The site behind https://software.opensuse.org. It is the default web interface to download openSUSE distributions and to search for OBS packages. Packaged at https://build.opensuse.org/project/show/openSUSE:infrastructure:software.opensuse.org
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
The feature is only activated in apps that use Ruby 3.2+ and Rails 7.1+. By default only queries that take longer than 100ms will have source recorded, which can be adjusted by updating the value of config.rails.db_query_source_threshold_ms.
Log envelope delivery message with debug instead of info (#2320)
Bug Fixes
Don't throw error on arbitrary arguments being passed to capture_event options #2301
The feature is only activated in apps that use Ruby 3.2+ and Rails 7.1+. By default only queries that take longer than 100ms will have source recorded, which can be adjusted by updating the value of config.rails.db_query_source_threshold_ms.
Log envelope delivery message with debug instead of info (#2320)
Bug Fixes
Don't throw error on arbitrary arguments being passed to capture_event options #2301
* Define Erubi.h as a module function (jeremyevans)
* Add erubi/capture_block, supporting capturing block output via standard <%= and <%== tags (jeremyevans)
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Rack::Request::Helpers module when parsing HTTP Accept headers. This vulnerability can be exploited by an attacker sending specially crafted Accept-Encoding or Accept-Language headers, causing the server to spend excessive time processing the request and leading to a Denial of Service (DoS).
Details
The fix for GHSA-54rr-7fvw-6x8f was not applied to the main branch and thus while the issue was fixed for the Rack v3.0 release series, it was not fixed in the v3.1 release series until v3.1.5.
Possible Denial of Service Vulnerability in Rack Header Parsing
There is a possible denial of service vulnerability in the header parsing
routines in Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26146.
Versions Affected: All.
Not affected: None
Fixed Versions: 2.0.9.4, 2.1.4.4, 2.2.8.1, 3.0.9.1
Impact
Carefully crafted headers can cause header parsing in Rack to take longer than
expected resulting in a possible denial of service issue. Accept and Forwarded
headers are impacted.
Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2
or newer are unaffected.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.
2-0-header-redos.patch - Patch for 2.0 series
2-1-header-redos.patch - Patch for 2.1 series
2-2-header-redos.patch - Patch for 2.2 series
3-0-header-redos.patch - Patch for 3.0 series
Credits
Thanks to svalkanov for reporting this and
providing patches!
Possible DoS Vulnerability with Range Header in Rack
There is a possible DoS vulnerability relating to the Range request header in
Rack. This vulnerability has been assigned the CVE identifier CVE-2024-26141.
Carefully crafted Range headers can cause a server to respond with an
unexpectedly large response. Responding with such large responses could lead
to a denial of service issue.
Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications).
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for
the two supported release series. They are in git-am format and consist of a
single changeset.
There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.
Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.
Workarounds
Setting Regexp.timeout in Ruby 3.2 is a possible workaround.
There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.
Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3
Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.
Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series
There is a possible denial of service vulnerability in the Range header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44570.
Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
2-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.0 series
2-1-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.1 series
2-2-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 2.2 series
3-0-Fix-ReDoS-in-Rack-Utils.get_byte_ranges.patch - Patch for 3.0 series
There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.
Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases
The fixed releases are available at the normal locations.
Workarounds
There are no feasible workarounds for this issue.
Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ sentry-rails (5.17.3 → 5.18.0) · Repo · Changelog
Release Notes
5.18.0
Does any of this look wrong? Please let us know.
✳️ minitest (5.23.1 → 5.24.1) · Repo · Changelog
Release Notes
5.24.1 (from changelog)
5.24.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 8 commits:
Branching minitest to version 5.24.1
- Fix the error message when an extension is invalid value. (y-yagi)
prepped for release
+ Added Minitest.register_plugin.
Remove more anacronisms. Allow tests to pass w/o rubygems loaded.
- Removed anacronism, but allow load_plugins to exit gracefully if --disable=gems.
Fix one failing tests when string literals are frozen.
Moved some methods around to follow actual call structure a bit better.
✳️ sentry-ruby (5.17.3 → 5.18.0) · Repo · Changelog
Release Notes
5.18.0
Does any of this look wrong? Please let us know.
↗️ erubi (indirect, 1.12.0 → 1.13.0) · Repo · Changelog
Release Notes
1.13.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 12 commits:
Bump version to 1.13.0
Add erubi/capture_block to the gem
Adjust nocov markers
Define Erubi.h as a module function
Add erubi/capture_block, supporting capturing block output via standard <%= and <%== tags
Restructure tests to make it so the same basic tests can be used for multiple engines
Add Ruby 3.3 to CI and bump actions/checkout to v4
Switch from hanna-nouveau to hanna
Stop testing Ruby 2.2 in CI as it no longer works with ubuntu-latest
Move to actions/checkout@v3
Limit rake gem restriction in CI to Ruby <2.4
Add CI for Ruby 3.2
↗️ irb (indirect, 1.13.1 → 1.14.0) · Repo
Release Notes
1.14.0
1.13.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 17 commits:
Bump version to v1.14.0 (#980)
Return only commands when completing help command's argument (#973)
Introduce cd command (#971)
Allow assigning and using local variable name conflicting with command (#961)
Improve how command calls' return value is handled (#972)
Bump version to v1.13.2 (#970)
Invalid encoding symbol now raises SyntaxError also in 3.3 (#969)
Cleanup irbrc generator cache always at teardown (#968)
fix typos in the `Index of Command-Line Options`
Suppress Ruby warnings in certain backtrace filtering tests (#966)
Add a section to guide users choose between helper methods and commands (#965)
Add accidentally dropped disable_irb command back (#964)
Remove useless Reline::Key.new and update wrong comment for alt+d (#963)
Reorder ruby lex clauses for unrecoverable first (#956)
Clean up tmpdir
Add a new initialization step to validate IRB.conf's values (#953)
Simplify regexp to account for prism error messages (#954)
↗️ rack (indirect, 2.2.9 → 3.1.6) · Repo · Changelog
Security Advisories 🚨
🚨 Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
🚨 Rack vulnerable to ReDoS in content type parsing (2nd degree polynomial)
🚨 Rack Header Parsing leads to Possible Denial of Service Vulnerability
🚨 Rack has possible DoS Vulnerability with Range Header
🚨 Possible Denial of Service Vulnerability in Rack's header parsing
🚨 Rack has possible DoS Vulnerability in Multipart MIME parsing
🚨 Denial of service via multipart parsing in Rack
🚨 Denial of service via header parsing in Rack
🚨 Denial of Service Vulnerability in Rack Content-Disposition parsing
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rack-session (indirect, 1.0.2 → 2.0.0) · Repo
Release Notes
2.0.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 36 commits:
Bump major version.
Set minimum rack version to 3.0.0+.
Update license with all contributors.
Revert "Rack < v3 compatible release." (#20)
Bump major version.
Remove old copyright.
Modernize gem.
Add note about compatibility.
Add missing packages.
Add external tests for Rack 2.2.
Rack < v3 compatible release.
Fix typo: ehancement -> enhancement
Bump minor version.
Fix typo `ehancement` -> `enhancement`
Expose same_site instance variable. Fixes #2.
Handle case where there is no existing cookie data
Require rack/session in README example
Bump patch version.
Consistency with rackup gem.
Remove unnecessary comment/text.
Add `LICENSE.md` to distribution.
Reformat the copyright to be more consistent and ordered.
We don't need to explicitly depend on the main branch any more.
Add frozen_string_literal to all files.
Update README and remove old workflow.
Update test workflow.
Allow for Rack 3 beta gem to be loaded
Fix formatting of README.
Bump minor version.
Add rack ~> 3.0 to gemspec.
Use undeprecated method to set cookie.
Remove `lib/rack/session/memcache.rb` it has been deprecated for 3 years.
Tidy up files copied from rack. (#5)
Various Fixes (#1)
Bump minor version.
Moved `Rack::Session` to separate gem.
↗️ rackup (indirect, 1.0.0 → 2.1.0) · Repo
Commits
See the full diff on Github. The new version differs by 9 commits:
Bump minor version.
Correctly support streaming responses with webrick. (#8)
Update contributors according to enhanced mailmap.
Bump major version.
Install Ragel dependency for Puma.
Test falcon and puma external test suites.
Add missing `rackup` executable.
Test on main rack.
Revert "Prepare for Rack 2.x compatible release."
↗️ reline (indirect, 0.5.8 → 0.5.9) · Repo
Release Notes
0.5.9
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 10 commits:
Bump version to 0.5.9 (#724)
Add more fallbacks when terminfo is not available (#722)
Suppress warning(Ruby 3.4) requiring fiddle from terminfo.rb (#721)
Remove instance variable @first_char (#717)
Refactor input key reading (#712)
Ensure no escape sequence before printing prompt (#716)
Reline::ANSI is general io. Reline::GeneralIO is not. (#659)
In ed_search_[prev|next]_history, make the cursor come to the end of the line when there is no search substr (#714)
Improve key binding match/matching check (#709)
Overhaul io gate structure (#666)
↗️ stringio (indirect, 3.1.0 → 3.1.1) · Repo · Changelog
Release Notes
3.1.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 25 commits:
Add 3.1.1 entry
Remove special handling of chilled strings
strio_read: preserve buffer encoding on partial reads (#95)
Extract `readonly_string_p`
Adjust styles [ci skip]
Eagerly defrost chilled strings
NULL StringIO by `StringIO.new(nil)`
Backport https://github.com/ruby/ruby/commit/09d8c99cdcb04fb6c6c8e61c9dea28927a3a0b46 (#91)
[DOC] Fix document file list
[DOC] Package rdoc files
[DOC] Add missing documents
[DOC] Add rdoc task
[DOC] Indent numbered list contents
Adapt other 19 methods to new names
Update CI versions
Define `StringIO::MAX_LENGTH`
Various cleanup for JRuby ext (#85)
Use new name for cat19 (#84)
Use macos-arm-oss(=macos-13) and macos-12 runners instead of macos-11 (#82)
Fix ascii_only? flag in strio_write (#77)
Update the coderange after overwrite
Bump actions/upload-artifact from 3 to 4 (#76)
Minor fix README.md (#75)
Ensure the gem installs fine on truffleruby in CI
Development of 3.1.1 started.
↗️ zeitwerk (indirect, 2.6.15 → 2.6.16) · Repo · Changelog
Release Notes
2.6.16 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 8 commits:
Ready for 2.6.16
Remove ruby-lsp from the Gemfile
Introduces the private class Zeitwerk::Cref
Add ruby-lsp to the Gemfile
Merge pull request #295 from kianmeng/fix-typos
Fix typos
Log directories being ignored for having no Ruby file
Reword and reorder logging test
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.All Depfu comment commands