Upgrade to Rails 7.1.3.2

In response to:
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
- https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946

No evidence that our app has been affected, but I like to move quickly
on these!
This commit is contained in:
Emi Matchu 2024-02-22 11:25:52 -08:00
parent 583f3c712f
commit ec1cd65a2e
40 changed files with 62 additions and 61 deletions

View file

@ -1,7 +1,7 @@
source 'https://rubygems.org' source 'https://rubygems.org'
ruby '3.1.4' ruby '3.1.4'
gem 'rails', '~> 7.1', '>= 7.1.1' gem 'rails', '~> 7.1', '>= 7.1.3.2'
# The HTTP server running the Rails instance. # The HTTP server running the Rails instance.
gem 'falcon', '~> 0.42.3' gem 'falcon', '~> 0.42.3'

View file

@ -7,70 +7,71 @@ GIT
GEM GEM
remote: https://rubygems.org/ remote: https://rubygems.org/
specs: specs:
actioncable (7.1.1) actioncable (7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
nio4r (~> 2.0) nio4r (~> 2.0)
websocket-driver (>= 0.6.1) websocket-driver (>= 0.6.1)
zeitwerk (~> 2.6) zeitwerk (~> 2.6)
actionmailbox (7.1.1) actionmailbox (7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
activejob (= 7.1.1) activejob (= 7.1.3.2)
activerecord (= 7.1.1) activerecord (= 7.1.3.2)
activestorage (= 7.1.1) activestorage (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
mail (>= 2.7.1) mail (>= 2.7.1)
net-imap net-imap
net-pop net-pop
net-smtp net-smtp
actionmailer (7.1.1) actionmailer (7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
actionview (= 7.1.1) actionview (= 7.1.3.2)
activejob (= 7.1.1) activejob (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
mail (~> 2.5, >= 2.5.4) mail (~> 2.5, >= 2.5.4)
net-imap net-imap
net-pop net-pop
net-smtp net-smtp
rails-dom-testing (~> 2.2) rails-dom-testing (~> 2.2)
actionpack (7.1.1) actionpack (7.1.3.2)
actionview (= 7.1.1) actionview (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
nokogiri (>= 1.8.5) nokogiri (>= 1.8.5)
racc
rack (>= 2.2.4) rack (>= 2.2.4)
rack-session (>= 1.0.1) rack-session (>= 1.0.1)
rack-test (>= 0.6.3) rack-test (>= 0.6.3)
rails-dom-testing (~> 2.2) rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6) rails-html-sanitizer (~> 1.6)
actiontext (7.1.1) actiontext (7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
activerecord (= 7.1.1) activerecord (= 7.1.3.2)
activestorage (= 7.1.1) activestorage (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
globalid (>= 0.6.0) globalid (>= 0.6.0)
nokogiri (>= 1.8.5) nokogiri (>= 1.8.5)
actionview (7.1.1) actionview (7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
builder (~> 3.1) builder (~> 3.1)
erubi (~> 1.11) erubi (~> 1.11)
rails-dom-testing (~> 2.2) rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6) rails-html-sanitizer (~> 1.6)
activejob (7.1.1) activejob (7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
globalid (>= 0.3.6) globalid (>= 0.3.6)
activemodel (7.1.1) activemodel (7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
activerecord (7.1.1) activerecord (7.1.3.2)
activemodel (= 7.1.1) activemodel (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
timeout (>= 0.4.0) timeout (>= 0.4.0)
activestorage (7.1.1) activestorage (7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
activejob (= 7.1.1) activejob (= 7.1.3.2)
activerecord (= 7.1.1) activerecord (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
marcel (~> 1.0) marcel (~> 1.0)
activesupport (7.1.1) activesupport (7.1.3.2)
base64 base64
bigdecimal bigdecimal
concurrent-ruby (~> 1.0, >= 1.0.2) concurrent-ruby (~> 1.0, >= 1.0.2)
@ -122,7 +123,7 @@ GEM
fiber-annotation fiber-annotation
fiber-local fiber-local
crass (1.0.6) crass (1.0.6)
date (3.3.3) date (3.3.4)
devise (4.9.3) devise (4.9.3)
bcrypt (~> 3.0) bcrypt (~> 3.0)
orm_adapter (~> 0.1) orm_adapter (~> 0.1)
@ -197,16 +198,16 @@ GEM
multi_xml (0.6.0) multi_xml (0.6.0)
mutex_m (0.1.2) mutex_m (0.1.2)
mysql2 (0.5.5) mysql2 (0.5.5)
net-imap (0.4.2) net-imap (0.4.10)
date date
net-protocol net-protocol
net-pop (0.1.2) net-pop (0.1.2)
net-protocol net-protocol
net-protocol (0.2.1) net-protocol (0.2.2)
timeout timeout
net-smtp (0.4.0) net-smtp (0.4.0.1)
net-protocol net-protocol
nio4r (2.5.9) nio4r (2.7.0)
nokogiri (1.15.3) nokogiri (1.15.3)
mini_portile2 (~> 2.8.2) mini_portile2 (~> 2.8.2)
racc (~> 1.4) racc (~> 1.4)
@ -242,20 +243,20 @@ GEM
rackup (1.0.0) rackup (1.0.0)
rack (< 3) rack (< 3)
webrick webrick
rails (7.1.1) rails (7.1.3.2)
actioncable (= 7.1.1) actioncable (= 7.1.3.2)
actionmailbox (= 7.1.1) actionmailbox (= 7.1.3.2)
actionmailer (= 7.1.1) actionmailer (= 7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
actiontext (= 7.1.1) actiontext (= 7.1.3.2)
actionview (= 7.1.1) actionview (= 7.1.3.2)
activejob (= 7.1.1) activejob (= 7.1.3.2)
activemodel (= 7.1.1) activemodel (= 7.1.3.2)
activerecord (= 7.1.1) activerecord (= 7.1.3.2)
activestorage (= 7.1.1) activestorage (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
bundler (>= 1.15.0) bundler (>= 1.15.0)
railties (= 7.1.1) railties (= 7.1.3.2)
rails-dom-testing (2.2.0) rails-dom-testing (2.2.0)
activesupport (>= 5.0.0) activesupport (>= 5.0.0)
minitest minitest
@ -266,9 +267,9 @@ GEM
rails-i18n (7.0.8) rails-i18n (7.0.8)
i18n (>= 0.7, < 2) i18n (>= 0.7, < 2)
railties (>= 6.0.0, < 8) railties (>= 6.0.0, < 8)
railties (7.1.1) railties (7.1.3.2)
actionpack (= 7.1.1) actionpack (= 7.1.3.2)
activesupport (= 7.1.1) activesupport (= 7.1.3.2)
irb irb
rackup (>= 1.0.0) rackup (>= 1.0.0)
rake (>= 12.2) rake (>= 12.2)
@ -330,7 +331,7 @@ GEM
thor (1.2.2) thor (1.2.2)
thread-local (1.1.0) thread-local (1.1.0)
tilt (2.2.0) tilt (2.2.0)
timeout (0.4.0) timeout (0.4.1)
timers (4.3.5) timers (4.3.5)
traces (0.11.1) traces (0.11.1)
tzinfo (2.0.6) tzinfo (2.0.6)
@ -373,7 +374,7 @@ DEPENDENCIES
parallel (~> 1.23) parallel (~> 1.23)
rack-attack (~> 6.7) rack-attack (~> 6.7)
rack-mini-profiler (~> 3.1) rack-mini-profiler (~> 3.1)
rails (~> 7.1, >= 7.1.1) rails (~> 7.1, >= 7.1.3.2)
rails-i18n (~> 7.0, >= 7.0.7) rails-i18n (~> 7.0, >= 7.0.7)
rdiscount (~> 2.2, >= 2.2.7.1) rdiscount (~> 2.2, >= 2.2.7.1)
react-rails (~> 2.7, >= 2.7.1) react-rails (~> 2.7, >= 2.7.1)

Binary file not shown.

BIN
vendor/cache/actioncable-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/actionmailbox-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/actionmailer-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/actionpack-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/actiontext-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/actionview-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/activejob-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/activemodel-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/activerecord-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/activestorage-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/activesupport-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/date-3.3.4.gem vendored Normal file

Binary file not shown.

BIN
vendor/cache/net-imap-0.4.10.gem vendored Normal file

Binary file not shown.

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/net-protocol-0.2.2.gem vendored Normal file

Binary file not shown.

BIN
vendor/cache/net-smtp-0.4.0.1.gem vendored Normal file

Binary file not shown.

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/nio4r-2.7.0.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/rails-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/railties-7.1.3.2.gem vendored Normal file

Binary file not shown.

Binary file not shown.

BIN
vendor/cache/timeout-0.4.1.gem vendored Normal file

Binary file not shown.