Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] [ruby] Update rdoc 6.4.0 → 6.10.0 (minor) #846

Closed
wants to merge 1 commit into from
Closed

🚨 [security] [ruby] Update rdoc 6.4.0 → 6.10.0 (minor) #846

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link

@depfu depfu bot commented Dec 19, 2024

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rdoc (6.4.0 → 6.10.0) · Repo · Changelog

Security Advisories 🚨

🚨 RDoc RCE vulnerability with .rdoc_options

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

  • For Ruby 3.0 users: Update to rdoc 6.3.4.1
  • For Ruby 3.1 users: Update to rdoc 6.4.1.1
  • For Ruby 3.2 users: Update to rdoc 6.5.1.1

You can use gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile.

Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.

🚨 RDoc RCE vulnerability with .rdoc_options

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

  • For Ruby 3.0 users: Update to rdoc 6.3.4.1
  • For Ruby 3.1 users: Update to rdoc 6.4.1.1
  • For Ruby 3.2 users: Update to rdoc 6.5.1.1

You can use gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile.

Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.

🚨 RDoc RCE vulnerability with .rdoc_options

An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.

When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can be restored.

When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.

We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

  • For Ruby 3.0 users: Update to rdoc 6.3.4.1
  • For Ruby 3.1 users: Update to rdoc 6.4.1.1
  • For Ruby 3.2 users: Update to rdoc 6.5.1.1

You can use gem update rdoc to update it. If you are using bundler, please add gem "rdoc", ">= 6.6.3.1" to your Gemfile.

Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.

Release Notes

6.10.0

What's Changed

✨ Enhancements

  • Print warnings for rdoc-ref links that can't be resolved by @st0012 in #1241
  • Enable cross reference in code by @nobu in #1240
  • Auto-hide navigation on link click by @sunblaze in #1238

🐛 Bug Fixes

🛠 Other Changes

Full Changelog: v6.9.1...v6.10.0

6.9.1

What's Changed

🐛 Bug Fixes

📚 Documentation

  • Fix dead links in the markup reference page by @st0012 in #1242

New Contributors

Full Changelog: v6.9.0...v6.9.1

6.9.0

What's Changed

✨ Enhancements

  • Deprecate main and title directives by @st0012 in #1218
  • Expand rdoc-ref targets at the end of ri output by @st0012 in #1141

🐛 Bug Fixes

  • Improve how gemspec's files are defined by @st0012 in #1212
  • fix: C variables should never show up in Ancestors tree by @flavorjones in #1217
  • Sort MethodAttr so that names starting with symbols are before names starting with alpha ASCII by @flavorjones in #1219
  • ClassModule#superclass= accepts a ClassModule as an argument by @flavorjones in #1222
  • Use distinct styles for note lists and label lists by @nevans in #1209

🛠 Other Changes

  • Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #1215
  • Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #1214
  • Fixed version number of rubygems/release-gem by @hsbt in #1216
  • Prefer String#ord to String#codepoints[0] by @flavorjones in #1220
  • Workaround JRuby's jar-dependencies error and test failures on CI by @st0012 in #1225
  • lint: Remove unreachable code by @okuramasafumi in #1137
  • Stop running CI against JRuby and some CI config cleanup by @st0012 in #1228
  • Make it loose coupling between RubyGems and RDoc by @mterada1228 in #1171
  • Fixed compatibility error with setup command and rdoc plugin on rubygems by @hsbt in #1234

Full Changelog: v6.8.1...v6.9.0

6.8.1

What's Changed

🐛 Bug Fixes

New Contributors

Full Changelog: v6.8.0...v6.8.1

6.8.0

What's Changed

✨ Enhancements

🐛 Bug Fixes

  • Abort with error message if --dump argument invalid by @adam12 in #1104
  • Fix darkfish responsiveness issue on screens between 1024px and ~1650px by @st0012 in #1148
  • Fix sidebar scroll and footer display by @st0012 in #1152
  • Fix sidebar scroll again and add missing footer back by @st0012 in #1154
  • Make summary triangle appear in correct place when summary text overflows to next line by @paracycle in #1160
  • Make darkfish more responsive and readable on mobile devices by @st0012 in #1162
  • Only let browser search through source code until it's expanded by @Earlopain in #1181
  • Fix ToRdoc#accept_table by @tompng in #1184
  • Extract excerpt from RDoc::Markup::Document (raw pages) correctly by @st0012 in #1200

📚 Documentation

🛠 Other Changes

New Contributors

Full Changelog: v6.7.0...v6.8.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ psych (indirect, 4.0.3 → 5.2.2) · Repo · Changelog

Release Notes

5.2.2

What's Changed

  • Do not depend on the evaluation order of C arguments by @mame in #698
  • Don't autolink Exception in psych module docs by @zzak in #699

Full Changelog: v5.2.1...v5.2.2

5.2.1

What's Changed

  • Eagerly require date by @tdeo in #695
  • Bump rubygems/release-gem from 612653d273a73bdae1df8453e090060bb4db5f31 to 9e85cb11501bebc2ae661c1500176316d3987059 by @dependabot in #697
  • Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in #696

New Contributors

  • @tdeo made their first contribution in #695

Full Changelog: v5.2.0...v5.2.1

5.2.0

What's Changed

New Contributors

Full Changelog: v5.1.2...v5.2.0

5.1.2

What's Changed

New Contributors

Full Changelog: v5.1.1.1...v5.1.2

5.1.1.1

  • Re-package v5.1.1 for JRuby: #655

5.1.1

What's Changed

  • Use callable workflow by @hsbt in #622
  • Rename Actions yaml name by @hsbt in #623
  • Update test libraries from ruby/ruby 2023-03-24 by @hsbt in #625
  • Use test-unit-ruby-core by @hsbt in #631
  • Prefer assert_include for simple strings by @nobu in #632
  • Update spec files by @nobu in #633
  • Comment out the code used to expand the file list by @nobu in #634
  • Remove private methods unused since #487 by @nobu in #635
  • Extract accessor methods without forwardable by @hsbt in #636
  • Skip BigDecimal tests when it's missing to load by @hsbt in #638
  • Bump actions/checkout from 3 to 4 by @dependabot in #646
  • Allow setting defaults for SnakeYAML limits by @headius in #647
  • More small JRuby improvements for Parser by @headius in #650
  • Remove SnakeYAML settings that don't work by @headius in #653

Full Changelog: v5.1.0...v5.1.1

5.0.2

What's Changed

New Contributors

Full Changelog: v5.0.1...v5.0.2

5.0.1

What's Changed

New Contributors

Full Changelog: v5.0.0...v5.0.1

5.0.0

What's Changed

  • Don't require strscan unnecessarily by @deivid-rodriguez in #534
  • Remove alias of load to unsafe_load by @miry in #539
  • Add strict_integer option to parse numbers with commas as strings by @sethboyles in #537
  • Remove bundled libyaml by @hsbt in #541
  • Added dependabot.yml for actions by @hsbt in #546
  • Bump actions/checkout from 2 to 3 by @dependabot in #547
  • Update actions by @hsbt in #545
  • Added condition for macOS homebrew by @hsbt in #548
  • Add --with-libyaml-source-dir option by @nobu in #544
  • Try bundled libyaml source if pre-installed is unavailable by @nobu in #550
  • Propagate the host configuration to libyaml by @nobu in #551
  • Remove unknown vendor for cross-compiling tool prefix by @nobu in #553
  • Make a static library from PIC object files by @nobu in #554
  • Propagate CC to libyaml by @nobu in #556
  • Improve libyaml source downloading error messages by @XrXr in #557
  • Update autoconf files bundled with yaml-2.5 by @nobu in #559
  • Update Psych::VERSION to 4.0.4.dev, Add Ruby 3.1 & windows-2022 to CI by @MSP-Greg in #536
  • scalar_scanner.rb - delete is typically 4 to 5 times faster than gsub by @MSP-Greg in #530
  • MSP-Greg actions is now ruby organization by @hsbt in #560
  • Fix libyaml download failure rescue under miniruby by @XrXr in #562
  • Fix infinite loop bug after YAML_MEMORY_ERROR (psych issue #440) by @khanderson in #526
  • Clarify tests about parsing aliases by @amomchilov in #568
  • Raise specific error when aliases are not enabled by @amomchilov in #567
  • Raise specific error when an anchor isn't defined by @amomchilov in #569
  • Dump Date/DateTime as proleptic Gregorian date as well as Time by @nobu in #573
  • Bump snakeyaml from 1.28 to 1.31 to resolve CVE-2022-25857 by @chadlwilson in #574
  • Convert some of Parser#parse to Ruby by @tenderlove in #580
  • Bump snakeyaml from 1.31 to 1.33 to resolve CVE-2022-38752 on JRuby by @chadlwilson in #585
  • Removed the related files for downloading with extlibs by @hsbt in #588
  • Cleanup bundled libyaml feature by @hsbt in #589
  • Only skip specific failures on JRuby instead of ignoring the whole CI feedback by @deivid-rodriguez in #524
  • Abandon when libyaml is not found by @nobu in #592

New Contributors

Full Changelog: v4.0.3...v5.0.0

4.0.6

4.0.5

4.0.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ stringio (indirect, 3.0.1 → 3.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 StringIO buffer overread vulnerability

An issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4.

The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return the memory value.

This vulnerability is not affected StringIO 3.0.3 and later, and Ruby 3.2.x and later.

We recommend to update the StringIO gem to version 3.0.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

  • For Ruby 3.0 users: Update to stringio 3.0.1.1
  • For Ruby 3.1 users: Update to stringio 3.1.0.2

You can use gem update stringio to update it. If you are using bundler, please add gem "stringio", ">= 3.0.1.2" to your Gemfile.

Release Notes

3.1.2

Improvements

  • JRuby: Added support for detecting encoding by BOM.

Fixes

Thanks

  • manun

3.1.1

Improvements

Fixes

Thanks

  • Tiago Cardoso

3.1.0

Fixes

  • TruffleRuby: Do not compile the C extension

    GH-71

3.0.9

stringio 3.0.9 - 2023-11-08

Improvements

  • JRuby: Aligned StringIO#gets behavior with the C implementation.

    GH-61

Fixes

  • CRuby: Fixed StringIO#pread with the length 0.

    Patch by Jean byroot Boussier.

    GH-67

  • CRuby: Fixed a bug that StringIO#gets with non ASCII compatible
    encoding such as UTF-16 doesn't detect correct new line characters.

    Reported by IWAMOTO Kouichi.

    GH-68

Thanks

  • Jean byroot Boussier

  • IWAMOTO Kouichi

3.0.8

stringio 3.0.8 - 2023-08-10

Improvements

  • Added StringIO#pread.

    Patch by Jean byroot Boussier.

    GH-56

  • JRuby: Added StringIO::VERSION.

    GH-57 GH-59

Thanks

  • Jean byroot Boussier

3.0.7

stringio 3.0.7 - 2023-06-02

  • CRuby: Avoid direct struct usage. This change is for supporting
    Ruby 3.3.

    GH-54

3.0.6

stringio 3.0.6 - 2023-04-14

Improvements

  • CRuby: Added support for write barrier.

  • JRuby: Added missing arty-checking.

    GH-48

  • JRuby: Added support for StringIO.new(encoding:).

    GH-45

3.0.5 (from changelog)

Improvements

Fixes

  • Fixed a bug that StringIO#gets("2+ character", chomp: true) did not remove the separator at the end. [Bug #19389]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 date (added, 3.4.1)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Dec 19, 2024
@depfu depfu bot mentioned this pull request Dec 19, 2024
Closed
@depfu Depfu
Copy link
Author

depfu bot commented Jan 17, 2025

Closed in favor of #850.

@depfu depfu bot closed this Jan 17, 2025
@depfu depfu bot deleted the depfu/update/rdoc-6.10.0 branch January 17, 2025 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants