From df18d678fd0594a018e5a26e665a0b749e8d687d Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Thu, 24 Jul 2025 17:02:51 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674179 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674176 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674184 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674192 - https://snyk.io/vuln/SNYK-RUBY-RESOLV-10872162 - https://snyk.io/vuln/SNYK-RUBY-THOR-10843853 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674188 --- Gemfile | 20 ++--- Gemfile.lock | 228 ++++++++++++++++++++++++++------------------------- 2 files changed, 126 insertions(+), 122 deletions(-) diff --git a/Gemfile b/Gemfile index 624f97cdb..de67d7d4c 100644 --- a/Gemfile +++ b/Gemfile @@ -1,14 +1,14 @@ source 'https://rubygems.org' -gem 'rails', '= 5.2.6.2' +gem 'rails', '= 5.2.6.3' gem 'mysql2' gem 'puma' gem 'turbolinks', '~> 5' gem 'haml' gem 'nifty-utils' gem 'nilify_blanks' -gem 'kaminari' +gem 'kaminari', '>= 1.2.2' gem 'bcrypt' -gem 'foreman' +gem 'foreman', '>= 0.86.0' gem 'hashie' gem 'authie', '~> 3.0' gem 'dynamic_form' @@ -27,14 +27,14 @@ gem 'gelf' gem 'moonrope' gem 'jwt' gem 'highline', :require => false -gem 'resolv', '~> 0.2.1' -gem 'dotenv-rails' +gem 'resolv', '~> 0.2.3' +gem 'dotenv-rails', '>= 2.8.0' group :development, :assets do - gem 'sass-rails', '~> 5.0' + gem 'sass-rails', '~> 5.0', '>= 5.0.8' gem 'uglifier', '>= 1.3.0' - gem 'coffee-rails', '~> 4.2' - gem 'jquery-rails' + gem 'coffee-rails', '~> 5.0', '>= 5.0.0' + gem 'jquery-rails', '>= 4.3.4' end group :development, :test do @@ -44,7 +44,7 @@ end group :development do gem 'annotate' gem 'rspec' - gem 'rspec-rails' - gem "factory_bot_rails", "~> 4.0" + gem 'rspec-rails', '>= 3.8.1' + gem "factory_bot_rails", "~> 5.0", ">= 5.0.0" gem "database_cleaner" end diff --git a/Gemfile.lock b/Gemfile.lock index 84d2fd9d3..446c843ba 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,43 +9,43 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (5.2.6.2) - actionpack (= 5.2.6.2) + actioncable (5.2.6.3) + actionpack (= 5.2.6.3) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailer (5.2.6.2) - actionpack (= 5.2.6.2) - actionview (= 5.2.6.2) - activejob (= 5.2.6.2) + actionmailer (5.2.6.3) + actionpack (= 5.2.6.3) + actionview (= 5.2.6.3) + activejob (= 5.2.6.3) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.2.6.2) - actionview (= 5.2.6.2) - activesupport (= 5.2.6.2) + actionpack (5.2.6.3) + actionview (= 5.2.6.3) + activesupport (= 5.2.6.3) rack (~> 2.0, >= 2.0.8) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.2.6.2) - activesupport (= 5.2.6.2) + actionview (5.2.6.3) + activesupport (= 5.2.6.3) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) - activejob (5.2.6.2) - activesupport (= 5.2.6.2) + activejob (5.2.6.3) + activesupport (= 5.2.6.3) globalid (>= 0.3.6) - activemodel (5.2.6.2) - activesupport (= 5.2.6.2) - activerecord (5.2.6.2) - activemodel (= 5.2.6.2) - activesupport (= 5.2.6.2) + activemodel (5.2.6.3) + activesupport (= 5.2.6.3) + activerecord (5.2.6.3) + activemodel (= 5.2.6.3) + activesupport (= 5.2.6.3) arel (>= 9.0) - activestorage (5.2.6.2) - actionpack (= 5.2.6.2) - activerecord (= 5.2.6.2) + activestorage (5.2.6.3) + actionpack (= 5.2.6.3) + activerecord (= 5.2.6.3) marcel (~> 1.0.0) - activesupport (5.2.6.2) + activesupport (5.2.6.3) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 0.7, < 2) minitest (~> 5.1) @@ -59,9 +59,10 @@ GEM secure_random_string autoprefixer-rails (9.1.3) execjs + base64 (0.3.0) basic_ssl (1.0.3) bcrypt (3.1.12) - builder (3.2.4) + builder (3.3.0) bunny (2.14.4) amq-protocol (~> 2.3, >= 2.3.0) byebug (10.0.2) @@ -70,73 +71,72 @@ GEM chronic (0.10.2) clockwork (2.0.3) tzinfo - coffee-rails (4.2.2) + coffee-rails (5.0.0) coffee-script (>= 2.2.0) - railties (>= 4.0.0) + railties (>= 5.2.0) coffee-script (2.4.1) coffee-script-source execjs coffee-script-source (1.12.2) - concurrent-ruby (1.1.9) + concurrent-ruby (1.3.5) crass (1.0.6) database_cleaner (1.7.0) deep_merge (1.2.1) - diff-lcs (1.3) - dotenv (2.7.6) - dotenv-rails (2.7.6) - dotenv (= 2.7.6) + diff-lcs (1.6.2) + dotenv (2.8.1) + dotenv-rails (2.8.1) + dotenv (= 2.8.1) railties (>= 3.2) dynamic_form (1.1.4) encrypto_signo (1.0.0) - erubi (1.10.0) - execjs (2.7.0) - factory_bot (4.11.1) - activesupport (>= 3.0.0) - factory_bot_rails (4.11.1) - factory_bot (~> 4.11.1) - railties (>= 3.0.0) + erubi (1.13.1) + execjs (2.10.0) + factory_bot (5.2.0) + activesupport (>= 4.2.0) + factory_bot_rails (5.2.0) + factory_bot (~> 5.2.0) + railties (>= 4.2.0) faraday (0.15.2) multipart-post (>= 1.2, < 3) - ffi (1.15.5) - foreman (0.85.0) - thor (~> 0.19.1) + ffi (1.17.2) + foreman (0.88.1) gelf (3.0.0) json - globalid (1.0.0) + globalid (1.1.0) activesupport (>= 5.0) haml (5.1.2) temple (>= 0.8.0) tilt hashie (3.6.0) highline (2.0.0) - i18n (1.9.1) + i18n (1.14.7) concurrent-ruby (~> 1.0) - jquery-rails (4.3.3) + jquery-rails (4.6.0) rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) json (2.5.1) jwt (2.1.0) - kaminari (1.2.1) + kaminari (1.2.2) activesupport (>= 4.1.0) - kaminari-actionview (= 1.2.1) - kaminari-activerecord (= 1.2.1) - kaminari-core (= 1.2.1) - kaminari-actionview (1.2.1) + kaminari-actionview (= 1.2.2) + kaminari-activerecord (= 1.2.2) + kaminari-core (= 1.2.2) + kaminari-actionview (1.2.2) actionview - kaminari-core (= 1.2.1) - kaminari-activerecord (1.2.1) + kaminari-core (= 1.2.2) + kaminari-activerecord (1.2.2) activerecord - kaminari-core (= 1.2.1) - kaminari-core (1.2.1) - loofah (2.14.0) + kaminari-core (= 1.2.2) + kaminari-core (1.2.2) + loofah (2.24.1) crass (~> 1.0.2) - nokogiri (>= 1.5.9) - marcel (1.0.2) - method_source (1.0.0) - mini_mime (1.1.2) - mini_portile2 (2.7.1) - minitest (5.15.0) + nokogiri (>= 1.12.0) + marcel (1.0.4) + method_source (1.1.0) + mini_mime (1.1.5) + mini_portile2 (2.8.9) + minitest (5.25.5) moonrope (2.0.2) deep_merge (~> 1.0) json @@ -147,58 +147,60 @@ GEM nilify_blanks (1.3.0) activerecord (>= 3.0.0) activesupport (>= 3.0.0) - nio4r (2.5.8) - nokogiri (1.13.1) - mini_portile2 (~> 2.7.0) + nio4r (2.7.4) + nokogiri (1.15.7) + mini_portile2 (~> 2.8.2) racc (~> 1.4) puma (5.6.2) nio4r (~> 2.0) - racc (1.6.0) - rack (2.2.3) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails (5.2.6.2) - actioncable (= 5.2.6.2) - actionmailer (= 5.2.6.2) - actionpack (= 5.2.6.2) - actionview (= 5.2.6.2) - activejob (= 5.2.6.2) - activemodel (= 5.2.6.2) - activerecord (= 5.2.6.2) - activestorage (= 5.2.6.2) - activesupport (= 5.2.6.2) + racc (1.8.1) + rack (2.2.17) + rack-test (2.2.0) + rack (>= 1.3) + rails (5.2.6.3) + actioncable (= 5.2.6.3) + actionmailer (= 5.2.6.3) + actionpack (= 5.2.6.3) + actionview (= 5.2.6.3) + activejob (= 5.2.6.3) + activemodel (= 5.2.6.3) + activerecord (= 5.2.6.3) + activestorage (= 5.2.6.3) + activesupport (= 5.2.6.3) bundler (>= 1.3.0) - railties (= 5.2.6.2) + railties (= 5.2.6.3) sprockets-rails (>= 2.0.0) - rails-dom-testing (2.0.3) - activesupport (>= 4.2.0) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.4.2) - loofah (~> 2.3) - railties (5.2.6.2) - actionpack (= 5.2.6.2) - activesupport (= 5.2.6.2) + rails-html-sanitizer (1.6.2) + loofah (~> 2.21) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) + railties (5.2.6.3) + actionpack (= 5.2.6.3) + activesupport (= 5.2.6.3) method_source rake (>= 0.8.7) thor (>= 0.19.0, < 2.0) rake (12.3.3) - rb-fsevent (0.10.3) - rb-inotify (0.9.10) - ffi (>= 0.5.0, < 2) - resolv (0.2.1) + rb-fsevent (0.11.2) + rb-inotify (0.11.1) + ffi (~> 1.0) + resolv (0.2.3) rspec (3.8.0) rspec-core (~> 3.8.0) rspec-expectations (~> 3.8.0) rspec-mocks (~> 3.8.0) - rspec-core (3.8.0) + rspec-core (3.8.2) rspec-support (~> 3.8.0) - rspec-expectations (3.8.1) + rspec-expectations (3.8.6) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.8.0) - rspec-mocks (3.8.0) + rspec-mocks (3.8.2) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.8.0) - rspec-rails (3.8.0) + rspec-rails (3.8.3) actionpack (>= 3.0) activesupport (>= 3.0) railties (>= 3.0) @@ -206,14 +208,14 @@ GEM rspec-expectations (~> 3.8.0) rspec-mocks (~> 3.8.0) rspec-support (~> 3.8.0) - rspec-support (3.8.0) - sass (3.5.7) + rspec-support (3.8.3) + sass (3.7.4) sass-listen (~> 4.0.0) sass-listen (4.0.0) rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) - sass-rails (5.0.7) - railties (>= 4.0.0, < 6) + sass-rails (5.1.0) + railties (>= 5.2.0) sass (~> 3.1) sprockets (>= 2.8, < 4.0) sprockets-rails (>= 2.0, < 4.0) @@ -222,7 +224,8 @@ GEM secure_random_string (1.0.0) sentry-raven (2.7.4) faraday (>= 0.7.6, < 1.0) - sprockets (3.7.2) + sprockets (3.7.5) + base64 concurrent-ruby (~> 1.0) rack (> 1, < 3) sprockets-rails (3.4.2) @@ -230,17 +233,18 @@ GEM activesupport (>= 5.2) sprockets (>= 3.0.0) temple (0.8.2) - thor (0.19.4) + thor (1.4.0) thread_safe (0.3.6) - tilt (2.0.10) + tilt (2.6.1) turbolinks (5.2.0) turbolinks-source (~> 5.2) turbolinks-source (5.2.0) - tzinfo (1.2.9) + tzinfo (1.2.11) thread_safe (~> 0.1) uglifier (4.1.18) execjs (>= 0.3.0, < 3) - websocket-driver (0.7.5) + websocket-driver (0.8.0) + base64 websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) @@ -258,20 +262,20 @@ DEPENDENCIES changey chronic clockwork - coffee-rails (~> 4.2) + coffee-rails (~> 5.0, >= 5.0.0) database_cleaner - dotenv-rails + dotenv-rails (>= 2.8.0) dynamic_form encrypto_signo - factory_bot_rails (~> 4.0) - foreman + factory_bot_rails (~> 5.0, >= 5.0.0) + foreman (>= 0.86.0) gelf haml hashie highline - jquery-rails + jquery-rails (>= 4.3.4) jwt - kaminari + kaminari (>= 1.2.2) mail! moonrope mysql2 @@ -279,15 +283,15 @@ DEPENDENCIES nilify_blanks nio4r puma - rails (= 5.2.6.2) - resolv (~> 0.2.1) + rails (= 5.2.6.3) + resolv (~> 0.2.3) rspec - rspec-rails - sass-rails (~> 5.0) + rspec-rails (>= 3.8.1) + sass-rails (~> 5.0, >= 5.0.8) secure_headers sentry-raven turbolinks (~> 5) uglifier (>= 1.3.0) BUNDLED WITH - 1.17.2 + 1.17.3