From 2d869ab248988534e7dde584bf9f63e2ccc66225 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Sun, 5 Oct 2025 10:06:02 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-7164639 - https://snyk.io/vuln/SNYK-RUBY-RACK-13052974 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-8732769 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-8732779 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674179 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674176 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674184 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674192 - https://snyk.io/vuln/SNYK-RUBY-RACK-10074187 - https://snyk.io/vuln/SNYK-RUBY-RACK-9398129 - https://snyk.io/vuln/SNYK-RUBY-REXML-13110060 - https://snyk.io/vuln/SNYK-RUBY-WEBRICK-10500756 - https://snyk.io/vuln/SNYK-RUBY-RACK-1061917 - https://snyk.io/vuln/SNYK-RUBY-WEBRICK-8068535 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-9510795 - https://snyk.io/vuln/SNYK-RUBY-RACK-8720151 - https://snyk.io/vuln/SNYK-RUBY-THOR-10843853 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-8220162 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-8220268 - https://snyk.io/vuln/SNYK-RUBY-RACK-9058602 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-7210237 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-9510789 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-9789079 - https://snyk.io/vuln/SNYK-RUBY-RACK-10074188 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-8454495 - https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-8496389 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-8453714 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-8447886 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-8448218 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-8448407 - https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-8448516 - https://snyk.io/vuln/SNYK-RUBY-NOKOGIRI-10674188 --- Gemfile | 14 ++--- Gemfile.lock | 156 ++++++++++++++++++++++++++++----------------------- 2 files changed, 92 insertions(+), 78 deletions(-) diff --git a/Gemfile b/Gemfile index 35b9ee91db3d8b..fdf5478e82bab9 100644 --- a/Gemfile +++ b/Gemfile @@ -12,7 +12,7 @@ gem 'rack', '~> 2.2.7' # For why irb is in the Gemfile, see: https://ruby.social/@st0012/111444685161478182 gem 'irb', '~> 1.8' -gem 'haml-rails', '~>2.0' +gem 'haml-rails', '~> 3.0', '>= 3.0.0' gem 'pg', '~> 1.5' gem 'pghero' gem 'dotenv-rails', '~> 2.8' @@ -146,11 +146,11 @@ end group :development do # Code linting CLI and plugins - gem 'rubocop', require: false - gem 'rubocop-capybara', require: false - gem 'rubocop-performance', require: false - gem 'rubocop-rails', require: false - gem 'rubocop-rspec', require: false + gem 'rubocop', '>= 1.66.0', require: false + gem 'rubocop-capybara', '>= 2.21.0', require: false + gem 'rubocop-performance', '>= 1.21.0', require: false + gem 'rubocop-rails', '>= 2.25.0', require: false + gem 'rubocop-rspec', '>= 2.28.0', require: false # Annotates modules with schema gem 'annotate', '~> 3.2' @@ -168,7 +168,7 @@ group :development do gem 'bundler-audit', '~> 0.9', require: false # Linter CLI for HAML files - gem 'haml_lint', require: false + gem 'haml_lint', '>= 0.58.0', require: false # Validate missing i18n keys gem 'i18n-tasks', '~> 1.0', require: false diff --git a/Gemfile.lock b/Gemfile.lock index 5464dbef705eff..07445ddeadd63a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -96,7 +96,7 @@ GEM annotate (3.2.0) activerecord (>= 3.2, < 8.0) rake (>= 10.4, < 14.0) - ast (2.4.2) + ast (2.4.3) attr_encrypted (4.0.0) encryptor (~> 3.0.0) attr_required (1.0.2) @@ -125,7 +125,7 @@ GEM faraday_middleware (~> 1.0, >= 1.0.0.rc1) net-http-persistent (~> 4.0) nokogiri (~> 1, >= 1.10.8) - base64 (0.2.0) + base64 (0.3.0) bcp47_spec (0.2.1) bcrypt (3.1.20) better_errors (2.10.1) @@ -139,7 +139,7 @@ GEM erubi (~> 1.4) parser (>= 2.4) smart_properties - bigdecimal (3.1.7) + bigdecimal (3.2.3) bindata (2.5.0) binding_of_caller (1.0.1) debug_inspector (>= 1.2.0) @@ -152,7 +152,7 @@ GEM brpoplpush-redis_script (0.1.3) concurrent-ruby (~> 1.0, >= 1.0.5) redis (>= 1.0, < 6) - builder (3.2.4) + builder (3.3.0) bundler-audit (0.9.1) bundler (>= 1.2.0, < 3) thor (~> 1.0) @@ -168,6 +168,7 @@ GEM case_transform (0.2) activesupport cbor (0.5.9.8) + cgi (0.5.0) charlock_holmes (0.7.7) chewy (7.5.1) activesupport (>= 5.2) @@ -177,8 +178,8 @@ GEM climate_control (1.2.0) cocoon (1.2.15) color_diff (0.1) - concurrent-ruby (1.2.3) - connection_pool (2.4.1) + concurrent-ruby (1.3.5) + connection_pool (2.5.4) cose (1.3.0) cbor (~> 0.5.9) openssl-signature_algorithm (~> 1.0) @@ -224,7 +225,7 @@ GEM dotenv-rails (2.8.1) dotenv (= 2.8.1) railties (>= 3.2) - drb (2.2.1) + drb (2.2.3) ed25519 (1.3.0) elasticsearch (7.13.3) elasticsearch-api (= 7.13.3) @@ -240,7 +241,9 @@ GEM launchy (~> 2.1) mail (~> 2.7) encryptor (3.0.0) - erubi (1.12.0) + erb (4.0.4) + cgi (>= 0.3.3) + erubi (1.13.1) et-orbi (1.2.10) tzinfo excon (0.110.0) @@ -302,12 +305,12 @@ GEM temple (>= 0.8.2) thor tilt - haml-rails (2.1.0) + haml-rails (3.0.0) actionpack (>= 5.1) activesupport (>= 5.1) haml (>= 4.0.6) railties (>= 5.1) - haml_lint (0.57.0) + haml_lint (0.66.0) haml (>= 5.0) parallel (~> 1.10) rainbow @@ -351,12 +354,13 @@ GEM inline_svg (1.9.0) activesupport (>= 3.0) nokogiri (>= 1.6) - io-console (0.7.2) - irb (1.12.0) - rdoc + io-console (0.8.1) + irb (1.15.2) + pp (>= 0.6.0) + rdoc (>= 4.0.0) reline (>= 0.4.2) jmespath (1.6.2) - json (2.7.1) + json (2.15.0) json-canonicalization (1.0.0) json-jwt (1.15.3.1) activesupport (>= 4.2) @@ -395,7 +399,7 @@ GEM marcel (~> 1.0.1) mime-types terrapin (>= 0.6.0, < 2.0) - language_server-protocol (3.17.0.3) + language_server-protocol (3.17.0.5) launchy (2.5.2) addressable (~> 2.8) letter_opener (1.8.1) @@ -406,6 +410,7 @@ GEM railties (>= 5.2) rexml link_header (0.0.8) + lint_roller (1.1.0) llhttp-ffi (0.4.0) ffi-compiler (~> 1.0) rake (~> 13.0) @@ -414,7 +419,7 @@ GEM activesupport (>= 4) railties (>= 4) request_store (~> 1.0) - loofah (2.22.0) + loofah (2.24.1) crass (~> 1.0.2) nokogiri (>= 1.12.0) mail (2.8.1) @@ -435,12 +440,12 @@ GEM mime-types-data (~> 3.2015) mime-types-data (3.2024.0305) mini_mime (1.1.5) - mini_portile2 (2.8.5) - minitest (5.22.3) + mini_portile2 (2.8.9) + minitest (5.25.5) msgpack (1.7.2) multi_json (1.15.0) multipart-post (2.3.0) - mutex_m (0.2.0) + mutex_m (0.3.0) net-http (0.4.1) uri net-http-persistent (4.0.2) @@ -456,7 +461,7 @@ GEM net-smtp (0.4.0.1) net-protocol nio4r (2.7.1) - nokogiri (1.16.3) + nokogiri (1.17.2) mini_portile2 (~> 2.8.2) racc (~> 1.4) nsa (0.3.0) @@ -499,8 +504,8 @@ GEM openssl (> 2.0) orm_adapter (0.5.0) ox (2.14.18) - parallel (1.24.0) - parser (3.3.0.5) + parallel (1.27.0) + parser (3.3.9.0) ast (~> 2.4.1) racc parslet (2.0.0) @@ -510,6 +515,8 @@ GEM pghero (3.4.1) activerecord (>= 6) posix-spawn (0.3.15) + pp (0.6.2) + prettyprint premailer (1.23.0) addressable css_parser (>= 1.12.0) @@ -518,13 +525,16 @@ GEM actionmailer (>= 3) net-smtp premailer (~> 1.7, >= 1.7.9) + prettyprint (0.2.0) + prism (1.5.1) private_address_check (0.5.0) propshaft (0.8.0) actionpack (>= 7.0.0) activesupport (>= 7.0.0) rack railties (>= 7.0.0) - psych (5.1.2) + psych (5.2.6) + date stringio public_suffix (5.0.4) puma (6.4.2) @@ -532,8 +542,8 @@ GEM pundit (2.3.1) activesupport (>= 3.0.0) raabro (1.4.0) - racc (1.7.3) - rack (2.2.9) + racc (1.8.1) + rack (2.2.18) rack-attack (6.7.0) rack (>= 1.0, < 4) rack-cors (2.0.2) @@ -551,9 +561,9 @@ GEM rack rack-session (1.0.2) rack (< 3) - rack-test (2.1.0) + rack-test (2.2.0) rack (>= 1.3) - rackup (1.0.0) + rackup (1.0.1) rack (< 3) webrick rails (7.1.3.2) @@ -574,13 +584,13 @@ GEM actionpack (>= 5.0.1.rc1) actionview (>= 5.0.1.rc1) activesupport (>= 5.0.1.rc1) - rails-dom-testing (2.2.0) + rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.6.0) + rails-html-sanitizer (1.6.2) loofah (~> 2.21) - nokogiri (~> 1.14) + nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rails-i18n (7.0.9) i18n (>= 0.7, < 2) railties (>= 6.0.0, < 8) @@ -593,29 +603,31 @@ GEM thor (~> 1.0, >= 1.2.2) zeitwerk (~> 2.6) rainbow (3.1.1) - rake (13.1.0) + rake (13.3.0) rdf (3.3.1) bcp47_spec (~> 0.2) link_header (~> 0.0, >= 0.0.8) rdf-normalize (0.7.0) rdf (~> 3.3) - rdoc (6.6.3.1) + rdoc (6.15.0) + erb psych (>= 4.0.0) + tsort redcarpet (3.6.0) redis (4.8.1) redis-namespace (1.11.0) redis (>= 4) redlock (1.3.2) redis (>= 3.0.0, < 6.0) - regexp_parser (2.9.0) - reline (0.4.3) + regexp_parser (2.11.3) + reline (0.6.2) io-console (~> 0.5) request_store (1.5.1) rack (>= 1.4) responders (3.1.1) actionpack (>= 5.2) railties (>= 5.2) - rexml (3.2.6) + rexml (3.4.4) rotp (6.3.0) rouge (4.2.1) rpam2 (4.0.2) @@ -647,35 +659,36 @@ GEM rspec-mocks (~> 3.0) sidekiq (>= 5, < 8) rspec-support (3.13.1) - rubocop (1.62.1) + rubocop (1.81.1) json (~> 2.3) - language_server-protocol (>= 3.17.0) + language_server-protocol (~> 3.17.0.2) + lint_roller (~> 1.1.0) parallel (~> 1.10) parser (>= 3.3.0.2) rainbow (>= 2.2.2, < 4.0) - regexp_parser (>= 1.8, < 3.0) - rexml (>= 3.2.5, < 4.0) - rubocop-ast (>= 1.31.1, < 2.0) + regexp_parser (>= 2.9.3, < 3.0) + rubocop-ast (>= 1.47.1, < 2.0) ruby-progressbar (~> 1.7) - unicode-display_width (>= 2.4.0, < 3.0) - rubocop-ast (1.31.2) - parser (>= 3.3.0.4) - rubocop-capybara (2.20.0) - rubocop (~> 1.41) - rubocop-factory_bot (2.25.1) - rubocop (~> 1.41) - rubocop-performance (1.20.2) - rubocop (>= 1.48.1, < 2.0) - rubocop-ast (>= 1.30.0, < 2.0) - rubocop-rails (2.24.1) + unicode-display_width (>= 2.4.0, < 4.0) + rubocop-ast (1.47.1) + parser (>= 3.3.7.2) + prism (~> 1.4) + rubocop-capybara (2.22.1) + lint_roller (~> 1.1) + rubocop (~> 1.72, >= 1.72.1) + rubocop-performance (1.26.0) + lint_roller (~> 1.1) + rubocop (>= 1.75.0, < 2.0) + rubocop-ast (>= 1.44.0, < 2.0) + rubocop-rails (2.33.4) activesupport (>= 4.2.0) + lint_roller (~> 1.1) rack (>= 1.1) - rubocop (>= 1.33.0, < 2.0) - rubocop-ast (>= 1.31.1, < 2.0) - rubocop-rspec (2.27.1) - rubocop (~> 1.40) - rubocop-capybara (~> 2.17) - rubocop-factory_bot (~> 2.22) + rubocop (>= 1.75.0, < 2.0) + rubocop-ast (>= 1.44.0, < 2.0) + rubocop-rspec (3.7.0) + lint_roller (~> 1.1) + rubocop (~> 1.72, >= 1.72.1) ruby-prof (1.7.0) ruby-progressbar (1.13.0) ruby-saml (1.15.0) @@ -732,7 +745,7 @@ GEM statsd-ruby (1.5.0) stoplight (3.0.2) redlock (~> 1.0) - stringio (3.1.0) + stringio (3.1.7) strong_migrations (1.8.0) activerecord (>= 5.2) swd (1.3.0) @@ -740,19 +753,20 @@ GEM attr_required (>= 0.0.5) httpclient (>= 2.4) sysexits (1.2.0) - temple (0.10.3) + temple (0.10.4) terminal-table (3.0.2) unicode-display_width (>= 1.1.1, < 3) terrapin (1.0.1) climate_control test-prof (1.3.2) - thor (1.3.1) - tilt (2.3.0) + thor (1.4.0) + tilt (2.6.1) timeout (0.4.1) tpm-key_attestation (0.12.0) bindata (~> 2.4) openssl (> 2.0) openssl-signature_algorithm (~> 1.0) + tsort (0.2.0) tty-color (0.6.0) tty-cursor (0.7.1) tty-prompt (0.23.1) @@ -773,7 +787,7 @@ GEM unf (0.1.4) unf_ext unf_ext (0.0.9.1) - unicode-display_width (2.5.0) + unicode-display_width (2.6.0) uri (0.12.2) validate_email (0.1.6) activemodel (>= 3.0) @@ -804,7 +818,7 @@ GEM rack-proxy (>= 0.6.1) railties (>= 5.2) semantic_range (>= 2.3.0) - webrick (1.8.1) + webrick (1.9.1) websocket (1.2.10) websocket-driver (0.7.6) websocket-extensions (>= 0.1.0) @@ -813,7 +827,7 @@ GEM xorcist (1.1.3) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.6.13) + zeitwerk (2.6.18) PLATFORMS ruby @@ -856,8 +870,8 @@ DEPENDENCIES fog-core (<= 2.4.0) fog-openstack (~> 1.0) fuubar (~> 2.5) - haml-rails (~> 2.0) - haml_lint + haml-rails (~> 3.0, >= 3.0.0) + haml_lint (>= 0.58.0) hcaptcha (~> 7.1) hiredis (~> 0.6) htmlentities (~> 4.3) @@ -918,11 +932,11 @@ DEPENDENCIES rspec-github (~> 2.4) rspec-rails (~> 6.0) rspec-sidekiq (~> 4.0) - rubocop - rubocop-capybara - rubocop-performance - rubocop-rails - rubocop-rspec + rubocop (>= 1.66.0) + rubocop-capybara (>= 2.21.0) + rubocop-performance (>= 1.21.0) + rubocop-rails (>= 2.25.0) + rubocop-rspec (>= 2.28.0) ruby-prof ruby-progressbar (~> 1.13) rubyzip (~> 2.3)