🚨 [security] Update railties 7.0.5 → 7.0.6 (patch)

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ railties (7.0.5 → 7.0.6) · Repo · Changelog

Release Notes

7.0.6 (from changelog)

Avoid escaping paths when editing credentials.

Jonathan Hefner

7.0.5.1 (from changelog)

No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

✳️ activemodel (7.0.5 → 7.0.6) · Repo · Changelog

Release Notes

7.0.6 (from changelog)

No changes.

7.0.5.1 (from changelog)

No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

✳️ activerecord (7.0.5 → 7.0.6) · Repo · Changelog

Release Notes

7.0.6 (from changelog)

Fix autosave associations with validations added on :base of the associated objects.

fatkodima

Fix result with anonymous PostgreSQL columns of different type from json.

Oleksandr Avoiants

Preserve timestamp when setting an ActiveSupport::TimeWithZone value to timestamptz attribute.

fatkodima
Fix where on association with has_one/has_many polymorphic relations.

Before:
Treasure.where(price_estimates: PriceEstimate.all)
#=> SELECT (...) WHERE "treasures"."id" IN (SELECT "price_estimates"."estimate_of_id" FROM "price_estimates")
Later:
Treasure.where(price_estimates: PriceEstimate.all)
#=> SELECT (...) WHERE "treasures"."id" IN (SELECT "price_estimates"."estimate_of_id" FROM "price_estimates" WHERE "price_estimates"."estimate_of_type" = 'Treasure')
Lázaro Nixon
Fix decrementing counter caches on optimistically locked record deletion

fatkodima

Ensure binary-destined values have binary encoding during type cast.

Matthew Draper

Preserve existing column default functions when altering table in SQLite.

fatkodima

Remove table alias added when using where.missing or where.associated.

fatkodima

Fix Enumerable#in_order_of to only flatten first level to preserve nesting.

Miha Rekar

7.0.5.1 (from changelog)

No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

✳️ activesupport (7.0.5 → 7.0.6) · Repo · Changelog

Release Notes

7.0.6 (from changelog)

Fix EncryptedConfiguration returning incorrect values for some Hash methods

Hartley McGuire

Fix arguments being destructed Enumerable#many? with block.

Andrew Novoselac

Fix humanize for strings ending with id.

fatkodima

7.0.5.1 (from changelog)

No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ actionpack (indirect, 7.0.5 → 7.0.6) · Repo · Changelog

Security Advisories 🚨

🚨 Possible XSS via User Supplied Values to redirect_to

The redirect_to method in Rails allows provided values to contain characters
which are not legal in an HTTP header value. This results in the potential for
downstream services which enforce RFC compliance on HTTP response headers to
remove the assigned Location header. This vulnerability has been assigned the
CVE identifier CVE-2023-28362.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4

Impact

This introduces the potential for a Cross-site-scripting (XSS) payload to be
delivered on the now static redirection page. Note that this both requires
user interaction and for a Rails app to be configured to allow redirects to
external hosts (defaults to false in Rails >= 7.0.x).

Releases

The FIXED releases are available at the normal locations.

Workarounds

Avoid providing user supplied URLs with arbitrary schemes to the redirect_to
method.

Release Notes

7.0.6 (from changelog)

No changes.

7.0.5.1 (from changelog)

Raise an exception if illegal characters are provide to redirect_to [CVE-2023-28362]

Zack Deveau

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ actionview (indirect, 7.0.5 → 7.0.6) · Repo · Changelog

Release Notes

7.0.6 (from changelog)

No changes.

7.0.5.1 (from changelog)

No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ i18n (indirect, 1.14.0 → 1.14.1) · Repo · Changelog

Release Notes

1.14.1

Included in this release

Simplify the "Translation missing" message when default is an empty Array by @amatsuda in #662

Maintenance stuff

Skip CIing on jruby against Rails 5.2 by @amatsuda in #664

A fix for failing CI against edge Rails by @amatsuda in #663

Add documentation hint for fallback values by @mark-a in #659

CI against Ruby 3.2 by @amatsuda in #665

Fix build warnings in the CI by using actions/checkout@v3 by @amatsuda in #666

Thanks to @amatsuda for these PRs!

New Contributors

@mark-a made their first contribution in #659

Full Changelog: v1.14.0...v1.14.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 12 commits:

↗️ minitest (indirect, 5.18.0 → 5.18.1) · Repo · Changelog

Release Notes

5.18.1 (from changelog)

3 bug fixes:

Avoid extra string allocations when filtering tests. (tenderlove)

Only mention deprecated ENV if it is an integer string.

Push up test_order to Minitest::Runnable to fix minitest/hell. (koic)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ racc (indirect, 1.6.2 → 1.7.1) · Repo · Changelog

Release Notes

1.7.1

What's Changed

Use released version of test-unit-ruby-core by @hsbt in #220

Fix place to specify rake-compiler version by @nobu in #223

Embedded path by @nobu in #221

Full Changelog: v1.7.0...v1.7.1

1.7.0

What's Changed

Update racc.ja document by @hsbt in #207

Make racc Ractor compatible by @pocke in #167

Get rid of anonymous eval calls by @casperisfine in #208

Adds Ruby 3.2 to the CI matrix. by @petergoldstein in #209

Improve actions by @hsbt in #211

Exclude jruby-head on macOS by @flavorjones in #214

Add a newline at EOF [ci skip] by @nobu in #215

[DOC] Strip trailing spaces by @nobu in #216

Add tests for sample dir and tweak samples by @hkdnet in #217

Remove ErrorSymbolValue reference by @jeremyevans in #213

Embed racc/info.rb too by @nobu in #218

New Contributors

@petergoldstein made their first contribution in #209

@hkdnet made their first contribution in #217

@jeremyevans made their first contribution in #213

Full Changelog: v1.6.2...v1.7.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 46 commits:

↗️ rails-dom-testing (indirect, 2.0.3 → 2.1.1) · Repo

Release Notes

2.1.0

What's Changed

Address warning: mismatched indentations at 'when' with 'case' by @yahonda in #74

Make assert_dom_equal ignore insignificant whitespace when walking the node tree by @jduff in #84

Expand Substitution Matching Types support by @seanpdoyle in #90

Alias assert_select methods to assert_dom versions by @seanpdoyle in #93

Raise an error if the last arg is the wrong format by @ghiculescu in #96

Fix replacement for multiple substitutions by @speckins in #76

Better error message if response.body is blank or not parseable by Nokogiri by @ghiculescu in #97

selector_assertions/html_selector: No trailing . on content_mismatch by @issyl0 in #102

Use Minitest::Assertion#diff for content failure messages by @flavorjones in #106

New Contributors

@nicolasleger made their first contribution in #73

@yahonda made their first contribution in #74

@dependabot made their first contribution in #79

@jduff made their first contribution in #86

@amatsuda made their first contribution in #88

@seanpdoyle made their first contribution in #90

@ghiculescu made their first contribution in #96

@jbampton made their first contribution in #95

@speckins made their first contribution in #76

@issyl0 made their first contribution in #102

@flavorjones made their first contribution in #103

Full Changelog: v2.0.3...v2.1.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 56 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

sanger / unified_warehouse