From 001b321d80ec79ea34b0c96770befb4a9ce6f7de Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Wed, 8 Mar 2023 23:01:54 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-RACK-3356639 --- Gemfile | 12 +-- Gemfile.lock | 207 ++++++++++++++++++++++++++++----------------------- 2 files changed, 121 insertions(+), 98 deletions(-) diff --git a/Gemfile b/Gemfile index ae5d736..c936c30 100644 --- a/Gemfile +++ b/Gemfile @@ -4,24 +4,24 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '2.5.1' # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' -gem 'rails', '~> 5.2.0' +gem 'rails', '~> 5.2.4', '>= 5.2.4.4' # Use postgresql as the database for Active Record gem 'pg', '>= 0.18', '< 2.0' # Use Puma as the app server gem 'puma', '~> 3.11' # Use SCSS for stylesheets -gem 'sass-rails', '~> 5.0' +gem 'sass-rails', '~> 5.1', '>= 5.1.0' # Use Uglifier as compressor for JavaScript assets gem 'uglifier', '>= 1.3.0' # See https://github.com/rails/execjs#readme for more supported runtimes # gem 'mini_racer', platforms: :ruby -gem 'devise', '~> 4.6.0' +gem 'devise', '~> 4.6.2' gem 'devise_saml_authenticatable' gem 'cancancan', '~> 2.2.0' gem 'paperclip', '~> 6.0.0' gem 'pry' # Use CoffeeScript for .coffee assets and views -gem 'coffee-rails', '~> 4.2' +gem 'coffee-rails', '~> 4.2', '>= 4.2.2' # Turbolinks makes navigating your web application faster. Read more: https://github.com/turbolinks/turbolinks gem 'turbolinks', '~> 5' # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder @@ -57,7 +57,7 @@ end group :development do # Access an interactive console on exception pages or by calling 'console' anywhere in the code. - gem 'web-console', '>= 3.3.0' + gem 'web-console', '>= 3.7.0' gem 'listen', '>= 3.0.5', '< 3.2' gem 'capistrano' gem 'capistrano-rbenv' # idiomatic rbenv support @@ -74,7 +74,7 @@ end group :test do # Adds support for Capybara system testing and selenium driver - gem 'capybara', '>= 2.15', '< 4.0' + gem 'capybara', '>= 3.34.0', '< 4.0' gem 'selenium-webdriver' # Easy installation and use of chromedriver to run system tests with Chrome gem 'chromedriver-helper' diff --git a/Gemfile.lock b/Gemfile.lock index e9c52b3..c192823 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,55 +1,55 @@ GEM remote: https://rubygems.org/ specs: - actioncable (5.2.4.4) - actionpack (= 5.2.4.4) + actioncable (5.2.8.1) + actionpack (= 5.2.8.1) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailer (5.2.4.4) - actionpack (= 5.2.4.4) - actionview (= 5.2.4.4) - activejob (= 5.2.4.4) + actionmailer (5.2.8.1) + actionpack (= 5.2.8.1) + actionview (= 5.2.8.1) + activejob (= 5.2.8.1) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.2.4.4) - actionview (= 5.2.4.4) - activesupport (= 5.2.4.4) + actionpack (5.2.8.1) + actionview (= 5.2.8.1) + activesupport (= 5.2.8.1) rack (~> 2.0, >= 2.0.8) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.2.4.4) - activesupport (= 5.2.4.4) + actionview (5.2.8.1) + activesupport (= 5.2.8.1) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) - activejob (5.2.4.4) - activesupport (= 5.2.4.4) + activejob (5.2.8.1) + activesupport (= 5.2.8.1) globalid (>= 0.3.6) - activemodel (5.2.4.4) - activesupport (= 5.2.4.4) - activerecord (5.2.4.4) - activemodel (= 5.2.4.4) - activesupport (= 5.2.4.4) + activemodel (5.2.8.1) + activesupport (= 5.2.8.1) + activerecord (5.2.8.1) + activemodel (= 5.2.8.1) + activesupport (= 5.2.8.1) arel (>= 9.0) - activestorage (5.2.4.4) - actionpack (= 5.2.4.4) - activerecord (= 5.2.4.4) - marcel (~> 0.3.1) - activesupport (5.2.4.4) + activestorage (5.2.8.1) + actionpack (= 5.2.8.1) + activerecord (= 5.2.8.1) + marcel (~> 1.0.0) + activesupport (5.2.8.1) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 0.7, < 2) minitest (~> 5.1) tzinfo (~> 1.1) - addressable (2.7.0) - public_suffix (>= 2.0.2, < 5.0) + addressable (2.8.1) + public_suffix (>= 2.0.2, < 6.0) airbrussh (1.4.0) sshkit (>= 1.6.1, != 1.7.0) archive-zip (0.12.0) io-like (~> 0.3.0) arel (9.0.0) - bcrypt (3.1.16) + bcrypt (3.1.18) bindex (0.8.1) bootsnap (1.5.1) msgpack (~> 1.0) @@ -83,13 +83,13 @@ GEM capistrano (~> 3.7) capistrano-bundler puma (~> 3.4) - capybara (3.34.0) + capybara (3.35.3) addressable mini_mime (>= 0.1.3) nokogiri (~> 1.8) rack (>= 1.6.0) rack-test (>= 0.6.3) - regexp_parser (~> 1.5) + regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) childprocess (3.0.0) chromedriver-helper (2.1.1) @@ -104,7 +104,7 @@ GEM coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.1.7) + concurrent-ruby (1.2.2) crass (1.0.6) devise (4.6.2) bcrypt (~> 3.0) @@ -112,18 +112,20 @@ GEM railties (>= 4.1.0, < 6.0) responders warden (~> 1.2.3) - devise_saml_authenticatable (1.6.3) + devise_saml_authenticatable (1.9.0) devise (> 2.0.0) ruby-saml (~> 1.7) - erubi (1.10.0) - execjs (2.7.0) - ffi (1.14.2) - ffi (1.14.2-x64-mingw32) - globalid (0.4.2) - activesupport (>= 4.2.0) - i18n (1.8.7) + digest (3.1.1) + erubi (1.12.0) + execjs (2.8.1) + ffi (1.15.5) + ffi (1.15.5-x64-mingw32) + globalid (1.1.0) + activesupport (>= 5.0) + i18n (1.12.0) concurrent-ruby (~> 1.0) io-like (0.3.1) + io-wait (0.3.0) jbuilder (2.10.1) activesupport (>= 5.0.0) ledermann-rails-settings (2.5.0) @@ -132,31 +134,48 @@ GEM rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) ruby_dep (~> 1.2) - loofah (2.9.0) + loofah (2.19.1) crass (~> 1.0.2) nokogiri (>= 1.5.9) - mail (2.7.1) + mail (2.8.1) mini_mime (>= 0.1.1) - marcel (0.3.3) - mimemagic (~> 0.3.2) + net-imap + net-pop + net-smtp + marcel (1.0.2) method_source (1.0.0) mime-types (3.3.1) mime-types-data (~> 3.2015) mime-types-data (3.2020.1104) - mimemagic (0.3.5) - mini_mime (1.0.2) - mini_portile2 (2.5.0) - minitest (5.14.3) + mimemagic (0.3.10) + nokogiri (~> 1) + rake + mini_mime (1.1.2) + mini_portile2 (2.6.1) + minitest (5.15.0) msgpack (1.3.3) msgpack (1.3.3-x64-mingw32) + net-imap (0.2.2) + digest + net-protocol + strscan + net-pop (0.1.2) + net-protocol + net-protocol (0.1.2) + io-wait + timeout net-scp (3.0.0) net-ssh (>= 2.6.5, < 7.0.0) + net-smtp (0.3.0) + digest + net-protocol + timeout net-ssh (6.1.0) - nio4r (2.5.4) - nokogiri (1.11.1) - mini_portile2 (~> 2.5.0) + nio4r (2.5.8) + nokogiri (1.12.5) + mini_portile2 (~> 2.6.1) racc (~> 1.4) - nokogiri (1.11.1-x64-mingw32) + nokogiri (1.12.5-x64-mingw32) racc (~> 1.4) orm_adapter (0.5.0) paperclip (6.0.0) @@ -176,49 +195,51 @@ GEM pry (0.13.1) coderay (~> 1.1) method_source (~> 1.0) - public_suffix (4.0.6) + public_suffix (4.0.7) puma (3.12.6) - racc (1.5.2) - rack (2.2.3) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails (5.2.4.4) - actioncable (= 5.2.4.4) - actionmailer (= 5.2.4.4) - actionpack (= 5.2.4.4) - actionview (= 5.2.4.4) - activejob (= 5.2.4.4) - activemodel (= 5.2.4.4) - activerecord (= 5.2.4.4) - activestorage (= 5.2.4.4) - activesupport (= 5.2.4.4) + racc (1.6.2) + rack (2.2.6.3) + rack-test (2.0.2) + rack (>= 1.3) + rails (5.2.8.1) + actioncable (= 5.2.8.1) + actionmailer (= 5.2.8.1) + actionpack (= 5.2.8.1) + actionview (= 5.2.8.1) + activejob (= 5.2.8.1) + activemodel (= 5.2.8.1) + activerecord (= 5.2.8.1) + activestorage (= 5.2.8.1) + activesupport (= 5.2.8.1) bundler (>= 1.3.0) - railties (= 5.2.4.4) + railties (= 5.2.8.1) sprockets-rails (>= 2.0.0) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.3.0) - loofah (~> 2.3) - railties (5.2.4.4) - actionpack (= 5.2.4.4) - activesupport (= 5.2.4.4) + rails-html-sanitizer (1.5.0) + loofah (~> 2.19, >= 2.19.1) + railties (5.2.8.1) + actionpack (= 5.2.8.1) + activesupport (= 5.2.8.1) method_source rake (>= 0.8.7) thor (>= 0.19.0, < 2.0) - rake (13.0.3) - rb-fsevent (0.10.4) + rake (13.0.6) + rb-fsevent (0.11.2) rb-inotify (0.10.1) ffi (~> 1.0) - regexp_parser (1.8.2) - responders (3.0.1) - actionpack (>= 5.0) - railties (>= 5.0) + regexp_parser (2.7.0) + responders (3.1.0) + actionpack (>= 5.2) + railties (>= 5.2) + rexml (3.2.5) roo (2.8.3) nokogiri (~> 1) rubyzip (>= 1.3.0, < 3.0.0) - ruby-saml (1.11.0) - nokogiri (>= 1.5.10) + ruby-saml (1.14.0) + nokogiri (>= 1.10.5) + rexml ruby_dep (1.5.0) rubyzip (2.3.0) sass (3.7.4) @@ -242,25 +263,27 @@ GEM sprockets (3.7.2) concurrent-ruby (~> 1.0) rack (> 1, < 3) - sprockets-rails (3.2.2) - actionpack (>= 4.0) - activesupport (>= 4.0) + sprockets-rails (3.4.2) + actionpack (>= 5.2) + activesupport (>= 5.2) sprockets (>= 3.0.0) sshkit (1.21.1) net-scp (>= 1.1.2) net-ssh (>= 2.8.0) sshkit-interactive (0.3.0) sshkit (~> 1.12) + strscan (3.0.6) terrapin (0.6.0) climate_control (>= 0.0.3, < 1.0) - thor (1.0.1) + thor (1.2.1) thread_safe (0.3.6) - tilt (2.0.10) + tilt (2.1.0) + timeout (0.3.2) ttfunk (1.7.0) turbolinks (5.2.1) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) - tzinfo (1.2.9) + tzinfo (1.2.11) thread_safe (~> 0.1) tzinfo-data (1.2020.6) tzinfo (>= 1.0.0) @@ -273,7 +296,7 @@ GEM activemodel (>= 5.0) bindex (>= 0.4.0) railties (>= 5.0) - websocket-driver (0.7.3) + websocket-driver (0.7.5) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) will_paginate (3.1.8) @@ -297,10 +320,10 @@ DEPENDENCIES capistrano-rbenv capistrano-rbenv-install capistrano3-puma - capybara (>= 2.15, < 4.0) + capybara (>= 3.34.0, < 4.0) chromedriver-helper - coffee-rails (~> 4.2) - devise (~> 4.6.0) + coffee-rails (~> 4.2, >= 4.2.2) + devise (~> 4.6.2) devise_saml_authenticatable jbuilder (~> 2.5) ledermann-rails-settings @@ -311,10 +334,10 @@ DEPENDENCIES prawn-table pry puma (~> 3.11) - rails (~> 5.2.0) + rails (~> 5.2.4, >= 5.2.4.4) roo (~> 2.8) rubyzip (>= 1.2.2) - sass-rails (~> 5.0) + sass-rails (~> 5.1, >= 5.1.0) selenium-webdriver spring spring-watcher-listen (~> 2.0.0) @@ -323,11 +346,11 @@ DEPENDENCIES turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) - web-console (>= 3.3.0) + web-console (>= 3.7.0) will_paginate (~> 3.1.0) RUBY VERSION ruby 2.5.1p57 BUNDLED WITH - 1.16.2 + 1.17.3