This repository was archived by the owner on Jul 12, 2022. It is now read-only.
🚨 [security] Upgrade jquery-rails: 4.0.4 → 4.3.5 (minor) #40
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Welcome to Depfu 👋
This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.
After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.
Let us know if you have any questions. Thanks so much for giving Depfu a try!
🚨 Your version of jquery-rails has known security vulnerabilities 🚨
Advisory: CVE-2019-11358
Disclosed: April 19, 2019
URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
Prototype pollution attack through jQuery $.extend
🚨 We recommend to merge and deploy this update as soon as possible! 🚨
Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ jquery-rails (4.0.4 → 4.3.5) · Repo · Changelog
Release Notes
4.3.5 (from changelog)
4.3.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
0.9.5
0.9.4
0.9.3
0.9.1
0.9.0
0.8.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 31 commits:
Try to be compatible with ruby 1.8Update gemspecsStop testing on 1.8, it might work thoughTravis don't know how to build these rubiesFix conversion crash on 1.9Require ruby version 2.0 or betterReduce supported ruby versionsTest newer rubiesUse 2.3.1 for testingMerge RUBY_INTEGER_UNIFICATION changesMake it interactiveEasy diffingUse ~> 2.0 test-unit that runs on 1.8 rubies as wellOnly test main 2.2 branchMove dependencies into gemspec filesCheck for existence of #to_json method before callAvoid system stack errorRemove permutation dependencyBe gone…Attempt to switch jruby into 2.0 modeAdd 2.3.0 for travis tetingAdd missing testsCall OBJECT_HANDLER for objects without #to_jsonCorrect CHANGESConvert README to markdownFix some linksSkip 1.8.4Add 2.2.3 explicitelyRemove sdoc and upgrade dependenciesBump version to 1.8.4 and add to CHANGESRemove remnants of GPL licensesRelease Notes
2.5.0 (from changelog)
2.4.0
2.3.1
2.3.0 (from changelog)
2.2.3
2.2.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
5.14.0 (from changelog)
5.13.0 (from changelog)
5.12.2 (from changelog)
5.12.1 (from changelog)
5.12.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.10.9
1.10.8
1.10.7
1.10.6
1.10.5
1.10.4
1.10.3
1.10.2
1.10.1
1.10.0
1.9.1
1.9.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.6.12 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 51 commits:
bump versionHandle case where session id key is requested but it is missingMerge pull request #1462 from jeremyevans/sessionid-to_sMerge branch '1-6-sec' into 1-6-stableBump versionmaking diff smallerfix memcache tests on 1.6fix tests on 1.6Introduce a new base class to avoid breaking when upgradingAdd a version prefix to the private id to make easier to migrate old valuesFallback to the public id when reading the session in the pool adapterAlso drop the session with the public id when destroying sessionsFallback to the legacy id when the new id is not foundAdd the private idrevert conditionals to masterremove NullSessionremove || raise and get closer to masterstore hashed id, send public iduse session id objectsremove more nilstry to ensure we always have some kind of objectFix assertion on baconBumping version for releaseWhitelist http/https schemesMerge pull request #1296 from tomelm/fix-prefers-plaintextBump version for releaseMerge pull request #1249 from mclark/handle-invalid-method-parametershandle failure to upcase invalid stringsStick with a passing version of Rubygems and bundlerbump version for releaseMerge pull request #1237 from eileencodes/backport-1137Backport pull request #1137 from unabridged/fix-eof-failurebump versionMerge pull request #1170 from rack/1-8-fixMerge pull request #1169 from eileencodes/fix-mistake-in-encoding-changeRuby 1.8 doesn't know about encodingsFix mistake in encoding changeBump rack version for releaseEnsure env values are ASCII 8BIT encodedBump Rack version for releaseMerge pull request #1115 from Shopify/fix-multipart-parsing-with-null-byteMerge pull request #1158 from marshall-lee/1-6-stable-backport-2f8b710Merge pull request #1080 from sophiedeziel/masterbumping versionUse Mutex instead of Thread.exclusive for reloaderCI: Refresh and repair buildsValidate the SameSite cookie optionMerge pull request #1037 from mastahyeti/backport_same_site_cookiesfirst-party cookies are now same-site cookiesFirst-Party cookies, another line of CSRF defensefix 1.8 backwards compatCommits
See the full diff on Github. The new version differs by 19 commits:
Bump gem version to prep for releaseMerge pull request #70 from Tonkpils/frozen-selector-string-fixDup selector string when extracting in case it's frozenFix jruby on travis"2.3" seems too fuzzyCurrent rails 4.2 doesn't support ruby 2.4 and 2.5CI against ruby 2.3nokogiri 1.7 requires ruby version >= 2.1.0It's because bundler is too old that bundler tries to bundle AS 5.0.0.rc2This tries to bundle activesupport 5.0.0.rc2 where we actually need 4.2.xRelease 1.0.8Allow Nokogiri 1.7Release 1.0.7Merge pull request #37 from aar0nr/readme-fixesFix Nokogiri documentation links in READMEMerge pull request #36 from tgxworld/fix_incorrect_spellingMove `CountDescribable` into `Rails::Dom::Testing::Assertions::SelectorAssertions`.Fix incorrect spelling.Dont set @html_document to not collide with ActionDispatchRelease Notes
1.3.0
1.2.0
1.1.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 57 commits:
v1.3.0Merge pull request #102 from orien/gem-metadataAdd project metadata to the gemspecMatch Loofah's API changes.Prepare 1.2.0Remove needless white list sanitizer deprecationsMerge pull request #96 from olleolleolle/patch-1CI: Drop unused sudo: false Travis directiveMerge pull request #95 from rwojnarowski/patch-1Deprecated warning text, missing spacePrepare version 1.1.0Merge pull request #91 from JuanitoFatas/doc/scrubbersMerge pull request #92 from JuanitoFatas/link-sanitizerImprove LinkSanitizer's documentationhref is not a HTML elementImprove Scrubber documentationsMerge pull request #87 from JuanitoFatas/migrate-to-safelistMigrate to SafeListSanitizerMerge pull request #90 from JuanitoFatas/jf.fix-testsUpdate test behavior for Nokogiri > 1.9.1.Merge pull request #89 from JuanitoFatas/rubiesMerge pull request #88 from JuanitoFatas/jf.relax-bundler-dependencyUpdate Ruby version matrix on CIUse a inclusive Bundler versionMerge pull request #86 from tebs/fix-documentation-linkFix Nokogiri link in documentation[ci skip] Please don't send more PRs trying to bump Loofah.Merge pull request #71 from nicolasleger/patch-1[CI] Allow failure with ruby head[CI] Test against Ruby 2.5Prepare to 1.0.4 releaseMake sure we address CVE-2018-8048Remove rbx since it doesn't seem to install.Merge pull request #66 from fschwahn/improve-testsFix deprecation warning from MinitestMake tests pass again with recent nokogiri versionsRename test to better reflect what is actually testedtyposWe're still testing against ruby 1.9 and 2.0 that aren't supported by nokogiri 1.7activesupport 5 doesn't support ruby < 2.2.2 that are still tested in this repobundle with the newest released bundlerTest against newer released rubies[ci skip] Remove faulty overrides in scrubber example.[ci skip] Change override method in PermitScrubber.Merge pull request #47 from pvalena/patch-1Correct license filenamebumping versionconvert CDATA nodes to TEXT nodes to avoid XSS issuesDo not unescape already escaped HTML entitiesDefine a less permissive list of tags and attributesUse the image hack name instead of the indexMerge pull request #43 from maclover7/contributingAdd CONTRIBUTING.md [ci skip]Merge pull request #40 from yui-knk/refactor/permitRefactor TargetScrubberMerge pull request #36 from JuanitoFatas/fix/gemspecFix homepage uri in gemspec.Release Notes
13.0.1 (from changelog)
13.0.0 (from changelog)
12.3.3 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Release Notes
1.0.1 (from changelog)
1.0.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
Commits
See the full diff on Github. The new version differs by 20 commits:
Bump version to 0.3.6Merge pull request #29 from nomoon/integer_unificationBetter comparisonFix Ruby 2.4 Integer unification deprecation error and get tests/CI functioning again.Merge pull request #26 from keithrbennett/add-concurrent-ruby-note-to-readmeModify README.md to explain that this code has been moved into the concurrent-ruby gem.Merge pull request #20 from dzjuck/remove_1_8Merge pull request #18 from dzjuck/flunk_to_failMerge pull request #17 from dzjuck/cache_values_specRemove code related to Ruby 1.8Call fail instead flunkAdd Cache#values specMerge pull request #15 from dzjuck/rspec_testsRewrite tests from minitest to rspecMerge pull request #14 from ktdreyer/minitest-reporter-optionaltests: make minitest-reporters optionalMerge pull request #13 from ktdreyer/simplecov-optionalMerge pull request #12 from ktdreyer/gemspec-summary-descriptiontests: make simplecov/coveralls optionalgemspec: switch summary and descriptionRelease Notes
1.2.7
1.2.6
1.2.5
1.2.4
1.2.3
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 concurrent-ruby (added, 1.1.6)
🆕 crass (added, 1.0.6)
🆕 mini_portile2 (added, 2.4.0)
🗑️ mini_portile (removed)
👉 No CI detected
You don't seem to have any Continuous Integration service set up!
Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.
This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:
depfu/.Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands