Update Ruby gems and Yarn packages.
Upgrade Rails to 7.0.2.2 and Puma to 5.6.2 to fix this CVE: * https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released * https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9 * https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016 This fixes a bug in Puma <5.6.2 that caused ActiveSupport::CurrentAttributes to not be reset between requests in certain cases, which could allow state to be leaked between requests.
This commit is contained in:
evazion
122
Gemfile.lock
122
Gemfile.lock
@@ -23,71 +23,71 @@ GIT
|
||||
GEM
|
||||
remote: https://rubygems.org/
|
||||
specs:
|
||||
actioncable (7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
actioncable (7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
nio4r (~> 2.0)
|
||||
websocket-driver (>= 0.6.1)
|
||||
actionmailbox (7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
activejob (= 7.0.1)
|
||||
activerecord (= 7.0.1)
|
||||
activestorage (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
actionmailbox (7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
activejob (= 7.0.2.2)
|
||||
activerecord (= 7.0.2.2)
|
||||
activestorage (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
mail (>= 2.7.1)
|
||||
net-imap
|
||||
net-pop
|
||||
net-smtp
|
||||
actionmailer (7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
actionview (= 7.0.1)
|
||||
activejob (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
actionmailer (7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
actionview (= 7.0.2.2)
|
||||
activejob (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
mail (~> 2.5, >= 2.5.4)
|
||||
net-imap
|
||||
net-pop
|
||||
net-smtp
|
||||
rails-dom-testing (~> 2.0)
|
||||
actionpack (7.0.1)
|
||||
actionview (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
actionpack (7.0.2.2)
|
||||
actionview (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
rack (~> 2.0, >= 2.2.0)
|
||||
rack-test (>= 0.6.3)
|
||||
rails-dom-testing (~> 2.0)
|
||||
rails-html-sanitizer (~> 1.0, >= 1.2.0)
|
||||
actiontext (7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
activerecord (= 7.0.1)
|
||||
activestorage (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
actiontext (7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
activerecord (= 7.0.2.2)
|
||||
activestorage (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
globalid (>= 0.6.0)
|
||||
nokogiri (>= 1.8.5)
|
||||
actionview (7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
actionview (7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
builder (~> 3.1)
|
||||
erubi (~> 1.4)
|
||||
rails-dom-testing (~> 2.0)
|
||||
rails-html-sanitizer (~> 1.1, >= 1.2.0)
|
||||
activejob (7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
activejob (7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
globalid (>= 0.3.6)
|
||||
activemodel (7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
activemodel (7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
activemodel-serializers-xml (1.0.2)
|
||||
activemodel (> 5.x)
|
||||
activesupport (> 5.x)
|
||||
builder (~> 3.1)
|
||||
activerecord (7.0.1)
|
||||
activemodel (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
activestorage (7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
activejob (= 7.0.1)
|
||||
activerecord (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
activerecord (7.0.2.2)
|
||||
activemodel (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
activestorage (7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
activejob (= 7.0.2.2)
|
||||
activerecord (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
marcel (~> 1.0)
|
||||
mini_mime (>= 1.1.0)
|
||||
activesupport (7.0.1)
|
||||
activesupport (7.0.2.2)
|
||||
concurrent-ruby (~> 1.0, >= 1.0.2)
|
||||
i18n (>= 1.6, < 2)
|
||||
minitest (>= 5.1)
|
||||
@@ -97,7 +97,7 @@ GEM
|
||||
ansi (1.5.0)
|
||||
ast (2.4.2)
|
||||
aws-eventstream (1.2.0)
|
||||
aws-partitions (1.553.0)
|
||||
aws-partitions (1.554.0)
|
||||
aws-sdk-core (3.126.0)
|
||||
aws-eventstream (~> 1, >= 1.0.2)
|
||||
aws-partitions (~> 1, >= 1.525.0)
|
||||
@@ -212,7 +212,7 @@ GEM
|
||||
ffi (~> 1.0)
|
||||
globalid (1.0.0)
|
||||
activesupport (>= 5.0)
|
||||
good_job (2.9.4)
|
||||
good_job (2.9.6)
|
||||
activejob (>= 5.2.0)
|
||||
activerecord (>= 5.2.0)
|
||||
concurrent-ruby (>= 1.0.2)
|
||||
@@ -248,7 +248,7 @@ GEM
|
||||
google-cloud-env (1.5.0)
|
||||
faraday (>= 0.17.3, < 2.0)
|
||||
google-cloud-errors (1.2.0)
|
||||
google-cloud-storage (1.36.0)
|
||||
google-cloud-storage (1.36.1)
|
||||
addressable (~> 2.8)
|
||||
digest-crc (~> 0.4)
|
||||
google-apis-iamcredentials_v1 (~> 0.1)
|
||||
@@ -290,7 +290,7 @@ GEM
|
||||
listen (3.7.1)
|
||||
rb-fsevent (~> 0.10, >= 0.10.3)
|
||||
rb-inotify (~> 0.9, >= 0.9.10)
|
||||
loofah (2.13.0)
|
||||
loofah (2.14.0)
|
||||
crass (~> 1.0.2)
|
||||
nokogiri (>= 1.5.9)
|
||||
mail (2.7.1)
|
||||
@@ -360,7 +360,7 @@ GEM
|
||||
pry-rails (0.3.9)
|
||||
pry (>= 0.10.4)
|
||||
public_suffix (4.0.6)
|
||||
puma (5.6.1)
|
||||
puma (5.6.2)
|
||||
nio4r (~> 2.0)
|
||||
puma-metrics (1.2.3)
|
||||
prometheus-client (>= 0.10)
|
||||
@@ -380,28 +380,28 @@ GEM
|
||||
rack-test (1.1.0)
|
||||
rack (>= 1.0, < 3)
|
||||
rack-timeout (0.6.0)
|
||||
rails (7.0.1)
|
||||
actioncable (= 7.0.1)
|
||||
actionmailbox (= 7.0.1)
|
||||
actionmailer (= 7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
actiontext (= 7.0.1)
|
||||
actionview (= 7.0.1)
|
||||
activejob (= 7.0.1)
|
||||
activemodel (= 7.0.1)
|
||||
activerecord (= 7.0.1)
|
||||
activestorage (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
rails (7.0.2.2)
|
||||
actioncable (= 7.0.2.2)
|
||||
actionmailbox (= 7.0.2.2)
|
||||
actionmailer (= 7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
actiontext (= 7.0.2.2)
|
||||
actionview (= 7.0.2.2)
|
||||
activejob (= 7.0.2.2)
|
||||
activemodel (= 7.0.2.2)
|
||||
activerecord (= 7.0.2.2)
|
||||
activestorage (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
bundler (>= 1.15.0)
|
||||
railties (= 7.0.1)
|
||||
railties (= 7.0.2.2)
|
||||
rails-dom-testing (2.0.3)
|
||||
activesupport (>= 4.2.0)
|
||||
nokogiri (>= 1.6)
|
||||
rails-html-sanitizer (1.4.2)
|
||||
loofah (~> 2.3)
|
||||
railties (7.0.1)
|
||||
actionpack (= 7.0.1)
|
||||
activesupport (= 7.0.1)
|
||||
railties (7.0.2.2)
|
||||
actionpack (= 7.0.2.2)
|
||||
activesupport (= 7.0.2.2)
|
||||
method_source
|
||||
rake (>= 12.2)
|
||||
thor (~> 1.0)
|
||||
@@ -409,7 +409,7 @@ GEM
|
||||
rainbow (3.1.1)
|
||||
rake (13.0.6)
|
||||
rakismet (1.5.4)
|
||||
rb-fsevent (0.11.0)
|
||||
rb-fsevent (0.11.1)
|
||||
rb-inotify (0.10.1)
|
||||
ffi (~> 1.0)
|
||||
rbtrace (0.4.14)
|
||||
@@ -419,7 +419,7 @@ GEM
|
||||
recaptcha (5.8.1)
|
||||
json
|
||||
redis (4.6.0)
|
||||
regexp_parser (2.2.0)
|
||||
regexp_parser (2.2.1)
|
||||
representable (3.1.1)
|
||||
declarative (< 0.1.0)
|
||||
trailblazer-option (>= 0.1.1, < 0.2.0)
|
||||
@@ -517,7 +517,7 @@ GEM
|
||||
unf_ext
|
||||
unf_ext (0.0.8)
|
||||
unicode-display_width (2.1.0)
|
||||
view_component (2.48.0)
|
||||
view_component (2.49.0)
|
||||
activesupport (>= 5.0.0, < 8.0)
|
||||
method_source (~> 1.0)
|
||||
webpacker (6.0.0.rc.6)
|
||||
|
||||
Reference in New Issue
Block a user