Bump carrierwave from 0.9.0 to 1.3.2

[dependabot[bot]]

Bumps carrierwave from 0.9.0 to 1.3.2.

Release notes

Sourced from carrierwave's releases.

v0.10.0

• [changed] Memoize uploaders and uploader_options (Derek Parker and Joshua Davey from Hashrocket)
• [changed] Don't force pad background color to white in resize_and_pad (@fnordfish)
• [changed] Remove auth access information when parsing URL for filename (@nddeluca)
• [changed] Read Content type from cached and uploaded file, adds mime-types as hard dependency
• [added] Added authenticated_url functionality for Openstack storage (@snoopie)
• [added] Add Polish I18n translations for errors (@ArturT)
• [added] Add Greek locale for error messages (@agorf)
• [added] Add French locale for error messages (@gdurelle)
• [added] Add Japanese locale for error messages (@tomodian)
• [added] Add Norwegian locale for error messages (@theodorton)
• [added] Add Portuguese locale for error messages (@pedrosmmoreira)
• [fixed] Overridden serializable_hash accepts an options hash (@bensie)
• [fixed] Fog connection object performance issues (@taavo)
• [fixed] Delete Tempfile after manipulate with MiniMagick (@dimko)
• [fixed] Ensure #remove_#{column} and #remove_#{column} return false after committing with ActiveRecord (@bensie)
• [fixed] Fix issue with content-disposition existing with no filename when downloading, reports that Google does this (@hasghari / @bensie / @taavo)

Changelog

Sourced from carrierwave's changelog.

1.3.2 - 2021-02-08

Fixed

• Fix Ruby 2.7 deprecations(@aubinlrx #2462)

Security

• Fix Code Injection vulnerability in CarrierWave::RMagick (@mshibuya eb9346df, GHSA-cf3w-g86h-35x4)
• Fix SSRF vulnerability in the remote file download feature (@mshibuya 91714add, GHSA-fwcm-636p-68r5)

1.3.1 - 2018-12-29

Fixed

• Fix #url_options_supported? causing nil error(@mshibuya 0b9a64a1, #2361)

1.3.0 - 2018-12-24

Added

• Query parameter support for fog-google(@stanhu #2332)
• Jets Turbine Support(@tongueroo #2355)
• Add allowed_types to content_type_whitelist_error(@mhluska #2270)

Fixed

• S3 HTTPS url causes certificate issue when bucket name contains period(@ransombriggs #2359)
• Failed to get image dimensions when image is cached but not stored yet(@artygus #2349)
• Only include x-amz-acl header for AWS(@stanhu #2356)
• Remove old caches when no space is left on disk(@dosuken123 #2342)

1.2.3 - 2018-06-30

Fixed

• Fix reading whole content of large files into memory on storing(@dosuken123 #2314)

1.2.2 - 2018-01-02

Fixed

• Reset Content-Type on converting file format(@kyoshidajp #2237)

1.2.1 - 2017-10-04

Fixed

• Locale check breaks when a Symbol is given to available_locales(@mshibuya #2234)

1.2.0 - 2017-09-30

Added

• Added Proc Support for Width and Height(@tomprats #2169)

Changed

• Decode unicode filenames from URL(@fedorkk #2131)
• Change file size of error message to human size(@aki77 #2199)

Fixed

• Bundled en translation was not loaded by default, causing translation missing(@mshibuya 95ce39d3)
• Remove potentially redundant HEAD request on checking fog file existence(@eritiro #2140)
• Failing with uninitialized constant if uri is not loaded(@jasdeepsingh #2223)
• RMagick cloud not process remotely stored files(@zog #2185)

... (truncated)

Commits

• 56f39b2 Version 1.3.2
• eb9346d Fix Code Injection vulnerability in CarrierWave::RMagick
• 91714ad Fix SSRF vulnerability in the remote file download feature
• 8228e1b URI.open does not exist before Ruby 2.5
• ac3d006 URI.encode becomes escape, not unescape
• 0712435 Merge pull request #2462 from aubinlrx/tweak/deprecation_warning_ruby_27
• c3c652a Cloud not make JRuby build pass on Xenial, reverting back to Trusty
• 0cbea95 Fix build issues with PostgreSQL and ImageMagick
• 6097836 use URI.open instead of Kernel.open for Ruby 2.7
• f10026b Use URI::DEFAULT_PARSER.unescape instead of URI.decode for Ruby 2.7
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/OregonDigital/oregondigital/network/alerts).