Build(deps): Bump rack-protection, sprockets, rack, omniauth, omniauth-github, omniauth-oauth2, omniauth-google-oauth2, pry-byebug, sidekiq, byebug, sassc-embedded and rqrcode - #487
Open
dependabot[bot] wants to merge 1274 commits into
Conversation
Similar to panel-body-bottom but shows up outside the div, and shows even during EmptyStateComponent is shown.
…#22992) This function was previously expecting multiple services to be injected on any class that uses it. This kind of hidden requirement leads to some very difficult-to-debug situations, so this commit updates the function to lookup all its required services inline.
Previously, theme fields from components would be cached for each of their parent themes.
Co-authored-by: Penar Musaraj <pmusaraj@gmail.com>
The hidden site setting max_drafts_per_user defaults to 10_000 drafts per user. The longest key should be "topic_<MAX_BIG_INT>" which is 25 characters.
This commit adds limits to themes and theme components on the: - file size of about.json and .discourse-compatibility - file size of theme assets - number of files in a theme
…course#23346) Why this change? As part of our ongoing efforts to security harden the Discourse application, we are adding the `cross_origin_opener_policy_header` site setting which allows the `Cross-Origin-Opener-Policy` response header to be set on requests that preloads the Discourse application. In more technical terms, only GET requests that are not json or xhr will have the response header set. The `cross_origin_opener_policy_header` site setting is hidden for now for testing purposes and will either be released as a public site setting or be remove if we decide to be opinionated and ship a default for the `Cross-Origin-Opener-Policy` response header.
Add spec compact
User profiles, including the summary, should be private to anonymous users if hide_user_profiles_from_public is enabled.
Why this change? The `PostsController#create` action allows arbitrary topic custom fields to be set by any user that can create a topic. Without any restrictions, this opens us up to potential security issues where plugins may be using topic custom fields in security sensitive areas. What does this change do? 1. This change introduces the `register_editable_topic_custom_field` plugin API which allows plugins to register topic custom fields that are editable either by staff users only or all users. The registered editable topic custom fields are stored in `DiscoursePluginRegistry` and is called by a new method `Topic#editable_custom_fields` which is then used in the `PostsController#create` controller action. When an unpermitted custom fields is present in the `meta_data` params, a 400 response code is returned. 2. Removes all reference to `meta_data` on a topic as it is confusing since we actually mean topic custom fields instead.
This adds access controls for the `/polls/grouped_poll_results` endpoint, such that only users with appropriate permissions can read the grouped results of a given poll.
Why this change? This ensures that malicious requests cannot end up causing the logs to quickly fill up. The default chosen is sufficient for most legitimate requests to the Discourse application. When truncation happens, parsing of logs in supported format like lograge may break down.
Ensure we escape the display names before passing it to the regexp used to update quotes whenever a user change their display name.
Block redirects when making the final request in TopicEmbed to prevent Server Side Request Forgery (SSRF)
The use of triple-curlies on Mustache templates opens the possibility for HTML injections.
There is an edge case where the following occurs: 1. The user sets a bookmark reminder on a post/topic 2. The post/topic is changed to a PM before or after the reminder fires, and the notification remains unread by the user 3. The user opens their bookmark reminder notification list and they can still see the notification even though they cannot access the topic anymore There is a very low chance for information leaking here, since the only thing that could be exposed is the topic title if it changes to something sensitive. This commit filters the bookmark unread notifications by using the bookmarkable can_see? methods and also prevents sending reminder notifications for bookmarks the user can no longer see.
Ensures posts cannot have SVG or PRE elements that are too tall.
…tem click (discourse#31664) - Add the behavior transformer `topic-list-item-click` to allow the customization for the click behavior on the topic list item.
…#31734) (discourse#31837) - backport of discourse#31734 to stable branch --------- Co-authored-by: Sérgio Saquetim <1108771+megothss@users.noreply.github.com>
- Add these params directly to stable since main refactored the template
- Move the change added in [this commit ](discourse@df412608c8fa1ff396b02751590025ad7015484e)to stable
…iscourse#32411) The `--disable-system-tests` CLI arg does nothing
```
Selenium::WebDriver::Error::WebDriverError:
Could not find a valid devtools version; use a more recent version of selenium-devtools gem
```
…iscourse#32413) This commit adds a new `--exclude-pattern` CLI option which supports excluding files using unix style pattern matching. This is to simplify a couple of situations: 1. Running `bin/turbo_rspec plugin/spec` but we want to exclude all tests in the `plugin/spec/system` folder. Example: `bin/turbo_rspec --exclude-pattern="*spec/system*" plugin/spec` 2. Running `bin/turbo_rspec plugin/*/spec/system` but we want to exclude tests for a particular plugin. Example: `bin/turbo_rspec --exclude-pattern="plugins/chat/*" plugin/*/spec/system`
When adding people to a DM, the ones already in the channel weren’t taken into account when checking whether the maximum limit was reached.
This patch adds a new shared example to be used as a smoke test in plugins and themes. A `skip_examples` argument is available to easily opt-out from a category of tests. Example: ```rb RSpec.describe "Testing core features", type: :system do it_behaves_like "having working core features", skip_examples: %i[search login] end ```
Some plugins are always enabled and don’t have a related site setting. This patch takes this into account.
…h-github, omniauth-oauth2, omniauth-google-oauth2, pry-byebug, sidekiq, byebug, sassc-embedded and rqrcode Bumps [rack-protection](https://github.com/sinatra/sinatra), [sprockets](https://github.com/rails/sprockets), [rack](https://github.com/rack/rack), [omniauth](https://github.com/omniauth/omniauth), [omniauth-github](https://github.com/intridea/omniauth-github), [omniauth-oauth2](https://github.com/omniauth/omniauth-oauth2), [omniauth-google-oauth2](https://github.com/zquestz/omniauth-google-oauth2), [pry-byebug](https://github.com/deivid-rodriguez/pry-byebug), [sidekiq](https://github.com/sidekiq/sidekiq), [byebug](https://github.com/deivid-rodriguez/byebug), [sassc-embedded](https://github.com/sass-contrib/sassc-embedded-shim-ruby) and [rqrcode](https://github.com/whomwah/rqrcode). These dependencies needed to be updated together. Updates `rack-protection` from 3.2.0 to 4.1.1 - [Changelog](https://github.com/sinatra/sinatra/blob/main/CHANGELOG.md) - [Commits](sinatra/sinatra@v3.2.0...v4.1.1) Updates `sprockets` from 3.7.5 to 4.2.2 - [Release notes](https://github.com/rails/sprockets/releases) - [Changelog](https://github.com/rails/sprockets/blob/main/CHANGELOG.md) - [Commits](rails/sprockets@v3.7.5...v4.2.2) Updates `rack` from 2.2.10 to 3.1.15 - [Release notes](https://github.com/rack/rack/releases) - [Changelog](https://github.com/rack/rack/blob/main/CHANGELOG.md) - [Commits](rack/rack@v2.2.10...v3.1.15) Updates `omniauth` from 1.9.2 to 2.1.3 - [Release notes](https://github.com/omniauth/omniauth/releases) - [Commits](omniauth/omniauth@v1.9.2...v2.1.3) Updates `omniauth-github` from 1.4.0 to 2.0.1 - [Release notes](https://github.com/intridea/omniauth-github/releases) - [Commits](omniauth/omniauth-github@v1.4.0...v2.0.1) Updates `omniauth-oauth2` from 1.7.3 to 1.8.0 - [Release notes](https://github.com/omniauth/omniauth-oauth2/releases) - [Changelog](https://github.com/omniauth/omniauth-oauth2/blob/master/CHANGELOG.md) - [Commits](omniauth/omniauth-oauth2@v1.7.3...v1.8.0) Updates `omniauth-google-oauth2` from 0.8.2 to 1.2.1 - [Release notes](https://github.com/zquestz/omniauth-google-oauth2/releases) - [Changelog](https://github.com/zquestz/omniauth-google-oauth2/blob/master/CHANGELOG.md) - [Commits](zquestz/omniauth-google-oauth2@v0.8.2...v1.2.1) Updates `pry-byebug` from 3.10.1 to 3.11.0 - [Release notes](https://github.com/deivid-rodriguez/pry-byebug/releases) - [Changelog](https://github.com/deivid-rodriguez/pry-byebug/blob/master/CHANGELOG.md) - [Commits](deivid-rodriguez/pry-byebug@v3.10.1...v3.11.0) Updates `sidekiq` from 6.5.12 to 7.3.9 - [Changelog](https://github.com/sidekiq/sidekiq/blob/main/Changes.md) - [Commits](sidekiq/sidekiq@v6.5.12...v7.3.9) Updates `byebug` from 11.1.3 to 12.0.0 - [Release notes](https://github.com/deivid-rodriguez/byebug/releases) - [Changelog](https://github.com/deivid-rodriguez/byebug/blob/master/CHANGELOG.md) - [Commits](deivid-rodriguez/byebug@v11.1.3...v12.0.0) Updates `sassc-embedded` from 1.77.7 to 1.80.4 - [Commits](sass-contrib/sassc-embedded-shim-ruby@v1.77.7...v1.80.4) Updates `rqrcode` from 2.2.0 to 3.1.0 - [Release notes](https://github.com/whomwah/rqrcode/releases) - [Changelog](https://github.com/whomwah/rqrcode/blob/main/CHANGELOG.md) - [Commits](whomwah/rqrcode@v2.2.0...v3.1.0) --- updated-dependencies: - dependency-name: rack-protection dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: sprockets dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: rack dependency-version: 3.1.15 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: omniauth dependency-version: 2.1.3 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: omniauth-github dependency-version: 2.0.1 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: omniauth-oauth2 dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: omniauth-google-oauth2 dependency-version: 1.2.1 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: pry-byebug dependency-version: 3.11.0 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: sidekiq dependency-version: 7.3.9 dependency-type: direct:production update-type: version-update:semver-major - dependency-name: byebug dependency-version: 12.0.0 dependency-type: direct:development update-type: version-update:semver-major - dependency-name: sassc-embedded dependency-version: 1.80.4 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: rqrcode dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps rack-protection, sprockets, rack, omniauth, omniauth-github, omniauth-oauth2, omniauth-google-oauth2, pry-byebug, sidekiq, byebug, sassc-embedded and rqrcode. These dependencies needed to be updated together.
Updates
rack-protectionfrom 3.2.0 to 4.1.1Changelog
Sourced from rack-protection's changelog.
... (truncated)
Commits
7b50a1b4.1.1 release (#2068)73f32914.1.0 release (#2063)cd3e00dAddHostAuthorizationrack-protection middleware (#2053)4a55850Remove WEBrick319af3aDeclare missing dependencies for Ruby 3.5 (#2032)8d0095fAdjustCookieTossingspec for Rack 3.1+5640495Fix typos in changelog, readme and code comments (#2006)b626e2d4.0.0 release (#1996)e56f657Require Ruby 2.7.8 as minimum Ruby version (#1993)9993829CI: remove rack monkey patchesUpdates
sprocketsfrom 3.7.5 to 4.2.2Release notes
Sourced from sprockets's releases.
... (truncated)
Changelog
Sourced from sprockets's changelog.
... (truncated)
Commits
4dff018Release 4.2.22fe13f2Merge pull request #812 from yahonda/uri_rfc3986_parser_escape_and_unescape_a...19b056cMerge pull request #813 from yahonda/add_loggerceac1ceMerge pull request #811 from yahonda/bump_rakee87e7c6Add logger as dependency to address warnings against Ruby 3.4.0dev9386ae4Addresswarning: URI::RFC3986_PARSERwarnings against ruby 3.4.0dev8b47cd5Bump rake version 13 or higher to suppress ostruct warnings37b8468Merge pull request #799 from m-nakamura145/update-ci-matrixe4686d5Merge pull request #810 from tricknotes/drop-base64b8eaeefDrop base64 gem from dependencyUpdates
rackfrom 2.2.10 to 3.1.15Release notes
Sourced from rack's releases.
Changelog
Sourced from rack's changelog.
... (truncated)
Commits
835e15bBump patch version.bd60f6eFeature detectCGI::Cookie. (#2333)3c1a46dReplace usage ofCGI::Cookie(#2328)0ac5c57Test on Ruby v3.4.5440b2cBump patch version.cd6b70aMerge commit from fork0379537Bump patch version.8e3c9b1EnsureRack::ETagcorrectly updates response body. (#2324)e8f4760Bump patch version.413b834Update changelog.Updates
omniauthfrom 1.9.2 to 2.1.3Release notes
Sourced from omniauth's releases.
... (truncated)
Commits
78d4e1dPrepare for next releasee23567aMerge pull request #1134 from TastyPi/env-overridec2ebe5bMerge pull request #1136 from mame/avoid-uri-abs_uri35f69b1Merge pull request #1137 from TastyPi/patch-12d93b53Exclude (macos, 2.5) from tests767a8b0Avoid usingURI::ABS_URI44c02d0Delete session omniauth.origin even if unused2632419Do not overrideomniauth.originin environment in test moded014c0eMerge pull request #1128 from enomotodev/ruby-3.30c8e471Test against Ruby 3.3Updates
omniauth-githubfrom 1.4.0 to 2.0.1Release notes
Sourced from omniauth-github's releases.
Commits
0ac46b5Release 2.0.1fa3e9cfMerge pull request #102 from jessieay/master684a74aUpgrade omniauth-oauth2 dependency1633cbbMerge pull request #100 from petergoldstein/feature/add_modern_rubies23cfa75Add Ruby 2.7, 3.0, and 3.1 to the CI matrixd2d9e01Merge pull request #96 from gogainda/patch-14ac10c7Update ruby.ymlf4e28d9Update ruby.yml027b861Update ruby.yml1f77226Merge pull request #95 from BobbyMcWho/chores-2020-01-12Updates
omniauth-oauth2from 1.7.3 to 1.8.0Release notes
Sourced from omniauth-oauth2's releases.
Changelog
Sourced from omniauth-oauth2's changelog.
Commits
3a43234Release 1.8.0043813cMerge pull request #152 from lucas-aragno/master8b948ddMerge branch 'master' into master8f6bae5Use omniauth 2.x to ensure latest security updatesUpdates
omniauth-google-oauth2from 0.8.2 to 1.2.1Release notes
Sourced from omniauth-google-oauth2's releases.
... (truncated)
Changelog
Sourced from omniauth-google-oauth2's changelog.
... (truncated)
Commits
3366dcbUnlock Sinatra version in examplea1ce612Updated CHANGELOG.md for 1.2.1f7b7a7dBump version to 1.2.18656538Add examples/Gemfile.lock to .gitignore5298eb1Use jwt v2.9.2's public claims verification API4dea8dbUse local source for example code7086b82Add FUNDING.yml719bd91Clarify use for storing devise google data in callbacks controller11af078Add 1.2.0 changelog and slight doc changes for image sizing452e119Update image sizing based on docs at https://developers.google.com/people/ima...Updates
pry-byebugfrom 3.10.1 to 3.11.0Release notes
Sourced from pry-byebug's releases.
Changelog
Sourced from pry-byebug's changelog.
Commits
458c74bMerge pull request #437 from deivid-rodriguez/release/3.11.09c71dbaMerge pull request #442 from deivid-rodriguez/tweak-ci-configc9f94d8Use stable job namesb631339Use default Bundler flags6f1ba74Bump tested rubies (#441)1e33f9aBump actions/checkout from 2 to 4 (#440)e362d32Merge pull request #439 from deivid-rodriguez/dependabot-tweakse3a4656Let Dependabot upgrade github actions0fdb262Switch Dependabot frequency to monthly5250d97Fix RuboCop warnings (#438)Updates
sidekiqfrom 6.5.12 to 7.3.9Changelog
Sourced from sidekiq's changelog.
... (truncated)
Commits
bf9afa4chore: bump922f37cBackport accessibility changes to 7-x branch (#6604)a235881fix: ensure we load our version of the adapter, not Railse0ccdb0Fix iterable jobs cancellation (#6589)57bdf45Fix tests on ruby 3.4886e434Adjust railtie to avoid loading AJ driver before AJ, fixes #658471fbcd8Use File::NULL9e1810aRevert "Adjust batch pagination, fixes #6577"1528704Revert "remove bad merge contents"6bd2e2bremove bad merge contentsUpdates
byebugfrom 11.1.3 to 12.0.0Release notes
Sourced from byebug's releases.
... (truncated)
Changelog
Sourced from byebug's changelog.
Commits
d17f48bMerge pull request #855 from deivid-rodriguez/release/12.0.03103035Get ready for 12.0.0 releasea5f7249Merge pull request #850 from deivid-rodriguez/updates625e212Upgrade rubocop related gems and fix new offenses5493f3eAdd official support for Ruby 3.1, 3.2, and 3.310893e6Remove unnecessary cache action from Windows workflowb6eeffbAddfaraday-retryto fix test warnings98259a5Bump pry to 0.15.21f6ab2eBump yard to 0.9.373e4162ebundle update rakeUpdates
sassc-embeddedfrom 1.77.7 to 1.80.4Commits
ec41a44v1.80.439d8f5bConvert nil to sass null instead of empty sass stringdaa94a2Use short style name as default1b81694Eagerly convert syntax to symbola4cacf9Encode sourcemap with template encoding like sasscd9fb607Use JSON.fast_generate on structure known to be safebeb8ab5Update release.yml03730a9v1.80.3