From e695c78c49363aff45f954ba57aa5bdb64bc364b Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Wed, 5 Apr 2023 01:28:04 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-1290051 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-1290052 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-2400638 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-2803847 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-3237231 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-3237232 - https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-2803851 - https://snyk.io/vuln/SNYK-RUBY-ACTIVERECORD-1080913 - https://snyk.io/vuln/SNYK-RUBY-ACTIVERECORD-2960802 - https://snyk.io/vuln/SNYK-RUBY-ACTIVERECORD-3237239 - https://snyk.io/vuln/SNYK-RUBY-ACTIVESTORAGE-2420035 - https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3237242 - https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3360028 - https://snyk.io/vuln/SNYK-RUBY-ADDRESSABLE-1316242 - https://snyk.io/vuln/SNYK-RUBY-DEVISE-465098 - https://snyk.io/vuln/SNYK-RUBY-GLOBALID-3237234 - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168317 - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168318 - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168649 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1293239 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-1726792 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2413994 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2620374 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2630623 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2630898 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-2840634 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-3052880 - https://snyk.io/vuln/SNYK-RUBY-PUMA-1291014 - https://snyk.io/vuln/SNYK-RUBY-PUMA-1730572 - https://snyk.io/vuln/SNYK-RUBY-PUMA-2400629 - https://snyk.io/vuln/SNYK-RUBY-PUMA-2437090 - https://snyk.io/vuln/SNYK-RUBY-RACK-1061917 - https://snyk.io/vuln/SNYK-RUBY-RACK-2848599 - https://snyk.io/vuln/SNYK-RUBY-RACK-2848600 - https://snyk.io/vuln/SNYK-RUBY-RACK-3237233 - https://snyk.io/vuln/SNYK-RUBY-RACK-3237237 - https://snyk.io/vuln/SNYK-RUBY-RACK-3237240 - https://snyk.io/vuln/SNYK-RUBY-RACK-3356639 - https://snyk.io/vuln/SNYK-RUBY-RACK-3360233 - https://snyk.io/vuln/SNYK-RUBY-RAILS-1071903 - https://snyk.io/vuln/SNYK-RUBY-RAILS-5291540 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-2935879 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168316 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168646 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168647 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168648 - https://snyk.io/vuln/SNYK-RUBY-TZINFO-2958048 --- Gemfile | 22 ++-- Gemfile.lock | 331 +++++++++++++++++++++++++++++---------------------- 2 files changed, 199 insertions(+), 154 deletions(-) diff --git a/Gemfile b/Gemfile index ae5d736..4bf1352 100644 --- a/Gemfile +++ b/Gemfile @@ -4,29 +4,29 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '2.5.1' # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' -gem 'rails', '~> 5.2.0' +gem 'rails', '~> 6.1.7', '>= 6.1.7.3' # Use postgresql as the database for Active Record gem 'pg', '>= 0.18', '< 2.0' # Use Puma as the app server -gem 'puma', '~> 3.11' +gem 'puma', '~> 4.3', '>= 4.3.12' # Use SCSS for stylesheets -gem 'sass-rails', '~> 5.0' +gem 'sass-rails', '~> 6.0', '>= 6.0.0' # Use Uglifier as compressor for JavaScript assets gem 'uglifier', '>= 1.3.0' # See https://github.com/rails/execjs#readme for more supported runtimes # gem 'mini_racer', platforms: :ruby -gem 'devise', '~> 4.6.0' +gem 'devise', '~> 4.7.1' gem 'devise_saml_authenticatable' gem 'cancancan', '~> 2.2.0' gem 'paperclip', '~> 6.0.0' gem 'pry' # Use CoffeeScript for .coffee assets and views -gem 'coffee-rails', '~> 4.2' +gem 'coffee-rails', '~> 4.2', '>= 4.2.2' # Turbolinks makes navigating your web application faster. Read more: https://github.com/turbolinks/turbolinks gem 'turbolinks', '~> 5' # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder -gem 'jbuilder', '~> 2.5' -gem 'sprockets', '~> 3.7.2' +gem 'jbuilder', '~> 2.10', '>= 2.10.1' +gem 'sprockets', '~> 4.2.0' gem 'ledermann-rails-settings' gem 'terrapin' #gem 'capistrano-nvm', require: false @@ -42,7 +42,7 @@ gem 'terrapin' # gem 'capistrano-rails', group: :development # gem 'htmltoword' gem 'prawn', '~> 2.2.2' -gem 'roo', '~> 2.8' +gem 'roo', '~> 2.8', '>= 2.8.3' gem 'prawn-table' gem 'rubyzip', '>= 1.2.2' # will load new rubyzip version gem 'will_paginate', '~> 3.1.0' @@ -57,14 +57,14 @@ end group :development do # Access an interactive console on exception pages or by calling 'console' anywhere in the code. - gem 'web-console', '>= 3.3.0' + gem 'web-console', '>= 3.7.0' gem 'listen', '>= 3.0.5', '< 3.2' gem 'capistrano' gem 'capistrano-rbenv' # idiomatic rbenv support gem 'capistrano-rbenv-install' # ensures the right ruby version is installed gem 'capistrano-bundler' # support for bundler gem 'capistrano-rails' # automatic migrations and asset compilation - gem 'capistrano3-puma' + gem 'capistrano3-puma', '>= 4.0.0' gem 'capistrano-rake' gem 'capistrano-rails-console', require: false # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring @@ -74,7 +74,7 @@ end group :test do # Adds support for Capybara system testing and selenium driver - gem 'capybara', '>= 2.15', '< 4.0' + gem 'capybara', '>= 3.34.0', '< 4.0' gem 'selenium-webdriver' # Easy installation and use of chromedriver to run system tests with Chrome gem 'chromedriver-helper' diff --git a/Gemfile.lock b/Gemfile.lock index e9c52b3..b9f6521 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,55 +1,72 @@ GEM remote: https://rubygems.org/ specs: - actioncable (5.2.4.4) - actionpack (= 5.2.4.4) + actioncable (6.1.7.3) + actionpack (= 6.1.7.3) + activesupport (= 6.1.7.3) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailer (5.2.4.4) - actionpack (= 5.2.4.4) - actionview (= 5.2.4.4) - activejob (= 5.2.4.4) + actionmailbox (6.1.7.3) + actionpack (= 6.1.7.3) + activejob (= 6.1.7.3) + activerecord (= 6.1.7.3) + activestorage (= 6.1.7.3) + activesupport (= 6.1.7.3) + mail (>= 2.7.1) + actionmailer (6.1.7.3) + actionpack (= 6.1.7.3) + actionview (= 6.1.7.3) + activejob (= 6.1.7.3) + activesupport (= 6.1.7.3) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.2.4.4) - actionview (= 5.2.4.4) - activesupport (= 5.2.4.4) - rack (~> 2.0, >= 2.0.8) + actionpack (6.1.7.3) + actionview (= 6.1.7.3) + activesupport (= 6.1.7.3) + rack (~> 2.0, >= 2.0.9) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.2.4.4) - activesupport (= 5.2.4.4) + rails-html-sanitizer (~> 1.0, >= 1.2.0) + actiontext (6.1.7.3) + actionpack (= 6.1.7.3) + activerecord (= 6.1.7.3) + activestorage (= 6.1.7.3) + activesupport (= 6.1.7.3) + nokogiri (>= 1.8.5) + actionview (6.1.7.3) + activesupport (= 6.1.7.3) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.0.3) - activejob (5.2.4.4) - activesupport (= 5.2.4.4) + rails-html-sanitizer (~> 1.1, >= 1.2.0) + activejob (6.1.7.3) + activesupport (= 6.1.7.3) globalid (>= 0.3.6) - activemodel (5.2.4.4) - activesupport (= 5.2.4.4) - activerecord (5.2.4.4) - activemodel (= 5.2.4.4) - activesupport (= 5.2.4.4) - arel (>= 9.0) - activestorage (5.2.4.4) - actionpack (= 5.2.4.4) - activerecord (= 5.2.4.4) - marcel (~> 0.3.1) - activesupport (5.2.4.4) + activemodel (6.1.7.3) + activesupport (= 6.1.7.3) + activerecord (6.1.7.3) + activemodel (= 6.1.7.3) + activesupport (= 6.1.7.3) + activestorage (6.1.7.3) + actionpack (= 6.1.7.3) + activejob (= 6.1.7.3) + activerecord (= 6.1.7.3) + activesupport (= 6.1.7.3) + marcel (~> 1.0) + mini_mime (>= 1.1.0) + activesupport (6.1.7.3) concurrent-ruby (~> 1.0, >= 1.0.2) - i18n (>= 0.7, < 2) - minitest (~> 5.1) - tzinfo (~> 1.1) - addressable (2.7.0) - public_suffix (>= 2.0.2, < 5.0) - airbrussh (1.4.0) + i18n (>= 1.6, < 2) + minitest (>= 5.1) + tzinfo (~> 2.0) + zeitwerk (~> 2.3) + addressable (2.8.3) + public_suffix (>= 2.0.2, < 6.0) + airbrussh (1.4.1) sshkit (>= 1.6.1, != 1.7.0) archive-zip (0.12.0) io-like (~> 0.3.0) - arel (9.0.0) - bcrypt (3.1.16) + bcrypt (3.1.18) bindex (0.8.1) bootsnap (1.5.1) msgpack (~> 1.0) @@ -58,12 +75,12 @@ GEM builder (3.2.4) byebug (11.1.3) cancancan (2.2.0) - capistrano (3.15.0) + capistrano (3.17.2) airbrussh (>= 1.0.0) i18n rake (>= 10.0.0) sshkit (>= 1.9.0) - capistrano-bundler (2.0.1) + capistrano-bundler (2.1.0) capistrano (~> 3.1) capistrano-rails (1.6.1) capistrano (~> 3.1) @@ -79,17 +96,17 @@ GEM capistrano-rbenv-install (1.2.0) capistrano (>= 3.0) capistrano-rbenv (>= 2.0) - capistrano3-puma (3.1.1) + capistrano3-puma (5.2.0) capistrano (~> 3.7) capistrano-bundler - puma (~> 3.4) - capybara (3.34.0) + puma (>= 4.0, < 6.0) + capybara (3.35.3) addressable mini_mime (>= 0.1.3) nokogiri (~> 1.8) rack (>= 1.6.0) rack-test (>= 0.6.3) - regexp_parser (~> 1.5) + regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) childprocess (3.0.0) chromedriver-helper (2.1.1) @@ -104,27 +121,30 @@ GEM coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.1.7) + concurrent-ruby (1.2.2) crass (1.0.6) - devise (4.6.2) + devise (4.7.3) bcrypt (~> 3.0) orm_adapter (~> 0.1) - railties (>= 4.1.0, < 6.0) + railties (>= 4.1.0) responders warden (~> 1.2.3) - devise_saml_authenticatable (1.6.3) + devise_saml_authenticatable (1.9.0) devise (> 2.0.0) ruby-saml (~> 1.7) - erubi (1.10.0) - execjs (2.7.0) - ffi (1.14.2) - ffi (1.14.2-x64-mingw32) - globalid (0.4.2) - activesupport (>= 4.2.0) - i18n (1.8.7) + digest (3.1.1) + erubi (1.12.0) + execjs (2.8.1) + ffi (1.15.5) + ffi (1.15.5-x64-mingw32) + globalid (1.1.0) + activesupport (>= 5.0) + i18n (1.12.0) concurrent-ruby (~> 1.0) io-like (0.3.1) - jbuilder (2.10.1) + io-wait (0.3.0) + jbuilder (2.11.5) + actionview (>= 5.0.0) activesupport (>= 5.0.0) ledermann-rails-settings (2.5.0) activerecord (>= 4.2) @@ -132,31 +152,48 @@ GEM rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) ruby_dep (~> 1.2) - loofah (2.9.0) + loofah (2.20.0) crass (~> 1.0.2) nokogiri (>= 1.5.9) - mail (2.7.1) + mail (2.8.1) mini_mime (>= 0.1.1) - marcel (0.3.3) - mimemagic (~> 0.3.2) + net-imap + net-pop + net-smtp + marcel (1.0.2) method_source (1.0.0) - mime-types (3.3.1) + mime-types (3.4.1) mime-types-data (~> 3.2015) - mime-types-data (3.2020.1104) - mimemagic (0.3.5) - mini_mime (1.0.2) - mini_portile2 (2.5.0) - minitest (5.14.3) + mime-types-data (3.2023.0218.1) + mimemagic (0.3.10) + nokogiri (~> 1) + rake + mini_mime (1.1.2) + mini_portile2 (2.6.1) + minitest (5.15.0) msgpack (1.3.3) msgpack (1.3.3-x64-mingw32) - net-scp (3.0.0) - net-ssh (>= 2.6.5, < 7.0.0) + net-imap (0.2.2) + digest + net-protocol + strscan + net-pop (0.1.2) + net-protocol + net-protocol (0.1.2) + io-wait + timeout + net-scp (4.0.0) + net-ssh (>= 2.6.5, < 8.0.0) + net-smtp (0.3.0) + digest + net-protocol + timeout net-ssh (6.1.0) - nio4r (2.5.4) - nokogiri (1.11.1) - mini_portile2 (~> 2.5.0) + nio4r (2.5.9) + nokogiri (1.12.5) + mini_portile2 (~> 2.6.1) racc (~> 1.4) - nokogiri (1.11.1-x64-mingw32) + nokogiri (1.12.5-x64-mingw32) racc (~> 1.4) orm_adapter (0.5.0) paperclip (6.0.0) @@ -176,62 +213,68 @@ GEM pry (0.13.1) coderay (~> 1.1) method_source (~> 1.0) - public_suffix (4.0.6) - puma (3.12.6) - racc (1.5.2) - rack (2.2.3) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails (5.2.4.4) - actioncable (= 5.2.4.4) - actionmailer (= 5.2.4.4) - actionpack (= 5.2.4.4) - actionview (= 5.2.4.4) - activejob (= 5.2.4.4) - activemodel (= 5.2.4.4) - activerecord (= 5.2.4.4) - activestorage (= 5.2.4.4) - activesupport (= 5.2.4.4) - bundler (>= 1.3.0) - railties (= 5.2.4.4) + public_suffix (4.0.7) + puma (4.3.12) + nio4r (~> 2.0) + racc (1.6.2) + rack (2.2.6.4) + rack-test (2.1.0) + rack (>= 1.3) + rails (6.1.7.3) + actioncable (= 6.1.7.3) + actionmailbox (= 6.1.7.3) + actionmailer (= 6.1.7.3) + actionpack (= 6.1.7.3) + actiontext (= 6.1.7.3) + actionview (= 6.1.7.3) + activejob (= 6.1.7.3) + activemodel (= 6.1.7.3) + activerecord (= 6.1.7.3) + activestorage (= 6.1.7.3) + activesupport (= 6.1.7.3) + bundler (>= 1.15.0) + railties (= 6.1.7.3) sprockets-rails (>= 2.0.0) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.3.0) - loofah (~> 2.3) - railties (5.2.4.4) - actionpack (= 5.2.4.4) - activesupport (= 5.2.4.4) + rails-html-sanitizer (1.5.0) + loofah (~> 2.19, >= 2.19.1) + railties (6.1.7.3) + actionpack (= 6.1.7.3) + activesupport (= 6.1.7.3) method_source - rake (>= 0.8.7) - thor (>= 0.19.0, < 2.0) - rake (13.0.3) - rb-fsevent (0.10.4) + rake (>= 12.2) + thor (~> 1.0) + rake (13.0.6) + rb-fsevent (0.11.2) rb-inotify (0.10.1) ffi (~> 1.0) - regexp_parser (1.8.2) - responders (3.0.1) - actionpack (>= 5.0) - railties (>= 5.0) + regexp_parser (2.7.0) + responders (3.1.0) + actionpack (>= 5.2) + railties (>= 5.2) + rexml (3.2.5) roo (2.8.3) nokogiri (~> 1) rubyzip (>= 1.3.0, < 3.0.0) - ruby-saml (1.11.0) - nokogiri (>= 1.5.10) + ruby-saml (1.14.0) + nokogiri (>= 1.10.5) + rexml ruby_dep (1.5.0) - rubyzip (2.3.0) - sass (3.7.4) - sass-listen (~> 4.0.0) - sass-listen (4.0.0) - rb-fsevent (~> 0.9, >= 0.9.4) - rb-inotify (~> 0.9, >= 0.9.7) - sass-rails (5.1.0) - railties (>= 5.2.0) - sass (~> 3.1) - sprockets (>= 2.8, < 4.0) - sprockets-rails (>= 2.0, < 4.0) - tilt (>= 1.1, < 3) + rubyzip (2.3.2) + sass-rails (6.0.0) + sassc-rails (~> 2.1, >= 2.1.1) + sassc (2.4.0) + ffi (~> 1.9) + sassc (2.4.0-x64-mingw32) + ffi (~> 1.9) + sassc-rails (2.1.2) + railties (>= 4.0.0) + sassc (>= 2.0) + sprockets (> 3.0) + sprockets-rails + tilt selenium-webdriver (3.142.7) childprocess (>= 0.5, < 4.0) rubyzip (>= 1.2.2) @@ -239,46 +282,48 @@ GEM spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) - sprockets (3.7.2) + sprockets (4.2.0) concurrent-ruby (~> 1.0) - rack (> 1, < 3) - sprockets-rails (3.2.2) - actionpack (>= 4.0) - activesupport (>= 4.0) + rack (>= 2.2.4, < 4) + sprockets-rails (3.4.2) + actionpack (>= 5.2) + activesupport (>= 5.2) sprockets (>= 3.0.0) - sshkit (1.21.1) + sshkit (1.21.4) net-scp (>= 1.1.2) net-ssh (>= 2.8.0) sshkit-interactive (0.3.0) sshkit (~> 1.12) + strscan (3.0.6) terrapin (0.6.0) climate_control (>= 0.0.3, < 1.0) - thor (1.0.1) - thread_safe (0.3.6) - tilt (2.0.10) + thor (1.2.1) + tilt (2.1.0) + timeout (0.3.2) ttfunk (1.7.0) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) - tzinfo (1.2.9) - thread_safe (~> 0.1) - tzinfo-data (1.2020.6) + tzinfo (2.0.6) + concurrent-ruby (~> 1.0) + tzinfo-data (1.2023.3) tzinfo (>= 1.0.0) uglifier (4.2.0) execjs (>= 0.3.0, < 3) warden (1.2.9) rack (>= 2.0.9) - web-console (3.7.0) - actionview (>= 5.0) - activemodel (>= 5.0) + web-console (4.2.0) + actionview (>= 6.0.0) + activemodel (>= 6.0.0) bindex (>= 0.4.0) - railties (>= 5.0) - websocket-driver (0.7.3) + railties (>= 6.0.0) + websocket-driver (0.7.5) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) will_paginate (3.1.8) xpath (3.2.0) nokogiri (~> 1.8) + zeitwerk (2.6.7) PLATFORMS ruby @@ -296,13 +341,13 @@ DEPENDENCIES capistrano-rake capistrano-rbenv capistrano-rbenv-install - capistrano3-puma - capybara (>= 2.15, < 4.0) + capistrano3-puma (>= 4.0.0) + capybara (>= 3.34.0, < 4.0) chromedriver-helper - coffee-rails (~> 4.2) - devise (~> 4.6.0) + coffee-rails (~> 4.2, >= 4.2.2) + devise (~> 4.7.1) devise_saml_authenticatable - jbuilder (~> 2.5) + jbuilder (~> 2.10, >= 2.10.1) ledermann-rails-settings listen (>= 3.0.5, < 3.2) paperclip (~> 6.0.0) @@ -310,24 +355,24 @@ DEPENDENCIES prawn (~> 2.2.2) prawn-table pry - puma (~> 3.11) - rails (~> 5.2.0) - roo (~> 2.8) + puma (~> 4.3, >= 4.3.12) + rails (~> 6.1.7, >= 6.1.7.3) + roo (~> 2.8, >= 2.8.3) rubyzip (>= 1.2.2) - sass-rails (~> 5.0) + sass-rails (~> 6.0, >= 6.0.0) selenium-webdriver spring spring-watcher-listen (~> 2.0.0) - sprockets (~> 3.7.2) + sprockets (~> 4.2.0) terrapin turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) - web-console (>= 3.3.0) + web-console (>= 3.7.0) will_paginate (~> 3.1.0) RUBY VERSION ruby 2.5.1p57 BUNDLED WITH - 1.16.2 + 1.17.3