Skip to content

Commit c4c8ba3

Browse files
remiremi
authored
Update Rails to 8.0.4.1 to fix security vulnerabilities (#350)
1 parent a04affe commit c4c8ba3

4 files changed

Lines changed: 98 additions & 88 deletions

File tree

‎.bundler-audit.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@
22
ignore:
33
- CVE-2024-27456 # https://github.com/advisories/GHSA-785g-282q-pwvx (packaging issue with rack-cors)
44
- CVE-2024-54133 # https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v (We don’t generate CSP from user input)
5+
- CVE-2026-32700 # https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc (User model patched)

‎Gemfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ gem 'rack-accept', require: 'rack/accept'
2121
gem 'rack-canonical-host', '1.3.0'
2222
gem 'rack-cors', require: 'rack/cors'
2323
gem 'rack-ssl', require: 'rack/ssl'
24-
gem 'rails', '~> 8.0.0'
24+
gem 'rails', '8.0.4.1'
2525
gem 'rails-html-sanitizer', '~> 1.6'
2626
gem 'ranked-model'
2727
gem 'rexml', '~> 3.4'

‎Gemfile.lock‎

Lines changed: 90 additions & 87 deletions
Original file line numberDiff line numberDiff line change
@@ -8,68 +8,68 @@ GIT
88
GEM
99
remote: https://rubygems.org/
1010
specs:
11-
actioncable (8.0.2.1)
12-
actionpack (= 8.0.2.1)
13-
activesupport (= 8.0.2.1)
11+
actioncable (8.0.4.1)
12+
actionpack (= 8.0.4.1)
13+
activesupport (= 8.0.4.1)
1414
nio4r (~> 2.0)
1515
websocket-driver (>= 0.6.1)
1616
zeitwerk (~> 2.6)
17-
actionmailbox (8.0.2.1)
18-
actionpack (= 8.0.2.1)
19-
activejob (= 8.0.2.1)
20-
activerecord (= 8.0.2.1)
21-
activestorage (= 8.0.2.1)
22-
activesupport (= 8.0.2.1)
17+
actionmailbox (8.0.4.1)
18+
actionpack (= 8.0.4.1)
19+
activejob (= 8.0.4.1)
20+
activerecord (= 8.0.4.1)
21+
activestorage (= 8.0.4.1)
22+
activesupport (= 8.0.4.1)
2323
mail (>= 2.8.0)
24-
actionmailer (8.0.2.1)
25-
actionpack (= 8.0.2.1)
26-
actionview (= 8.0.2.1)
27-
activejob (= 8.0.2.1)
28-
activesupport (= 8.0.2.1)
24+
actionmailer (8.0.4.1)
25+
actionpack (= 8.0.4.1)
26+
actionview (= 8.0.4.1)
27+
activejob (= 8.0.4.1)
28+
activesupport (= 8.0.4.1)
2929
mail (>= 2.8.0)
3030
rails-dom-testing (~> 2.2)
31-
actionpack (8.0.2.1)
32-
actionview (= 8.0.2.1)
33-
activesupport (= 8.0.2.1)
31+
actionpack (8.0.4.1)
32+
actionview (= 8.0.4.1)
33+
activesupport (= 8.0.4.1)
3434
nokogiri (>= 1.8.5)
3535
rack (>= 2.2.4)
3636
rack-session (>= 1.0.1)
3737
rack-test (>= 0.6.3)
3838
rails-dom-testing (~> 2.2)
3939
rails-html-sanitizer (~> 1.6)
4040
useragent (~> 0.16)
41-
actiontext (8.0.2.1)
42-
actionpack (= 8.0.2.1)
43-
activerecord (= 8.0.2.1)
44-
activestorage (= 8.0.2.1)
45-
activesupport (= 8.0.2.1)
41+
actiontext (8.0.4.1)
42+
actionpack (= 8.0.4.1)
43+
activerecord (= 8.0.4.1)
44+
activestorage (= 8.0.4.1)
45+
activesupport (= 8.0.4.1)
4646
globalid (>= 0.6.0)
4747
nokogiri (>= 1.8.5)
48-
actionview (8.0.2.1)
49-
activesupport (= 8.0.2.1)
48+
actionview (8.0.4.1)
49+
activesupport (= 8.0.4.1)
5050
builder (~> 3.1)
5151
erubi (~> 1.11)
5252
rails-dom-testing (~> 2.2)
5353
rails-html-sanitizer (~> 1.6)
54-
activejob (8.0.2.1)
55-
activesupport (= 8.0.2.1)
54+
activejob (8.0.4.1)
55+
activesupport (= 8.0.4.1)
5656
globalid (>= 0.3.6)
57-
activemodel (8.0.2.1)
58-
activesupport (= 8.0.2.1)
59-
activerecord (8.0.2.1)
60-
activemodel (= 8.0.2.1)
61-
activesupport (= 8.0.2.1)
57+
activemodel (8.0.4.1)
58+
activesupport (= 8.0.4.1)
59+
activerecord (8.0.4.1)
60+
activemodel (= 8.0.4.1)
61+
activesupport (= 8.0.4.1)
6262
timeout (>= 0.4.0)
6363
activerecord_json_validator (3.1.0)
6464
activerecord (>= 4.2.0, < 9)
6565
json_schemer (~> 2.2)
66-
activestorage (8.0.2.1)
67-
actionpack (= 8.0.2.1)
68-
activejob (= 8.0.2.1)
69-
activerecord (= 8.0.2.1)
70-
activesupport (= 8.0.2.1)
66+
activestorage (8.0.4.1)
67+
actionpack (= 8.0.4.1)
68+
activejob (= 8.0.4.1)
69+
activerecord (= 8.0.4.1)
70+
activesupport (= 8.0.4.1)
7171
marcel (~> 1.0)
72-
activesupport (8.0.2.1)
72+
activesupport (8.0.4.1)
7373
base64
7474
benchmark (>= 0.3)
7575
bigdecimal
@@ -78,7 +78,7 @@ GEM
7878
drb
7979
i18n (>= 1.6, < 2)
8080
logger (>= 1.4.2)
81-
minitest (>= 5.1)
81+
minitest (>= 5.1, < 6)
8282
securerandom (>= 0.3)
8383
tzinfo (~> 2.0, >= 2.0.5)
8484
uri (>= 0.13.1)
@@ -92,9 +92,9 @@ GEM
9292
babel-source (>= 4.0, < 6)
9393
execjs (~> 2.0)
9494
base64 (0.3.0)
95-
bcrypt (3.1.20)
96-
benchmark (0.4.1)
97-
bigdecimal (3.3.1)
95+
bcrypt (3.1.22)
96+
benchmark (0.5.0)
97+
bigdecimal (4.0.1)
9898
blockenspiel (0.5.0)
9999
bootsnap (1.18.6)
100100
msgpack (~> 1.2)
@@ -111,14 +111,14 @@ GEM
111111
activerecord (>= 3.0.0)
112112
activesupport (>= 3.0.0)
113113
cancancan (3.6.1)
114-
concurrent-ruby (1.3.5)
115-
connection_pool (2.5.4)
114+
concurrent-ruby (1.3.6)
115+
connection_pool (3.0.2)
116116
crass (1.0.6)
117117
database_cleaner-active_record (2.2.2)
118118
activerecord (>= 5.a)
119119
database_cleaner-core (~> 2.0)
120120
database_cleaner-core (2.0.1)
121-
date (3.4.1)
121+
date (3.5.1)
122122
devise (4.9.4)
123123
bcrypt (~> 3.0)
124124
orm_adapter (~> 0.1)
@@ -127,7 +127,7 @@ GEM
127127
warden (~> 1.2.3)
128128
diff-lcs (1.6.2)
129129
drb (2.2.3)
130-
erb (5.1.1)
130+
erb (6.0.2)
131131
erubi (1.13.1)
132132
execjs (2.8.1)
133133
factory_bot (6.5.5)
@@ -140,20 +140,21 @@ GEM
140140
activerecord (>= 4.0.0)
141141
gaffe (1.2.0)
142142
rails (>= 4.0.0)
143-
globalid (1.2.1)
143+
globalid (1.3.0)
144144
activesupport (>= 6.1)
145145
hana (1.3.7)
146-
i18n (1.14.7)
146+
i18n (1.14.8)
147147
concurrent-ruby (~> 1.0)
148-
io-console (0.8.1)
149-
irb (1.15.2)
148+
io-console (0.8.2)
149+
irb (1.17.0)
150150
pp (>= 0.6.0)
151+
prism (>= 1.3.0)
151152
rdoc (>= 4.0.0)
152153
reline (>= 0.4.2)
153154
jquery-turbolinks (2.1.0)
154155
railties (>= 3.1.0)
155156
turbolinks
156-
json (2.15.2)
157+
json (2.19.2)
157158
json_schemer (2.4.0)
158159
bigdecimal
159160
hana (~> 1.3)
@@ -162,22 +163,23 @@ GEM
162163
language_server-protocol (3.17.0.5)
163164
lint_roller (1.1.0)
164165
logger (1.7.0)
165-
loofah (2.24.1)
166+
loofah (2.25.1)
166167
crass (~> 1.0.2)
167168
nokogiri (>= 1.12.0)
168-
mail (2.8.1)
169+
mail (2.9.0)
170+
logger
169171
mini_mime (>= 0.1.1)
170172
net-imap
171173
net-pop
172174
net-smtp
173-
marcel (1.0.4)
175+
marcel (1.1.0)
174176
mini_check (0.3.0)
175177
json
176178
mini_mime (1.1.5)
177179
mini_portile2 (2.8.9)
178-
minitest (5.26.0)
180+
minitest (5.27.0)
179181
msgpack (1.8.0)
180-
net-imap (0.5.9)
182+
net-imap (0.6.3)
181183
date
182184
net-protocol
183185
net-pop (0.1.2)
@@ -186,8 +188,8 @@ GEM
186188
timeout
187189
net-smtp (0.5.1)
188190
net-protocol
189-
nio4r (2.7.4)
190-
nokogiri (1.18.10)
191+
nio4r (2.7.5)
192+
nokogiri (1.19.2)
191193
mini_portile2 (~> 2.8.2)
192194
racc (~> 1.4)
193195
orm_adapter (0.5.0)
@@ -203,14 +205,14 @@ GEM
203205
prettyprint
204206
prettyprint (0.2.0)
205207
prism (1.6.0)
206-
psych (5.2.6)
208+
psych (5.3.1)
207209
date
208210
stringio
209211
public_suffix (5.0.4)
210212
puma (7.1.0)
211213
nio4r (~> 2.0)
212214
racc (1.8.1)
213-
rack (2.2.20)
215+
rack (2.2.22)
214216
rack-accept (0.4.5)
215217
rack (>= 0.4)
216218
rack-canonical-host (1.3.0)
@@ -227,50 +229,51 @@ GEM
227229
rackup (1.0.1)
228230
rack (< 3)
229231
webrick
230-
rails (8.0.2.1)
231-
actioncable (= 8.0.2.1)
232-
actionmailbox (= 8.0.2.1)
233-
actionmailer (= 8.0.2.1)
234-
actionpack (= 8.0.2.1)
235-
actiontext (= 8.0.2.1)
236-
actionview (= 8.0.2.1)
237-
activejob (= 8.0.2.1)
238-
activemodel (= 8.0.2.1)
239-
activerecord (= 8.0.2.1)
240-
activestorage (= 8.0.2.1)
241-
activesupport (= 8.0.2.1)
232+
rails (8.0.4.1)
233+
actioncable (= 8.0.4.1)
234+
actionmailbox (= 8.0.4.1)
235+
actionmailer (= 8.0.4.1)
236+
actionpack (= 8.0.4.1)
237+
actiontext (= 8.0.4.1)
238+
actionview (= 8.0.4.1)
239+
activejob (= 8.0.4.1)
240+
activemodel (= 8.0.4.1)
241+
activerecord (= 8.0.4.1)
242+
activestorage (= 8.0.4.1)
243+
activesupport (= 8.0.4.1)
242244
bundler (>= 1.15.0)
243-
railties (= 8.0.2.1)
245+
railties (= 8.0.4.1)
244246
rails-dom-testing (2.3.0)
245247
activesupport (>= 5.0.0)
246248
minitest
247249
nokogiri (>= 1.6)
248-
rails-html-sanitizer (1.6.2)
249-
loofah (~> 2.21)
250+
rails-html-sanitizer (1.7.0)
251+
loofah (~> 2.25)
250252
nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
251253
rails_12factor (0.0.3)
252254
rails_serve_static_assets
253255
rails_stdout_logging
254256
rails_serve_static_assets (0.0.5)
255257
rails_stdout_logging (0.0.3)
256-
railties (8.0.2.1)
257-
actionpack (= 8.0.2.1)
258-
activesupport (= 8.0.2.1)
258+
railties (8.0.4.1)
259+
actionpack (= 8.0.4.1)
260+
activesupport (= 8.0.4.1)
259261
irb (~> 1.13)
260262
rackup (>= 1.0.0)
261263
rake (>= 12.2)
262264
thor (~> 1.0, >= 1.2.2)
265+
tsort (>= 0.2)
263266
zeitwerk (~> 2.6)
264267
rainbow (3.1.1)
265-
rake (13.3.0)
268+
rake (13.3.1)
266269
ranked-model (0.4.11)
267270
activerecord (>= 5.2)
268-
rdoc (6.15.0)
271+
rdoc (7.2.0)
269272
erb
270273
psych (>= 4.0.0)
271274
tsort
272275
regexp_parser (2.11.3)
273-
reline (0.6.2)
276+
reline (0.6.3)
274277
io-console (~> 0.5)
275278
request_store (1.7.0)
276279
rack (>= 1.4)
@@ -346,10 +349,10 @@ GEM
346349
actionpack (>= 6.1)
347350
activesupport (>= 6.1)
348351
sprockets (>= 3.0.0)
349-
stringio (3.1.7)
350-
thor (1.4.0)
352+
stringio (3.2.0)
353+
thor (1.5.0)
351354
tilt (2.0.10)
352-
timeout (0.4.3)
355+
timeout (0.6.1)
353356
tsort (0.2.0)
354357
turbolinks (5.2.1)
355358
turbolinks-source (~> 5.2)
@@ -361,18 +364,18 @@ GEM
361364
unicode-display_width (3.2.0)
362365
unicode-emoji (~> 4.1)
363366
unicode-emoji (4.1.0)
364-
uri (1.0.4)
367+
uri (1.1.1)
365368
useragent (0.16.11)
366369
versionomy (0.5.0)
367370
blockenspiel (~> 0.5)
368371
warden (1.2.9)
369372
rack (>= 2.0.9)
370-
webrick (1.9.1)
373+
webrick (1.9.2)
371374
websocket-driver (0.8.0)
372375
base64
373376
websocket-extensions (>= 0.1.0)
374377
websocket-extensions (0.1.5)
375-
zeitwerk (2.7.3)
378+
zeitwerk (2.7.5)
376379

377380
PLATFORMS
378381
ruby
@@ -403,7 +406,7 @@ DEPENDENCIES
403406
rack-canonical-host (= 1.3.0)
404407
rack-cors
405408
rack-ssl
406-
rails (~> 8.0.0)
409+
rails (= 8.0.4.1)
407410
rails-html-sanitizer (~> 1.6)
408411
rails_12factor
409412
ranked-model

‎app/models/user.rb‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,4 +46,10 @@ def allowed_organizations
4646
def password_required?
4747
!persisted? || !password.nil? || !password_confirmation.nil?
4848
end
49+
50+
# Address <https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc> without updating Devise
51+
def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
52+
unconfirmed_email_will_change!
53+
super
54+
end
4955
end

0 commit comments

Comments
 (0)