From 96a27f8b980e8d7ed26708c52874f7ec5900411e Mon Sep 17 00:00:00 2001 From: Sylvain Date: Mon, 17 Dec 2018 11:10:39 +0100 Subject: [PATCH] [security] CVE-2018-16476: updated rails to 4.2.11 --- CHANGELOG.md | 1 + Gemfile | 2 +- Gemfile.lock | 80 ++++++++++++++++++++++++++-------------------------- 3 files changed, 42 insertions(+), 41 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f1645c2a1..e3d75a10b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,7 @@ - Refactored subscriptions to keep track of the previous ones - Improved automated tests suite - Added Rubocop gem to the Gemfile +- Fix a security update: dependency ActiveJob < 4.2.11 has a vulnerability as described in [CVE-2018-16476](https://nvd.nist.gov/vuln/detail/CVE-2018-16476) - [TODO DEPLOY] `rake db:migrate` - [TODO DEPLOY] `bundle install` diff --git a/Gemfile b/Gemfile index 74586879a..323aa4e3f 100644 --- a/Gemfile +++ b/Gemfile @@ -2,7 +2,7 @@ source 'https://rubygems.org' gem 'compass-rails', '2.0.4' # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' -gem 'rails', '4.2.10' +gem 'rails', '4.2.11' # Use SCSS for stylesheets gem 'sass-rails', '5.0.1' diff --git a/Gemfile.lock b/Gemfile.lock index 64c3b81a9..e14c7f083 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -14,39 +14,39 @@ GEM specs: Ascii85 (1.0.2) aasm (4.1.0) - actionmailer (4.2.10) - actionpack (= 4.2.10) - actionview (= 4.2.10) - activejob (= 4.2.10) + actionmailer (4.2.11) + actionpack (= 4.2.11) + actionview (= 4.2.11) + activejob (= 4.2.11) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 1.0, >= 1.0.5) - actionpack (4.2.10) - actionview (= 4.2.10) - activesupport (= 4.2.10) + actionpack (4.2.11) + actionview (= 4.2.11) + activesupport (= 4.2.11) rack (~> 1.6) rack-test (~> 0.6.2) rails-dom-testing (~> 1.0, >= 1.0.5) rails-html-sanitizer (~> 1.0, >= 1.0.2) actionpack-page_caching (1.0.2) actionpack (>= 4.0.0, < 5) - actionview (4.2.10) - activesupport (= 4.2.10) + actionview (4.2.11) + activesupport (= 4.2.11) builder (~> 3.1) erubis (~> 2.7.0) rails-dom-testing (~> 1.0, >= 1.0.5) rails-html-sanitizer (~> 1.0, >= 1.0.3) active_record_query_trace (1.4) - activejob (4.2.10) - activesupport (= 4.2.10) + activejob (4.2.11) + activesupport (= 4.2.11) globalid (>= 0.3.0) - activemodel (4.2.10) - activesupport (= 4.2.10) + activemodel (4.2.11) + activesupport (= 4.2.11) builder (~> 3.1) - activerecord (4.2.10) - activemodel (= 4.2.10) - activesupport (= 4.2.10) + activerecord (4.2.11) + activemodel (= 4.2.11) + activesupport (= 4.2.11) arel (~> 6.0) - activesupport (4.2.10) + activesupport (4.2.11) i18n (~> 0.7) minitest (~> 5.1) thread_safe (~> 0.3, >= 0.3.4) @@ -120,7 +120,7 @@ GEM compass (~> 1.0.0) sass-rails (<= 5.0.1) sprockets (< 2.13) - concurrent-ruby (1.0.5) + concurrent-ruby (1.1.4) connection_pool (2.2.0) coveralls (0.8.16) json (>= 1.8, < 3) @@ -209,7 +209,7 @@ GEM httparty (0.13.7) json (~> 1.8) multi_xml (>= 0.5.2) - i18n (0.9.1) + i18n (0.9.5) concurrent-ruby (~> 1.0) ice_nine (0.11.2) jaro_winkler (1.5.1) @@ -232,7 +232,7 @@ GEM loofah (2.2.3) crass (~> 1.0.2) nokogiri (>= 1.5.9) - mail (2.7.0) + mail (2.7.1) mini_mime (>= 0.1.1) mailcatcher (0.6.5) eventmachine (= 1.0.9.1) @@ -249,9 +249,9 @@ GEM mime-types (2.99.3) mimemagic (0.3.2) mini_magick (4.2.0) - mini_mime (1.0.0) + mini_mime (1.0.1) mini_portile2 (2.3.0) - minitest (5.10.3) + minitest (5.11.3) minitest-reporters (1.1.8) ansi builder @@ -269,7 +269,7 @@ GEM net-ssh-gateway (1.2.0) net-ssh (>= 2.6.5) netrc (0.10.3) - nokogiri (1.8.4) + nokogiri (1.8.5) mini_portile2 (~> 2.3.0) notify_with (0.0.2) jbuilder (~> 2.0) @@ -319,21 +319,21 @@ GEM rack-test (0.6.3) rack (>= 1.0) railroady (1.4.0) - rails (4.2.10) - actionmailer (= 4.2.10) - actionpack (= 4.2.10) - actionview (= 4.2.10) - activejob (= 4.2.10) - activemodel (= 4.2.10) - activerecord (= 4.2.10) - activesupport (= 4.2.10) + rails (4.2.11) + actionmailer (= 4.2.11) + actionpack (= 4.2.11) + actionview (= 4.2.11) + activejob (= 4.2.11) + activemodel (= 4.2.11) + activerecord (= 4.2.11) + activesupport (= 4.2.11) bundler (>= 1.3.0, < 2.0) - railties (= 4.2.10) + railties (= 4.2.11) sprockets-rails rails-deprecated_sanitizer (1.0.3) activesupport (>= 4.2.0.alpha) - rails-dom-testing (1.0.8) - activesupport (>= 4.2.0.beta, < 5.0) + rails-dom-testing (1.0.9) + activesupport (>= 4.2.0, < 5.0) nokogiri (~> 1.6) rails-deprecated_sanitizer (>= 1.0.1) rails-html-sanitizer (1.0.4) @@ -345,14 +345,14 @@ GEM rails_stdout_logging rails_serve_static_assets (0.0.4) rails_stdout_logging (0.0.3) - railties (4.2.10) - actionpack (= 4.2.10) - activesupport (= 4.2.10) + railties (4.2.11) + actionpack (= 4.2.11) + activesupport (= 4.2.11) rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) rainbow (3.0.0) raindrops (0.13.0) - rake (12.2.1) + rake (12.3.2) rb-fsevent (0.9.4) rb-inotify (0.9.5) ffi (>= 0.5.0) @@ -473,7 +473,7 @@ GEM cldr-plurals-runtime-rb (~> 1.0.0) json tzinfo - tzinfo (1.2.4) + tzinfo (1.2.5) thread_safe (~> 0.1) uglifier (4.1.20) execjs (>= 0.3.0, < 3) @@ -559,7 +559,7 @@ DEPENDENCIES pundit rack-protection (= 1.5.5) railroady - rails (= 4.2.10) + rails (= 4.2.11) rails-observers rails_12factor recurrence