From 57c81d2752373ecf8d9512017d3f71f4bd99c998 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Mon, 23 Mar 2026 21:12:41 +0000 Subject: [PATCH] fix: Gemfile & Gemfile.lock to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-RUBY-JSON-15692503 - https://snyk.io/vuln/SNYK-RUBY-LOOFAH-15683821 - https://snyk.io/vuln/SNYK-RUBY-ACTIONTEXTTRIX-15481279 --- Gemfile | 2 +- Gemfile.lock | 129 ++++++++++++++++++++++++++------------------------- 2 files changed, 66 insertions(+), 65 deletions(-) diff --git a/Gemfile b/Gemfile index 3dce69ad7..844d0a254 100644 --- a/Gemfile +++ b/Gemfile @@ -4,7 +4,7 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '3.4.8' # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' -gem 'rails', '~> 8.0', '>= 8.0.4' +gem 'rails', '~> 8.1', '>= 8.1.2.1' # State machine gem 'aasm' diff --git a/Gemfile.lock b/Gemfile.lock index 3972b8af6..875e27a02 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,31 +9,31 @@ GEM specs: aasm (4.12.3) concurrent-ruby (~> 1.0) - action_text-trix (2.1.16) + action_text-trix (2.1.17) railties - actioncable (8.1.2) - actionpack (= 8.1.2) - activesupport (= 8.1.2) + actioncable (8.1.2.1) + actionpack (= 8.1.2.1) + activesupport (= 8.1.2.1) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (8.1.2) - actionpack (= 8.1.2) - activejob (= 8.1.2) - activerecord (= 8.1.2) - activestorage (= 8.1.2) - activesupport (= 8.1.2) + actionmailbox (8.1.2.1) + actionpack (= 8.1.2.1) + activejob (= 8.1.2.1) + activerecord (= 8.1.2.1) + activestorage (= 8.1.2.1) + activesupport (= 8.1.2.1) mail (>= 2.8.0) - actionmailer (8.1.2) - actionpack (= 8.1.2) - actionview (= 8.1.2) - activejob (= 8.1.2) - activesupport (= 8.1.2) + actionmailer (8.1.2.1) + actionpack (= 8.1.2.1) + actionview (= 8.1.2.1) + activejob (= 8.1.2.1) + activesupport (= 8.1.2.1) mail (>= 2.8.0) rails-dom-testing (~> 2.2) - actionpack (8.1.2) - actionview (= 8.1.2) - activesupport (= 8.1.2) + actionpack (8.1.2.1) + actionview (= 8.1.2.1) + activesupport (= 8.1.2.1) nokogiri (>= 1.8.5) rack (>= 2.2.4) rack-session (>= 1.0.1) @@ -41,38 +41,38 @@ GEM rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) useragent (~> 0.16) - actiontext (8.1.2) + actiontext (8.1.2.1) action_text-trix (~> 2.1.15) - actionpack (= 8.1.2) - activerecord (= 8.1.2) - activestorage (= 8.1.2) - activesupport (= 8.1.2) + actionpack (= 8.1.2.1) + activerecord (= 8.1.2.1) + activestorage (= 8.1.2.1) + activesupport (= 8.1.2.1) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (8.1.2) - activesupport (= 8.1.2) + actionview (8.1.2.1) + activesupport (= 8.1.2.1) builder (~> 3.1) erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (8.1.2) - activesupport (= 8.1.2) + activejob (8.1.2.1) + activesupport (= 8.1.2.1) globalid (>= 0.3.6) - activemodel (8.1.2) - activesupport (= 8.1.2) - activerecord (8.1.2) - activemodel (= 8.1.2) - activesupport (= 8.1.2) + activemodel (8.1.2.1) + activesupport (= 8.1.2.1) + activerecord (8.1.2.1) + activemodel (= 8.1.2.1) + activesupport (= 8.1.2.1) timeout (>= 0.4.0) activerecord-import (2.2.0) activerecord (>= 4.2) - activestorage (8.1.2) - actionpack (= 8.1.2) - activejob (= 8.1.2) - activerecord (= 8.1.2) - activesupport (= 8.1.2) + activestorage (8.1.2.1) + actionpack (= 8.1.2.1) + activejob (= 8.1.2.1) + activerecord (= 8.1.2.1) + activesupport (= 8.1.2.1) marcel (~> 1.0) - activesupport (8.1.2) + activesupport (8.1.2.1) base64 bigdecimal concurrent-ruby (~> 1.0, >= 1.3.1) @@ -178,7 +178,7 @@ GEM drb (2.2.3) email_validator (2.2.4) activemodel - erb (6.0.1) + erb (6.0.2) erubi (1.13.1) et-orbi (1.4.0) tzinfo @@ -267,7 +267,7 @@ GEM rails-dom-testing (>= 1, < 3) railties (>= 4.2.0) thor (>= 0.14, < 2.0) - json (2.18.1) + json (2.19.2) jsonapi-deserializable (0.2.0) jsonapi-parser (0.1.1) jsonapi-rails (0.4.1) @@ -312,7 +312,7 @@ GEM request_store (~> 1.0) lolsoap (0.11.0) nokogiri (~> 1.5) - loofah (2.25.0) + loofah (2.25.1) crass (~> 1.0.2) nokogiri (>= 1.12.0) mail (2.9.0) @@ -329,7 +329,8 @@ GEM mime-types-data (3.2023.0808) mini_mime (1.1.5) mini_portile2 (2.8.9) - minitest (6.0.1) + minitest (6.0.2) + drb (~> 2.0) prism (~> 1.5) msgpack (1.5.1) multi_xml (0.8.1) @@ -351,7 +352,7 @@ GEM net-protocol netrc (0.11.0) nio4r (2.7.5) - nokogiri (1.19.1) + nokogiri (1.19.2) mini_portile2 (~> 2.8.2) racc (~> 1.4) oauth2 (2.0.17) @@ -420,26 +421,26 @@ GEM rack (>= 1.3) rackup (2.3.1) rack (>= 3) - rails (8.1.2) - actioncable (= 8.1.2) - actionmailbox (= 8.1.2) - actionmailer (= 8.1.2) - actionpack (= 8.1.2) - actiontext (= 8.1.2) - actionview (= 8.1.2) - activejob (= 8.1.2) - activemodel (= 8.1.2) - activerecord (= 8.1.2) - activestorage (= 8.1.2) - activesupport (= 8.1.2) + rails (8.1.2.1) + actioncable (= 8.1.2.1) + actionmailbox (= 8.1.2.1) + actionmailer (= 8.1.2.1) + actionpack (= 8.1.2.1) + actiontext (= 8.1.2.1) + actionview (= 8.1.2.1) + activejob (= 8.1.2.1) + activemodel (= 8.1.2.1) + activerecord (= 8.1.2.1) + activestorage (= 8.1.2.1) + activesupport (= 8.1.2.1) bundler (>= 1.15.0) - railties (= 8.1.2) + railties (= 8.1.2.1) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.6.2) - loofah (~> 2.21) + rails-html-sanitizer (1.7.0) + loofah (~> 2.25) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rails_event_store (2.18.0) activejob (>= 6.0) @@ -452,9 +453,9 @@ GEM ruby_event_store-browser (= 2.18.0) rails_event_store_active_record (2.18.0) ruby_event_store-active_record (= 2.18.0) - railties (8.1.2) - actionpack (= 8.1.2) - activesupport (= 8.1.2) + railties (8.1.2.1) + actionpack (= 8.1.2.1) + activesupport (= 8.1.2.1) irb (~> 1.13) rackup (>= 1.0.0) rake (>= 12.2) @@ -595,7 +596,7 @@ GEM temple (0.10.4) thor (1.5.0) tilt (2.6.1) - timeout (0.6.0) + timeout (0.6.1) tsort (0.2.0) tzinfo (2.0.6) concurrent-ruby (~> 1.0) @@ -624,7 +625,7 @@ GEM xpath (3.2.0) nokogiri (~> 1.8) zache (0.13.1) - zeitwerk (2.7.4) + zeitwerk (2.7.5) PLATFORMS ruby @@ -672,7 +673,7 @@ DEPENDENCIES pry-rails puma (~> 6.4, >= 6.4.3) rack-maintenance (~> 3.0) - rails (~> 8.0, >= 8.0.4) + rails (~> 8.1, >= 8.1.2.1) rails_event_store (~> 2.18, >= 2.18.0) redcarpet (~> 3.6) rollbar (~> 3.5, >= 3.5.1)