[no description] https://git.osdyson.ru/mirror/pkgsrc/atom?h=trunk 2022-09-10T08:18:59Z 2022-09-10T08:18:59Z taca taca@pkgsrc.org 2022-09-10T08:18:59Z urn:sha1:5d781e1cf65a9229fcec23b0dfbd3680835d403e Ruby on Rails 6.0.6 release on 9th September 2022 and Active Record is only updated. databases/ruby-activerecord60 * Symbol is allowed by default for YAML columns Étienne Barrié 2022-07-13T14:44:08Z taca taca@pkgsrc.org 2022-07-13T14:44:08Z urn:sha1:b901e521bec1e116801714b1f5cb131f5d72cb34 Rails 6.0.5.1 (2022-07-12) updates databases/ruby-activerecord60 only. databases/ruby-activerecord60 * Change ActiveRecord::Coders::YAMLColumn default to safe_load This adds two new configuration options The configuration options are as follows: o config.active_storage.use_yaml_unsafe_load When set to true, this configuration option tells Rails to use the old "unsafe" YAML loading strategy, maintaining the existing behavior but leaving the possible escalation vulnerability in place. Setting this option to true is *not* recommended, but can aid in upgrading. o config.active_record.yaml_column_permitted_classes The "safe YAML" loading method does not allow all classes to be deserialized by default. This option allows you to specify classes deemed "safe" in your application. For example, if your application uses Symbol and Time in serialized data, you can add Symbol and Time to the allowed list as follows: config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time] [CVE-2022-32224] 2022-06-07T14:59:20Z taca taca@pkgsrc.org 2022-06-07T14:59:20Z urn:sha1:6cb9b2db6fdcdf9b0272f463b23e98bce946f865 Ruby on Rails 6.0.5 (2022-05-12) Active Support * Fix tag helper regression. Action Text * Disentangle Action Text from ApplicationController Allow Action Text to be used without having an ApplicationController defined. This makes sure: - Action Text attachments render the correct URL host in mailers. - an ActionController::Renderer isn't allocated per request. - Sidekiq doesn't hang with the "classic" autoloader. 2022-05-05T03:24:54Z taca taca@pkgsrc.org 2022-05-05T03:24:54Z urn:sha1:722bd11f88db16423e51678cf2f79619de7e5179 No change except version. 2022-03-13T15:08:21Z taca taca@pkgsrc.org 2022-03-13T15:08:21Z urn:sha1:8b83aed0daf94357e21e10491af10c7c2d7abf58 Changes are in devel/ruby-activestorage60 only. ## Rails 6.0.4.7 (March 08, 2022) ## * Added image transformation validation via configurable allow-list. Variant now offers a configurable allow-list for transformation methods in addition to a configurable deny-list for arguments. [CVE-2022-21831] 2022-02-13T07:31:21Z taca taca@pkgsrc.org 2022-02-13T07:31:21Z urn:sha1:a012041fc63036146569e9942cbf9ed99170e844 This update contains security fix for CVE-2022-23633 in ruby-actionpack60. Active Support 6.0.4.6 (2022-02-11) * Fix Reloader method signature to work with the new Executor signature. Action Pack 6.0.4.6 6.0.4.5 (2022-02-11) * Under certain circumstances, the middleware isn't informed that the response body has been fully closed which result in request state not being fully reset before the next request. [CVE-2022-23633] Other packages have no change. 2021-12-19T05:13:37Z taca taca@pkgsrc.org 2021-12-19T05:13:37Z urn:sha1:79929fd274ba72b5f17abda24893115a2fda8545 No change except version. 2021-10-26T10:09:13Z nia nia@pkgsrc.org 2021-10-26T10:09:13Z urn:sha1:110d5bf2cb42630a7f459b1e8f899f8e59991e1b All checksums have been double-checked against existing RMD160 and SHA512 hashes The following distfiles could not be fetched (some may be only fetched conditionally): ./databases/cstore/distinfo D6.data.ros.gz ./databases/cstore/distinfo cstore0.2.tar.gz ./databases/cstore/distinfo data4.tar.gz 2021-10-07T13:35:05Z nia nia@pkgsrc.org 2021-10-07T13:35:05Z urn:sha1:461331b2af81f67812062f24d93a6ed5e8abfee9 2021-08-22T07:12:49Z taca taca@pkgsrc.org 2021-08-22T07:12:49Z urn:sha1:d852ac530634013f85b107dd160016e9a0edd006 Update Ruby on Rails 6.0 pacakges to 6.0.4.1. Real changes are in Action Pack (www/ruby-actionpack60). ## Rails 6.0.4.1 (August 19, 2021) ## * [CVE-2021-22942] Fix possible open redirect in Host Authorization middleware. Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.