🚨 [security] Update activesupport 7.0.4.3 → 7.0.7.2 (patch)

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ activesupport (indirect, 7.0.4.3 → 7.0.7.2) · Repo · Changelog

Security Advisories 🚨

🚨 Possible File Disclosure of Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:
$ umask 0077

Release Notes

7.0.7.1 (from changelog)

Use a temporary file for storing unencrypted files while editing

[CVE-2023-38037]

7.0.7 (from changelog)

Fix Cache::NullStore with local caching for repeated reads.

fatkodima

Fix to_s with no arguments not respecting custom :default formats

Hartley McGuire

Fix ActiveSupport::Inflector.humanize(nil) raising NoMethodError: undefined method `end_with?' for nil:NilClass.

James Robinson

Fix Enumerable#sum for Enumerator#lazy.

fatkodima, Matthew Draper, Jonathan Hefner

Improve error message when EventedFileUpdateChecker is used without a compatible version of the Listen gem

Hartley McGuire

7.0.6 (from changelog)

Fix EncryptedConfiguration returning incorrect values for some Hash methods

Hartley McGuire

Fix arguments being destructed Enumerable#many? with block.

Andrew Novoselac

Fix humanize for strings ending with id.

fatkodima

7.0.5.1 (from changelog)

No changes.

7.0.5 (from changelog)

Fixes TimeWithZone ArgumentError.

Niklas Häusele

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 34 commits:

↗️ i18n (indirect, 1.12.0 → 1.14.1) · Repo · Changelog

Release Notes

1.14.1

Included in this release

Simplify the "Translation missing" message when default is an empty Array by @amatsuda in #662

Maintenance stuff

Skip CIing on jruby against Rails 5.2 by @amatsuda in #664

A fix for failing CI against edge Rails by @amatsuda in #663

Add documentation hint for fallback values by @mark-a in #659

CI against Ruby 3.2 by @amatsuda in #665

Fix build warnings in the CI by using actions/checkout@v3 by @amatsuda in #666

Thanks to @amatsuda for these PRs!

New Contributors

@mark-a made their first contribution in #659

Full Changelog: v1.14.0...v1.14.1

1.14.0

What's Changed

fix LazyLoadable#available_locales duplicating locales by @ccutrer in #655

Add more helpful translation error when :default option is provided. by @Nerian in #654

Fix I18n::Locale::Fallbacks not initializing itself on Ruby 3 by @yheuhtozr in #653

Fix I18n.t when locale contains separator by @tubaxenor in #656

This reverts a change from #651, that was released in v1.13.0

New Contributors

@ccutrer made their first contribution in #655

@Nerian made their first contribution in #654

@yheuhtozr made their first contribution in #653

@tubaxenor made their first contribution in #656

Full Changelog: v1.13.0...v1.14.0

1.13.0

What's Changed

Fix symbol resolving with pluralization by @movermeyer in #636

Updating DEFAULT_APPROXIMATIONS with capitalised German Eszett character for consistency by @lucapericlp in #627

Fix load_path example in README.md by @nickcampbell18 in #642

Add support for meridian indicators on Date objects by @movermeyer in #640

Make translations loading thread-safe by @mensfeld in #644

Get closer to full CLDR pluralization support by @movermeyer in #634

Allow passing scope argument to exists? by @misdoro in #647

Revert #503 changes for Backend::Base by @movermeyer in #637

Properly stub constants by @fatkodima in #650

Optimize I18n.t by @fatkodima in #651

Return same string object when no interpolations were made by @fatkodima in #649

New Contributors

@lucapericlp made their first contribution in #627

@nickcampbell18 made their first contribution in #642

@mensfeld made their first contribution in #644

@misdoro made their first contribution in #647

Full Changelog: v1.12.0...v1.13.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 51 commits:

↗️ minitest (indirect, 5.18.0 → 5.19.0) · Repo · Changelog

Release Notes

5.19.0 (from changelog)

2 minor enhancements:

Add metadata lazy accessor to Runnable / Result. (matteeyah)

Only load minitest/unit (aka ancient MiniTest compatibility layer) if ENV

1 bug fix:

Minitest::TestTask enthusiastically added itself to default. (ParadoxV5)

5.18.1 (from changelog)

3 bug fixes:

Avoid extra string allocations when filtering tests. (tenderlove)

Only mention deprecated ENV if it is an integer string.

Push up test_order to Minitest::Runnable to fix minitest/hell. (koic)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 12 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

ryanfb / cts-cite-driver