Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade various Gems to comply with Mend security alerts #30

Merged
merged 2 commits into from
May 10, 2024

Conversation

darrylhopkins
Copy link

@darrylhopkins darrylhopkins commented May 3, 2024

2908109

Note: Mend gave us an auto-generated PR #27 to upgrade various Gems, but it didn't include a Gemfile.lock so I created a new PR with the same updates to Gemfile.

To get tests to pass, I needed to update various other Gems including adding faraday per gem 'faraday-net_http'

List of alerts that Mend flagged

Library Severity Direct Name Suggested Fix Version
actionpack-7.0.4.gem High: 2; Medium: 3 - Upgrade to version actionpack - 6.1.7.1, 7.0.4.1
loofah-2.19.0.gem High: 2; Medium: 1 kaminari-1.2.2.gem,actionpack-7.0.4.gem Upgrade to version loofah - 2.19.1
rack-2.2.4.gem High: 5; Medium: 3 actionpack-7.0.4.gem Upgrade to version rack - 2.2.6.4,3.0.6.1
activesupport-7.0.4.gem High: 1; Medium: 1 activerecord-7.0.4.gem,activejob-7.0.4.gem,kaminari-1.2.2.gem,actionpack-7.0.4.gem Upgrade to version activesupport - 6.1.7.1,7.0.4.1
rails-html-sanitizer-1.4.3.gem High: 1; Medium: 3 kaminari-1.2.2.gem,actionpack-7.0.4.gem Upgrade to version rails-html-sanitizer - 1.4.4
activerecord-7.0.4.gem High: 2 kaminari-1.2.2.gem Upgrade to version activerecord - 6.1.7.1,7.0.4.1
globalid-1.0.0.gem High: 1 activejob-7.0.4.gem Upgrade to version globalid - 1.0.1

@darrylhopkins darrylhopkins force-pushed the 2908109-mend-security-alerts branch from 1ddee35 to 7e503ab Compare May 3, 2024 21:16
@darrylhopkins darrylhopkins requested a review from edtaupier May 4, 2024 00:55
@darrylhopkins darrylhopkins marked this pull request as ready for review May 4, 2024 00:55
@darrylhopkins darrylhopkins requested a review from a team as a code owner May 4, 2024 00:55
@darrylhopkins darrylhopkins merged commit a0ef22f into master May 10, 2024
3 checks passed
@scifisamurai scifisamurai deleted the 2908109-mend-security-alerts branch May 10, 2024 18:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants