Skip to content

Comments

🚨 [security] Update activesupport: 6.1.1 → 6.1.7.3 (minor)#456

Closed
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/activesupport-6.1.7.3
Closed

🚨 [security] Update activesupport: 6.1.1 → 6.1.7.3 (minor)#456
depfu[bot] wants to merge 1 commit intomasterfrom
depfu/update/activesupport-6.1.7.3

Conversation

@depfu
Copy link

@depfu depfu bot commented Mar 14, 2023 •
edited
Loading

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ activesupport (6.1.1 → 6.1.7.3) · Repo · Changelog

Security Advisories 🚨

🚨 Possible XSS Security Vulnerability in SafeBuffer#bytesplice

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

🚨 ReDoS based DoS vulnerability in Active Support’s underscore

There is a possible regular expression based DoS vulnerability in Active
Support. This vulnerability has been assigned the CVE identifier
CVE-2023-22796.

Versions Affected: All
Not affected: None
Fixed Versions: 6.1.7.1, 7.0.4.1

Impact

A specially crafted string passed to the underscore method can cause the
regular expression engine to enter a state of catastrophic backtracking.
This can cause the process to use large amounts of CPU and memory, leading
to a possible DoS vulnerability.

This affects String#underscore, ActiveSupport::Inflector.underscore,
String#titleize, and any other methods using these.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Workarounds

There are no feasible workarounds for this issue.

Users on Ruby 3.2.0 or greater may be able to reduce the impact by
configuring Regexp.timeout.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.1.7 → 1.2.2) · Repo · Changelog

Release Notes

1.2.2

concurrent-ruby 1.2.2:

  • (#993) Fix arguments passed to Concurrent::Map's default_proc.

1.2.1

concurrent-ruby 1.2.1:

  • (#990) Add missing require 'fiber' for FiberLocalVar.
  • (#989) Optimize Concurrent::Map#[] on CRuby by letting the backing Hash handle the default_proc.

1.2.0

concurrent-ruby 1.2.0:

  • (#975) Set the Ruby compatibility version at 2.3
  • (#962) Fix ReentrantReadWriteLock to use the same granularity for locals as for Mutex it uses.
  • (#983) Add FiberLocalVar
  • (#934) concurrent-ruby now supports requiring individual classes (public classes listed in the docs), e.g., require 'concurrent/map'
  • (#976) Let Promises.any_fulfilled_future take an Event
  • Improve documentation of various classes
  • (#972) Remove Rubinius-related code

concurrent-ruby-edge 0.7.0:

  • (#975) Set the Ruby compatibility version at 2.3
  • (#934) concurrent-ruby now supports requiring individual classes (public classes listed in the docs), e.g., require 'concurrent/map'
  • (#972) Remove Rubinius-related code

1.1.10

concurrent-ruby:

  • (#951) Set the Ruby compatibility version at 2.2
  • (#939, #933) The caller_runs fallback policy no longer blocks reads from the job queue by worker threads
  • (#938, #761, #652) You can now explicitly prune_pool a thread pool (Sylvain Joyeux)
  • (#937, #757, #670) We switched the Yahoo stock API for demos to Alpha Vantage (Gustavo Caso)
  • (#932, #931) We changed how SafeTaskExecutor handles local jump errors (Aaron Jensen)
  • (#927) You can use keyword arguments in your initialize when using Async (Matt Larraz)
  • (#926, #639) We removed timeout from TimerTask because it wasn't sound, and now it's a no-op with a warning (Jacob Atzen)
  • (#919) If you double-lock a re-entrant read-write lock, we promote to locked for writing (zp yuan)
  • (#915) monotonic_time now accepts an optional unit parameter, as Ruby's clock_gettime (Jean Boussier)

1.1.9 (from changelog)

concurrent-ruby:

  • (#866) Child promise state not set to :pending immediately after #execute when parent has completed
  • (#905, #872) Fix RubyNonConcurrentPriorityQueue#delete method
  • (2df0337d) Make sure locks are not shared on shared when objects are dup/cloned
  • (#900, #906, #796, #847, #911) Fix Concurrent::Set tread-safety issues on CRuby
  • (#907) Add new ConcurrentMap backend for TruffleRuby

1.1.8 (from changelog)

  • (#885) Fix race condition in TVar for stale reads
  • (#884) RubyThreadLocalVar: Do not iterate over hash which might conflict with new pair addition

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.8.7 → 1.13.0) · Repo · Changelog

Release Notes

1.13.0

What's Changed

New Contributors

Full Changelog: v1.12.0...v1.13.0

1.12.0

What's Changed

  • Revert "Add support for CLDR data in I18n::Backend::Pluralization" by @radar in #633 -- this was causing breaking changes unintentionally.

Full Changelog: v1.11.0...v1.12.0

1.11.0

What's Changed

New Contributors

Full Changelog: v1.10.0...v1.11.0

1.10.0

What's Changed

New Features

Bug fixes

Other changes

  • Remove pry from Gemfile as it is not used by @dvzrv in #608

New Contributors

Full Changelog: v1.9.1...v1.10.0

1.9.1

What's Changed

Full Changelog: v1.9.0...v1.9.1

1.9.0

Minor version bump: The number of changes in this release are more than I would feel comfortable including in a point release. Therefore, I have bumped the minor version number here. -- @radar

What's Changed

New Contributors

Full Changelog: v1.8.11...v1.9.0

1.8.11

What's Changed

New Contributors

Full Changelog: v1.8.10...v1.8.11

1.8.10

  • Fix string locale will trigger on_fallback hook - #562

1.8.9

  • Rely on Ruby 3's native Hash#except method -- #557

This release also contains several build related updates -- rather than listing them out here, you can see the compare view between 1.8.8 and 1.8.9.

1.8.8

  • Fixed threadsafety issues in Simple backend: #554
  • Re-attempt to fix threadsafety of fallbacks: #548
  • Use OpenSSL::Digest instead of usual Digest libraries: #549
  • Goodbye, post-install message #552
  • Use Rails' main branch, instead of master #553

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ minitest (indirect, 5.14.3 → 5.18.0) · Repo · Changelog

Release Notes

5.18.0 (from changelog)

  • 2 major enhancements:

    • Added assert_pattern & refute_pattern for pattern matching. (flavorjones)

    • Added matching must_pattern_match & wont_pattern_match to minitest/spec.

  • 1 bug fix:

    • Support the new message format of NameError in Ruby 3.3 (mame)

5.17.0 (from changelog)

  • 1 minor enhancement:

    • Refactor setup hooks into a SETUP_METHODS constant. (MSP-Greg)

  • 3 bug fixes:

    • Fix kwargs for Mock calls to delegator. (blowmage)

    • Fix kwargs for expectations. (bobmazanec, blowmage)

    • Remove check for .b method. (tenderlove)

5.16.3 (from changelog)

  • 2 bug fixes:

    • Fixed exception sanitization by removing TypeError restriction on rescue.

    • Use A instead of deprecated TESTOPTS in rake test:slow. (davidstosik)

5.16.2 (from changelog)

  • 4 bug fixes:

    • Added MT_KWARGS_HACK kludge for stub to deal with ruby 2.7 kwargs nastiness. (tsugimoto)

    • In #expect, pop Hash class from args if $MT_KWARGS_HACK. (casperisfine)

    • In above scenario, set expected kwargs (as Objects) based on actual kwargs.

    • Nuke ivars if exception fails to marshal twice (eg better_errors). (irphilli)

5.16.1 (from changelog)

  • 2 bug fixes:

    • Apparently adding real kwarg support to mocks/stubs broke some code. Fixed.

      • Use `MT_KWARGS_HACK=1` to activate the kludgy kwargs support w/ caveats.

    • Clarified some doco wrt the block on #stub.

5.16.0 (from changelog)

  • 2 major enhancements:

    • Added Minitest::TestTask.

    • Dropping ruby 2.2 - 2.5. 2.6 is DTM soon too.

  • 11 minor enhancements:

    • Added –show-skips option to show skips at end of run but not require –verbose. (MSP-Greg)

    • Added Minitest.seed, the random seed used by the run.

    • Calling `srand Minitest.seed` before all shuffles to ensure determinism.

    • Extended #stub to handle kwargs for both block and call args. (SampsonCrowley)

    • Extended Mock#__call to display kwargs.

    • Extended Mock#expect to record kwargs.

    • Extended Mock#method_missing to take kwargs & compare them against expected.

    • Mock#method_missing displays better errors on arity mismatch.

    • Removed minor optimization removing empty suites before run.

    • Simplified test randomization (test order will change even with fixed seed).

    • assert_match now returns the MatchData on success. (Nakilon)

  • 3 bug fixes:

    • (Re)Fixed marshalling of exceptions, neutering them in 2 passes.

    • Fixed more problems with rdoc.

    • Had to patch up mock and stub to deal with <=2.7 kwargs oddities

5.15.0 (from changelog)

  • 1 major enhancement:

    • assert_throws returns the value returned, if any. (volmer)

  • 3 minor enhancements:

    • Added -S <CODES> option to skip reporting of certain types of output

    • Enable Ruby deprecation warnings by default. (casperisfine)

    • Use Etc.nprocessors by default in order to maximize cpu usage. (tonytonyjan)

  • 6 bug fixes:

    • Close then unlink tempfiles on Windows. (nobu)

    • Fixed #skip_until for windows paths. (MSP-Greg)

    • Fixed a bunch of tests for jruby and windows. (MSP-Greg)

    • Fixed marshalling of specs if they error. (tenderlove, jeremyevans, et al)

    • Updated deprecation message for block expectations. (blowmage)

    • Use Kernel.warn directly in expectations in case CUT defines their own warn. (firien)

5.14.4 (from changelog)

  • 1 bug fix:

    • Fixed deprecation warning using stub with methods using keyword arguments. (Nakilon)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ tzinfo (indirect, 2.0.4 → 2.0.6) · Repo · Changelog

Release Notes

2.0.6

  • Eliminate Object#untaint deprecation warnings on JRuby 9.4.0.0. #145.

TZInfo v2.0.6 on RubyGems.org

2.0.5

  • Changed DateTime results to always use the proleptic Gregorian calendar. This affects DateTime results prior to 1582-10-15 and any arithmetic performed on the results that would produce a secondary result prior to 1582-10-15.
  • Added support for eager loading all the time zone and country data by calling either TZInfo::DataSource#eager_load! or TZInfo.eager_load!. Compatible with Ruby On Rails' eager_load_namespaces. #129.
  • Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v2.0.5 on RubyGems.org

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 39 commits:

↗️ zeitwerk (indirect, 2.4.2 → 2.6.8) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Mar 14, 2023
@depfu depfu bot requested a review from Dangeranger March 14, 2023 21:56
@depfu depfu bot mentioned this pull request Mar 14, 2023
Closed
@depfu depfu bot force-pushed the depfu/update/activesupport-6.1.7.3 branch from dd75a83 to b5ae358 Compare May 8, 2023 21:40
@depfu
Copy link
Author

depfu bot commented Jun 27, 2023

Closed in favor of #476.

@depfu depfu bot closed this Jun 27, 2023
@depfu depfu bot deleted the depfu/update/activesupport-6.1.7.3 branch June 27, 2023 23:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Dangeranger Dangeranger Awaiting requested review from Dangeranger

Assignees

@Dangeranger Dangeranger

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Dangeranger