8000 Update dependency devise to v4 [SECURITY] by renovate[bot] · Pull Request #17 · amleaver/piccolo · GitHub

More Web Proxy on the site http://driver.im/

Update dependency devise to v4 [SECURITY] #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

renovate wants to merge 1 commit into master from renovate/rubygems-devise-vulnerability

Contributor

renovate bot commented

•

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
devise (changelog)	`3.5.2` -> `4.7.1`

GitHub Vulnerability Alerts

CVE-2019-5421

Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts within the Devise::Models::Lockable class not being concurrency safe.

CVE-2019-16109

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)

CVE-2015-8314

Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.

Release Notes

heartcombo/devise (devise)

`v4.7.1`

`v4.7.0`

`v4.6.2`

`v4.6.1`

`v4.6.0`

`v4.5.0`

`v4.4.3`

`v4.4.2`

`v4.4.1`

`v4.4.0`

`v4.3.0`

`v4.2.1`

`v4.2.0`

`v4.1.1`

`v4.1.0`

`v4.0.3`

`v4.0.2`

`v4.0.1`

`v4.0.0`

`v3.5.10`

`v3.5.9`

`v3.5.8`

`v3.5.7`

`v3.5.6`

`v3.5.5`

`v3.5.4`

`v3.5.3`

bug fixes
- Fix password reset for records where confirmation_required? is disabled and
  confirmation_sent_at is nil. (by @andygeers)
- Allow resources with no email field to be recoverable (and do not clear the
  reset password token if the model was already persisted). (by @seddy, @stanhu)
enhancements
- Upon setting Devise.send_password_change_notification = true a user will receive notification when their password has been changed.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot force-pushed the renovate/rubygems-devise-vulnerability branch from 3b74662 to 5cf83f2 Compare

November 20, 2022 08:34


          Update dependency devise to v4 [SECURITY]

90e58d2

renovate bot force-pushed the renovate/rubygems-devise-vulnerability branch from 5cf83f2 to 90e58d2 Compare

March 16, 2023 17:52

Contributor Author

renovate bot commented

•

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

Unknown switches '--patch, --strict'

renovate bot changed the title ~~Update dependency devise to v4 [SECURITY]~~ Update dependency devise to v3.5.4 [SECURITY]

Contributor Author

renovate bot commented

•

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: Gemfile.lock

Fetching source index from https://rubygems.org/
--- ERROR REPORT TEMPLATE -------------------------------------------------------
- What did you do?

  I ran the command `/opt/containerbase/tools/bundler/1.11.2/3.4.2/bin/bundler lock --update devise`

- What did you expect to happen?

  I expected Bundler to...

- What happened instead?

  Instead, what actually happened was...


Error details

    NoMethodError: undefined method 'inflate' for module Gem
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/fetcher.rb:90:in 'Bundler::Fetcher#fetch_spec'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/remote_specification.rb:71:in 'Bundler::RemoteSpecification#_remote_specification'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/remote_specification.rb:76:in 'Bundler::RemoteSpecification#method_missing'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:160:in 'block in Bundler::Resolver::SpecGroup#__dependencies'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:157:in 'Array#each'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:157:in 'Bundler::Resolver::SpecGroup#__dependencies'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:112:in 'Bundler::Resolver::SpecGroup#activate_platform'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:275:in 'block in Bundler::Resolver#search_for'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:275:in 'Array#each'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:275:in 'Bundler::Resolver#search_for'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:332:in 'block in Bundler::Resolver#verify_gemfile_dependencies_are_found!'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:330:in 'Array#each'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:330:in 'Bundler::Resolver#verify_gemfile_dependencies_are_found!'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:199:in 'Bundler::Resolver#start'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/resolver.rb:183:in 'Bundler::Resolver.resolve'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/definition.rb:198:in 'Bundler::Definition#resolve'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/definition.rb:137:in 'Bundler::Definition#specs'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/definition.rb:126:in 'Bundler::Definition#resolve_remotely!'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/cli/lock.rb:27:in 'Bundler::CLI::Lock#run'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/cli.rb:412:in 'Bundler::CLI#lock'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/vendor/thor/lib/thor/command.rb:27:in 'Bundler::Thor::Command#run'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/vendor/thor/lib/thor/invocation.rb:126:in 'Bundler::Thor::Invocation#invoke_command'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/vendor/thor/lib/thor.rb:359:in 'Bundler::Thor.dispatch'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/vendor/thor/lib/thor/base.rb:440:in 'Bundler::Thor::Base::ClassMethods#start'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/cli.rb:10:in 'Bundler::CLI.start'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/exe/bundler:19:in 'block in <top (required)>'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/lib/bundler/friendly_errors.rb:7:in 'Bundler.with_friendly_errors'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/gems/bundler-1.11.2/exe/bundler:17:in '<top (required)>'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/bin/bundler:25:in 'Kernel#load'
      /opt/containerbase/tools/bundler/1.11.2/3.4.2/bin/bundler:25:in '<main>'

Environment

    Bundler   1.11.2
    Rubygems  3.6.2
    Ruby      3.4.2p28 (2025-02-15 revision d2930f8e7a5db8a7337fa43370940381b420cc3e) [x86_64-linux]
    GEM_HOME  /runner/cache/others/bundler
    GEM_PATH  :/opt/containerbase/tools/bundler/1.11.2/3.4.2
    Git       2.49.0

Bundler settings

    github.com
      Set via BUNDLE_GITHUB__COM: "**redacted**"
--- TEMPLATE END ----------------------------------------------------------------

Unfortunately, an unexpected error occurred, and Bundler cannot continue.

First, try this link to see if there are any existing issue reports for this error:
https://github.com/bundler/bundler/search?q=undefined+method+%27inflate%27+for+module+Gem&type=Issues

If there aren't any reports for this error yet, please create copy and paste the report template above into a new issue. Don't forget to anonymize any private data! The new issue form is located at:
https://github.com/bundler/bundler/issues/new

renovate bot changed the title ~~Update dependency devise to v3.5.4 [SECURITY]~~ Update dependency devise to v4 [SECURITY]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

0