Skip to content

🚨 [security] Update activesupport 6.1.7.7 → 8.1.1 (major) #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
depfu wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🚨 [security] Update activesupport 6.1.7.7 → 8.1.1 (major) #110

depfu wants to merge 1 commit into from

Conversation

@depfu
Copy link
Contributor

@depfu depfu bot commented Oct 30, 2025

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ activesupport (6.1.7.7 → 8.1.1) · Repo · Changelog

Security Advisories 🚨

🚨 Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:

$ umask 0077

🚨 Possible XSS Security Vulnerability in SafeBuffer#bytesplice

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

🚨 ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1
Impact

A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.

All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.

Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 6.1 series
7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ minitest (5.25.2 → 5.26.0) · Repo · Changelog

Release Notes

5.26.0 (from changelog)

The Seattle.rb Nerd Party, Slightly Tipsy Edition!

  • 2 minor enhancements:

    • Added extra documentation to Minitest::TestTask options.

    • Make parallelize_me! a no-op when n_threads=1.

  • 9 bug fixes:

    • Bypass parallel_executor entirely when n_threads=1.

    • Don’t require rubygems in Rakefile… it is 2025.

    • Ensure that minitest exits non-zero on Interrupt. (tavianator)

    • Fix Minitest.run sequence rdoc to include loop vars and read consistently.

    • Fix call to parallel_executor.shutdown when it isn’t defined.

    • Removed some 1.8/1.9-based code from the assertions and expectations.

    • Still fighting with rdoc? Yup. Still fighting with rdoc…

    • Switched assert_equal’s diff from Tempfile.open to Tempfile.create.

    • Use Regexp.escape for BASE_RE in case pwd has special chars. (astra_1993)

5.25.5 (from changelog)

  • 4 bug fixes:

    • Bumped minimum ruby to 2.7.

    • Fixed expectation docs for must/wont_pattern_match. (jaredcwhite)

    • Reorder Minitest::Test.ancestors to allow reaching Minitest::Assertions#skipped? (Edouard-chin)

    • Update the ruby and rails compatibility tables. (bquorning)

5.25.4 (from changelog)

  • 1 bug fix:

    • Fix for must_verify definition if only requiring minitest/mock (but why?).

5.25.3 (from changelog)

  • 5 bug fixes:

    • Fixed assert_mock to fail instead of raise on unmet mock expectations.

    • Fixed assert_mock to take an optional message argument.

    • Fixed formatting of unmet mock expectation messages.

    • Fixed missing must_verify expectation to match assert_mock.

    • minitest/pride: Fixed to use true colors with *-direct terminals (bk2204)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 24 commits:

↗️ concurrent-ruby (indirect, 1.2.3 → 1.3.5) · Repo · Changelog

Release Notes

1.3.5

What's Changed

New Contributors

Full Changelog: v1.3.4...v1.3.5

1.3.4

What's Changed

  • Update comment for JRuby variant of processor_count to reality by @meineerde in #1054
  • Add Concurrent.cpu_requests that is cgroups aware. by @heka1024 in #1058
  • Fix the doc of Concurrent.available_processor_count by @y-yagi in #1059
  • Fix the return value of Concurrent.available_processor_count when cpu.cfs_quota_us is -1 by @y-yagi in #1060

New Contributors

Full Changelog: v1.3.3...v1.3.4

1.3.3

What's Changed

Full Changelog: v1.3.2...v1.3.3

1.3.2

What's Changed

New Contributors

Full Changelog: v1.3.1...v1.3.2

1.3.1

This release is essentially v1.3.0, but with a properly packaged gem. There was an issue publishing v1.3.0 and that gem needed to be yanked to avoid breaking downstream projects. The v1.3.0 changelog is reproduced below.

What's Changed

  • Add Concurrent.usable_processor_count that is cgroups aware by @casperisfine in #1038
  • Align Java Executor Service behavior for shuttingdown?, shutdown? by @bensheldon in #1042

New Contributors

Full Changelog: v1.2.3...v1.3.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 46 commits:

↗️ i18n (indirect, 1.14.1 → 1.14.7) · Repo · Changelog

Release Notes

1.14.7

What's Changed

  • Ruby 3.4 Hash#inspect compatibility. by @voxik in #709
  • Removed (annoying) post-install message that was triggering on all Rubies, rather than the specified versions.

Full Changelog: v1.14.6...v1.14.7

1.14.6

What's Changed

Ruby < 3.2 support will be dropped April 2025. Upgrade now to continue using i18n after that date.

New Contributors

Full Changelog: v1.14.5...v1.14.6

1.14.5

What's Changed

  • Explicitly bundle racc gem for Ruby 3.3+ by @amatsuda in #690
  • Optimize I18n::Locale::Fallbacks#[] for recursive locale mappings by @uiur in #692
  • Add I18n.interpolation_keys by @tom-lord in #682
  • Fix syntax in documentation for I18n::Backend::Base.interpolate by @tom-lord in #691
  • Fix that escaped interpolations with reserved keywords raised ReservedInterpolationKey by @Bilka2 in #688

New Contributors

Full Changelog: v1.14.4...v1.14.5

1.14.4

What's Changed

Note: the racc dependency will be coming back in Version 2.

  • undo strict racc dependency on this branch by @radar in #687

Full Changelog: v1.14.3...v1.14.4

1.14.3

What's Changed

  • Pass options to along to exists? super calls by @radar in #671
  • Improve TOKENIZER by 23% by @kbrock in #668
  • Regex part deux - INTERPOLATION_SYNTAX by @kbrock in #669
  • Raise when translated entry contains interpolations for reserved keywords and no substitutions provided by @fatkodima in #678
  • Implement Fallbacks#inspect and Fallbacks#empty? by @fatkodima in #683

Upkeep

New Contributors

Full Changelog: v1.14.1...v1.14.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 67 commits:

🆕 base64 (added, 0.3.0)

🆕 bigdecimal (added, 3.3.1)

🆕 connection_pool (added, 2.5.4)

🆕 drb (added, 2.2.3)

🆕 json (added, 2.15.2)

🆕 logger (added, 1.7.0)

🆕 securerandom (added, 0.4.1)

🆕 uri (added, 1.0.4)

🗑️ zeitwerk (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Oct 30, 2025
@depfu depfu bot mentioned this pull request Oct 30, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant