From f64c8d41808a34cf820f0ae46c27adcb9fd9c224 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Sat, 26 Jul 2025 10:26:13 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674179 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674176 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674184 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674192 - https://snyk.io/vuln/SNYK-RUBY-THOR-10843853 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674188 --- Gemfile | 10 +-- Gemfile.lock | 219 ++++++++++++++++++++++++++++----------------------- 2 files changed, 125 insertions(+), 104 deletions(-) diff --git a/Gemfile b/Gemfile index 9a53cb2..84488d1 100644 --- a/Gemfile +++ b/Gemfile @@ -1,17 +1,17 @@ source 'https://rubygems.org' -gem 'active_model_serializers', '0.10.5' +gem 'active_model_serializers', '0.10.6' gem 'algorithmia' gem 'bcrypt', '~> 3.1.7' gem 'bunny' gem 'carrierwave' gem 'cloudinary' gem 'dalli' -gem 'devise' +gem 'devise', '>= 4.4.0' gem 'elasticsearch', '5.0.4' gem 'gemoji-parser' gem 'google-cloud-language' -gem 'kaminari' +gem 'kaminari', '>= 1.1.0' gem 'mongoid' gem 'newrelic_rpm' gem 'oj' @@ -20,12 +20,12 @@ gem 'omniauth-google-oauth2' gem 'pg', '~> 0.18.3' gem 'puma' gem 'rack-cors', require: 'rack/cors' -gem 'rails', '~> 5.1.1' +gem 'rails', '~> 5.1.2' gem 'rails_autoscale_agent' gem 'redis', '~> 3.0' gem 'redis-namespace' gem 'rubocop' -gem 'sanitize' +gem 'sanitize', '>= 4.6.0' gem 'scout_apm' gem 'searchkick' gem 'sidekiq' diff --git a/Gemfile.lock b/Gemfile.lock index eb4b42d..6f267df 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,46 +1,46 @@ GEM remote: https://rubygems.org/ specs: - actioncable (5.1.1) - actionpack (= 5.1.1) + actioncable (5.1.7) + actionpack (= 5.1.7) nio4r (~> 2.0) websocket-driver (~> 0.6.1) - actionmailer (5.1.1) - actionpack (= 5.1.1) - actionview (= 5.1.1) - activejob (= 5.1.1) + actionmailer (5.1.7) + actionpack (= 5.1.7) + actionview (= 5.1.7) + activejob (= 5.1.7) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.1.1) - actionview (= 5.1.1) - activesupport (= 5.1.1) + actionpack (5.1.7) + actionview (= 5.1.7) + activesupport (= 5.1.7) rack (~> 2.0) - rack-test (~> 0.6.3) + rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.1.1) - activesupport (= 5.1.1) + actionview (5.1.7) + activesupport (= 5.1.7) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) - active_model_serializers (0.10.5) + active_model_serializers (0.10.6) actionpack (>= 4.1, < 6) activemodel (>= 4.1, < 6) case_transform (>= 0.2) jsonapi-renderer (>= 0.1.1.beta1, < 0.2) - activejob (5.1.1) - activesupport (= 5.1.1) + activejob (5.1.7) + activesupport (= 5.1.7) globalid (>= 0.3.6) - activemodel (5.1.1) - activesupport (= 5.1.1) - activerecord (5.1.1) - activemodel (= 5.1.1) - activesupport (= 5.1.1) + activemodel (5.1.7) + activesupport (= 5.1.7) + activerecord (5.1.7) + activemodel (= 5.1.7) + activesupport (= 5.1.7) arel (~> 8.0) - activesupport (5.1.1) + activesupport (5.1.7) concurrent-ruby (~> 1.0, >= 1.0.2) - i18n (~> 0.7) + i18n (>= 0.7, < 2) minitest (~> 5.1) tzinfo (~> 1.1) addressable (2.5.1) @@ -52,10 +52,10 @@ GEM arel (8.0.0) ast (2.3.0) aws_cf_signer (0.1.3) - bcrypt (3.1.11) + bcrypt (3.1.20) brakeman (3.7.0) bson (4.2.1) - builder (3.2.3) + builder (3.3.0) bullet (5.5.1) activesupport (>= 3.0.0) uniform_notifier (~> 1.10.0) @@ -71,14 +71,15 @@ GEM cloudinary (1.8.1) aws_cf_signer rest-client - concurrent-ruby (1.0.5) + concurrent-ruby (1.3.5) connection_pool (2.2.1) - crass (1.0.2) + crass (1.0.6) dalli (2.7.6) - devise (4.3.0) + date (3.4.1) + devise (4.9.4) bcrypt (~> 3.0) orm_adapter (~> 0.1) - railties (>= 4.1.0, < 5.2) + railties (>= 4.1.0) responders warden (~> 1.2.3) domain_name (0.5.20170404) @@ -91,7 +92,7 @@ GEM elasticsearch-transport (5.0.4) faraday multi_json - erubi (1.6.0) + erubi (1.13.1) ethon (0.10.1) ffi (>= 1.3.0) faraday (0.12.1) @@ -100,8 +101,8 @@ GEM gemoji (3.0.0) gemoji-parser (1.3.1) gemoji (>= 2.1.0) - globalid (0.4.0) - activesupport (>= 4.2.0) + globalid (1.1.0) + activesupport (>= 5.0) google-cloud-core (1.0.0) google-cloud-env (~> 1.0) googleauth (~> 0.5.1) @@ -136,41 +137,49 @@ GEM domain_name (~> 0.5) httparty (0.15.6) multi_xml (>= 0.5.2) - i18n (0.8.4) + i18n (1.14.7) + concurrent-ruby (~> 1.0) json (1.8.6) - jsonapi-renderer (0.1.2) + jsonapi-renderer (0.1.3) jwt (1.5.6) - kaminari (1.0.1) + kaminari (1.2.2) activesupport (>= 4.1.0) - kaminari-actionview (= 1.0.1) - kaminari-activerecord (= 1.0.1) - kaminari-core (= 1.0.1) - kaminari-actionview (1.0.1) + kaminari-actionview (= 1.2.2) + kaminari-activerecord (= 1.2.2) + kaminari-core (= 1.2.2) + kaminari-actionview (1.2.2) actionview - kaminari-core (= 1.0.1) - kaminari-activerecord (1.0.1) + kaminari-core (= 1.2.2) + kaminari-activerecord (1.2.2) activerecord - kaminari-core (= 1.0.1) - kaminari-core (1.0.1) + kaminari-core (= 1.2.2) + kaminari-core (1.2.2) listen (3.1.5) rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) ruby_dep (~> 1.2) little-plugger (1.1.4) + logger (1.7.0) logging (2.2.2) little-plugger (~> 1.1) multi_json (~> 1.10) - loofah (2.0.3) - nokogiri (>= 1.5.9) - mail (2.6.6) - mime-types (>= 1.16, < 4) + loofah (2.24.1) + crass (~> 1.0.2) + nokogiri (>= 1.12.0) + mail (2.8.1) + mini_mime (>= 0.1.1) + net-imap + net-pop + net-smtp memoist (0.16.0) - method_source (0.8.2) - mime-types (3.1) - mime-types-data (~> 3.2015) - mime-types-data (3.2016.0521) - mini_portile2 (2.2.0) - minitest (5.10.2) + method_source (1.1.0) + mime-types (3.7.0) + logger + mime-types-data (~> 3.2025, >= 3.2025.0507) + mime-types-data (3.2025.0722) + mini_mime (1.1.5) + mini_portile2 (2.8.9) + minitest (5.25.5) mongo (2.4.2) bson (>= 4.2.1, < 5.0.0) mongoid (6.2.0) @@ -180,13 +189,21 @@ GEM multi_xml (0.6.0) multipart-post (2.0.0) mustermann (1.0.0) + net-imap (0.4.22) + date + net-protocol + net-pop (0.1.2) + net-protocol + net-protocol (0.2.2) + timeout + net-smtp (0.5.1) + net-protocol netrc (0.11.0) newrelic_rpm (4.2.0.334) - nio4r (2.1.0) - nokogiri (1.8.0) - mini_portile2 (~> 2.2.0) - nokogumbo (1.4.13) - nokogiri + nio4r (2.7.4) + nokogiri (1.15.7) + mini_portile2 (~> 2.8.2) + racc (~> 1.4) oauth2 (1.4.0) faraday (>= 0.8, < 0.13) jwt (~> 1.0) @@ -216,49 +233,52 @@ GEM powerpack (0.1.1) public_suffix (2.0.5) puma (3.9.1) - rack (2.0.3) + racc (1.8.1) + rack (2.2.17) rack-cors (0.4.1) rack-protection (2.0.0) rack - rack-test (0.6.3) - rack (>= 1.0) - rails (5.1.1) - actioncable (= 5.1.1) - actionmailer (= 5.1.1) - actionpack (= 5.1.1) - actionview (= 5.1.1) - activejob (= 5.1.1) - activemodel (= 5.1.1) - activerecord (= 5.1.1) - activesupport (= 5.1.1) - bundler (>= 1.3.0, < 2.0) - railties (= 5.1.1) + rack-test (2.2.0) + rack (>= 1.3) + rails (5.1.7) + actioncable (= 5.1.7) + actionmailer (= 5.1.7) + actionpack (= 5.1.7) + actionview (= 5.1.7) + activejob (= 5.1.7) + activemodel (= 5.1.7) + activerecord (= 5.1.7) + activesupport (= 5.1.7) + bundler (>= 1.3.0) + railties (= 5.1.7) sprockets-rails (>= 2.0.0) - rails-dom-testing (2.0.3) - activesupport (>= 4.2.0) + rails-dom-testing (2.3.0) + activesupport (>= 5.0.0) + minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.0.3) - loofah (~> 2.0) + rails-html-sanitizer (1.6.2) + loofah (~> 2.21) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rails_autoscale_agent (0.3.0) activesupport (>= 3.2) - railties (5.1.1) - actionpack (= 5.1.1) - activesupport (= 5.1.1) + railties (5.1.7) + actionpack (= 5.1.7) + activesupport (= 5.1.7) method_source rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) rainbow (2.2.2) rake - rake (12.0.0) + rake (13.3.0) rb-fsevent (0.9.8) rb-inotify (0.9.8) ffi (>= 0.5.0) redis (3.3.3) redis-namespace (1.5.3) redis (~> 3.0, >= 3.0.4) - responders (2.4.0) - actionpack (>= 4.2.0, < 5.3) - railties (>= 4.2.0, < 5.3) + responders (3.0.1) + actionpack (>= 5.0) + railties (>= 5.0) rest-client (2.0.2) http-cookie (>= 1.0.2, < 2.0) mime-types (>= 1.16, < 4.0) @@ -273,10 +293,9 @@ GEM unicode-display_width (~> 1.0, >= 1.0.1) ruby-progressbar (1.8.1) ruby_dep (1.5.0) - sanitize (4.5.0) + sanitize (6.1.3) crass (~> 1.0.2) - nokogiri (>= 1.4.4) - nokogumbo (~> 1.4.1) + nokogiri (>= 1.12.0) scout_apm (2.1.28) searchkick (2.3.1) activemodel (>= 4.1) @@ -302,36 +321,38 @@ GEM spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) - sprockets (3.7.1) + sprockets (4.2.2) concurrent-ruby (~> 1.0) - rack (> 1, < 3) - sprockets-rails (3.2.0) + logger + rack (>= 2.2.4, < 4) + sprockets-rails (3.2.2) actionpack (>= 4.0) activesupport (>= 4.0) sprockets (>= 3.0.0) - thor (0.19.4) + thor (1.4.0) thread_safe (0.3.6) tilt (2.0.7) + timeout (0.4.3) typhoeus (1.1.2) ethon (>= 0.9.0) - tzinfo (1.2.3) + tzinfo (1.2.11) thread_safe (~> 0.1) unf (0.1.4) unf_ext unf_ext (0.0.7.4) unicode-display_width (1.2.1) uniform_notifier (1.10.0) - warden (1.2.7) - rack (>= 1.0) + warden (1.2.9) + rack (>= 2.0.9) websocket-driver (0.6.5) websocket-extensions (>= 0.1.0) - websocket-extensions (0.1.2) + websocket-extensions (0.1.5) PLATFORMS ruby DEPENDENCIES - active_model_serializers (= 0.10.5) + active_model_serializers (= 0.10.6) algorithmia bcrypt (~> 3.1.7) brakeman @@ -341,11 +362,11 @@ DEPENDENCIES carrierwave cloudinary dalli - devise + devise (>= 4.4.0) elasticsearch (= 5.0.4) gemoji-parser google-cloud-language - kaminari + kaminari (>= 1.1.0) listen (>= 3.0.5, < 3.2) mongoid newrelic_rpm @@ -355,12 +376,12 @@ DEPENDENCIES pg (~> 0.18.3) puma rack-cors - rails (~> 5.1.1) + rails (~> 5.1.2) rails_autoscale_agent redis (~> 3.0) redis-namespace rubocop - sanitize + sanitize (>= 4.6.0) scout_apm searchkick sidekiq @@ -371,4 +392,4 @@ DEPENDENCIES tzinfo-data BUNDLED WITH - 1.15.2 + 1.17.3