Skip to content

Commit

Permalink
fix: update Rails and REXML to patch security vulnerabilities
Browse files Browse the repository at this point in the history 
- Update Rails from 7.1.3 to 7.1.4.2 to fix:
  - CVE-2024-47889 in Action Mailer (ReDoS in block_format)
  - CVE-2024-41128 in Action Dispatch (ReDoS in query parameter filtering)
  - CVE-2024-47887 in Action Controller (ReDoS in HTTP Token authentication)
  - CVE-2024-47888 in Action Text (ReDoS in plain_text_for_blockquote_node)

- Update REXML from 3.3.8 to 3.3.9 to fix:
  - CVE-2024-49761 (High severity ReDoS vulnerability)

Dependencies updated via bundle update
  • Loading branch information
@OlegPhenomenon
OlegPhenomenon committed Nov 26, 2024
1 parent 26bfe80 commit 238b160
Show file tree
Hide file tree
Showing 2 changed files with 74 additions and 74 deletions.
4 changes: 2 additions & 2 deletions Gemfile
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
source 'https://rubygems.org'
git_source(:github) { |repo| "https://github.com/#{repo}.git" }
# Bundle edge Rails instead: gem 'rails', github: 'rails/rails', branch: 'main'
gem 'rails', '~> 7.1.3'
gem 'rails', '~> 7.1.4.1'
gem 'pg', '~> 1.1'
gem 'puma', '~> 6.4.0'
gem 'redis', '~> 5.0'
gem 'bcrypt', '~> 3.1.7'
gem 'bootsnap', '>= 1.4.4', require: false
gem 'rexml'
gem 'rexml', '~> 3.3.9'
gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]
gem 'wkhtmltopdf-binary'
gem 'pdfkit'
Expand Down
144 changes: 72 additions & 72 deletions Gemfile.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,71 +37,71 @@ GIT
GEM
remote: https://rubygems.org/
specs:
actioncable (7.1.4)
actionpack (= 7.1.4)
activesupport (= 7.1.4)
actioncable (7.1.4.2)
actionpack (= 7.1.4.2)
activesupport (= 7.1.4.2)
nio4r (~> 2.0)
websocket-driver (>= 0.6.1)
zeitwerk (~> 2.6)
actionmailbox (7.1.4)
actionpack (= 7.1.4)
activejob (= 7.1.4)
activerecord (= 7.1.4)
activestorage (= 7.1.4)
activesupport (= 7.1.4)
actionmailbox (7.1.4.2)
actionpack (= 7.1.4.2)
activejob (= 7.1.4.2)
activerecord (= 7.1.4.2)
activestorage (= 7.1.4.2)
activesupport (= 7.1.4.2)
mail (>= 2.7.1)
net-imap
net-pop
net-smtp
actionmailer (7.1.4)
actionpack (= 7.1.4)
actionview (= 7.1.4)
activejob (= 7.1.4)
activesupport (= 7.1.4)
actionmailer (7.1.4.2)
actionpack (= 7.1.4.2)
actionview (= 7.1.4.2)
activejob (= 7.1.4.2)
activesupport (= 7.1.4.2)
mail (~> 2.5, >= 2.5.4)
net-imap
net-pop
net-smtp
rails-dom-testing (~> 2.2)
actionpack (7.1.4)
actionview (= 7.1.4)
activesupport (= 7.1.4)
actionpack (7.1.4.2)
actionview (= 7.1.4.2)
activesupport (= 7.1.4.2)
nokogiri (>= 1.8.5)
racc
rack (>= 2.2.4)
rack-session (>= 1.0.1)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6)
actiontext (7.1.4)
actionpack (= 7.1.4)
activerecord (= 7.1.4)
activestorage (= 7.1.4)
activesupport (= 7.1.4)
actiontext (7.1.4.2)
actionpack (= 7.1.4.2)
activerecord (= 7.1.4.2)
activestorage (= 7.1.4.2)
activesupport (= 7.1.4.2)
globalid (>= 0.6.0)
nokogiri (>= 1.8.5)
actionview (7.1.4)
activesupport (= 7.1.4)
actionview (7.1.4.2)
activesupport (= 7.1.4.2)
builder (~> 3.1)
erubi (~> 1.11)
rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6)
activejob (7.1.4)
activesupport (= 7.1.4)
activejob (7.1.4.2)
activesupport (= 7.1.4.2)
globalid (>= 0.3.6)
activemodel (7.1.4)
activesupport (= 7.1.4)
activerecord (7.1.4)
activemodel (= 7.1.4)
activesupport (= 7.1.4)
activemodel (7.1.4.2)
activesupport (= 7.1.4.2)
activerecord (7.1.4.2)
activemodel (= 7.1.4.2)
activesupport (= 7.1.4.2)
timeout (>= 0.4.0)
activestorage (7.1.4)
actionpack (= 7.1.4)
activejob (= 7.1.4)
activerecord (= 7.1.4)
activesupport (= 7.1.4)
activestorage (7.1.4.2)
actionpack (= 7.1.4.2)
activejob (= 7.1.4.2)
activerecord (= 7.1.4.2)
activesupport (= 7.1.4.2)
marcel (~> 1.0)
activesupport (7.1.4)
activesupport (7.1.4.2)
base64
bigdecimal
concurrent-ruby (~> 1.0, >= 1.0.2)
Expand Down Expand Up @@ -173,7 +173,7 @@ GEM
activerecord (>= 5.a)
database_cleaner-core (~> 2.0.0)
database_cleaner-core (2.0.1)
date (3.3.4)
date (3.4.0)
diff-lcs (1.5.0)
docile (1.4.0)
drb (2.2.1)
Expand Down Expand Up @@ -275,7 +275,7 @@ GEM
rb-fsevent (~> 0.10, >= 0.10.3)
rb-inotify (~> 0.9, >= 0.9.10)
logger (1.5.3)
loofah (2.22.0)
loofah (2.23.1)
crass (~> 1.0.2)
nokogiri (>= 1.12.0)
mail (2.8.1)
Expand All @@ -285,15 +285,15 @@ GEM
net-smtp
marcel (1.0.4)
mini_mime (1.1.5)
mini_portile2 (2.8.7)
minitest (5.25.1)
mini_portile2 (2.8.8)
minitest (5.25.2)
money (6.16.0)
i18n (>= 0.6.4, <= 2)
msgpack (1.7.2)
mutex_m (0.2.0)
mutex_m (0.3.0)
net-http (0.4.1)
uri
net-imap (0.4.16)
net-imap (0.5.1)
date
net-protocol
net-pop (0.1.2)
Expand All @@ -305,7 +305,7 @@ GEM
net-smtp (0.5.0)
net-protocol
net-ssh (7.2.0)
nio4r (2.7.3)
nio4r (2.7.4)
nokogiri (1.16.7)
mini_portile2 (~> 2.8.2)
racc (~> 1.4)
Expand Down Expand Up @@ -342,13 +342,13 @@ GEM
pg_search (2.3.6)
activerecord (>= 5.2)
activesupport (>= 5.2)
psych (5.1.2)
psych (5.2.0)
stringio
public_suffix (5.0.3)
puma (6.4.3)
nio4r (~> 2.0)
racc (1.8.1)
rack (2.2.9)
rack (2.2.10)
rack-oauth2 (2.2.0)
activesupport
attr_required
Expand All @@ -362,23 +362,23 @@ GEM
rack (< 3)
rack-test (2.1.0)
rack (>= 1.3)
rackup (1.0.0)
rackup (1.0.1)
rack (< 3)
webrick
rails (7.1.4)
actioncable (= 7.1.4)
actionmailbox (= 7.1.4)
actionmailer (= 7.1.4)
actionpack (= 7.1.4)
actiontext (= 7.1.4)
actionview (= 7.1.4)
activejob (= 7.1.4)
activemodel (= 7.1.4)
activerecord (= 7.1.4)
activestorage (= 7.1.4)
activesupport (= 7.1.4)
rails (7.1.4.2)
actioncable (= 7.1.4.2)
actionmailbox (= 7.1.4.2)
actionmailer (= 7.1.4.2)
actionpack (= 7.1.4.2)
actiontext (= 7.1.4.2)
actionview (= 7.1.4.2)
activejob (= 7.1.4.2)
activemodel (= 7.1.4.2)
activerecord (= 7.1.4.2)
activestorage (= 7.1.4.2)
activesupport (= 7.1.4.2)
bundler (>= 1.15.0)
railties (= 7.1.4)
railties (= 7.1.4.2)
rails-dom-testing (2.2.0)
activesupport (>= 5.0.0)
minitest
Expand All @@ -389,9 +389,9 @@ GEM
rails-i18n (7.0.8)
i18n (>= 0.7, < 2)
railties (>= 6.0.0, < 8)
railties (7.1.4)
actionpack (= 7.1.4)
activesupport (= 7.1.4)
railties (7.1.4.2)
actionpack (= 7.1.4.2)
activesupport (= 7.1.4.2)
irb
rackup (>= 1.0.0)
rake (>= 12.2)
Expand All @@ -402,16 +402,16 @@ GEM
rb-fsevent (0.11.2)
rb-inotify (0.10.1)
ffi (~> 1.0)
rdoc (6.7.0)
rdoc (6.8.1)
psych (>= 4.0.0)
redis (5.0.8)
redis-client (>= 0.17.0)
redis-client (0.18.0)
connection_pool
regexp_parser (2.8.2)
reline (0.5.10)
reline (0.5.11)
io-console (~> 0.5)
rexml (3.3.8)
rexml (3.3.9)
rspec-core (3.12.2)
rspec-support (~> 3.12.0)
rspec-expectations (3.12.3)
Expand Down Expand Up @@ -483,7 +483,7 @@ GEM
net-ssh (>= 2.8.0)
stimulus-rails (1.3.0)
railties (>= 6.0.0)
stringio (3.1.1)
stringio (3.1.2)
strong_migrations (1.6.4)
activerecord (>= 5.2)
swd (2.0.2)
Expand All @@ -494,7 +494,7 @@ GEM
terminal-table (3.0.2)
unicode-display_width (>= 1.1.1, < 3)
thor (1.3.2)
timeout (0.4.1)
timeout (0.4.2)
turbo-rails (1.5.0)
actionpack (>= 6.0.0)
activejob (>= 6.0.0)
Expand Down Expand Up @@ -529,13 +529,13 @@ GEM
addressable (>= 2.8.0)
crack (>= 0.3.2)
hashdiff (>= 0.4.0, < 2.0.0)
webrick (1.8.2)
webrick (1.9.0)
websocket (1.2.10)
websocket-driver (0.7.6)
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
wkhtmltopdf-binary (0.12.6.6)
zeitwerk (2.7.0)
zeitwerk (2.7.1)

PLATFORMS
ruby
Expand Down Expand Up @@ -581,9 +581,9 @@ DEPENDENCIES
pg (~> 1.1)
pg_search
puma (~> 6.4.0)
rails (~> 7.1.3)
rails (~> 7.1.4.1)
redis (~> 5.0)
rexml
rexml (~> 3.3.9)
rspec-rails
rubocop-rails
selenium-webdriver
Expand Down

0 comments on commit 238b160

Please sign in to comment.