From 585fd4cf675153b5ad44ccfee35d7df4b3e43e2d Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Wed, 14 Dec 2022 16:43:08 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168317 - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168318 - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168649 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168316 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168646 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168647 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168648 --- Gemfile | 8 +-- Gemfile.lock | 168 ++++++++++++++++++++++++++++----------------------- 2 files changed, 98 insertions(+), 78 deletions(-) diff --git a/Gemfile b/Gemfile index b3cebf9..43124c2 100644 --- a/Gemfile +++ b/Gemfile @@ -4,13 +4,13 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '2.5.0' # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' -gem 'rails', '~> 5.2.2' +gem 'rails', '~> 5.2.4', '>= 5.2.4.4' # Use sqlite3 as the database for Active Record gem 'sqlite3', '1.3.11' # Use Puma as the app server gem 'puma', '~> 3.11' # Use SCSS for stylesheets -gem 'sass-rails', '~> 5.0' +gem 'sass-rails', '~> 5.1', '>= 5.1.0' # Use Uglifier as compressor for JavaScript assets gem 'uglifier', '>= 1.3.0' # See https://github.com/rails/execjs#readme for more supported runtimes @@ -19,7 +19,7 @@ gem 'pg' # Use CoffeeScript for .coffee assets and views gem 'cocaine', '0.4.0' gem 'travis' -gem 'coffee-rails', '~> 4.2' +gem 'coffee-rails', '~> 4.2', '>= 4.2.2' # Turbolinks makes navigating your web application faster. Read more: https://github.com/turbolinks/turbolinks gem 'turbolinks', '~> 5' # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder @@ -51,7 +51,7 @@ group :development do gem 'capistrano-bundler', '~> 1.1', require: false gem 'capistrano-passenger', '~> 0.1.1', require: false gem 'capistrano-slackify', require: false - gem 'web-console', '>= 3.3.0' + gem 'web-console', '>= 3.7.0' gem 'listen', '>= 3.0.5', '< 3.2' # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring gem 'spring' diff --git a/Gemfile.lock b/Gemfile.lock index a029c4a..6233246 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,43 +1,43 @@ GEM remote: https://rubygems.org/ specs: - actioncable (5.2.4.4) - actionpack (= 5.2.4.4) + actioncable (5.2.8.1) + actionpack (= 5.2.8.1) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailer (5.2.4.4) - actionpack (= 5.2.4.4) - actionview (= 5.2.4.4) - activejob (= 5.2.4.4) + actionmailer (5.2.8.1) + actionpack (= 5.2.8.1) + actionview (= 5.2.8.1) + activejob (= 5.2.8.1) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.2.4.4) - actionview (= 5.2.4.4) - activesupport (= 5.2.4.4) + actionpack (5.2.8.1) + actionview (= 5.2.8.1) + activesupport (= 5.2.8.1) rack (~> 2.0, >= 2.0.8) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.2.4.4) - activesupport (= 5.2.4.4) + actionview (5.2.8.1) + activesupport (= 5.2.8.1) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) - activejob (5.2.4.4) - activesupport (= 5.2.4.4) + activejob (5.2.8.1) + activesupport (= 5.2.8.1) globalid (>= 0.3.6) - activemodel (5.2.4.4) - activesupport (= 5.2.4.4) - activerecord (5.2.4.4) - activemodel (= 5.2.4.4) - activesupport (= 5.2.4.4) + activemodel (5.2.8.1) + activesupport (= 5.2.8.1) + activerecord (5.2.8.1) + activemodel (= 5.2.8.1) + activesupport (= 5.2.8.1) arel (>= 9.0) - activestorage (5.2.4.4) - actionpack (= 5.2.4.4) - activerecord (= 5.2.4.4) - marcel (~> 0.3.1) - activesupport (5.2.4.4) + activestorage (5.2.8.1) + actionpack (= 5.2.8.1) + activerecord (= 5.2.8.1) + marcel (~> 1.0.0) + activesupport (5.2.8.1) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 0.7, < 2) minitest (~> 5.1) @@ -92,17 +92,18 @@ GEM coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.1.7) + concurrent-ruby (1.1.10) crass (1.0.6) - erubi (1.9.0) + digest (3.1.1) + erubi (1.11.0) ethon (0.12.0) ffi (>= 1.3.0) - execjs (2.7.0) + execjs (2.8.1) faraday (1.0.1) multipart-post (>= 1.2, < 3) faraday_middleware (1.0.0) faraday (~> 1.0) - ffi (1.13.1) + ffi (1.15.5) gh (0.18.0) activesupport (~> 5.0) addressable (~> 2.4) @@ -111,12 +112,13 @@ GEM multi_json (~> 1.0) net-http-persistent (~> 2.9) net-http-pipeline - globalid (0.4.2) - activesupport (>= 4.2.0) + globalid (1.0.0) + activesupport (>= 5.0) highline (2.0.3) - i18n (1.8.5) + i18n (1.12.0) concurrent-ruby (~> 1.0) io-like (0.3.1) + io-wait (0.2.3) jbuilder (2.10.1) activesupport (>= 5.0.0) json (2.3.1) @@ -126,64 +128,80 @@ GEM rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) ruby_dep (~> 1.2) - loofah (2.7.0) + loofah (2.19.1) crass (~> 1.0.2) nokogiri (>= 1.5.9) - mail (2.7.1) + mail (2.8.0) mini_mime (>= 0.1.1) - marcel (0.3.3) - mimemagic (~> 0.3.2) + net-imap + net-pop + net-smtp + marcel (1.0.2) method_source (1.0.0) - mimemagic (0.3.5) - mini_mime (1.0.2) - mini_portile2 (2.4.0) - minitest (5.14.2) + mini_mime (1.1.2) + mini_portile2 (2.6.1) + minitest (5.15.0) msgpack (1.3.3) multi_json (1.15.0) multipart-post (2.1.1) net-http-persistent (2.9.4) net-http-pipeline (1.0.1) + net-imap (0.2.2) + digest + net-protocol + strscan + net-pop (0.1.2) + net-protocol + net-protocol (0.1.2) + io-wait + timeout net-scp (2.0.0) net-ssh (>= 2.6.5, < 6.0.0) + net-smtp (0.3.0) + digest + net-protocol + timeout net-ssh (5.2.0) - nio4r (2.5.3) - nokogiri (1.10.10) - mini_portile2 (~> 2.4.0) + nio4r (2.5.8) + nokogiri (1.12.5) + mini_portile2 (~> 2.6.1) + racc (~> 1.4) pg (1.1.4) public_suffix (4.0.6) puma (3.12.6) pusher-client (0.6.2) json websocket (~> 1.0) - rack (2.2.3) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails (5.2.4.4) - actioncable (= 5.2.4.4) - actionmailer (= 5.2.4.4) - actionpack (= 5.2.4.4) - actionview (= 5.2.4.4) - activejob (= 5.2.4.4) - activemodel (= 5.2.4.4) - activerecord (= 5.2.4.4) - activestorage (= 5.2.4.4) - activesupport (= 5.2.4.4) + racc (1.6.1) + rack (2.2.4) + rack-test (2.0.2) + rack (>= 1.3) + rails (5.2.8.1) + actioncable (= 5.2.8.1) + actionmailer (= 5.2.8.1) + actionpack (= 5.2.8.1) + actionview (= 5.2.8.1) + activejob (= 5.2.8.1) + activemodel (= 5.2.8.1) + activerecord (= 5.2.8.1) + activestorage (= 5.2.8.1) + activesupport (= 5.2.8.1) bundler (>= 1.3.0) - railties (= 5.2.4.4) + railties (= 5.2.8.1) sprockets-rails (>= 2.0.0) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) - rails-html-sanitizer (1.3.0) - loofah (~> 2.3) - railties (5.2.4.4) - actionpack (= 5.2.4.4) - activesupport (= 5.2.4.4) + rails-html-sanitizer (1.4.4) + loofah (~> 2.19, >= 2.19.1) + railties (5.2.8.1) + actionpack (= 5.2.8.1) + activesupport (= 5.2.8.1) method_source rake (>= 0.8.7) thor (>= 0.19.0, < 2.0) - rake (13.0.1) - rb-fsevent (0.10.4) + rake (13.0.6) + rb-fsevent (0.11.2) rb-inotify (0.10.1) ffi (~> 1.0) regexp_parser (1.7.1) @@ -210,17 +228,19 @@ GEM sprockets (3.7.2) concurrent-ruby (~> 1.0) rack (> 1, < 3) - sprockets-rails (3.2.2) - actionpack (>= 4.0) - activesupport (>= 4.0) + sprockets-rails (3.4.2) + actionpack (>= 5.2) + activesupport (>= 5.2) sprockets (>= 3.0.0) sqlite3 (1.3.11) sshkit (1.21.0) net-scp (>= 1.1.2) net-ssh (>= 2.8.0) - thor (1.0.1) + strscan (3.0.5) + thor (1.2.1) thread_safe (0.3.6) - tilt (2.0.10) + tilt (2.0.11) + timeout (0.3.1) travis (1.9.1) faraday (~> 1.0) faraday_middleware (~> 1.0) @@ -235,7 +255,7 @@ GEM turbolinks-source (5.2.0) typhoeus (0.8.0) ethon (>= 0.8.0) - tzinfo (1.2.7) + tzinfo (1.2.10) thread_safe (~> 0.1) uglifier (4.2.0) execjs (>= 0.3.0, < 3) @@ -245,7 +265,7 @@ GEM bindex (>= 0.4.0) railties (>= 5.0) websocket (1.2.8) - websocket-driver (0.7.3) + websocket-driver (0.7.5) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) xpath (3.2.0) @@ -266,13 +286,13 @@ DEPENDENCIES capybara (>= 2.15) chromedriver-helper cocaine (= 0.4.0) - coffee-rails (~> 4.2) + coffee-rails (~> 4.2, >= 4.2.2) jbuilder (~> 2.5) listen (>= 3.0.5, < 3.2) pg puma (~> 3.11) - rails (~> 5.2.2) - sass-rails (~> 5.0) + rails (~> 5.2.4, >= 5.2.4.4) + sass-rails (~> 5.1, >= 5.1.0) selenium-webdriver spring spring-watcher-listen (~> 2.0.0) @@ -281,10 +301,10 @@ DEPENDENCIES turbolinks (~> 5) tzinfo-data uglifier (>= 1.3.0) - web-console (>= 3.3.0) + web-console (>= 3.7.0) RUBY VERSION ruby 2.5.0p0 BUNDLED WITH - 2.1.4 + 1.17.3