Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependencies #213

Merged
merged 4 commits into from
Jan 9, 2025
Merged

Upgrade dependencies #213

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0142de9
Upgrade dependencies
remi Jan 8, 2025
8008ed4
Ignore CVE-2024-54133
remi Jan 8, 2025
14d8550
Only make `npm audit` fail for critical vulnerabilities
remi Jan 8, 2025
17de059
Merge branch 'main' into update/upgrade-dependencies
remi Jan 8, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .bundler-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
---
ignore:
- CVE-2024-27456 # https://github.com/advisories/GHSA-785g-282q-pwvx (packaging issue with rack-cors)
- CVE-2024-54133 # https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v (We don’t generate CSP from user input)
2 changes: 1 addition & 1 deletion Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ gem 'rack-accept', require: 'rack/accept'
gem 'rack-canonical-host', '1.3.0'
gem 'rack-cors', require: 'rack/cors'
gem 'rack-ssl', require: 'rack/ssl'
gem 'rails', '6.1.7.7'
gem 'rails', '6.1.7.9'
gem 'ranked-model'
gem 'sass-rails', '~> 5.1'
gem 'sentry-rails'
Expand Down
171 changes: 87 additions & 84 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,63 +1,63 @@
GEM
remote: https://rubygems.org/
specs:
actioncable (6.1.7.7)
actionpack (= 6.1.7.7)
activesupport (= 6.1.7.7)
actioncable (6.1.7.9)
actionpack (= 6.1.7.9)
activesupport (= 6.1.7.9)
nio4r (~> 2.0)
websocket-driver (>= 0.6.1)
actionmailbox (6.1.7.7)
actionpack (= 6.1.7.7)
activejob (= 6.1.7.7)
activerecord (= 6.1.7.7)
activestorage (= 6.1.7.7)
activesupport (= 6.1.7.7)
actionmailbox (6.1.7.9)
actionpack (= 6.1.7.9)
activejob (= 6.1.7.9)
activerecord (= 6.1.7.9)
activestorage (= 6.1.7.9)
activesupport (= 6.1.7.9)
mail (>= 2.7.1)
actionmailer (6.1.7.7)
actionpack (= 6.1.7.7)
actionview (= 6.1.7.7)
activejob (= 6.1.7.7)
activesupport (= 6.1.7.7)
actionmailer (6.1.7.9)
actionpack (= 6.1.7.9)
actionview (= 6.1.7.9)
activejob (= 6.1.7.9)
activesupport (= 6.1.7.9)
mail (~> 2.5, >= 2.5.4)
rails-dom-testing (~> 2.0)
actionpack (6.1.7.7)
actionview (= 6.1.7.7)
activesupport (= 6.1.7.7)
actionpack (6.1.7.9)
actionview (= 6.1.7.9)
activesupport (= 6.1.7.9)
rack (~> 2.0, >= 2.0.9)
rack-test (>= 0.6.3)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.0, >= 1.2.0)
actiontext (6.1.7.7)
actionpack (= 6.1.7.7)
activerecord (= 6.1.7.7)
activestorage (= 6.1.7.7)
activesupport (= 6.1.7.7)
actiontext (6.1.7.9)
actionpack (= 6.1.7.9)
activerecord (= 6.1.7.9)
activestorage (= 6.1.7.9)
activesupport (= 6.1.7.9)
nokogiri (>= 1.8.5)
actionview (6.1.7.7)
activesupport (= 6.1.7.7)
actionview (6.1.7.9)
activesupport (= 6.1.7.9)
builder (~> 3.1)
erubi (~> 1.4)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.1, >= 1.2.0)
activejob (6.1.7.7)
activesupport (= 6.1.7.7)
activejob (6.1.7.9)
activesupport (= 6.1.7.9)
globalid (>= 0.3.6)
activemodel (6.1.7.7)
activesupport (= 6.1.7.7)
activerecord (6.1.7.7)
activemodel (= 6.1.7.7)
activesupport (= 6.1.7.7)
activemodel (6.1.7.9)
activesupport (= 6.1.7.9)
activerecord (6.1.7.9)
activemodel (= 6.1.7.9)
activesupport (= 6.1.7.9)
activerecord_json_validator (2.1.5)
activerecord (>= 4.2.0, < 8)
json_schemer (~> 0.2.18)
activestorage (6.1.7.7)
actionpack (= 6.1.7.7)
activejob (= 6.1.7.7)
activerecord (= 6.1.7.7)
activesupport (= 6.1.7.7)
activestorage (6.1.7.9)
actionpack (= 6.1.7.9)
activejob (= 6.1.7.9)
activerecord (= 6.1.7.9)
activesupport (= 6.1.7.9)
marcel (~> 1.0)
mini_mime (>= 1.1.0)
activesupport (6.1.7.7)
activesupport (6.1.7.9)
concurrent-ruby (~> 1.0, >= 1.0.2)
i18n (>= 1.6, < 2)
minitest (>= 5.1)
Expand All @@ -72,6 +72,7 @@ GEM
babel-transpiler (0.7.0)
babel-source (>= 4.0, < 6)
execjs (~> 2.0)
base64 (0.2.0)
bcrypt (3.1.19)
bigdecimal (3.1.7)
blockenspiel (0.5.0)
Expand All @@ -82,21 +83,21 @@ GEM
activemodel (>= 3.0.0)
brakeman (6.1.2)
racc
builder (3.2.4)
builder (3.3.0)
bundler-audit (0.9.1)
bundler (>= 1.2.0, < 3)
thor (~> 1.0)
camaraderie (0.2.1)
activerecord (>= 3.0.0)
activesupport (>= 3.0.0)
cancancan (3.5.0)
concurrent-ruby (1.2.3)
concurrent-ruby (1.3.4)
crass (1.0.6)
database_cleaner-active_record (2.1.0)
activerecord (>= 5.a)
database_cleaner-core (~> 2.0.0)
database_cleaner-core (2.0.1)
date (3.3.4)
date (3.4.1)
devise (4.9.3)
bcrypt (~> 3.0)
orm_adapter (~> 0.1)
Expand All @@ -106,7 +107,7 @@ GEM
diff-lcs (1.5.1)
ecma-re-validator (0.4.0)
regexp_parser (~> 2.2)
erubi (1.12.0)
erubi (1.13.1)
execjs (2.8.1)
factory_bot (6.4.5)
activesupport (>= 5.0.0)
Expand All @@ -121,7 +122,7 @@ GEM
globalid (1.2.1)
activesupport (>= 6.1)
hana (1.3.7)
i18n (1.14.4)
i18n (1.14.6)
concurrent-ruby (~> 1.0)
jquery-turbolinks (2.1.0)
railties (>= 3.1.0)
Expand All @@ -134,33 +135,33 @@ GEM
simpleidn (~> 0.2)
uri_template (~> 0.7)
language_server-protocol (3.17.0.3)
loofah (2.22.0)
loofah (2.24.0)
crass (~> 1.0.2)
nokogiri (>= 1.12.0)
mail (2.8.1)
mini_mime (>= 0.1.1)
net-imap
net-pop
net-smtp
marcel (1.0.2)
method_source (1.0.0)
marcel (1.0.4)
method_source (1.1.0)
mini_check (0.3.0)
json
mini_mime (1.1.5)
mini_portile2 (2.8.5)
minitest (5.22.3)
mini_portile2 (2.8.8)
minitest (5.25.4)
msgpack (1.7.2)
net-imap (0.4.10)
net-imap (0.5.5)
date
net-protocol
net-pop (0.1.2)
net-protocol
net-protocol (0.2.2)
timeout
net-smtp (0.4.0.1)
net-smtp (0.5.0)
net-protocol
nio4r (2.7.0)
nokogiri (1.16.3)
nio4r (2.7.4)
nokogiri (1.18.1)
mini_portile2 (~> 2.8.2)
racc (~> 1.4)
orm_adapter (0.5.0)
Expand All @@ -173,10 +174,10 @@ GEM
racc
pg (1.5.6)
public_suffix (5.0.4)
puma (6.4.2)
puma (6.5.0)
nio4r (~> 2.0)
racc (1.7.3)
rack (2.2.9)
racc (1.8.1)
rack (2.2.10)
rack-accept (0.4.5)
rack (>= 0.4)
rack-canonical-host (1.3.0)
Expand All @@ -186,43 +187,43 @@ GEM
rack (>= 2.0.0)
rack-ssl (1.4.1)
rack
rack-test (2.1.0)
rack-test (2.2.0)
rack (>= 1.3)
rails (6.1.7.7)
actioncable (= 6.1.7.7)
actionmailbox (= 6.1.7.7)
actionmailer (= 6.1.7.7)
actionpack (= 6.1.7.7)
actiontext (= 6.1.7.7)
actionview (= 6.1.7.7)
activejob (= 6.1.7.7)
activemodel (= 6.1.7.7)
activerecord (= 6.1.7.7)
activestorage (= 6.1.7.7)
activesupport (= 6.1.7.7)
rails (6.1.7.9)
actioncable (= 6.1.7.9)
actionmailbox (= 6.1.7.9)
actionmailer (= 6.1.7.9)
actionpack (= 6.1.7.9)
actiontext (= 6.1.7.9)
actionview (= 6.1.7.9)
activejob (= 6.1.7.9)
activemodel (= 6.1.7.9)
activerecord (= 6.1.7.9)
activestorage (= 6.1.7.9)
activesupport (= 6.1.7.9)
bundler (>= 1.15.0)
railties (= 6.1.7.7)
railties (= 6.1.7.9)
sprockets-rails (>= 2.0.0)
rails-dom-testing (2.2.0)
activesupport (>= 5.0.0)
minitest
nokogiri (>= 1.6)
rails-html-sanitizer (1.6.0)
rails-html-sanitizer (1.6.2)
loofah (~> 2.21)
nokogiri (~> 1.14)
nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
rails_12factor (0.0.3)
rails_serve_static_assets
rails_stdout_logging
rails_serve_static_assets (0.0.5)
rails_stdout_logging (0.0.3)
railties (6.1.7.7)
actionpack (= 6.1.7.7)
activesupport (= 6.1.7.7)
railties (6.1.7.9)
actionpack (= 6.1.7.9)
activesupport (= 6.1.7.9)
method_source
rake (>= 12.2)
thor (~> 1.0)
rainbow (3.1.1)
rake (13.1.0)
rake (13.2.1)
ranked-model (0.4.9)
activerecord (>= 5.2)
regexp_parser (2.9.0)
Expand All @@ -231,7 +232,7 @@ GEM
responders (3.1.1)
actionpack (>= 5.2)
railties (>= 5.2)
rexml (3.2.6)
rexml (3.4.0)
rspec-core (3.13.0)
rspec-support (~> 3.13.0)
rspec-expectations (3.13.0)
Expand Down Expand Up @@ -286,20 +287,21 @@ GEM
spring (4.1.3)
spring-commands-rspec (1.0.4)
spring (>= 0.9.1)
sprockets (3.7.2)
sprockets (3.7.5)
base64
concurrent-ruby (~> 1.0)
rack (> 1, < 3)
sprockets-es6 (0.9.2)
babel-source (>= 5.8.11)
babel-transpiler
sprockets (>= 3.0.0)
sprockets-rails (3.4.2)
actionpack (>= 5.2)
activesupport (>= 5.2)
sprockets-rails (3.5.2)
actionpack (>= 6.1)
activesupport (>= 6.1)
sprockets (>= 3.0.0)
thor (1.3.1)
thor (1.3.2)
tilt (2.0.10)
timeout (0.4.1)
timeout (0.4.3)
turbolinks (5.2.1)
turbolinks-source (~> 5.2)
turbolinks-source (5.2.0)
Expand All @@ -316,10 +318,11 @@ GEM
blockenspiel (~> 0.5)
warden (1.2.9)
rack (>= 2.0.9)
websocket-driver (0.7.6)
websocket-driver (0.7.7)
base64
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
zeitwerk (2.6.13)
zeitwerk (2.7.1)

PLATFORMS
ruby
Expand Down Expand Up @@ -349,7 +352,7 @@ DEPENDENCIES
rack-canonical-host (= 1.3.0)
rack-cors
rack-ssl
rails (= 6.1.7.7)
rails (= 6.1.7.9)
rails_12factor
ranked-model
rspec-rails (~> 6.1)
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ check: check-dependencies-security check-code-security
.PHONY: check-dependencies-security
check-dependencies-security:
bundle exec bundle-audit check --update
npm audit --production
npm audit --production --audit-level=critical

.PHONY: check-code-security
check-code-security:
Expand Down
Loading