🚨 [security] Update activesupport 6.1.4.4 → 8.1.1 (major) #109

depfu · 2025-10-30T04:55:11Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ activesupport (6.1.4.4 → 8.1.1) · Repo · Changelog

Security Advisories 🚨

🚨 Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:
$ umask 0077

🚨 Active Support Possibly Discloses Locally Encrypted Files

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:
$ umask 0077

🚨 Possible XSS Security Vulnerability in SafeBuffer#bytesplice

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

🚨 Possible XSS Security Vulnerability in SafeBuffer#bytesplice

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

🚨 ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1
Impact

A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.

All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.

Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 6.1 series
7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 7.0 series
Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

🚨 ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1
Impact

A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.

All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.

Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 6.1 series
7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 7.0 series
Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by 33 commits:

✳️ minitest (5.15.0 → 5.26.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.1.9 → 1.3.5) · Repo · Changelog

Release Notes

1.3.5

What's Changed

Remove dependency on logger by @eregon in #1062

Avoid error when member is present on ancestor class by @francesmcmullin in #1068

Set rake-compiler source and target to Java 8 by @headius in #1071

chore: fix typos by @chenrui333 in #1076

New Contributors

@francesmcmullin made their first contribution in #1068

@chenrui333 made their first contribution in #1076

Full Changelog: v1.3.4...v1.3.5

1.3.4

What's Changed

Update comment for JRuby variant of processor_count to reality by @meineerde in #1054

Add Concurrent.cpu_requests that is cgroups aware. by @heka1024 in #1058

Fix the doc of Concurrent.available_processor_count by @y-yagi in #1059

Fix the return value of Concurrent.available_processor_count when cpu.cfs_quota_us is -1 by @y-yagi in #1060

New Contributors

@heka1024 made their first contribution in #1058

@y-yagi made their first contribution in #1059

Full Changelog: v1.3.3...v1.3.4

1.3.3

What's Changed

Improve speed for windows Get-CimInstance by @Earlopain in #1053

Full Changelog: v1.3.2...v1.3.3

1.3.2

What's Changed

Fix method name in CHANGELOG.md by @nertzy in #1049

Remove dependency on win32ole by @Earlopain in #1051

New Contributors

@nertzy made their first contribution in #1049

@Earlopain made their first contribution in #1051

Full Changelog: v1.3.1...v1.3.2

1.3.1

This release is essentially v1.3.0, but with a properly packaged gem. There was an issue publishing v1.3.0 and that gem needed to be yanked to avoid breaking downstream projects. The v1.3.0 changelog is reproduced below.

What's Changed

Add Concurrent.usable_processor_count that is cgroups aware by @casperisfine in #1038

Align Java Executor Service behavior for shuttingdown?, shutdown? by @bensheldon in #1042

New Contributors

@dependabot made their first contribution in #1028

@kkohrt made their first contribution in #1037

Full Changelog: v1.2.3...v1.3.1

1.2.3

What's Changed

Fix TimerTask :execution_interval docs by @freemanoid in #994

Fix TimerTask docs to not refer to #execute as "blocking" by @bensheldon in #996

Fix TimerTask example output by @bensheldon in #1003

Fix broken CI due to rake-compiler error on Ruby < 2.6 by @mattbrictson in #1007

Fix doc typo: yeild → yield by @mattbrictson in #1006

Fix DaemonThreadFactory - reuse single Java thread factory by @obulkin in #1009

Fix sporadic failures testing with JRuby by @headius in #1012

Allow TimerSet to safely handle an executor raising RejectedExecutionError by @bensheldon in #999

Use executor from arg in then_on/rescue_on/chain_on for Promises by @tgwizard in #1005

Allow TimerTask to be initialized with a specified Executor by @bensheldon in #1000

Create method ThreadPoolExecutor#active_count to expose the number of threads that are actively executing tasks by @bensheldon in #1002

Drop dependency on mutex_m by @casperisfine in #1013

Fix compile error on FreeBSD 14 by @janbiedermann in #1014

Fix spurious return in Promises#wait_until_resolved by @eregon in #1016

Remove AtomicReferenceMapBackend and CheapLockable by @eregon in #1018

Add Ruby 3.3 in CI by @eregon in #1021

docs: fix typo in throttle docs by @G-Rath in #1024

docs: update promises grammar by @G-Rath in #1026

Add TimerTask#interval_type option to configure interval calculation by @bensheldon in #997

New Contributors

@freemanoid made their first contribution in #994

@bensheldon made their first contribution in #996

@mattbrictson made their first contribution in #1007

@obulkin made their first contribution in #1009

@headius made their first contribution in #1012

@tgwizard made their first contribution in #1005

@janbiedermann made their first contribution in #1014

@G-Rath made their first contribution in #1024

Full Changelog: v1.2.2...v1.2.3

1.2.2

concurrent-ruby 1.2.2:

(#993) Fix arguments passed to Concurrent::Map's default_proc.

1.2.1

concurrent-ruby 1.2.1:

(#990) Add missing require 'fiber' for FiberLocalVar.

(#989) Optimize Concurrent::Map#[] on CRuby by letting the backing Hash handle the default_proc.

1.2.0

concurrent-ruby 1.2.0:

(#975) Set the Ruby compatibility version at 2.3

(#962) Fix ReentrantReadWriteLock to use the same granularity for locals as for Mutex it uses.

(#983) Add FiberLocalVar

(#934) concurrent-ruby now supports requiring individual classes (public classes listed in the docs), e.g., require 'concurrent/map'

(#976) Let Promises.any_fulfilled_future take an Event

Improve documentation of various classes

(#972) Remove Rubinius-related code

concurrent-ruby-edge 0.7.0:

(#975) Set the Ruby compatibility version at 2.3

(#934) concurrent-ruby now supports requiring individual classes (public classes listed in the docs), e.g., require 'concurrent/map'

(#972) Remove Rubinius-related code

1.1.10

concurrent-ruby:

(#951) Set the Ruby compatibility version at 2.2

(#939, #933) The caller_runs fallback policy no longer blocks reads from the job queue by worker threads

(#938, #761, #652) You can now explicitly prune_pool a thread pool (Sylvain Joyeux)

(#937, #757, #670) We switched the Yahoo stock API for demos to Alpha Vantage (Gustavo Caso)

(#932, #931) We changed how SafeTaskExecutor handles local jump errors (Aaron Jensen)

(#927) You can use keyword arguments in your initialize when using Async (Matt Larraz)

(#926, #639) We removed timeout from TimerTask because it wasn't sound, and now it's a no-op with a warning (Jacob Atzen)

(#919) If you double-lock a re-entrant read-write lock, we promote to locked for writing (zp yuan)

(#915) monotonic_time now accepts an optional unit parameter, as Ruby's clock_gettime (Jean Boussier)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.8.11 → 1.14.7) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ tzinfo (indirect, 2.0.4 → 2.0.6) · Repo · Changelog

Release Notes

2.0.6

Eliminate Object#untaint deprecation warnings on JRuby 9.4.0.0. #145.

TZInfo v2.0.6 on RubyGems.org

2.0.5

Changed DateTime results to always use the proleptic Gregorian calendar. This affects DateTime results prior to 1582-10-15 and any arithmetic performed on the results that would produce a secondary result prior to 1582-10-15.

Added support for eager loading all the time zone and country data by calling either TZInfo::DataSource#eager_load! or TZInfo.eager_load!. Compatible with Ruby On Rails' eager_load_namespaces. #129.

Ignore the SECURITY file from Arch Linux's tzdata package. #134.

TZInfo v2.0.5 on RubyGems.org

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 39 commits:

🆕 base64 (added, 0.3.0)

🆕 bigdecimal (added, 3.3.1)

🆕 connection_pool (added, 2.5.4)

🆕 drb (added, 2.2.3)

🆕 json (added, 2.15.2)

🆕 logger (added, 1.7.0)

🆕 securerandom (added, 0.4.1)

🆕 uri (added, 1.0.4)

🗑️ zeitwerk (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Update all of rails to version 8.1.1

e56570d

depfu bot added the depfu label Oct 30, 2025

depfu bot mentioned this pull request Oct 30, 2025

🚨 [security] Update activesupport 6.1.4.4 → 8.1.0 (major) #108

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

🚨 [security] Update activesupport 6.1.4.4 → 8.1.1 (major) #109

🚨 [security] Update activesupport 6.1.4.4 → 8.1.1 (major) #109

Uh oh!

depfu bot commented Oct 30, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

🚨 [security] Update activesupport 6.1.4.4 → 8.1.1 (major) #109

Are you sure you want to change the base?

🚨 [security] Update activesupport 6.1.4.4 → 8.1.1 (major) #109

Uh oh!

Conversation

depfu bot commented Oct 30, 2025

What changed?

✳️ activesupport (6.1.4.4 → 8.1.1) · Repo · Changelog

Impact

Releases

Workarounds

Impact

Releases

Workarounds

Impact

Workarounds

Impact

Workarounds

✳️ minitest (5.15.0 → 5.26.0) · Repo · Changelog

↗️ concurrent-ruby (indirect, 1.1.9 → 1.3.5) · Repo · Changelog

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

↗️ i18n (indirect, 1.8.11 → 1.14.7) · Repo · Changelog

↗️ tzinfo (indirect, 2.0.4 → 2.0.6) · Repo · Changelog

🆕 base64 (added, 0.3.0)

🆕 bigdecimal (added, 3.3.1)

🆕 connection_pool (added, 2.5.4)

🆕 drb (added, 2.2.3)

🆕 json (added, 2.15.2)

🆕 logger (added, 1.7.0)

🆕 securerandom (added, 0.4.1)

🆕 uri (added, 1.0.4)

🗑️ zeitwerk (removed)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant