Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🚨 [security] Update all of rails 7.2.2 β†’ 7.2.2.1 (minor) #131

Merged
merged 1 commit into from
Dec 11, 2024

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Dec 11, 2024


🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!


Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ actionmailer (7.2.2 β†’ 7.2.2.1) Β· Repo Β· Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ railties (7.2.2 β†’ 7.2.2.1) Β· Repo Β· Changelog

Release Notes

7.2.2.1 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ rdoc (6.7.0 β†’ 6.8.1) Β· Repo Β· Changelog

Release Notes

6.8.1

What's Changed

πŸ› Bug Fixes

New Contributors

Full Changelog: v6.8.0...v6.8.1

6.8.0

What's Changed

✨ Enhancements

πŸ› Bug Fixes

  • Abort with error message if --dump argument invalid by @adam12 in #1104
  • Fix darkfish responsiveness issue on screens between 1024px and ~1650px by @st0012 in #1148
  • Fix sidebar scroll and footer display by @st0012 in #1152
  • Fix sidebar scroll again and add missing footer back by @st0012 in #1154
  • Make summary triangle appear in correct place when summary text overflows to next line by @paracycle in #1160
  • Make darkfish more responsive and readable on mobile devices by @st0012 in #1162
  • Only let browser search through source code until it's expanded by @Earlopain in #1181
  • Fix ToRdoc#accept_table by @tompng in #1184
  • Extract excerpt from RDoc::Markup::Document (raw pages) correctly by @st0012 in #1200

πŸ“š Documentation

πŸ›  Other Changes

New Contributors

Full Changelog: v6.7.0...v6.8.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionpack (indirect, 7.2.2 β†’ 7.2.2.1) Β· Repo Β· Changelog

Security Advisories 🚨

🚨 Possible Content Security Policy bypass in Action Dispatch

There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.

Impact

Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases

The fixed releases are available at the normal locations.

Workarounds

Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits

Thanks to ryotak for the report!

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionview (indirect, 7.2.2 β†’ 7.2.2.1) Β· Repo Β· Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activejob (indirect, 7.2.2 β†’ 7.2.2.1) Β· Repo Β· Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activesupport (indirect, 7.2.2 β†’ 7.2.2.1) Β· Repo Β· Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ date (indirect, 3.4.0 β†’ 3.4.1) Β· Repo

Release Notes

3.4.1

What's Changed

  • Fix incorrect argc2 decrement in datetime_s_iso8601 function by @pelbyl in #105
  • Trivial changes by @nobu in #107
  • Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #109
  • Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #108
  • [DOC] Empty the false document by @nobu in #110
  • Suppress warnings by @nobu in #111

New Contributors

Full Changelog: v3.4.0...v3.4.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ io-console (indirect, 0.7.2 β†’ 0.8.0) Β· Repo

Release Notes

0.8.0

What's Changed

  • Move omits by @nobu in #68
  • Load the built extension library in noctty tests by @nobu in #69
  • Show the correct exception when the stty backend cannot be required by @eregon in #70
  • Skip building extension on WASI by @kateinoigakukun in #71
  • Update gperf by @nobu in #73
  • Declare as Ractor-safe by @nobu in #74
  • Make IO.console Ractor-safe by @nobu in #75
  • Support older versions of ruby by @nobu in #77
  • Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #78
  • Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #79
  • Read errno before calling rb_io_path() by @XrXr in #80
  • Check if rb_syserr_fail_str is available by @nobu in #81
  • Freeze the version string by @nobu in #82
  • Add IO#ttyname that returns the tty name or nil by @nobu in #76

New Contributors

Full Changelog: v0.7.2...v0.8.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ logger (indirect, 1.6.1 β†’ 1.6.2) Β· Repo

Sorry, we couldn't find anything useful about this release.

↗️ minitest (indirect, 5.25.1 β†’ 5.25.4) Β· Repo Β· Changelog

Release Notes

5.25.4 (from changelog)

  • 1 bug fix:

    • Fix for must_verify definition if only requiring minitest/mock (but why?).

5.25.3 (from changelog)

  • 5 bug fixes:

    • Fixed assert_mock to fail instead of raise on unmet mock expectations.

    • Fixed assert_mock to take an optional message argument.

    • Fixed formatting of unmet mock expectation messages.

    • Fixed missing must_verify expectation to match assert_mock.

    • minitest/pride: Fixed to use true colors with *-direct terminals (bk2204)

5.25.2 (from changelog)

  • 4 bug fixes:

    • Include class name in spec name. (thomasmarshall)

    • Fixed β€˜redefining object_id’ warning from ruby 3.4. (mattbrictson)

    • Minitest top-level namespace no longer includes entire contents of README.rdoc. Too much!

    • Refactored spec’s describe to more cleanly determine the superclass and name

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ psych (indirect, 5.2.0 β†’ 5.2.1) Β· Repo Β· Changelog

Release Notes

5.2.1

What's Changed

  • Eagerly require date by @tdeo in #695
  • Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #697
  • Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #696

New Contributors

  • @tdeo made their first contribution in #695

Full Changelog: v5.2.0...v5.2.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rackup (indirect, 2.2.0 β†’ 2.2.1) Β· Repo Β· Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ reline (indirect, 0.5.11 β†’ 0.5.12) Β· Repo

Release Notes

0.5.12

What's Changed

πŸ› Bug Fixes

  • Fix completion quote, preposing and target calculation bug by @tompng in #763
  • Fix tab completion appending quote by @tompng in #782
  • Fix io_gate.encoding raises IOError in ruby <= 3.0 by @tompng in #785

πŸ›  Other Changes

  • Remove unused things from reline/unicode.rb by @tompng in #759
  • Refactor perform_completon by @tompng in #778
  • Remove terminfo.rb by @tompng in #769
  • Removed redundant argument at Reline::LineEditor::CompletionBlockTest by @hsbt in #781
  • Handle multibyte character input by KeyStroke by @tompng in #713
  • fix/omit test that fail in encoding=US_ASCII by @tompng in #784
  • Extract TruffleRuby workflow from reline.yml by @ima1zumi in #783
  • Bump version to 0.5.12 by @ima1zumi in #786

Full Changelog: v0.5.11...v0.5.12

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ securerandom (indirect, 0.3.1 β†’ 0.4.0) Β· Repo

Release Notes

0.4.0

What's Changed

  • Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #33
  • Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #32
  • Removed Random::Formatter by @hsbt in #34

Full Changelog: v0.3.2...v0.4.0

0.3.2

What's Changed

New Contributors

Full Changelog: v0.3.1...v0.3.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ useragent (indirect, 0.16.10 β†’ 0.16.11) Β· Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.


Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Dec 11, 2024
Copy link

codecov bot commented Dec 11, 2024

Codecov Report

All modified and coverable lines are covered by tests βœ…

Project coverage is 89.26%. Comparing base (d68856c) to head (4486470).
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #131   +/-   ##
=======================================
  Coverage   89.26%   89.26%           
=======================================
  Files           8        8           
  Lines         298      298           
  Branches      104      104           
=======================================
  Hits          266      266           
  Misses         32       32           

β˜” View full report in Codecov by Sentry.
πŸ“’ Have feedback on the report? Share it here.

@coveralls
Copy link

coveralls commented Dec 11, 2024

Pull Request Test Coverage Report for Build 12283600941

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 84.755%

Totals Coverage Status
Change from base Build 12283573263: 0.0%
Covered Lines: 247
Relevant Lines: 274

πŸ’› - Coveralls

@pboling
Copy link
Owner

pboling commented Dec 11, 2024

@depfu rebase

pboling
pboling previously approved these changes Dec 11, 2024
@depfu depfu bot force-pushed the depfu/update/group/rails-7.2.2.1 branch from 4ce30d0 to 4486470 Compare December 11, 2024 19:34
@pboling pboling merged commit 69f1fcc into main Dec 11, 2024
40 checks passed
@pboling pboling deleted the depfu/update/group/rails-7.2.2.1 branch December 11, 2024 19:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants