Bump activerecord, rails, rspec-rails, webpacker, coffee-rails and sass-rails

[dependabot]

Bumps activerecord, rails, rspec-rails, webpacker, coffee-rails and sass-rails. These dependencies needed to be updated together.
Updates activerecord from 5.2.4.1 to 7.0.4.1

Release notes

Sourced from activerecord's releases.

v7.0.4.1

This is a security release. More information is available in our security announcements forum: https://discuss.rubyonrails.org/c/security-announcements/9

Active Support

• Avoid regex backtracking in Inflector.underscore

  [CVE-2023-22796]

Active Model

• No changes.

Active Record

• Make sanitize_as_sql_comment more strict

  Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

  This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

  This also clarifies in the documentation of annotate that it should not be provided user input.

  [CVE-2023-22794]

• Added integer width check to PostgreSQL::Quoting

  Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

  This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

  [CVE-2022-44566]

Action View

... (truncated)

Changelog

Sourced from activerecord's changelog.

Rails 7.0.4.1 (January 17, 2023)

• Make sanitize_as_sql_comment more strict

  Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

  This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

  This also clarifies in the documentation of annotate that it should not be provided user input.

  [CVE-2023-22794]

• Added integer width check to PostgreSQL::Quoting

  Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

  This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

  [CVE-2022-44566]

Rails 7.0.4 (September 09, 2022)

• Symbol is allowed by default for YAML columns

  Étienne Barrié

• Fix ActiveRecord::Store to serialize as a regular Hash

  Previously it would serialize as an ActiveSupport::HashWithIndifferentAccess which is wasteful and cause problem with YAML safe_load.

  Jean Boussier

• Add timestamptz as a time zone aware type for PostgreSQL

  This is required for correctly parsing timestamp with time zone values in your database.

  If you don't want this, you can opt out by adding this initializer:

... (truncated)

Commits

• 23e0345 Version 7.0.4.1
• d7aba06 Make sanitize_as_sql_comment more strict
• 82bcdc0 Added integer width check to PostgreSQL::Quoting
• 8015c2c Version 7.0.4
• 4d9b4b4 Merge pull request #45872 from the-spectator/correct_hwia_encoding
• c5a407d Linkify code references [ci-skip]
• e874cf5 Fix typos [ci-skip]
• fb09b1b Don't handle this change for legacy_connection_handling
• 0667ba4 Merge pull request #45773 from eileencodes/only-setup-shared-pools-if-we-have...
• d60d058 Merge pull request #45744 from fatkodima/mysql-change-column-collation
• Additional commits viewable in compare view

Updates rails from 5.2.4.1 to 7.0.4.1

Release notes

Sourced from rails's releases.

v7.0.4.1

This is a security release. More information is available in our security announcements forum: https://discuss.rubyonrails.org/c/security-announcements/9

Active Support

• Avoid regex backtracking in Inflector.underscore

  [CVE-2023-22796]

Active Model

• No changes.

Active Record

• Make sanitize_as_sql_comment more strict

  Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

  This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

  This also clarifies in the documentation of annotate that it should not be provided user input.

  [CVE-2023-22794]

• Added integer width check to PostgreSQL::Quoting

  Given a value outside the range for a 64bit signed integer type PostgreSQL will treat the column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan.

  This behavior is configurable via ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

  [CVE-2022-44566]

Action View

... (truncated)

Commits

• 23e0345 Version 7.0.4.1
• d7aba06 Make sanitize_as_sql_comment more strict
• 8d82687 Avoid regex backtracking on If-None-Match header
• 2164d4f Avoid regex backtracking in Inflector.underscore
• cd46b0e Use string#split instead of regex for domain parts
• e50e26d Fix sec issue with _url_host_allowed?
• 82bcdc0 Added integer width check to PostgreSQL::Quoting
• 8015c2c Version 7.0.4
• f3c345e Merge pull request #45964 from jhawthorn/server_timing_safety
• ff27758 Revert "Merge pull request #44695 from Edouard-chin/ec-tagger-logger-broadcast"
• Additional commits viewable in compare view

Updates rspec-rails from 3.9.0 to 6.0.1

Release notes

Sourced from rspec-rails's releases.

4.0.2 / 2020-12-26

Full Changelog

Bug Fixes:

• Indent all extra failure lines output from system specs. (Alex Robbin, #2321)
• Generated request spec for update now uses the correct let. (Paul Hanyzewski, #2344)
• Return true/false from predicate methods in config rather than raw values. (Phil Pirozhkov, Jon Rowe, #2353, #2354)
• Remove old #fixture_path feature detection code which broke under newer Rails. (Koen Punt, Jon Rowe, #2370)

Changelog

Sourced from rspec-rails's changelog.

6.0.1 / 2022-10-18

Full Changelog

Bug Fixes:

• Prevent tagged logged support in Rails 7 calling #name. (Jon Rowe, #2625)

6.0.0 / 2022-10-10

Full Changelog

Enhancements:

• Support Rails 7
• Template tweaks to remove instance variables from generated specs. (Takuma Ishikawa, #2599)
• Generators now respects default path configuration option. (@​vivekmiyani, #2508)

Breaking Changes:

• Drop support for Rails below 6.1
• Drop support for Ruby below 2.5 (following supported versions of Rails 6.1)
• Change the order of after_teardown from after to around in system specs to improve compatibility with extensions and Capybara. (Tim Diggins, #2596)

Deprecations:

• Deprecates integration spec generator (rspec:integration) which was an alias of request spec generator (rspec:request) (Luka Lüdicke, #2374)

5.1.2 / 2022-04-24

Full Changelog

Bug Fixes:

• Fix controller scaffold templates parameter name. (Taketo Takashima, #2591)
• Include generator specs in the inferred list of specs. (Jason Karns, #2597)

5.1.1 / 2022-03-07

Full Changelog

Bug Fixes:

• Properly handle global id serialised arguments in have_enqueued_mail. (Jon Rowe, #2578)

5.1.0 / 2022-01-26

Full Changelog

Enhancements:

... (truncated)

Commits

• ce70c2f v6.0.1
• 8f867f4 Changelog for 6.0.1
• ac38623 Changelog for #2625
• bc5a3c0 Merge pull request #2625 from rspec/replacement-tagged-logger-support
• 73c0989 Merge pull request #2626 from rspec/fix-build
• 0646044 v6.0.0
• 7cd6f93 s/upload_backups_spec.rb/upload_backups_job_spec.rb/g
• 8016684 Merge pull request #2587 from rspec/shanecav84/include-tagged-logging
• 0b4d164 Fixed typo
• 396c68f This updates Rubocop and uses the .rubocop_rspec_base.yml for consistency
• Additional commits viewable in compare view

Updates webpacker from 4.2.2 to 5.4.3

Changelog

Sourced from webpacker's changelog.

[5.4.3] - 2021-09-14

• Specify webpack-dev-server to be v3, to avoid getting webpack-dev-server v4 (#3121)

[5.4.2] - 2021-08-20

• Fix babel warning about private-methods in @babel/plugin-proposal-private-property-in-object as well (67fa6edf).

[5.4.1] - 2021-08-20

• Update all dependencies within the same major version (#3120)
• Fix babel warning about private-methods (#3016)

[5.4.0] - 2021-05-18

• Fix compatibility with Psych 4 (ceaf826d)

[5.3.0] - 2021-04-27

• Adds experimental Yarn 2 support. Note you must manually set nodeLinker: node-modules in your .yarnrc.yml.
• Keep backups, even when they're old #2912

[5.2.2] - 2021-04-27

• Bump deps and remove node-sass #2997.

[5.2.1] - 2020-08-17

• Revert #1311.

[5.2.0] - 2020-08-16

• Bump dependencies and fixes. See diff for changes.

[5.1.1] - 2020-04-20

• Update TypeScript documentation and installer to use babel-loader for typescript.[(#2541](rails/webpacker#2541)

[5.1.0] - 2020-04-19

• Remove yarn integrity check #2518
• Switch from ts-loader to babel-loader #2449 Please see the TypeScript documentation to upgrade existing projects to use typescript with 5.1
• Resolve multi-word snakecase WEBPACKER_DEV_SERVER env values #2528

[5.0.1] - 2020-03-22

• Upgrade deps and fix sass loader config options bug #2508

[5.0.0] - 2020-03-22

... (truncated)

Commits

• e0c998e Bump for v5.4.3
• e5ebf86 Bump for v5.4.3
• 5fa5a4e Specify webpack-dev-server to be v3 (#3121)
• c43f55f Bump for 5.4.2
• 67fa6ed Match loose setting to quiet warning
• 0a810f0 Bump for 5.4.1
• a3770ab Upgrade 5.x minors dependencies (#3120)
• 0bae978 Update yarn.lock file (#3114)
• b58107f bump optimize-css-assets-webpack-plugin to 5.0.8 (#3095)
• bf525f3 [5.x] CI fixes (#3106)
• Additional commits viewable in compare view

Updates coffee-rails from 4.2.2 to 5.0.0

Changelog

Sourced from coffee-rails's changelog.

5.0.0 (Apr 23, 2019)

• Remove support to Rails < 5.2.
• Support Rails 6.

Commits

• 32a2939 Prepare to 5.0.0
• 6507f0a Set the javascripts generator option as true in the railtie
• 5f0e005 Point to rails repository
• 74214e8 Merge pull request #114 from larouxn/rails_6_support
• eff9c00 Revert folder structure changes, remove --javascripts flag
• e7ce694 Fix for exclusively Rails 6
• 69e6782 TESTING, use my fork of Rails
• fc8c48c Conditionally use Rails 6 folder stucture
• 5df5816 Merge pull request #111 from larouxn/stop_testing_below_ruby_2.2
• 9bead93 Merge pull request #112 from larouxn/update_travis_jruby_version
• Additional commits viewable in compare view

Updates sass-rails from 5.1.0 to 6.0.0

Release notes

Sourced from sass-rails's releases.

6.0.0

Breaking change

• Move the implementation to sassc-rails.

  This gem is now only just a wrapper around sassc-rails. For more information on how sassc differs from Ruby sass see https://github.com/sass/sassc-rails#libsass-compatibility-with-ruby-sass.

Commits

• a77240c Prepare to 6.0.0
• 8dbe4dc Bump version to 6.0.0.beta3
• 830a8ec Bump minimum version of sassc-rails
• ff54c20 Fix open-ended dependency
• ebe9ef7 Bump version to v6.0.0.beta2
• 409d871 Merge pull request #424 from rails/sassc-rails
• d809900 Recomend to use SassC::Rails::Importer to users requiring sass/rails/importer
• 706526d Make sass-rails an wrapper for sassc-rails to allow a smooth upgrade path
• ac38f1e Merge pull request #423 from gregmolnar/master
• d61b999 remove gemnasium badge from readme
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.