🚨 [security] Update all of rails: 5.1.6.1 → 5.1.6.2 (patch)

🚨 Your version of actionview has known security vulnerabilities 🚨

Advisory: CVE-2019-5419 Disclosed: March 13, 2019 URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI

Denial of Service Vulnerability in Action View

There is a potential denial of service vulnerability in actionview.
This vulnerability has been assigned the CVE identifier CVE-2019-5419.

Impact

Specially crafted accept headers can cause the Action View template location
code to consume 100% CPU, causing the server unable to process requests. This
impacts all Rails applications that render views.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Workarounds

This vulnerability can be mitigated by wrapping render calls with
respond_to blocks. For example, the following example is vulnerable:
class UserController < ApplicationController
  def index
    render "index"
  end
end
But the following code is not vulnerable:
class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end
Implicit rendering is impacted, so this code is vulnerable:
class UserController < ApplicationController
  def index
  end
end
But can be changed this this:
class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end
Alternatively to specifying the format, the following monkey patch can be
applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true

ActionDispatch::Request.prepend(Module.new do
  def formats
    super().select do |format|
      format.symbol || format.ref == "*/*"
    end
  end
end)
Credits

Thanks to John Hawthorn john@hawthorn.email of GitHub

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (5.1.6.1 → 5.1.6.2) · Repo

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ actioncable (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ actionmailer (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ actionpack (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ actionview (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ activejob (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ activemodel (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ activerecord (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ activesupport (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ concurrent-ruby (indirect, 1.1.4 → 1.1.5) · Repo · Changelog

Release Notes

1.1.5 (from changelog)

concurrent-ruby:

fix potential leak of context on JRuby and Java 7

concurrent-ruby-edge:

Add finalized Concurrent::Cancellation

Add finalized Concurrent::Throttle

Add finalized Concurrent::Promises::Channel

Add new Concurrent::ErlangActor

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.5.2 → 1.6.0) · Repo · Changelog

↗️ mini_mime (indirect, 1.0.0 → 1.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 12 commits:

↗️ railties (indirect, 5.1.6.1 → 5.1.6.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 2 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

depfu / example-ruby