🚨 [security] Upgrade all of rails: 5.1.7 → 5.2.4.3 (minor)#244
Closed
depfu[bot] wants to merge 1 commit intomasterfrom
Closed
🚨 [security] Upgrade all of rails: 5.1.7 → 5.2.4.3 (minor)#244depfu[bot] wants to merge 1 commit intomasterfrom
depfu[bot] wants to merge 1 commit intomasterfrom
Conversation
Contributor
Author
|
Closed in favor of #257. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🚨 Your version of activesupport has known security vulnerabilities 🚨
Advisory: CVE-2020-8165
Disclosed: May 18, 2020
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
🚨 We recommend to merge and deploy this update as soon as possible! 🚨
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ nokogiri (1.10.2 → 1.10.9) · Repo · Changelog
Release Notes
1.10.9
1.10.8
1.10.7
1.10.6
1.10.5
1.10.4
1.10.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 40 commits:
version bump to v1.10.9update CHANGELOGChange return type to RubyArrayupdate CHANGELOG for #1985Work around a bug in libxml2version bump to v1.10.8update CHANGELOG for v1.10.8remove patches from the hoe Manifestupdate to use rake-compiler ~1.1.0backport libxml2 patch for CVE-2020-7595version bump to v1.10.7update CHANGELOGFix the patch from #1953 to work with both `git` and `patch`Fix typo in generated metadataadd gem metadataversion bump to v1.10.6update CHANGELOGAdd a patch to fix libxml2.la's pathadd security note to CHANGELOGversion bump to v1.10.5update CHANGELOGdependency: update libxslt to 1.1.34 finaldependency: update libxml to 2.9.10 finaladd suppressions for ruby 2.7update CHANGELOG with correct release date for v1.10.4update rake-compiler commands to install bundlerversion bump to v1.10.4Merge branch '1915-css-tokenizer-load-file-vulnerability_v1.10.x' into v1.10.xupdate CHANGELOGregenerate lexical scanner using rexical 1.0.7eliminate `eval` from Builder#initializerufo formattingrubocop security scan is run as part of the `test` rake targetadd rubocop as a dev dependencyadding a temporary pipeline for v1.10.xversion bump to v1.10.3Merge pull request #1898 from sparklemotion/1892-libxslt-patch-for-usn-3947Backport libxslt patch for CVE-2019-11068Merge branch 'concourse-icons'ci: add icons to concourse resources✳️ rails (5.1.7 → 5.2.4.3) · Repo
Release Notes
5.2.4.1
5.2.4
5.2.3
5.2.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 52 commits:
Prepare for 9.0.0Merge pull request #501 from abelards/patch-1Merge pull request #502 from kddeisz/count-mathAllow count nodes to have math functionsUpdate README.mdMerge pull request #500 from jcoleman/fix_incorrect_typecasting_of_raw_sql_stringsType-castable attributes should not try to cast SqlLiteral nodesMerge pull request #496 from amatsuda/froms_to_nowhereMerge pull request #499 from jgraichen/jg/cte-bindparamsSupport BindParams in subqueriesMerge pull request #498 from yhirano55/update_travisUpdate .travis.ymlUnused variablesMerge pull request #495 from koic/add_required_ruby_version_to_gemspecUpdate travis.ymlAdd required_ruby_version to gemspecMerge pull request #494 from koic/remove_encoding_utf8_magic_commentRemove encoding utf-8 magic commentMerge pull request #493 from gaurish/patch-1Remove Unused variable - offset_bindMerge pull request #492 from mikaji/ci_against_2.4.1Merge pull request #491 from yahonda/follow_up_add_bind_for_oracle_visitorCI against 2.4.1Address `undefined method `value_for_database'` in Oracle visitorChange the verison to 9.0.0.alphaMerge pull request #490 from MaxLap/fix_nodes_hash_eql_eqeqAdd missing hash, eql?, == to various node classesMerge pull request #489 from kamipo/remove_unused_bind_valuesRemove unused `bind_values`Fix test failuresAdjust `BindParam` as needed for ARAdd a collector to grab the bind values off the ASTEnsure `ToSql` collector returns a UTF-8 stringRefactor `substitute_binds` to perform substitution immediatelyAdd a value field `Nodes::BindParam`Rename `Collectors::Bind`Merge pull request #484 from kirs/multiple-insert-v2Merge pull request #472 from film42/masterTest concurrency of visitor superclass fallbackSupport INSERT with multiple valuesMerge pull request #483 from kamipo/remove_unused_engineAdd regression testRevert "Merge pull request #482 from kirs/multiple-insert"Merge pull request #482 from kirs/multiple-insertRemove unused `engine`Support multiple insertsMerge pull request #475 from PedroSena/chainable-insertMade InsertManager#insert chainableMerge pull request #474 from JaKXz/patch-1docs(distinct): tweaks [skip ci]docs(distinct): fix distinct example [skip ci]docs: add distinct to READMERelease Notes
1.1.6 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.0.6
1.0.5
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 8 commits:
Release 1.0.6Limit number values to a sensible rangeUpdate historyAdd project metadata to the gemspecRelease 1.0.5Remove test files and omit themRemove 1.9.3 from the test matrixUpdate Travis test matrixRelease Notes
1.9.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 7 commits:
Bump version to 1.9.0Change default :bufvar from 'String.new' to '::String.new' to work with BasicObjectTry to get Travis passingUse minitest-global_expecations in tests to avoid deprecation issues with minitest 5.12Test JRuby 9.2 on TravisTest on TruffleRuby on TravisCI: Add Ruby 2.6 to the matrixRelease Notes
1.8.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 65 commits:
Bump to 1.8.2Fix regression introduced by b7f69f78Add pry to GemfileExpand post-install message to clarify for new appsBump to 1.8.1Merge pull request #508 from ruby-i18n/revert-499-chain-fallback-backendsRevert "Chain fallback backends"Bump to 1.8.0Merge pull request #499 from vipera/chain-fallback-backendsBump to 1.7.1Merge pull request #503 from CrAsH1101/preserve-count-optionAdd test for preserving count optionMerge pull request #505 from peterberkenbosch/update-readme-with-gh-workflow-badgeReplace TravisCI badge with GH Actions badgeMerge pull request #504 from ruby-i18n/bump-ruby-rails:wave: Travis CI :cry:Ignore Ruby 2.3.8 + Rails 6.0.xCorrect Rails version numberCorrect more ruby versionsUse actions/checkout@v2Ignore Rails 6.0.0 + Ruby 2.4Specify exact versions for eregon/use-ruby-actionUse eregon/use-ruby-action for Ruby 2.7, 2.3 + JRuby supportUndo required_ruby_version bumpAdd missing GemfileFail slowlyBump Ruby + Rails versionsMerge pull request #501 from alchimere/add-user-friendly-comment-on-translate-kwargsAdd comment on kwargs to avoid new people open issues like #500Preserve count optionI18n::Backend::Chain#translations fallback mergeUse activesupport implementation of Hash#deep_merge!Merge pull request #495 from ghiculescu/pluralization_fallback_testAdd tests for existing behaviorMerge pull request #480 from Tietew/exclude-count-on-retrieve-linkAdd JRuby to build pipelineAdd Ruby 2.3 to Ruby pipelineOne i in gemfileExclude Ruby 2.4.x + Rails master Gemfile buildUpdate ruby.ymlUpdate ruby.ymlExclude :count option on retrieve linkBump to 1.7.0Merge pull request #491 from ruby-i18n/pipe-interpolationAllow pipes in interpolationsMerge pull request #486 from amatsuda/kwargs_2.7Merge pull request #487 from amatsuda/httpsKeyword arguments have to be explicitly double-splatted in Ruby 2.7+GitHub is https by defaultMerge pull request #488 from amatsuda/reduce_allocationsMerge pull request #489 from lbraun/fix-typosFix typosNo need to dup before creating another Hash instance via Hash#rejectMerge pull request #483 from hsbt/remove-rubyforgeRemoved rubyforge_project from gemspec. Because rubyforge was EOL.Merge pull request #481 from ahorek/public#include is public since ruby 2.1Merge pull request #476 from TaigaMikami/masterFix typo :)Merge pull request #475 from KaanOzkan/raise-disabledRaise disabled during boot inside fallbackMerge pull request #470 from gburgett/patch-1Merge branch 'master' into patch-1Use each_with_object and more descriptive namesUpdate spec for new behavior of chain backendRelease Notes
2.5.0 (from changelog)
2.4.0
2.3.1
2.3.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 17 commits:
Merge pull request #64 from banister/release-1-0-0Release v1.0.0Merge pull request #63 from banister/travis-removalTest solely on CircleCI, remove TravisMerge pull request #62 from banister/circleciTest on CircleCIMerge pull request #61 from jasonkarns/patch-1More closely match MIT License text verbatimMerge pull request #59 from casperisfine/fix-ruby-2.7Test against Ruby 2.7 on CIHandle new message for unterminated lists on MRI 2.7Merge pull request #60 from casperisfine/fix-ciFix ruby warning in spec_helperAdd MRI 2.5 and 2.6Fix CI buildMerge pull request #56 from nisusam/fix_documentation_linkFix `documentation` linkCommits
See the full diff on Github. The new version differs by 13 commits:
Changelog and prepare for releaseFEATURE: update for latest parity with mime types dataRemove unsupported rubies from travis test matrixrelax bundler versionUpdate benchmark in readmeAdd gems to Gemfile for bench scriptAllow custom db pathsUpdate benchmarkTest on Ruby 2.5 and Ruby 2.6Merge pull request #16 from Aqualon/readme_improvementsFix some typos/whitespaceFix link to bench.rbbump cache on travisRelease Notes
5.14.0 (from changelog)
5.13.0 (from changelog)
5.12.2 (from changelog)
5.12.1 (from changelog)
5.12.0 (from changelog)
Does any of this look wrong? Please let us know.
Release Notes
2.5.2 (from changelog)
2.4.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 67 commits:
Fix error: use of undeclared identifier 'EV_USE_LINUXAIO'.RuboCop...........Bump version.Replace usage of `long` with `size_t` in memory allocation functions.Fix `ev_backend_poll` so that it doesn't generate warnings.Detect aio_abi.h and define EV_USE_LINUXAIO if present.Add project metadata to the gemspecUpdate README.mdBump version.Add missing closing ')' on assert call in ev_port.cAdd notes about release process.Update license details.Report supported backends and current backend.Bump version.Test empty selector timeout.Update to libev-4.27.Merge pull request #219 from Jesus/masterAdds Puma to the list of projects using nio4rAllow calling `deregister` on closed IO objects (#217)Travis -add testing on OpenSSL 1.0.1 (trusty) & 1.1.1 (bionic & osx) [skip appveyor]Update `CHANGES.md` and `README.md`.Enable KQUEUE on macOS 10.14+.Don't freeze strings in file with `frozen_string_literal`.Bump minimum supported Ruby to 2.3.Update travis config.Set TRUFFLERUBY_RECOMPILE_OPENSSL to workaround OpenSSL issuesmonitor.rb :nodoc => :nodoc: [skip ci]Skip IO.try_convert in ruby code for SSL SocketsSplit some OpenSSL specs into TLSv1.2 and TLSv1.3.gitignore - add .rspec_status [skip ci]appveyor.yml - update with Ruby x64 - 2.5, 2.6, & head/trunkBump version.Restore piratey patches.Use `struct ev_loop` in `selector.c`.Use `struct ev_loop`.Update libev to v4.25.Doesn't seem like gem/bundler update is required.Run truffleruby with NIO4R_PURE.Skip SSL spec on JRuby because the socket isn't readable for some reason.Fix rubocop.Don't invoke `monitor.close` after related IO has already been closed.Prefer generic latest stable jruby in travis config.Java Extension: use at least Java 1.8, avoid warningsTravis: update to jruby-9.2.5.0 (#197)Don't allow 2.6 to fail.Fix trailing whitespace.Increase and embed select precision on a per-test basis.Simplify rubocop usage.Remove Ruby 2.2 since it's no longer supported by bundler.Try reverting select timeout.Try to detect unwritable OpenSSL socket.Fix rubocop.Remove pending check since it appears to be unnecessary.Merge pull request #200 from boutil/patch-1Fix travis os: name.Simplify travis build matrix.Rework port allocation and selector timeouts. Fixes #184.allow failures for Ruby 2.6 for nowMerge pull request #199 from boutil/masterIncrease size of RSA keys to 2048 bitsUpdate travis config, add support for truffleruby.Merge pull request #192 from junaruga/feature/doc-ruby-2.5Merge pull request #191 from junaruga/feature/travis-updateAdd Ruby 2.5 to supported platforms.Update Rubies to the latest version on Travis CI.Merge pull request #190 from olleolleolle/patch-4Travis: jruby-9.2.0.0Release Notes
2.2.2 (from changelog)
2.2.1 (from changelog)
2.2.0 (from changelog)
2.1.2 (from changelog)
2.1.1 (from changelog)
2.1.0 (from changelog)
2.0.8 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.3.0
1.2.0
1.1.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 30 commits:
v1.3.0Merge pull request #102 from orien/gem-metadataAdd project metadata to the gemspecMatch Loofah's API changes.Prepare 1.2.0Remove needless white list sanitizer deprecationsMerge pull request #96 from olleolleolle/patch-1CI: Drop unused sudo: false Travis directiveMerge pull request #95 from rwojnarowski/patch-1Deprecated warning text, missing spacePrepare version 1.1.0Merge pull request #91 from JuanitoFatas/doc/scrubbersMerge pull request #92 from JuanitoFatas/link-sanitizerImprove LinkSanitizer's documentationhref is not a HTML elementImprove Scrubber documentationsMerge pull request #87 from JuanitoFatas/migrate-to-safelistMigrate to SafeListSanitizerMerge pull request #90 from JuanitoFatas/jf.fix-testsUpdate test behavior for Nokogiri > 1.9.1.Merge pull request #89 from JuanitoFatas/rubiesMerge pull request #88 from JuanitoFatas/jf.relax-bundler-dependencyUpdate Ruby version matrix on CIUse a inclusive Bundler versionMerge pull request #86 from tebs/fix-documentation-linkFix Nokogiri link in documentation[ci skip] Please don't send more PRs trying to bump Loofah.Merge pull request #71 from nicolasleger/patch-1[CI] Allow failure with ruby head[CI] Test against Ruby 2.5Release Notes
5.2.4.1
5.2.4
5.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
12.3.3 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 25 commits:
Bump version to 12.3.3.Use File.open explicitly.Merge pull request #317 from ruby/ignore-gitignoreRemoved gitignore from gemspec files.Merge pull request #309 from RDIL/patch-1Remove deprecated travis ci optionMerge pull request #307 from ruby/azure-pipelinesOnly enabled macOS environmentuse realpathDo not specify ruby version of macOSIgnore matrix build for macOSRenameRemoved non supported versions.Extracted ruby versions for matrixAdded missing vmImageApplied matrix build for the multiple platforms.Set up CI with Azure PipelinesMerge pull request #305 from aycabta/use-2.6.1Use Ruby 2.6.1Merge pull request #303 from tmatilai/app-name-in-errorUse the application's name in error message if a task is not foundMerge pull request #301 from ruby/colby/update-rubocopfix outstanding rubocop warningsMerge pull request #300 from ruby/colby/add-ruby-2.6Add ruby 2.6.0 to .travis.ymlRelease Notes
1.2.7
1.2.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 46 commits:
Improve grammar.Preparing v1.2.7.Update to Ruby 2.7.1.Revert to Ruby 2.4.9 and 2.7.0.Update to Ruby 2.4.10, 2.5.8, 2.6.6, 2.7.1 and JRuby 9.2.11.1.Use shields.io for badges.Update copyright years.Add a build status badge for AppVeyor.Replace broken links.Use https for links where available.Update to JRuby 9.2.11.0.Merge pull request #112.Test for just the non-existence of #untaint.Fix comments relating to taint/untaint removal.Don't rely on lexicographic version comparisons.Fix test failures on Ruby 1.8.7.Fix erroneous 'wrong number of arguments' errors on JRuby 9.0.5.0.`$VERBOSE = false` won't be worked since `rb_warning` is changed to `rb_warn`Update to Ruby 2.7.0.Update copyright years.Preparing v1.2.6.Replace expired gem signing certificate.Fix a comment.Ruby Enterprise Edition requires older versions of RubyGems and Bundler.Fix block not being called by RubyCoreSupport.open_file on JRuby 9.2.Revert "Try and fix an incorrect rake version being picked with JRuby 1.7."Try and fix an incorrect rake version being picked with JRuby 1.7.Convert to UNIX line endings.Simplify minitest version constraint.Update to Ruby v2.7.0-rc2.Run CI tests on Windows with AppVeyor.Enable verbose test output.Update Travis CI Ruby versions.Prevent bundler from attempting to use version minitest v5.12.0.Allow newer versions of Rake that fix warnings with Ruby 2.7.Eliminate a warning when calling File.open with keyword arguments.Suppress deprecation warnings due to Object#untaint on Ruby 2.7.Fix test failures on Ruby 1.8.7 caused by DateTime issues.Remove the unused REQUIRE_PATH constant from RubyDataSource.Fix SecurityErrors when loading data in safe mode.Test that RUBY_ENGINE is defined.Skip tests that fail due to Ruby bug 14060 on Ruby 2.4.4.Update to the latest Ruby, JRuby and Rubinius releases.Fix a documentation typo.Return the correct seconds since the epoch value for strftime with %s.Restrictions on timezones only apply to older (pre-1.9) Ruby releases.Release Notes
0.7.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 31 commits:
Bump version to 0.7.1Change markdown formatting of docs.Remove a redundant statement from the Hybi setup code.Fail a draft-76 connection of a header does not contain any digits.Depend on Rake < 12.3 if we're running on Ruby < 2.0.Reformat the C and Java native extension modules.Fix an uninitialised variable warning.Update Travis target versions.Switch license to Apache 2.0.Test on Ruby 2.5.0.I think you have to use jruby-head instead of jruby-9 now.Bump the Ruby versions for Travis.If any header used by Hybi is present, then pick Hybi, and likewise for Draft76. This means the driver is more likely to pick Hybi and report likely combinations of malformed headers as errors to the client.If any driver encounters a validation error in the request headers, it can throw an error and Driver#start will catch that and send a 400 response to the client.Fix the version of Rubygems that Travis is using on Ruby 1.9.Bump version to 0.7.0.Refactor the client examples, and get the TCPSocket one into a runnable state so it can be run from the command line with a URI.Don't require rubygems, this has not been necessary since Ruby 1.8.Merge pull request #53 from izwick-schachter/masterAdded TCPSocket client exampleRename tcp_server.rb to em_server.rb.Add an example EventMachine client.Flesh out the docs for the new ping/pong events.Make the ping/pong tests check the content of the events.Emit ping and pong events after all other effects of those frames have been carried out.Merge pull request #51 from ably-forks/support-ping-in-event-emitterUpdate Ruby versions in Travis config.Update docs to reflect ping & pong eventsEmit :ping and :pong events in the driverMerge pull request #50 from junaruga/feature/travis-ruby-headUpdate Ruby 2.3, 2.4 to latest version on Travis.Release Notes
0.1.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 7 commits:
Bump version to 0.1.4Change markdown formatting of docs.Fix deprecation warning about =~ being called on TrueClass.Fix RSpec warnings about raise_error with no arguments.Update Travis target versions.Switch license to Apache 2.0.Test on Ruby 2.5.0.🆕 activestorage (added, 5.2.4.3)
🆕 marcel (added, 0.3.3)
🆕 mimemagic (added, 0.3.5)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands