🚨 [security] Update devise: 4.4.1 → 4.6.1 (minor)

🚨 Your version of devise has known security vulnerabilities 🚨

Advisory: CVE-2019-5421 Disclosed: February 07, 2019 URL: https://github.com/plataformatec/devise/issues/4981

Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module

Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a
time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts
within the Devise::Models::Lockable class not being concurrency safe.

🚨 We recommend to merge and deploy this update as soon as possible! 🚨

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ devise (4.4.1 → 4.6.1) · Repo · Changelog

Release Notes

4.6.1 (from changelog)

bug fixes

Check if root_path is defined with #respond_to? instead of #present (by @tegon)

4.6.0 (from changelog)

enhancements

Allow to skip email and password change notifications (by @iorme1)

Include the use of nil for allow_unconfirmed_access_for in the docs (by @joaumg)

Ignore useless files into the .gem file (by @huacnlee)

Explain the code that prevents enumeration attacks inside Devise::Strategies::DatabaseAuthenticatable (by @tegon)

Refactor the devise_error_messages! helper to render a partial (by @prograhamer)

Add an option (Devise.sign_in_after_change_password) to not automatically sign in a user after changing a password (by @knjko)

bug fixes

Fix missing comma in Simple Form generator (by @colinross)

Fix error with migration generator in Rails 6 (by @oystersauce8)

Set encrypted_password to nil when password is set to nil (by @sivagollapalli)

Consider whether the request supports flash messages inside Devise::Controllers::Helpers#is_flashing_format? (by @colinross)

Fix typo inside Devise::Generators::ControllersGenerator (by @kopylovvlad)

Sanitize parameters inside Devise::Models::Authenticatable#find_or_initialize_with_errors (by @rlue)

#after_database_authentication callback was not called after authentication on password reset (by @kanmaniselvan)

Fix corner case when #confirmation_period_valid? was called at the same second as confirmation_sent_at was set. Mostly true for date types that only have second precisions. (by @stanhu)

Fix unclosed li tag in error_messages partial (by @mracos)

Fix Routes issue when devise engine is mounted in another engine on Rails versions lower than 5.1 (by @a-barbieri)

Make #increment_failed_attempts concurrency safe (by @tegon)

Apply Test Helper fix to Rails 6.0 as well as 5.x (by @matthewrudy)

deprecations

The second argument of DatabaseAuthenticatable's #update_with_password and #update_without_password is deprecated and will be removed in the next major version. It was added to support a feature deprecated in Rails 4, so you can safely remove it from your code. (by @ihatov08)

The DeviseHelper.devise_error_messages! is deprecated and will be removed in the next major version. Use the devise/shared/error_messages partial instead. (by @mracos)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ bcrypt (indirect, 3.1.11 → 3.1.12) · Repo · Changelog

Release Notes

3.1.12

Add support for Ruby 2.3, 2.4, and 2.5 in compiled Windows binaries

Fix compatibility with libxcrypt [GH #164 by @besser82]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 20 commits:

↗️ concurrent-ruby (indirect, 1.0.5 → 1.1.5) · Repo · Changelog

Release Notes

1.1.5 (from changelog)

concurrent-ruby:

fix potential leak of context on JRuby and Java 7

concurrent-ruby-edge:

Add finalized Concurrent::Cancellation

Add finalized Concurrent::Throttle

Add finalized Concurrent::Promises::Channel

Add new Concurrent::ErlangActor

1.1.4 (from changelog)

(#780) Remove java_alias of 'submit' method of Runnable to let executor service work on java 11

(#776) Fix NameError on defining a struct with a name which is already taken in an ancestor

1.1.0

concurrent-ruby:

requires at least Ruby 2.0

Promises
are moved from concurrent-ruby-edge to concurrent-ruby

Add support for TruffleRuby

(#734) Fix Array/Hash/Set construction broken on TruffleRuby

AtomicReference fixed

fixed documentation and README links

fix Set for TruffleRuby and Rubinius

CI stabilization

remove sharp dependency edge -> core

remove warnings

documentation updates

Exchanger is no longer documented as edge since it was already available in
concurrent-ruby

(#644) Fix Map#each and #each_pair not returning enumerator outside of MRI

(#659) Edge promises fail during error handling

(#741) Raise on recursive Delay#value call

(#727) #717 fix global IO executor on JRuby

(#740) Drop support for CRuby 1.9, JRuby 1.7, Rubinius.

(#737) Move AtomicMarkableReference out of Edge

(#708) Prefer platform specific memory barriers

(#735) Fix wrong expected exception in channel spec assertion

(#729) Allow executor option in Promise#then

(#725) fix timeout check to use timeout_interval

(#719) update engine detection

(#660) Add specs for Promise#zip/Promise.zip ordering

(#654) Promise.zip execution changes

(#666) Add thread safe set implementation

(#651) #699 #to_s, #inspect should not output negative object IDs.

(#685) Avoid RSpec warnings about raise_error

(#680) Avoid RSpec monkey patching, persist spec results locally, use RSpec
v3.7.0

(#665) Initialize the monitor for new subarrays on Rubinius

(#661) Fix error handling in edge promises

concurrent-ruby-edge:

(#659) Edge promises fail during error handling

Edge files clearly separated in lib-edge

added ReInclude

add Promises.zip_futures_over_on

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ crass (indirect, 1.0.3 → 1.0.4) · Repo · Changelog

Release Notes

1.0.4

Fixed whitespace warnings. (#7 - @yahonda)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ erubi (indirect, 1.7.0 → 1.8.0) · Repo · Changelog

Release Notes

1.8.0 (from changelog)

* Support :yield_returns_buffer option in capture_end for always returning the (potentially modified) buffer in <%|= tags (evanleck) (#15)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 18 commits:

↗️ i18n (indirect, 0.9.3 → 0.9.5) · Repo · Changelog

Release Notes

0.9.5

#404 reported a regression in 0.9.3, which wasn't fixed by 0.9.4. #408 fixes this issue.

Thanks @wjordan!

0.9.4

Fixed a regression with chained backends introduced in v0.9.3 (#402) - #405 - bug report / #407 - PR to fix

Optimize Backend::Simple#available_locales - reports are that this is now 4x faster than previously - #406

Does any of this look wrong? Please let us know.

↗️ loofah (indirect, 2.1.1 → 2.2.3) · Repo · Changelog

Release Notes

2.2.3

Notably, this release addresses CVE-2018-16468.

2.2.2

2.2.2 / 2018-03-22

Make public Loofah::HTML5::Scrub.force_correct_attribute_escaping!,
which was previously a private method. This is so that downstream gems
(like rails-html-sanitizer) can use this logic directly for their own
attribute scrubbers should they need to address CVE-2018-8048.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 52 commits:

↗️ method_source (indirect, 0.9.0 → 0.9.2) · Repo

Commits

See the full diff on Github. The new version differs by 12 commits:

↗️ mini_portile2 (indirect, 2.3.0 → 2.4.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ minitest (indirect, 5.11.1 → 5.11.3) · Repo · Changelog

↗️ nokogiri (indirect, 1.8.1 → 1.10.1) · Repo · Changelog

Release Notes

1.10.1

1.10.1 / 2019-01-13

Features

[MRI] During installation, handle Xcode 10's new library pathOS. [#1801, #1851] (Thanks, @mlj and @deepj!)

Avoid unnecessary creation of Procs in many methods. [#1776] (Thanks, @chopraanmol1!)

Bug fixes

CSS selector :has() now correctly matches against any descendant. Previously this selector matched against only direct children). [#350] (Thanks, @Phrogz!)

NodeSet#attr now returns nil if it's empty. Previously this raised a NoMethodError.

[MRI] XPath errors are no longer suppressed during XSLT::Stylesheet#transform. Previously these errors were suppressed which led to silent failures and a subsequent segfault. [#1802]

1.10.0

1.10.0 / 2019-01-04

Features

[MRI] Cross-built Windows gems now support Ruby 2.6 [#1842, #1850]

Backwards incompatibilities

This release ends support for:

Ruby 2.2, for which official support ended on 2018-03-31 [#1841]

JRuby 1.7, for which official support ended on 2017-11-21 [#1741]

Dependencies

[MRI] libxml2 is updated from 2.9.8 to 2.9.9

[MRI] libxslt is updated from 1.1.32 to 1.1.33

1.9.1

1.9.1 / 2018-12-17

Bug fixes

Fix a bug introduced in v1.9.0 where XML::DocumentFragment#dup no longer returned an instance of the callee's class, instead always returning an XML::DocumentFragment. This notably broke any subclass of XML::DocumentFragment including HTML::DocumentFragment as well as the Loofah gem's Loofah::HTML::DocumentFragment. [#1846]

1.9.0

1.9.0 / 2018-12-17

Security Notes

[JRuby] Upgrade Xerces dependency from 2.11.0 to 2.12.0 to address upstream vulnerability CVE-2012-0881 [#1831] (Thanks @grajagandev for reporting.)

Notable non-functional changes

Decrease installation size by removing many unneeded files (e.g., /test) from the packaged gems. [#1719] (Thanks, @stevecrozz!)

Features

XML::Attr#value= allows HTML node attribute values to be set to either a blank string or an empty boolean attribute. [#1800]

Introduce XML::Node#wrap which does what XML::NodeSet#wrap has always done, but for a single node. [#1531] (Thanks, @ethirajsrinivasan!)

[MRI] Improve installation experience on macOS High Sierra (Darwin). [#1812, #1813] (Thanks, @gpakosz and @nurse!)

[MRI] Node#dup supports copying a node directly to a new document. See the method documentation for details.

[MRI] DocumentFragment#dup is now more memory-efficient, avoiding making unnecessary copies. [#1063]

[JRuby] NodeSet has been rewritten to improve performance! [#1795]

Bug fixes

NodeSet#each now returns self instead of zero. [#1822] (Thanks, @olehif!)

[MRI] Address a memory leak when using XML::Builder to create nodes with namespaces. [#1810]

[MRI] Address a memory leak when unparenting a DTD. [#1784] (Thanks, @stevecheckoway!)

[MRI] Use RbConfig::CONFIG instead of ::MAKEFILE_CONFIG to fix installations that use Makefile macros. [#1820] (Thanks, @nobu!)

[JRuby] Decrease large memory usage when making nested XPath queries. [#1749]

[JRuby] Fix failing tests on JRuby 9.2.x

[JRuby] Fix default namespaces in nodes reparented into a different document [#1774]

[JRuby] Fix support for Java 9. [#1759] (Thanks, @Taywee!)

Dependencies

[MRI] Upgrade mini_portile2 dependency from ~> 2.3.0 to ~> 2.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rack (indirect, 2.0.3 → 2.0.6) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 19 commits:

↗️ rack-test (indirect, 0.8.2 → 1.1.0) · Repo · Changelog

Release Notes

1.1.0

1.1.0 / 2018-07-21

Breaking changes:

None

Minor enhancements / new functionality:

[GitHub] Added configuration for Stale (Per Lundberg #232)

follow_direct: Include rack.session.options (Mark Edmondson #233)

[CI] Add simplecov (fatkodima #227)

Bug fixes:

Follow relative locations correctly. (Samuel Williams #230)

1.0.0

1.0.0 / 2018-03-27

The first release in the 1.0.0 series. 🎉 For the 1.x releases, we will follow Semantic Versioning very strictly; please keep this in mind when submitting fixes/suggesting changes.

Breaking changes:

Always set CONTENT_TYPE for non-GET requests
(Per Lundberg #223)

Minor enhancements / bug fixes:

Create tempfile using the basename without extension
(Edouard Chin #201)

Save session during follow_redirect!
(Alexander Popov #218)

Document how to use URL params with DELETE method
(Timur Platonov #220)

0.8.3

0.8.3 / 2018-02-27

Bug fixes:

Do not set Content-Type if params are explicitly set to nil
(Bartek Bułat #212). Fixes #200.

Fix UploadedFile#new regression
(Per Lundberg #215)

Minor enhancements

[CI] Test against Ruby 2.5 (Nicolas Leger #217)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 20 commits:

↗️ rails-html-sanitizer (indirect, 1.0.3 → 1.0.4) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ rake (indirect, 12.3.0 → 12.3.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ responders (indirect, 2.4.0 → 2.4.1) · Repo · Changelog

Release Notes

2.4.1 (from changelog)

Add support for Rails 6 beta

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ thor (indirect, 0.20.0 → 0.20.3) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 73 commits:

↗️ tzinfo (indirect, 1.2.4 → 1.2.5) · Repo · Changelog

Release Notes

1.2.5

Support recursively (deep) freezing Country and Timezone instances. #80.

Allow negative daylight savings time offsets to be derived when reading from zoneinfo files. The utc_offset and std_offset are now derived correctly for Europe/Dublin in the 2018a and 2018b releases of the Time Zone Database.

TZInfo v1.2.5 on RubyGems.org

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ warden (indirect, 1.2.7 → 1.2.8) · Repo · Changelog

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

mattzollinhofer / teachy