html-sanitizer (indirect, 1.0.4 → 1.2.0) · Repo · Changelog

Release Notes

1.2.0

• Remove needless white_list_sanitizer deprecation.

  By deprecating this, we were forcing Rails 5.2 to be updated or spew
  deprecations that users could do nothing about.

  That's pointless and I'm sorry for adding that!

  Now there's no deprecation warning and Rails 5.2 works out of the box, while
  Rails 6 can use the updated naming.

  Kasper Timm Hansen

1.1.0

• Add safe_list_sanitizer and deprecate white_list_sanitizer to be removed
  in 1.2.0. #87

  Juanito Fatas

• Remove href from LinkScrubber's tags as it's not an element.
  #92

  Juanito Fatas

• Explain that we don't need to bump Loofah here if there's CVEs.
  d4d823c

  Kasper Timm Hansen

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

• Prepare 1.2.0
• Remove needless white list sanitizer deprecations
• Merge pull request #96 from olleolleolle/patch-1
• CI: Drop unused sudo: false Travis directive
• Merge pull request #95 from rwojnarowski/patch-1
• Deprecated warning text, missing space
• Prepare version 1.1.0
• Merge pull request #91 from JuanitoFatas/doc/scrubbers
• Merge pull request #92 from JuanitoFatas/link-sanitizer
• Improve LinkSanitizer's documentation
• href is not a HTML element
• Improve Scrubber documentations
• Merge pull request #87 from JuanitoFatas/migrate-to-safelist
• Migrate to SafeListSanitizer
• Merge pull request #90 from JuanitoFatas/jf.fix-tests
• Update test behavior for Nokogiri > 1.9.1.
• Merge pull request #89 from JuanitoFatas/rubies
• Merge pull request #88 from JuanitoFatas/jf.relax-bundler-dependency
• Update Ruby version matrix on CI
• Use a inclusive Bundler version
• Merge pull request #86 from tebs/fix-documentation-link
• Fix Nokogiri link in documentation
• [ci skip] Please don't send more PRs trying to bump Loofah.
• Merge pull request #71 from nicolasleger/patch-1
• [CI] Allow failure with ruby head
• [CI] Test against Ruby 2.5

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

• Circle CI, Semaphore and Travis-CI are all excellent options.
• If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
• If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with depfu/.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)