Skip to content

Bump activesupport, activerecord, exception_notification, active_record_migrations, activerecord-postgis-adapter, grape, sinatra, rack_csrf, capistrano and rake #51

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump activesupport, activerecord, exception_notification, active_record_migrations, activerecord-postgis-adapter, grape, sinatra, rack_csrf, capistrano and rake #51

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 1, 2023

Bumps activesupport, activerecord, exception_notification, active_record_migrations, activerecord-postgis-adapter, grape, sinatra, rack_csrf, capistrano and rake. These dependencies needed to be updated together.
Updates activesupport from 4.2.5.1 to 7.0.4.2

Release notes

Sourced from activesupport's releases.

v7.0.4.2

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Fix domain: :all for two letter TLD

    This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

... (truncated)

Changelog

Sourced from activesupport's changelog.

Rails 7.0.4.2 (January 24, 2023)

  • No changes.

Rails 7.0.4.1 (January 17, 2023)

Rails 7.0.4 (September 09, 2022)

  • Redis cache store is now compatible with redis-rb 5.0.

    Jean Boussier

  • Fix NoMethodError on custom ActiveSupport::Deprecation behavior.

    ActiveSupport::Deprecation.behavior= was supposed to accept any object that responds to call, but in fact its internal implementation assumed that this object could respond to arity, so it was restricted to only Proc objects.

    This change removes this arity restriction of custom behaviors.

    Ryo Nakamura

Rails 7.0.3.1 (July 12, 2022)

  • No changes.

Rails 7.0.3 (May 09, 2022)

  • No changes.

Rails 7.0.2.4 (April 26, 2022)

  • Fix and add protections for XSS in ActionView::Helpers and ERB::Util.

    Add the method ERB::Util.xml_name_escape to escape dangerous characters in names of tags and names of attributes, following the specification of XML.

    Álvaro Martín Fraguas

Rails 7.0.2.3 (March 08, 2022)

... (truncated)

Commits
  • 7c70791 Version 7.0.4.2
  • 23e0345 Version 7.0.4.1
  • 2164d4f Avoid regex backtracking in Inflector.underscore
  • 8015c2c Version 7.0.4
  • ff27758 Revert "Merge pull request #44695 from Edouard-chin/ec-tagger-logger-broadcast"
  • 4a1f224 Merge pull request #45882 from rails/short-inspect-on-test-case
  • a3bd3b5 Backport Redis 5.0 compatibility
  • 67f37ac Fix flaky tests for RedisCacheStore
  • c520e38 Document AS::Cache::MemCacheStore#write options [ci-skip]
  • a74b650 Document AS::Cache::Store#initialize options [ci-skip]
  • Additional commits viewable in compare view

Updates activerecord from 4.2.5.1 to 7.0.4.2

Release notes

Sourced from activerecord's releases.

v7.0.4.2

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • No changes.

Action Pack

  • Fix domain: :all for two letter TLD

    This fixes a compatibility issue introduced in our previous security release when using domain: :all with a two letter but single level top level domain domain (like .ca, rather than .co.uk).

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 7.0.4.2 (January 24, 2023)

  • No changes.

Rails 7.0.4.1 (January 17, 2023)

  • Make sanitize_as_sql_comment more strict

    Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

    This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

    This also clarifies in the documentation of annotate that it should not be provided user input.

    [CVE-2023-22794]

  • Added integer width check to PostgreSQL::Quoting

    Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

    This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

    [CVE-2022-44566]

Rails 7.0.4 (September 09, 2022)

  • Symbol is allowed by default for YAML columns

    Étienne Barrié

  • Fix ActiveRecord::Store to serialize as a regular Hash

    Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess which is wasteful and cause problem with YAML safe_load.

    Jean Boussier

  • Add timestamptz as a time zone aware type for PostgreSQL

... (truncated)

Commits
  • 7c70791 Version 7.0.4.2
  • 23e0345 Version 7.0.4.1
  • d7aba06 Make sanitize_as_sql_comment more strict
  • 82bcdc0 Added integer width check to PostgreSQL::Quoting
  • 8015c2c Version 7.0.4
  • 4d9b4b4 Merge pull request #45872 from the-spectator/correct_hwia_encoding
  • c5a407d Linkify code references [ci-skip]
  • e874cf5 Fix typos [ci-skip]
  • fb09b1b Don't handle this change for legacy_connection_handling
  • 0667ba4 Merge pull request #45773 from eileencodes/only-setup-shared-pools-if-we-have...
  • Additional commits viewable in compare view

Updates exception_notification from 4.1.4 to 4.5.0

Changelog

Sourced from exception_notification's changelog.

== 4.5.0

  • enhancements

    • Added Rails 7 compatibility (by @​fwininger)
    • Added support for the optional data attribute to the SNS notifier (@​TomK32)
    • Addressed a deprecation warning for module_parent_name which was thrown for users using Rails > 6.x (@​quorak)
    • Restored the hash separator for controller#action in the email notifier (@​garethrees)

  • removals

    • Dropped support for Tinder (gem is no longer maintained) (by @​fwininger)
    • Dropped support for Ruby on Rails versions below 5.2

== 4.4.3

  • big fixes
    • Remove using configured default from address from custom mailer_parent class

== 4.4.2 (yanked)

  • bug fixes
    • Fix sender_address being overwritten

== 4.4.1

  • enhancements

    • Enhance ignore_if option to allow by-notifier customization (by @​fursich)
    • Ignore extended modules of ignored exceptions (by @​elengine)
    • Add exception_data to Mattermost notifier (by @​camillof)

  • bug fixes

== 4.4.0

== 4.3.0

  • enhancements

... (truncated)

Commits
  • 13bd47d Merge pull request #527 from mschnitzer/master
  • 092d399 Delete travis config
  • 60cbe96 Reflect current GitHub actions build status in README
  • 01874d9 Update release date for upcoming 4.5.0 release
  • 7337212 Highlight that Rails versions below 5.2 are no longer supported
  • 5eaea31 Merge pull request #524 from Cyberwatch/refactor_tests
  • 84f4be8 Add net-smtp to be compatible with ruby 3.1
  • 7d3c321 Use github action for testing and update test suite
  • 10272f9 Merge pull request #526 from mschnitzer/prepare_for_4.5.0
  • 09fb4a4 Merge pull request #523 from Cyberwatch/update_rails_7
  • Additional commits viewable in compare view

Updates active_record_migrations from 4.2.5.1.1 to 6.1.1.3

Commits
  • f698fa9 Fix deprecation warning in ActiveRecord 7
  • 377711e Release a new version with the environment fix
  • 42da53e Merge pull request #26 from bf39l/master
  • ebe488b line up 'ar_internal_metadata' env value
  • c7e2d30 v6.1.1.1: Remove warnings on ActiveRecord 6.1.1
  • 44a03d3 Add support for ActiveRecord >= 5.2.0
  • 32c3e8c v5.0.2.1: should work with future versions of AR too
  • 4384fa4 v5.0.1.1: upgrade AR to 5.0.1
  • bda01c6 v5.0.0.1.1: upgrade AR to 5.0.0.1
  • d6c52d0 v5.0.0.2: Fix missing requirements from AR
  • Additional commits viewable in compare view

Updates activerecord-postgis-adapter from 3.1.4 to 8.0.1

Changelog

Sourced from activerecord-postgis-adapter's changelog.

8.0.1 / 2022-08-01

  • Support for generated columns and other adapter fixes (ddiachkov) #360

8.0.0 / 2022-01-03

  • Breaking Change: Remove PostgisDatabaseTasks (seuros) #352
  • ActiveRecord 7 support (seuros) #352

7.1.1 / 2021-08-17

  • Modify truncate_tables to ignore spatial_ref_sys #341, #345
  • Fix Default Values #347

7.1.0 / 2021-03-28

  • Support Attributes #334
  • Access configuration_hash using symbols #335
  • Support JRuby #330

7.0.1 / 2021-01-13

  • Fix db:gis:setup task #329

7.0.0 / 2020-12-22

  • Add ActiveRecord 6.1 Compatability (tagliala) #324
  • Change SpatialFactoryStore attribute parsing #325
  • Update Arel Module #325

6.0.2 / 2020-03-28

  • Support JRuby #331

6.0.1 / 2020-08-16

  • Fix SchemaStatements#initialize_type_map #309
  • Add support for Ruby 2.7 #306
  • Adapt gem to ActiveRecord 6.0. #315

6.0.0 / 2019-08-21

  • Support ActiveRecord 6.0 #303

5.2.3 / 2021-03-28

  • Support JRuby #332

5.2.2 / 2018-12-02

... (truncated)

Commits
  • 0fb0f10 Merge branch 'master' of github.com:rgeo/activerecord-postgis-adapter
  • 67bd2ee bump to version 8.0.1
  • be38941 Merge pull request #368 from rgeo/upgrading-docs
  • 78ecc62 formatting
  • 9868437 update documentation around upgrades
  • dbdd36b Merge pull request #366 from seuros/patch-1
  • 0960639 test postgresql 14
  • 4f4e28f Merge pull request #361 from petergoldstein/feature/add_ruby_3_1_to_ci
  • bda60cf Add ruby-head
  • 8728d46 Add Ruby 3.1 to CI
  • Additional commits viewable in compare view

Updates grape from 0.17.0 to 1.7.0

Changelog

Sourced from grape's changelog.

1.7.0 (2022/12/20)

Features

Fixes

1.6.2 (2021/12/30)

Fixes

  • #2219: Revert the changes for autoloading provided in 1.6.1 - @​dm1try.

1.6.1 (2021/12/28)

Features

Fixes

... (truncated)

Commits

Updates sinatra from 1.4.7 to 3.0.5

Changelog

Sourced from sinatra's changelog.

3.0.5 / 2022-12-16

  • Fix: Add Zeitwerk compatibility. #1831 by Dawid Janczak

  • Fix: Allow CALLERS_TO_IGNORE to be overridden

3.0.4 / 2022-11-25

  • Fix: Escape filename in the Content-Disposition header. #1841 by Kunpei Sakai

3.0.3 / 2022-11-11

3.0.2 / 2022-10-01

  • New: Add Haml 6 support. #1820 by Jordan Owens

3.0.1 / 2022-09-26

  • Fix: Revert removal of rack-protection.rb. #1814 by Olle Jonsson

  • Fix: Revert change to server start and stop messaging by using Kernel#warn. Renamed internal warn method warn_for_deprecation. #1818 by Jordan Owens

3.0.0 / 2022-09-26

  • New: Add Falcon support. #1794 by Samuel Williams and @​horaciob

  • New: Add AES GCM encryption support for session cookies. #1324 (sinatra/sinatra#1324) by Michael Coyne

  • Deprecated: Sinatra Reloader will be removed in the next major release.

  • Fix: Internal Sinatra errors now extend Sinatra::Error. This fixes #1204 and #1518. bda8c29d by Jordan Owens

  • Fix: Preserve query param value if named route param nil. #1676 by Jordan Owens

  • Require Ruby 2.6 as minimum Ruby version. #1699 by Eloy Pérez

  • Breaking change: Remove support for the Stylus template engine. #1697 by Eloy Pérez

  • Breaking change: Remove support for the erubis template engine. #1761 by Eloy Pérez

  • Breaking change: Remove support for the textile template engine. #1766 by Eloy Pérez

  • Breaking change: Remove support for SASS as a template engine. #1768 by Eloy Pérez

  • Breaking change: Remove support for Wlang as a template engine. #1780 by Eloy Pérez

  • Breaking change: Remove support for CoffeeScript as a template engine. #1790 by Eloy Pérez

... (truncated)

Commits

Updates rack_csrf from 2.5.0 to 2.7.0

Changelog

Sourced from rack_csrf's changelog.

v2.7.0 (2022-09-10)

Many little, negligible, changes, plus support for Rake 3 (courtesy of jeremyevans 🏆)

v2.6.0 (2016-12-31)

Many little, internal, changes; the important ones are:

  • switched to use SecureRandom.urlsafe_base64 to make the token URL-friendly (courtesy of steved);
  • code is tested against Rack 1.4, 1.5, 1.6 and 2.0;
  • code is tested only on Ruby 2.0.0 and later.
Commits
  • 8747446 Version bump to 2.7.0.
  • 9cd881b Updated Changelog, LICENSE and README.
  • d73463e Added Rack 3 to the list of Rack versions we test against.
  • be32e3c Added a couple of require's for Rack 3.
  • d1b0fcb Merge pull request #18 from jeremyevans/rack3-request-utils
  • 0802f50 Fix for old versions of rack lacking rack/version
  • 358363d When using Rack 3, only load rack/request and rack/utils
  • 9a0a6ab Merge pull request #17 from baldowl/dependabot/bundler/cucumber-tw-3.0
  • 1febe4c Merge pull request #16 from baldowl/dependabot/github_actions/actions/checkout-3
  • 46221a0 Updated the list of Rubies to test against.
  • Additional commits viewable in compare view

Updates capistrano from 3.16.0 to 3.17.1

Release notes

Sourced from capistrano's releases.

3.17.1

📚 Documentation

🏠 Housekeeping

Full Changelog: capistrano/capistrano@v3.17.0...v3.17.1

3.17.0

✨ New Features

🐛 Bug Fixes

  • Add linked_dirs and linked_files to VariblesDoctor WHITELIST (#2103) @​y-yagi

🏠 Housekeeping

Commits

Updates rake from 10.5.0 to 13.0.6

Changelog

Sourced from rake's changelog.

=== 13.0.6

  • Additional fix for #389 Pull request #390 by hsbt

=== 13.0.5

  • Fixed the regression of #388 Pull request #389 by hsbt

=== 13.0.4

  • Fix rake test loader swallowing useful error information. Pull request #367 by deivid-rodriguez
  • Add -C/--directory option the same as GNU make. Pull request #376 by nobu

=== 13.0.3

  • Fix breaking change of execution order on TestTask. Pull request #368 by ysakasin

=== 13.0.2

==== Enhancements

  • Fix tests to work with current FileUtils Pull Request #358 by jeremyevans
  • Simplify default rake test loader Pull Request #357 by deivid-rodriguez
  • Update rdoc Pull Request #366 by bahasalien
  • Update broken links to rake articles from Avdi in README Pull Request #360 by svl7

=== 13.0.1

==== Bug fixes

  • Fixed bug: Reenabled task raises previous exception on second invokation Pull Request #271 by thorsteneckel
  • Fix an incorrectly resolved arg pattern Pull Request #327 by mjbellantoni

=== 13.0.0

==== Enhancements

  • Follows recent changes on keyword arguments in ruby 2.7. Pull Request #326 by nobu

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump activesupport, activerecord, exception_notification, active_reco…
6becdf9 
…rd_migrations, activerecord-postgis-adapter, grape, sinatra, rack_csrf, capistrano and rake

Bumps [activesupport](https://github.com/rails/rails), [activerecord](https://github.com/rails/rails), [exception_notification](https://github.com/smartinez87/exception_notification), [active_record_migrations](https://github.com/rosenfeld/active_record_migrations), [activerecord-postgis-adapter](https://github.com/rgeo/activerecord-postgis-adapter), [grape](https://github.com/ruby-grape/grape), [sinatra](https://github.com/sinatra/sinatra), [rack_csrf](https://github.com/baldowl/rack_csrf), [capistrano](https://github.com/capistrano/capistrano) and [rake](https://github.com/ruby/rake). These dependencies needed to be updated together.

Updates `activesupport` from 4.2.5.1 to 7.0.4.2
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v7.0.4.2/activesupport/CHANGELOG.md)
- [Commits](rails/rails@v4.2.5.1...v7.0.4.2)

Updates `activerecord` from 4.2.5.1 to 7.0.4.2
- [Release notes](https://github.com/rails/rails/releases)
- [Changelog](https://github.com/rails/rails/blob/v7.0.4.2/activerecord/CHANGELOG.md)
- [Commits](rails/rails@v4.2.5.1...v7.0.4.2)

Updates `exception_notification` from 4.1.4 to 4.5.0
- [Release notes](https://github.com/smartinez87/exception_notification/releases)
- [Changelog](https://github.com/smartinez87/exception_notification/blob/master/CHANGELOG.rdoc)
- [Commits](smartinez87/exception_notification@v4.1.4...v4.5.0)

Updates `active_record_migrations` from 4.2.5.1.1 to 6.1.1.3
- [Release notes](https://github.com/rosenfeld/active_record_migrations/releases)
- [Commits](rosenfeld/active_record_migrations@v4.2.5.1.1...v6.1.1.3)

Updates `activerecord-postgis-adapter` from 3.1.4 to 8.0.1
- [Release notes](https://github.com/rgeo/activerecord-postgis-adapter/releases)
- [Changelog](https://github.com/rgeo/activerecord-postgis-adapter/blob/master/History.md)
- [Commits](rgeo/activerecord-postgis-adapter@v3.1.4...v8.0.1)

Updates `grape` from 0.17.0 to 1.7.0
- [Release notes](https://github.com/ruby-grape/grape/releases)
- [Changelog](https://github.com/ruby-grape/grape/blob/master/CHANGELOG.md)
- [Commits](ruby-grape/grape@v0.17.0...v1.7.0)

Updates `sinatra` from 1.4.7 to 3.0.5
- [Release notes](https://github.com/sinatra/sinatra/releases)
- [Changelog](https://github.com/sinatra/sinatra/blob/master/CHANGELOG.md)
- [Commits](sinatra/sinatra@v1.4.7...v3.0.5)

Updates `rack_csrf` from 2.5.0 to 2.7.0
- [Release notes](https://github.com/baldowl/rack_csrf/releases)
- [Changelog](https://github.com/baldowl/rack_csrf/blob/master/Changelog.md)
- [Commits](baldowl/rack_csrf@v2.5.0...v2.7.0)

Updates `capistrano` from 3.16.0 to 3.17.1
- [Release notes](https://github.com/capistrano/capistrano/releases)
- [Commits](capistrano/capistrano@v3.16.0...v3.17.1)

Updates `rake` from 10.5.0 to 13.0.6
- [Release notes](https://github.com/ruby/rake/releases)
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc)
- [Commits](ruby/rake@v10.5.0...v13.0.6)

---
updated-dependencies:
- dependency-name: activesupport
  dependency-type: direct:production
- dependency-name: activerecord
  dependency-type: direct:production
- dependency-name: exception_notification
  dependency-type: direct:production
- dependency-name: active_record_migrations
  dependency-type: direct:production
- dependency-name: activerecord-postgis-adapter
  dependency-type: direct:production
- dependency-name: grape
  dependency-type: direct:production
- dependency-name: sinatra
  dependency-type: direct:production
- dependency-name: rack_csrf
  dependency-type: direct:production
- dependency-name: capistrano
  dependency-type: direct:development
- dependency-name: rake
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 1, 2023
@dependabot dependabot bot mentioned this pull request Feb 1, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant