| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Rails 5.2.8.1 (2022-07-12) updates databases/ruby-activerecord52 only.
databases/ruby-activerecord52
* Change ActiveRecord::Coders::YAMLColumn default to safe_load
This adds two new configuration options The configuration options are as
follows:
o config.active_storage.use_yaml_unsafe_load
When set to true, this configuration option tells Rails to use the old
"unsafe" YAML loading strategy, maintaining the existing behavior but
leaving the possible escalation vulnerability in place. Setting this
option to true is *not* recommended, but can aid in upgrading.
o config.active_record.yaml_column_permitted_classes
The "safe YAML" loading method does not allow all classes to be
deserialized by default. This option allows you to specify classes deemed
"safe" in your application. For example, if your application uses Symbol
and Time in serialized data, you can add Symbol and Time to the allowed
list as follows:
config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]
[CVE-2022-32224]
|
|
Ruby on Rails 5.2.8 (2022-05-12)
Active Support
* Fix tag helper regression.
Action View
* Make `LoadInterlockAwareMonitor` work in Ruby 2.7.
* Retain Ruby 2.2 compatibility.
|
|
No change except version.
|
|
Ruby on Rails 5.2.6.3 is not latest version but it should be easy to pull-up
to pkgsrc-2021Q4.
Changes are in devel/ruby-activestorage52 only.
Rails 5.2.6.3 (March 08, 2022)
* Added image transformation validation via configurable allow-list.
Variant now offers a configurable allow-list for
transformation methods in addition to a configurable deny-list for arguments.
[CVE-2022-21831]
|
|
This update contains security fix for CVE-2022-23633 in
Active Support 5.2.6.2 (2022-02-11)
* Fix Reloader method signature to work with the new Executor signature.
Action Pack 5.2.6.2 (2022-02-11)
* Under certain circumstances, the middleware isn't informed that the
response body has been fully closed which result in request state
not being fully reset before the next request.
[CVE-2022-23633]
|
|
All checksums have been double-checked against existing RMD160 and
SHA512 hashes
The following distfiles could not be fetched (some may be only fetched
conditionally):
./databases/cstore/distinfo D6.data.ros.gz
./databases/cstore/distinfo cstore0.2.tar.gz
./databases/cstore/distinfo data4.tar.gz
|
|
|
|
Ruby on Rails 5.2.6 (2021-05-05)
There are changes in www/ruby-actionpack52 only, including security fix.
Action Pack
* Accept base64_urlsafe CSRF tokens to make forward compatible.
Base64 strict-encoded CSRF tokens are not inherently websafe, which
makes them difficult to deal with. For example, the common practice
of sending the CSRF token to a browser in a client-readable cookie
does not work properly out of the box: the value has to be
url-encoded and decoded to survive transport.
In this version, we generate Base64 urlsafe-encoded CSRF tokens,
which are inherently safe to transport. Validation accepts both
urlsafe tokens, and strict-encoded tokens for backwards
compatibility.
How the tokes are encoded is controllr by the
action_controller.urlsafe_csrf_tokens config.
In Rails 5.2.5, the CSRF token format was accidentally changed to
urlsafe-encoded.
Atention: If you already upgraded your application to 5.2.5, set the
config urlsafe_csrf_tokens to true, otherwise your form submission
will start to fail during the deploy of this new version.
Rails.application.config.action_controller.urlsafe_csrf_tokens = true
If you are upgrading from 5.2.4.x, you don't need to change this
configuration.
Scott Blum, Étienne Barrié
|
|
Real changes are in devel/ruby-activestorage52 only.
## Rails 5.2.5 (March 26, 2021) ##
* Marcel is upgraded to version 1.0.0 to avoid a dependency on GPL-licensed
mime types data.
*George Claghorn*
* The Poppler PDF previewer renders a preview image using the original
document's crop box rather than its media box, hiding print margins. This
matches the behavior of the MuPDF previewer.
*Vincent Robert*
|
|
## Rails 5.2.4.5 (February 10, 2021) ##
* Fix possible DoS vector in PostgreSQL money type
Carefully crafted input can cause a DoS via the regular expressions used
for validating the money format in the PostgreSQL adapter. This patch
fixes the regexp.
Thanks to @dee-see from Hackerone for this patch!
[CVE-2021-22880]
*Aaron Patterson*
|
|
Update Ruby on Rails 52 to 5.2.4.4.
Security fix in ruby-actionview52.
## Rails 5.2.4.4 (September 09, 2020) ##
* [CVE-2020-15169] Fix potential XSS vulnerability in the `translate`/`t` helper
*Jonathan Hefner*
|
|
Update ruby-activerecord52 to 5.2.4.3.
## Rails 5.2.4.3 (May 18, 2020) ##
* No changes.
|
|
Update ruby-activerecord52 to 5.2.4.2.
## Rails 5.2.4.1 (December 18, 2019) ##
* No changes.
## Rails 5.2.4 (November 27, 2019) ##
* Fix circular `autosave: true` causes invalid records to be saved.
Prior to the fix, when there was a circular series of `autosave: true`
associations, the callback for a `has_many` association was run while
another instance of the same callback on the same association hadn't
finished running. When control returned to the first instance of the
callback, the instance variable had changed, and subsequent associated
records weren't saved correctly. Specifically, the ID field for the
`belongs_to` corresponding to the `has_many` was `nil`.
Fixes #28080.
*Larry Reid*
* PostgreSQL: Fix GROUP BY with ORDER BY virtual count attribute.
Fixes #36022.
*Ryuta Kamizono*
* Fix sqlite3 collation parsing when using decimal columns.
*Martin R. Schuster*
* Make ActiveRecord `ConnectionPool.connections` method thread-safe.
Fixes #36465.
*Jeff Doering*
* Assign all attributes before calling `build` to ensure the child record is visible in
`before_add` and `after_add` callbacks for `has_many :through` associations.
Fixes #33249.
*Ryan H. Kerr*
|
|
## Rails 5.2.3 (March 27, 2019) ##
* Fix different `count` calculation when using `size` with manual `select` with DISTINCT.
Fixes #35214.
*Juani Villarejo*
* Fix prepared statements caching to be enabled even when query caching is enabled.
*Ryuta Kamizono*
* Don't allow `where` with invalid value matches to nil values.
Fixes #33624.
*Ryuta Kamizono*
* Restore an ability that class level `update` without giving ids.
Fixes #34743.
*Ryuta Kamizono*
* Fix join table column quoting with SQLite.
*Gannon McGibbon*
* Ensure that `delete_all` on collection proxy returns affected count.
*Ryuta Kamizono*
* Reset scope after delete on collection association to clear stale offsets of removed records.
*Gannon McGibbon*
## Rails 5.2.2.1 (March 11, 2019) ##
* No changes.
|
|
Add ruby-activerecord52 version 5.2.2 package.
= Active Record -- Object-relational mapping put on rails
Active Record connects classes to relational database tables to establish an
almost zero-configuration persistence layer for applications. The library
provides a base class that, when subclassed, sets up a mapping between the new
class and an existing table in the database. In context of an application,
these classes are commonly referred to as *models*. Models can also be
connected to other models; this is done by defining *associations*.
This is for Ruby on Rails 5.2.
|
