Skip to content

🚨 [security] Update devise: 4.7.2 → 4.8.1 (minor)#366

Closed
depfu[bot] wants to merge 1 commit intodevelopfrom
depfu/update/devise-4.8.1
Closed

🚨 [security] Update devise: 4.7.2 → 4.8.1 (minor)#366
depfu[bot] wants to merge 1 commit intodevelopfrom
depfu/update/devise-4.8.1

Conversation

@depfu
Copy link
Contributor

@depfu depfu bot commented Dec 17, 2021

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ devise (4.7.2 → 4.8.1) · Repo · Changelog

Release Notes

4.8.1 (from changelog)

  • enhancements
    • Add support for Rails 7.0. Please note that Turbo integration is not fully supported by Devise yet.

4.8.0 (from changelog)

  • enhancements

    • Devise now enables the upgrade of OmniAuth 2+. Previously Devise would raise an error if you'd try to upgrade. Please note that OmniAuth 2 is considered a security upgrade and recommended to everyone. You can read more about the details (and possible necessary changes to your app as part of the upgrade) in their release notes. Devise's OmniAuth Overview wiki was also updated to cover OmniAuth 2.0 requirements.
      • Note that the upgrade required Devise shared links that initiate the OmniAuth flow to be changed to method: :post, which is now a requirement for OmniAuth, part of the security improvement. If you have copied and customized the Devise shared links partial to your app, or if you have other links in your app that initiate the OmniAuth flow, they will have to be updated to use method: :post, or changed to use buttons (e.g. button_to) to work with OmniAuth 2. (if you're using links with method: :post, make sure your app has rails-ujs or jquery-ujs included in order for these links to work properly.)
      • As part of the OmniAuth 2.0 upgrade you might also need to add the omniauth-rails_csrf_protection gem to your app if you don't have it already. (and you don't want to roll your own code to verify requests.) Check the OmniAuth v2 release notes for more info.
    • Introduce Lockable#reset_failed_attempts! model method to reset failed attempts counter to 0 after the user signs in.
      • This logic existed inside the lockable warden hook and is triggered automatically after the user signs in. The new model method is an extraction to allow you to override it in the application to implement things like switching to a write database if you're using the new multi-DB infrastructure from Rails for example, similar to how it's already possible with Trackable#update_tracked_fields!.
    • Add support for Ruby 3.
    • Add support for Rails 6.1.
    • Move CI to GitHub Actions.

  • deprecations

    • Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION is deprecated in favor of Devise::Models::Authenticatable::UNSAFE_ATTRIBUTES_FOR_SERIALIZATION (@hanachin)

4.7.3 (from changelog)

  • bug fixes
    • Do not modify :except option given to #serializable_hash. (by @dpep)
    • Fix thor deprecation when running the devise generator. (by @deivid-rodriguez)
    • Fix hanging tests for streaming controllers using Devise. (by @afn)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ bcrypt (indirect, 3.1.13 → 3.1.16) · Repo · Changelog

Release Notes

3.1.16 (from changelog)

  - Fix compilation on FreeBSD. [GH #234]

3.1.15 (from changelog)

  - Remove GVL optimization.  Apparently it breaks things [GH #230]

3.1.14 (from changelog)

  - Start calibration from the minimum cost supported by the algorithm [GH #206 by @sergey-alekseev]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.1.7 → 1.1.9) · Repo · Changelog

Release Notes

1.1.9 (from changelog)

concurrent-ruby:

  • (#866) Child promise state not set to :pending immediately after #execute when parent has completed
  • (#905, #872) Fix RubyNonConcurrentPriorityQueue#delete method
  • (2df0337d) Make sure locks are not shared on shared when objects are dup/cloned
  • (#900, #906, #796, #847, #911) Fix Concurrent::Set tread-safety issues on CRuby
  • (#907) Add new ConcurrentMap backend for TruffleRuby

1.1.8 (from changelog)

  • (#885) Fix race condition in TVar for stale reads
  • (#884) RubyThreadLocalVar: Do not iterate over hash which might conflict with new pair addition

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ erubi (indirect, 1.9.0 → 1.10.0) · Repo · Changelog

Release Notes

1.10.0 (from changelog)

* Improve template parsing, mostly by reducing allocations (jeremyevans)

    

  • 

    Do not ship tests in the gem, reducing gem size about 20% (jeremyevans)
    

    • 

  • 

    Support :literal_prefix and :literal_postfix options for how to output literal tags (e.g. <%% code %>) (jaredcwhite) (#26, #27)
    

    •

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.8.5 → 1.8.11) · Repo · Changelog

Release Notes

1.8.11

What's Changed

New Contributors

Full Changelog: v1.8.10...v1.8.11

1.8.10

  • Fix string locale will trigger on_fallback hook - #562

1.8.9

  • Rely on Ruby 3's native Hash#except method -- #557

This release also contains several build related updates -- rather than listing them out here, you can see the compare view between 1.8.8 and 1.8.9.

1.8.8

  • Fixed threadsafety issues in Simple backend: #554
  • Re-attempt to fix threadsafety of fallbacks: #548
  • Use OpenSSL::Digest instead of usual Digest libraries: #549
  • Goodbye, post-install message #552
  • Use Rails' main branch, instead of master #553

1.8.7

  • Fixed a regression with fallback logic: see issues #547, #546 and #542.

1.8.6

  • Fallbacks are now stored in Thread.current for multi-threading compatibility: #542
  • no-op arguments are no longer allowed for I18n.t calls -- fixes an incompatibility with Ruby 3.0: #545

This gem's GitHub workflow files have been updated to ensure compatibility between new Rails versions (6.1) and the new Ruby release (3.0). See the "Actions" tab on GitHub for the full range of supported Rails and Ruby versions.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ loofah (indirect, 2.6.0 → 2.13.0) · Repo · Changelog

Release Notes

2.13.0

2.13.0 / 2021-12-10

Bug fixes

  • Loofah::HTML::DocumentFragment#text no longer serializes top-level comment children. [#221]

2.12.0

2.12.0 / 2021-08-11

Features

  • Support empty HTML5 data attributes. [#215]

2.11.0

2.11.0 / 2021-07-31

Features

  • Allow HTML5 element wbr.
  • Allow all CSS property values for border-collapse. [#201]

Changes

  • Deprecating Loofah::HTML5::SafeList::VOID_ELEMENTS which is not a canonical list of void HTML4 or HTML5 elements.
  • Removed some elements from Loofah::HTML5::SafeList::VOID_ELEMENTS that either are not acceptable elements or aren't considered "void" by libxml2.

2.10.0

2.10.0 / 2021-06-06

Features

2.9.1

2.9.1 / 2021-04-07

Bug fixes

  • Fix a regression in v2.9.0 which inappropriately removed CSS properties with quoted string values. [#202]

2.9.0

2.9.0 / 2021-01-14

  • Handle CSS functions in a CSS shorthand property (like background). [#199, #200]

2.8.0

2.8.0 / 2020-11-25

  • Allow CSS properties order, flex-direction, flex-grow, flex-wrap, flex-shrink, flex-flow, flex-basis, flex, justify-content, align-self, align-items, and align-content. [#197] (Thanks, @miguelperez!)

2.7.0

2.7.0 / 2020-08-26

Features

  • Allow CSS properties page-break-before, page-break-inside, and page-break-after. [#190] (Thanks, @ahorek!)

Fixes

  • Don't drop the !important rule from some CSS properties. [#191] (Thanks, @b7kich!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mini_portile2 (indirect, 2.4.0 → 2.6.1) · Repo · Changelog

Release Notes

2.6.1

2.6.1 / 2021-05-31

Dependencies

Make net-ftp an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called and net-ftp isn't available; this should only happen in Ruby 3.1 and later.

2.6.0

2.6.0 / 2021-05-31

Added

Recipes may build against a local directory by specifying source_directory instead of files. In
particular, this may be useful for debugging problems with the upstream dependency (e.g., use git bisect in a local clone) or for continuous integration with upstream HEAD.

2.5.3

2.5.3 / 2021-05-31

Make net-ftp an optional dependency, since requiring it as a hard dependency in v2.5.2 caused warnings to be emitted by Ruby 2.7 and earlier. A warning message is emitted if FTP functionality is called and net-ftp isn't available; this should only happen in Ruby 3.1 and later.

2.5.2

2.5.2 / 2021-05-28

Dependencies

Add net-ftp as an explicit dependency to accommodate the upcoming Ruby 3.1 changes that move this and other gems out of the "default" gem set and into the "bundled" gem set. See https://bugs.ruby-lang.org/issues/17873 [#101]

2.5.1

2.5.1 / 2021-04-28

Dependencies

This release ends support for ruby < 2.3.0. If you're on 2.2.x or earlier, we strongly suggest that you find the time to upgrade, because official support for Ruby 2.2 ended on 2018-03-31.

Enhancements

  • MiniPortile.execute now takes an optional :env hash, which is merged into the environment variables for the subprocess. Likely this is only useful for specialized use cases. [#99]
  • Experimental support for cmake-based projects extended to Windows. (Thanks, @larskanis!)

2.5.0

2.5.0 / 2020-02-24

Enhancements

  • When verifying GPG signatures, remove all imported pubkeys from keyring [#90] (Thanks, @hanazuki!)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ minitest (indirect, 5.14.1 → 5.15.0) · Repo · Changelog

Release Notes

5.15.0 (from changelog)

  • 1 major enhancement:

    • assert_throws returns the value returned, if any. (volmer)

  • 3 minor enhancements:

    • Added -S <CODES> option to skip reporting of certain types of output

    • Enable Ruby deprecation warnings by default. (casperisfine)

    • Use Etc.nprocessors by default in order to maximize cpu usage. (tonytonyjan)

  • 6 bug fixes:

    • Close then unlink tempfiles on Windows. (nobu)

    • Fixed #skip_until for windows paths. (MSP-Greg)

    • Fixed a bunch of tests for jruby and windows. (MSP-Greg)

    • Fixed marshalling of specs if they error. (tenderlove, jeremyevans, et al)

    • Updated deprecation message for block expectations. (blowmage)

    • Use Kernel.warn directly in expectations in case CUT defines their own warn. (firien)

5.14.4 (from changelog)

  • 1 bug fix:

    • Fixed deprecation warning using stub with methods using keyword arguments. (Nakilon)

5.14.3 (from changelog)

  • 1 bug fix:

    • Bumped require_ruby_version to < 4 (trunk = 3.1).

5.14.2 (from changelog)

  • 1 bug fix:

    • Bumped ruby version to include 3.0 (trunk).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.10.10 → 1.12.5) · Repo · Changelog

Security Advisories 🚨

🚨 Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby

Severity

The Nokogiri maintainers have evaluated this as High Severity 7.5 (CVSS3.0) for JRuby users. (This security advisory does not apply to CRuby users.)

Impact

In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default.

Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:

  • Nokogiri::XML::SAX::Parser
  • Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
  • Nokogiri::XML::SAX::PushParser
  • Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser

Mitigation

JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.

CRuby users are not affected.

🚨 Update packaged dependency libxml2 from 2.9.10 to 2.9.12

Summary

Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:

Note that two additional CVEs were addressed upstream but are not relevant to this release. CVE-2021-3516 via xmllint is not present in Nokogiri, and CVE-2020-7595 has been patched in Nokogiri since v1.10.8 (see #1992).

Please note that this advisory only applies to the CRuby implementation of Nokogiri < 1.11.4, and only if the packaged version of libxml2 is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libxml2 release announcements.

Mitigation

Upgrade to Nokogiri >= 1.11.4.

Impact

I've done a brief analysis of the published CVEs that are addressed in this upstream release. The libxml2 maintainers have not released a canonical set of CVEs, and so this list is pieced together from secondary sources and may be incomplete.

All information below is sourced from security.archlinux.org, which appears to have the most up-to-date information as of this analysis.

CVE-2019-20388

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2020-7595

This has been patched in Nokogiri since v1.10.8 (see #1992).

CVE-2020-24977

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3516

Verified that the fix commit first appears in v2.9.11. This vector does not exist within Nokogiri, which does not ship xmllint.

CVE-2021-3517

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3518

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3537

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4.

CVE-2021-3541

Verified that the fix commit first appears in v2.9.11. It seems possible that this issue would be present in programs using Nokogiri < v1.11.4, however Nokogiri's default parse options prevent the attack from succeeding (it is necessary to opt into DTDLOAD which is off by default).

For more details supporting this analysis of this CVE, please visit #2233.

🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability

Description

In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.

This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.

Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".

Affected Versions

Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3

Mitigation

There are no known workarounds for affected versions. Upgrade to Nokogiri
1.11.0.rc4 or later.

If, after upgrading to 1.11.0.rc4 or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):

  1. Ensure the input is trusted. Do not enable this option
    for untrusted input.
  2. When invoking the Nokogiri::XML::Schema constructor,
    pass as the second parameter an instance of Nokogiri::XML::ParseOptions with the
    NONET flag turned off.

So if your previous code was:

# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network
# but in v1.11.0.rc4 and later, this call will disallow network access for external resources
schema = Nokogiri::XML::Schema.new(schema)

# in v1.11.0.rc4 and later, the following is equivalent to the code above

# (the second parameter is optional, and this demonstrates its default value)

schema = Nokogiri::XML::Schema.new(schema, Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)

Then you can add the second parameter to indicate that the input is trusted by changing it to:

# in v1.11.0.rc3 and earlier, this would raise an ArgumentError
# but in v1.11.0.rc4 and later, this allows resources to be accessed over the network
schema = Nokogiri::XML::Schema.new(trusted_schema, Nokogiri::XML::ParseOptions.new.nononet)
Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rails-html-sanitizer (indirect, 1.3.0 → 1.4.2) · Repo · Changelog

Release Notes

1.4.2

1.4.2 / 2021-08-23

  • Slightly improve performance.

    Assuming elements are more common than comments, make one less method call per node.

1.4.1

1.4.1 / 2021-08-18

  • Fix regression in v1.4.0 that did not pass comment nodes to the scrubber.

    Some scrubbers will want to override the default behavior and allow comments, but v1.4.0 only
    passed through elements to the scrubber's keep_node? method.

    This change once again allows the scrubber to make the decision on comment nodes, but still skips
    other non-elements like processing instructions (see #115).

    Mike Dalessio

1.4.0

1.4.0 / 2021-08-18

  • Processing Instructions are no longer allowed by Rails::Html::PermitScrubber

    Previously, a PI with a name (or "target") matching an allowed tag name was not scrubbed. There
    are no known security issues associated with these PIs, but similar to comments it's preferred to
    omit these nodes when possible from sanitized output.

    Fixes #115.

    Mike Dalessio

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rake (indirect, 13.0.1 → 13.0.6) · Repo · Changelog

Release Notes

13.0.6 (from changelog)

  • Additional fix for #389 Pull request #390 by hsbt

13.0.5 (from changelog)

  • Fixed the regression of #388 Pull request #389 by hsbt

13.0.4 (from changelog)

  • Fix rake test loader swallowing useful error information. Pull request #367 by deivid-rodriguez

  • Add -C/–directory option the same as GNU make. Pull request #376 by nobu

13.0.3 (from changelog)

  • Fix breaking change of execution order on TestTask. Pull request #368 by ysakasin

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ thor (indirect, 1.0.1 → 1.1.0) · Repo · Changelog

Release Notes

1.1.0 (from changelog)

  • Don't use ANSI colors when terminal is dumb.
  • Ensure default option/argument is not erroneously aliased.
  • Fixes a bug in the calculation of the print_wrapped method.
  • Obey :mute and options[:quiet] in Shell#say.
  • Support Ruby 3.0.
  • Add force option to the gsub_file action.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ tzinfo (indirect, 1.2.7 → 1.2.9) · Repo · Changelog

Release Notes

1.2.9

  • Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a zoneinfo file that includes rules specifying an additional transition to the final defined offset (for example, Africa/Casablanca in version 2018e of the Time Zone Database). #123.

TZInfo v1.2.9 on RubyGems.org

1.2.8

  • Added support for handling "slim" format zoneinfo files that are produced by default by zic version 2020b and later. The POSIX-style TZ string is now used calculate DST transition times after the final defined transition in the file. The 64-bit section is now always used regardless of whether Time has support for 64-bit times. #120.
  • Rubinius is no longer supported.

TZInfo v1.2.8 on RubyGems.org

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ warden (indirect, 1.2.8 → 1.2.9) · Repo · Changelog

Release Notes

1.2.9 (from changelog)

  • Avoid warning on uninitialized instance variable (#188)
  • Bump rack to 2.2.3 (#190)
  • Remove Gemfile.lock
  • Resolve outstanding TODO entries (#179)
  • A bunch of gem structure cleanup (thanks @olleolleolle)
  • Set winning strategy when :warden is thrown (#174)
  • Bump rack dependency to >= 2.0.9 due to CVEs

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 racc (added, 1.6.0)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Dec 17, 2021
@depfu depfu bot mentioned this pull request Dec 17, 2021
Closed
@depfu
Copy link
Contributor Author

depfu bot commented Feb 18, 2023

Closed in favor of #419.

@depfu depfu bot closed this Feb 18, 2023
@depfu depfu bot deleted the depfu/update/devise-4.8.1 branch February 18, 2023 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants