Skip to content

[Snyk] Security upgrade rails from 8.0.2 to 8.0.2.1 #1882

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

[Snyk] Security upgrade rails from 8.0.2 to 8.0.2.1 #1882

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
272545a
fix: Gemfile to reduce vulnerabilities
snyk-bot Aug 14, 2025
f2e9cf0
remove duplicate gems
MrNagoo Aug 20, 2025
3623eb0
update Gemfile.lock
MrNagoo Aug 20, 2025
8ba32de
update warning message and Capybara test
MrNagoo Aug 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 6 additions & 11 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
ruby '3.3.4'

# Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main"
gem 'rails', '~> 8.0'
gem 'rails', '~> 8.0', '>= 8.0.2.1'

# The original asset pipeline for Rails [https://github.com/rails/sprockets-rails]
gem 'sprockets-rails'
Expand All @@ -15,11 +15,10 @@ gem 'pg'
# Use the Puma web server [https://github.com/puma/puma]
gem 'puma'


gem "importmap-rails", ">= 2.2.0"
gem 'importmap-rails', '>= 2.2.0'

# Hotwire"s SPA-like page accelerator [https://turbo.hotwired.dev]
gem "turbo-rails", ">= 2.0.14"
gem 'turbo-rails', '>= 2.0.14'

# Hotwire"s modest JavaScript framework [https://stimulus.hotwired.dev]
gem 'stimulus-rails'
Expand Down Expand Up @@ -64,10 +63,6 @@ gem 'omniauth-rails_csrf_protection'
gem 'rack-attack'
gem 'rack-cors', '>= 3.0.0', require: 'rack/cors'
# Use Redis to cache Touchpoints in all envs=
gem 'redis-client'
gem 'redis-namespace'
gem 'sidekiq', '>= 8.0.4'
gem 'json-jwt'
gem 'aasm'
gem 'acts-as-taggable-on'
gem 'json-jwt'
Expand All @@ -76,7 +71,7 @@ gem 'paper_trail'
gem 'redis-client'
gem 'redis-namespace'
gem 'rolify'
gem 'sidekiq', '>= 6.5.0'
gem 'sidekiq', '>= 8.0.4'

group :development, :test do
gem 'dotenv'
Expand All @@ -94,8 +89,8 @@ group :development do
gem 'bundler-audit'
gem 'listen'
gem 'rails-erd'
gem "rubocop-rails", ">= 2.32.0"
gem "rubocop-rspec"
gem 'rubocop-rails', '>= 2.32.0'
gem 'rubocop-rspec'
gem 'web-console'
end

Expand Down
114 changes: 57 additions & 57 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,45 +18,45 @@ GEM
aasm-diagram (0.1.3)
aasm (~> 5.0, >= 4.12)
ruby-graphviz (~> 1.2)
actioncable (8.0.2)
actionpack (= 8.0.2)
activesupport (= 8.0.2)
actioncable (8.0.2.1)
actionpack (= 8.0.2.1)
activesupport (= 8.0.2.1)
nio4r (~> 2.0)
websocket-driver (>= 0.6.1)
zeitwerk (~> 2.6)
actionmailbox (8.0.2)
actionpack (= 8.0.2)
activejob (= 8.0.2)
activerecord (= 8.0.2)
activestorage (= 8.0.2)
activesupport (= 8.0.2)
actionmailbox (8.0.2.1)
actionpack (= 8.0.2.1)
activejob (= 8.0.2.1)
activerecord (= 8.0.2.1)
activestorage (= 8.0.2.1)
activesupport (= 8.0.2.1)
mail (>= 2.8.0)
actionmailer (8.0.2)
actionpack (= 8.0.2)
actionview (= 8.0.2)
activejob (= 8.0.2)
activesupport (= 8.0.2)
actionmailer (8.0.2.1)
actionpack (= 8.0.2.1)
actionview (= 8.0.2.1)
activejob (= 8.0.2.1)
activesupport (= 8.0.2.1)
mail (>= 2.8.0)
rails-dom-testing (~> 2.2)
actionpack (8.0.2)
actionview (= 8.0.2)
activesupport (= 8.0.2)
actionpack (8.0.2.1)
actionview (= 8.0.2.1)
activesupport (= 8.0.2.1)
nokogiri (>= 1.8.5)
rack (>= 2.2.4)
rack-session (>= 1.0.1)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.2)
rails-html-sanitizer (~> 1.6)
useragent (~> 0.16)
actiontext (8.0.2)
actionpack (= 8.0.2)
activerecord (= 8.0.2)
activestorage (= 8.0.2)
activesupport (= 8.0.2)
actiontext (8.0.2.1)
actionpack (= 8.0.2.1)
activerecord (= 8.0.2.1)
activestorage (= 8.0.2.1)
activesupport (= 8.0.2.1)
globalid (>= 0.6.0)
nokogiri (>= 1.8.5)
actionview (8.0.2)
activesupport (= 8.0.2)
actionview (8.0.2.1)
activesupport (= 8.0.2.1)
builder (~> 3.1)
erubi (~> 1.11)
rails-dom-testing (~> 2.2)
Expand All @@ -66,22 +66,22 @@ GEM
activemodel (>= 4.1)
case_transform (>= 0.2)
jsonapi-renderer (>= 0.1.1.beta1, < 0.3)
activejob (8.0.2)
activesupport (= 8.0.2)
activejob (8.0.2.1)
activesupport (= 8.0.2.1)
globalid (>= 0.3.6)
activemodel (8.0.2)
activesupport (= 8.0.2)
activerecord (8.0.2)
activemodel (= 8.0.2)
activesupport (= 8.0.2)
activemodel (8.0.2.1)
activesupport (= 8.0.2.1)
activerecord (8.0.2.1)
activemodel (= 8.0.2.1)
activesupport (= 8.0.2.1)
timeout (>= 0.4.0)
activestorage (8.0.2)
actionpack (= 8.0.2)
activejob (= 8.0.2)
activerecord (= 8.0.2)
activesupport (= 8.0.2)
activestorage (8.0.2.1)
actionpack (= 8.0.2.1)
activejob (= 8.0.2.1)
activerecord (= 8.0.2.1)
activesupport (= 8.0.2.1)
marcel (~> 1.0)
activesupport (8.0.2)
activesupport (8.0.2.1)
base64
benchmark (>= 0.3)
bigdecimal
Expand Down Expand Up @@ -437,20 +437,20 @@ GEM
rack (>= 1.3)
rackup (2.2.1)
rack (>= 3)
rails (8.0.2)
actioncable (= 8.0.2)
actionmailbox (= 8.0.2)
actionmailer (= 8.0.2)
actionpack (= 8.0.2)
actiontext (= 8.0.2)
actionview (= 8.0.2)
activejob (= 8.0.2)
activemodel (= 8.0.2)
activerecord (= 8.0.2)
activestorage (= 8.0.2)
activesupport (= 8.0.2)
rails (8.0.2.1)
actioncable (= 8.0.2.1)
actionmailbox (= 8.0.2.1)
actionmailer (= 8.0.2.1)
actionpack (= 8.0.2.1)
actiontext (= 8.0.2.1)
actionview (= 8.0.2.1)
activejob (= 8.0.2.1)
activemodel (= 8.0.2.1)
activerecord (= 8.0.2.1)
activestorage (= 8.0.2.1)
activesupport (= 8.0.2.1)
bundler (>= 1.15.0)
railties (= 8.0.2)
railties (= 8.0.2.1)
rails-controller-testing (1.0.5)
actionpack (>= 5.0.1.rc1)
actionview (>= 5.0.1.rc1)
Expand All @@ -467,9 +467,9 @@ GEM
rails-html-sanitizer (1.6.2)
loofah (~> 2.21)
nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
railties (8.0.2)
actionpack (= 8.0.2)
activesupport (= 8.0.2)
railties (8.0.2.1)
actionpack (= 8.0.2.1)
activesupport (= 8.0.2.1)
irb (~> 1.13)
rackup (>= 1.0.0)
rake (>= 12.2)
Expand Down Expand Up @@ -685,20 +685,20 @@ DEPENDENCIES
pry
puma
rack-attack
rack-cors
rails (~> 8.0)
rack-cors (>= 3.0.0)
rails (~> 8.0, >= 8.0.2.1)
rails-controller-testing
rails-erd
redis-client
redis-namespace
rolify
rspec-rails (>= 8.0.1)
rspec_junit_formatter
rubocop-rails
rubocop-rails (>= 2.32.0)
rubocop-rspec
sassc-rails
selenium-webdriver
sidekiq (>= 6.5.0)
sidekiq (>= 8.0.4)
simplecov
sprockets-rails
stimulus-rails
Expand Down
92 changes: 73 additions & 19 deletions app/models/form.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -570,27 +570,83 @@ def to_a11_v2_array(start_date: nil, end_date: nil)
.order('created_at')
return nil if non_flagged_submissions.blank?

answer_02_options = self.questions.where(answer_field: "answer_02").first.question_options.collect(&:value)
answer_03_options = self.questions.where(answer_field: "answer_03").first.question_options.collect(&:value)
answer_02_options = questions.where(answer_field: 'answer_02').first.question_options.collect(&:value)
answer_03_options = questions.where(answer_field: 'answer_03').first.question_options.collect(&:value)

non_flagged_submissions.map do |submission|
{
id: submission.id,
answer_01: submission.answer_01,
answer_02_effectiveness: submission.answer_02 && submission.answer_02.split(",").include?("effectiveness") ? 1 :(answer_02_options.include?("effectiveness") ? 0 : 'null'),
answer_02_ease: submission.answer_02 && submission.answer_02.split(",").include?("ease") ? 1 : (answer_02_options.include?("ease") ? 0 : 'null'),
answer_02_efficiency: submission.answer_02 && submission.answer_02.split(",").include?("efficiency") ? 1 : (answer_02_options.include?("efficiency") ? 0 : 'null'),
answer_02_transparency: submission.answer_02 && submission.answer_02.split(",").include?("transparency") ? 1 : (answer_02_options.include?("transparency") ? 0 : 'null'),
answer_02_humanity: submission.answer_02 && submission.answer_02.split(",").include?("humanity") ? 1 : (answer_02_options.include?("humanity") ? 0 : 'null'),
answer_02_employee: submission.answer_02 && submission.answer_02.split(",").include?("employee") ? 1 : (answer_02_options.include?("employee") ? 0 : 'null'),
answer_02_other: submission.answer_02 && submission.answer_02.split(",").include?("other") ? 1 : (answer_02_options.include?("other") ? 0 : 'null'),
answer_03_effectiveness: submission.answer_03 && submission.answer_03.split(",").include?("effectiveness") ? 1 : (answer_03_options.include?("effectiveness") ? 0 : 'null'),
answer_03_ease: submission.answer_03 && submission.answer_03.split(",").include?("ease") ? 1 : (answer_03_options.include?("ease") ? 0 : 'null'),
answer_03_efficiency: submission.answer_03 && submission.answer_03.split(",").include?("efficiency") ? 1 : (answer_03_options.include?("efficiency") ? 0 : 'null'),
answer_03_transparency: submission.answer_03 && submission.answer_03.split(",").include?("transparency") ? 1 : (answer_03_options.include?("transparency") ? 0 : 'null'),
answer_03_humanity: submission.answer_03 && submission.answer_03.split(",").include?("humanity") ? 1 : (answer_03_options.include?("humanity") ? 0 : 'null'),
answer_03_employee: submission.answer_03 && submission.answer_03.split(",").include?("employee") ? 1 : (answer_03_options.include?("employee") ? 0 : 'null'),
answer_03_other: submission.answer_03 && submission.answer_03.split(",").include?("other") ? 1 : (answer_03_options.include?("other") ? 0 : 'null'),
answer_02_effectiveness: if submission.answer_02 && submission.answer_02.split(',').include?('effectiveness')
1
else
(answer_02_options.include?('effectiveness') ? 0 : 'null')
end,
answer_02_ease: if submission.answer_02 && submission.answer_02.split(',').include?('ease')
1
else
(answer_02_options.include?('ease') ? 0 : 'null')
end,
answer_02_efficiency: if submission.answer_02 && submission.answer_02.split(',').include?('efficiency')
1
else
(answer_02_options.include?('efficiency') ? 0 : 'null')
end,
answer_02_transparency: if submission.answer_02 && submission.answer_02.split(',').include?('transparency')
1
else
(answer_02_options.include?('transparency') ? 0 : 'null')
end,
answer_02_humanity: if submission.answer_02 && submission.answer_02.split(',').include?('humanity')
1
else
(answer_02_options.include?('humanity') ? 0 : 'null')
end,
answer_02_employee: if submission.answer_02 && submission.answer_02.split(',').include?('employee')
1
else
(answer_02_options.include?('employee') ? 0 : 'null')
end,
answer_02_other: if submission.answer_02 && submission.answer_02.split(',').include?('other')
1
else
(answer_02_options.include?('other') ? 0 : 'null')
end,
answer_03_effectiveness: if submission.answer_03 && submission.answer_03.split(',').include?('effectiveness')
1
else
(answer_03_options.include?('effectiveness') ? 0 : 'null')
end,
answer_03_ease: if submission.answer_03 && submission.answer_03.split(',').include?('ease')
1
else
(answer_03_options.include?('ease') ? 0 : 'null')
end,
answer_03_efficiency: if submission.answer_03 && submission.answer_03.split(',').include?('efficiency')
1
else
(answer_03_options.include?('efficiency') ? 0 : 'null')
end,
answer_03_transparency: if submission.answer_03 && submission.answer_03.split(',').include?('transparency')
1
else
(answer_03_options.include?('transparency') ? 0 : 'null')
end,
answer_03_humanity: if submission.answer_03 && submission.answer_03.split(',').include?('humanity')
1
else
(answer_03_options.include?('humanity') ? 0 : 'null')
end,
answer_03_employee: if submission.answer_03 && submission.answer_03.split(',').include?('employee')
1
else
(answer_03_options.include?('employee') ? 0 : 'null')
end,
answer_03_other: if submission.answer_03 && submission.answer_03.split(',').include?('other')
1
else
(answer_03_options.include?('other') ? 0 : 'null')
end,
answer_04: submission.answer_04,
}
end
Expand Down Expand Up @@ -900,9 +956,7 @@ def ensure_a11_v2_radio_format
end

def warn_about_not_too_many_questions
if questions.size >= 30
errors.add(:base, "Touchpoints supports a maximum of 30 questions. There are currently #{questions_count} questions. Fewer questions tend to yield higher response rates.")
end
errors.add(:base, "Touchpoints supports a maximum of 30 questions. There are currently #{questions_count} questions. Fewer questions tend to yield higher response rates.") if questions.size > 20
end

def contains_elements?(array, required_elements)
Expand Down
Loading