Skip to content
This repository has been archived by the owner on Jun 26, 2023. It is now read-only.

Automated Bundle Update #6

Merged
merged 1 commit into from Aug 21, 2019
Merged

Automated Bundle Update #6

merged 1 commit into from Aug 21, 2019

Conversation

johnsyweb
Copy link
Contributor

Gems brought up-to-date with ❤️ by Unwrappr.
See individual annotations below for details.

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
actionpack (5.2.2.1)
actionview (= 5.2.2.1)
activesupport (= 5.2.2.1)
actionpack (6.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actionpack

Major version upgrade 📈❗ 5.2.2.1 → 6.0.0

[change-log, source-code]

Commits

A change of 7275 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
actionview (5.2.2.1)
activesupport (= 5.2.2.1)
rails-html-sanitizer (~> 1.0, >= 1.2.0)
actionview (6.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actionview

Major version upgrade 📈❗ 5.2.2.1 → 6.0.0

[change-log, source-code]

Commits

A change of 7275 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
arel (>= 9.0)
activesupport (5.2.2.1)
rails-html-sanitizer (~> 1.1, >= 1.2.0)
activemodel (6.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

activemodel

Major version upgrade 📈❗ 5.2.2.1 → 6.0.0

[change-log, source-code]

Commits

A change of 7275 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
rails-html-sanitizer (~> 1.1, >= 1.2.0)
activemodel (6.0.0)
activesupport (= 6.0.0)
activerecord (6.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

activerecord

Major version upgrade 📈❗ 5.2.2.1 → 6.0.0

[change-log, source-code]

Commits

A change of 7275 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
activerecord (6.0.0)
activemodel (= 6.0.0)
activesupport (= 6.0.0)
activesupport (6.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

activesupport

Major version upgrade 📈❗ 5.2.2.1 → 6.0.0

[change-log, source-code]

Commits

A change of 7275 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 0.7, < 2)
minitest (~> 5.1)
tzinfo (~> 1.1)
arel (9.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

arel

Gem removed 🔥

[change-log, source-code]

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
@@ -48,32 +47,33 @@ GEM
method_source (0.9.2)
mini_portile2 (2.4.0)
minitest (5.11.3)
money (6.13.2)
money (6.13.4)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

money

Patch version upgrade 📈🔹 6.13.2 → 6.13.4

[change-log, source-code]

Commits

A change of 12 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
i18n (>= 0.6.4, <= 2)
nokogiri (1.10.1)
nokogiri (1.10.4)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nokogiri

Patch version upgrade 📈🔹 1.10.1 → 1.10.4

[change-log, source-code]

🎉 Patched vulnerabilities:

  • CVE-2019-5477
    Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file

    URL: CVE-2019-5477 - Nokogiri Command Injection Vulnerability sparklemotion/nokogiri#1915

    A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. Upgrade to Nokogiri v1.10.4, or avoid calling the undocumented method Nokogiri::CSS::Tokenizer#load_file with untrusted user input.

  • CVE-2019-11068
    Nokogiri gem, via libxslt, is affected by improper access control vulnerability

    URL: Investigate Ubuntu libxslt patches in USN-3947-1 and USN-3947-2 sparklemotion/nokogiri#1892

    Nokogiri v1.10.3 has been released. This is a security release. It addresses a CVE in upstream libxslt rated as "Priority: medium" by Canonical, and "NVD Severity: high" by Debian. More details are available below. If you're using your distro's system libraries, rather than Nokogiri's vendored libraries, there's no security need to upgrade at this time, though you may want to check with your distro whether they've patched this (Canonical has patched Ubuntu packages). Note that this patch is not yet (as of 2019-04-22) in an upstream release of libxslt. Full details about the security update are available in Github Issue [#1892] Investigate Ubuntu libxslt patches in USN-3947-1 and USN-3947-2 sparklemotion/nokogiri#1892. --- CVE-2019-11068 Permalinks are: - Canonical: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-11068 - Debian: https://security-tracker.debian.org/tracker/CVE-2019-11068 Description: > libxslt through 1.1.33 allows bypass of a protection mechanism > because callers of xsltCheckRead and xsltCheckWrite permit access > even upon receiving a -1 error code. xsltCheckRead can return -1 for > a crafted URL that is not actually invalid and is subsequently > loaded. Canonical rates this as "Priority: Medium". Debian rates this as "NVD Severity: High (attack range: remote)".

Commits

A change of 86 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
mini_portile2 (~> 2.4.0)
pagerduty (2.1.2)
json (>= 1.7.7)
rack (2.0.6)
rack (2.0.7)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rack

Patch version upgrade 📈🔹 2.0.6 → 2.0.7

[change-log, source-code]

Commits

A change of 4 commits. See the full changes on the compare page.

These are the individual commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
rack-test (1.1.0)
rack (>= 1.0, < 3)
rails-dom-testing (2.0.3)
activesupport (>= 4.2.0)
nokogiri (>= 1.6)
rails-html-sanitizer (1.0.4)
rails-html-sanitizer (1.2.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rails-html-sanitizer

Minor version upgrade 📈🔶 1.0.4 → 1.2.0

[change-log, source-code]

Commits

A change of 26 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
railties (5.2.2.1)
actionpack (= 5.2.2.1)
activesupport (= 5.2.2.1)
railties (6.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

railties

Major version upgrade 📈❗ 5.2.2.1 → 6.0.0

[change-log, source-code]

Commits

A change of 7275 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
thor (>= 0.19.0, < 2.0)
rake (12.3.2)
thor (>= 0.20.3, < 2.0)
rake (12.3.3)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rake

Patch version upgrade 📈🔹 12.3.2 → 12.3.3

[change-log, source-code]

Commits

A change of 25 commits. See the full changes on the compare page.

These are the first 10 commits:

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
thor (0.20.3)
thread_safe (0.3.6)
tzinfo (1.2.5)
thread_safe (~> 0.1)
zxcvbn-ruby (0.1.2)
zeitwerk (2.1.9)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zeitwerk

Gem added ⛄

[change-log, source-code]

johnsyweb
johnsyweb commented Aug 21, 2019
View reviewed changes
Gemfile.lock
thor (0.20.3)
thread_safe (0.3.6)
tzinfo (1.2.5)
thread_safe (~> 0.1)
zxcvbn-ruby (0.1.2)
zeitwerk (2.1.9)
zxcvbn-ruby (1.0.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zxcvbn-ruby

Major version upgrade 📈❗ 0.1.2 → 1.0.0

[change-log, source-code]

Commits

A change of 16 commits. See the full changes on the compare page.

These are the first 10 commits:

@johnsyweb johnsyweb merged commit d32b101 into master Aug 21, 2019
@johnsyweb johnsyweb deleted the auto_bundle_update_20192108-1614 branch August 21, 2019 06:16
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@johnsyweb