🚨 [security] [ruby] Update rails 6.1.7.4 → 6.1.7.6 (patch)

[depfu[bot]]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (6.1.7.4 → 6.1.7.6) · Repo

Release Notes

6.1.7.5

Active Support

• Use a temporary file for storing unencrypted files while editing

  [CVE-2023-38037]

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• No changes.

Active Job

• No changes.

Action Mailer

• No changes.

Action Cable

• No changes.

Active Storage

• No changes.

Action Mailbox

• No changes.

Action Text

• No changes.

Railties

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ actioncable (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ actionmailbox (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

↗️ actionmailer (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ actionpack (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ actiontext (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ actionview (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ activejob (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ activemodel (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ activerecord (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ activestorage (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ activesupport (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Security Advisories 🚨

🚨 Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:

$ umask 0077

Release Notes

6.1.7.5 (from changelog)

• Use a temporary file for storing unencrypted files while editing

  [CVE-2023-38037]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ mini_mime (indirect, 1.1.2 → 1.1.5) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 13 commits:

• Update mime types from upstream and bump
• Version bump
• Handle MIME::Types differences on Windows
• Shim IO#pread when not supported
• Version bump
• Make the library fork safe and drop the mutex
• DB updates 2023-03-01T10:03:17Z (#49)
• Adds Ruby 3.2 to the CI matrix. Requires Ruby >= 2.6. (#48)
• DEV: Require ruby >= 2.5 (#46)
• DEV: Update gem description to match repo desc (#47)
• DB updates 2022-01-06T11:58:07Z (#45)
• Update CI config (#42)
• Add Ruby 3.0 to CI (#40)

↗️ minitest (indirect, 5.18.1 → 5.19.0) · Repo · Changelog

Release Notes

5.19.0 (from changelog)

• 2 minor enhancements:

  • Add metadata lazy accessor to Runnable / Result. (matteeyah)

  • Only load minitest/unit (aka ancient MiniTest compatibility layer) if ENV

• 1 bug fix:

  • Minitest::TestTask enthusiastically added itself to default. (ParadoxV5)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• prepped for release
• + Add metadata lazy accessor to Runnable / Result. (matteeyah)
• - Minitest::TestTask enthusiastically added itself to default. (ParadoxV5)
• + Only load minitest/unit (aka ancient MiniTest compatibility layer) if ENV["MT_COMPAT"]
• Replace 'MiniTest' with 'Minitest' in example code. (sambostock)

↗️ net-imap (indirect, 0.3.6 → 0.3.7) · Repo

Release Notes

0.3.7

What's Changed

• 🔒️ Backport: Fix for Digest MD5 bad challenges by @nobu in #160
  • PR for backport is #161

Full Changelog: v0.3.6...v0.3.7

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 6 commits:

• 🏷️ Bump version to 0.3.7
• 🔀 Merge pull request #161 from ruby/backport-digest_md5-bad-challenge
• ✅ Mark assert_linear_performance test as pending
• Remove nested quantifier
• Fix `NoMethodError` when "qop" is not present
• Add test for bad challenge

↗️ nokogiri (indirect, 1.15.3 → 1.15.4) · Repo · Changelog

Release Notes

1.15.4

1.15.4 / 2023-08-11

Dependencies

• [CRuby] Vendored libxml2 is updated to v2.11.5 from v2.11.4. For details please see https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.5

Fixed

• Fixed a typo in a HTML5 parser error message. [#2927] (Thanks, @anishathalye!)
• [CRuby] ObjectSpace.memsize_of is now safe to call on Documents with complex DTDs. In previous versions, this debugging method could result in a segfault. [#2923, #2924]

---

sha256 checksums:

14091a07e07045a440213f7d5ced732fa7654ae8b6c7d180137f4124c5284ab8  nokogiri-1.15.4-aarch64-linux.gem
572ddc19934d010e98821a946d89462ae66b310fecc3fe12c48b0025c2f76855  nokogiri-1.15.4-arm-linux.gem
707288e293f4fc82a008f90b7ba0180d9f803f6a239a13e424378fedf8cf93e9  nokogiri-1.15.4-arm64-darwin.gem
04745925f63af61144eccef38a703928629cf97c34dbb1c42e3def17ac77ec92  nokogiri-1.15.4-java.gem
a0bfb65461a0453afed1a41b235fe84d5b9c7f4d70afd45f0dc2fdec8909faf1  nokogiri-1.15.4-x64-mingw-ucrt.gem
b9d01b9202e33cc23d19b2c1fc18ff4029cdda9b4f937a4baaefd4124a2158ba  nokogiri-1.15.4-x64-mingw32.gem
f6ae258d7ed5f81715118282aa45486e68fd44b9747d0244a236e9ed5b94c45d  nokogiri-1.15.4-x86-linux.gem
3f65b2426ece8da908bd5df5b6262ce525393f5245f8258a245bb4c3f5759b98  nokogiri-1.15.4-x86-mingw32.gem
d756605c540034debd7f486ae27802e6b1b129013fd6b1bb823783ef6f2bc5d7  nokogiri-1.15.4-x86_64-darwin.gem
872ced3d72d797ed9b5a76c67141c6cee7589711358e11c73e9c53724ffd1842  nokogiri-1.15.4-x86_64-linux.gem
e4a801e5ef643cc0036f0a7e93433d18818b31d48c9c287596b68e92c0173c4d  nokogiri-1.15.4.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 9 commits:

• version bump to v1.15.4
• backport updates and fixes to v1.15.x (#2953)
• dep: update libxml2 to v2.11.5
• test: add coverage for the memsize_of bug
• fix memsize_node when called on xmlAttrs
• Fix typo
• ci: ruby-saml's downstream test suite needs minitest compat
• style: prefer Minitest to MiniTest
• ci: update suppression stack signature

↗️ rack (indirect, 2.2.7 → 2.2.8) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 7 commits:

• Bump patch version.
• Regenerate SPEC (#2102)
• Fix inefficient assert pattern in Rack::Lint (#2101)
• Prefer ubuntu-latest for testing. (#2095)
• Update cookie.rb (#2092)
• adds missing 2.2.7 to CHANGELOG.md (#2081)
• Limit file extension length of multipart tempfiles (#2069) (#2075)

↗️ rails-dom-testing (indirect, 2.1.1 → 2.2.0) · Repo

Release Notes

2.2.0

What's Changed

• Allow user to choose the HTML parser used by @flavorjones in #109
• Fix string substitution regression by @nicoco007 in #110

New Contributors

• @nicoco007 made their first contribution in #110

Full Changelog: v2.1.1...v2.2.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 27 commits:

• Prepare for 2.2.0
• :scissors:
• No need to wait rubocop to run tests
• Test with Rails edge
• Merge pull request #110 from nicoco007/fix-substitution-regression
• Special case Regexp instead of strings
• Fix string substitution regression
• Remove constants from global namespace
• Match constant definition with the file name
• Inline CountDescribable module
• Remove unnecessary requires
• Setup Active Support in a common place
• :scissors:
• Require railtie in the main file
• Merge pull request #109 from flavorjones/flavorjones-dom-testing-html-version
• doc: update documentation to include HTML parser selection
• feat: railtie to set Rails::Dom::Testing.default_html_version
• feat: some assertions allow setting the HTML parser version
• feat: Introduce Rails::Dom::Testing.default_html_version
• Add .rdoc_options to make README the front page.
• Merge pull request #108 from flavorjones/flavorjones-rails-rubocop-standards
• ci: prepend a rubocop job
• style: use require_relative where appropriate
• style(rubocop): unsafe autocorrects
• style(rubocop): safe autocorrects
• dev: import Rails rubocop config, set Ruby version to >=2.5
• dev: remove unnecessary development dependencies

↗️ railties (indirect, 6.1.7.4 → 6.1.7.6) · Repo · Changelog

Release Notes

6.1.7.5 (from changelog)

• No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• Preparing for 6.1.7.6 release
• Bumping version for new release
• Preparing for 6.1.7.5 release
• bumping version / changelog
• Use a temporary file for storing unencrypted files while editing

↗️ zeitwerk (indirect, 2.6.9 → 2.6.11) · Repo · Changelog

Release Notes

2.6.11 (from changelog)

• Let on_load callbacks for implicit namespaces autoload other implicit namespaces.

2.6.10 (from changelog)

• Improve validation of the values returned by the inflector's camelize.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 8 commits:

• Ready for 2.6.11
• Let on_dir_autoloaded be reentrant
• Update code comment
• Ready for 2.6.10
• Rename cpath_expected_at tests
• Centralize and improve camelize validations
• Relax wording in CHANGELOG
• Fixes typo

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)