From 2cd48b3f6ed5143b2d13f33d3118b12e3fc44291 Mon Sep 17 00:00:00 2001 From: Jan-Kazlouski-elastic Date: Mon, 3 Aug 2026 13:24:49 +0300 Subject: [PATCH] fix(deps): bump activesupport to 7.2.3.1 for CVE-2026-33176 Clears High CVE-2026-33176 (and CVE-2026-33169 / CVE-2026-33170). Requires loading active_support/inflector before factory_bot under Active Support 7.2. Part of https://github.com/elastic/security/issues/13041 Co-authored-by: Cursor --- Gemfile | 4 +- Gemfile.lock | 30 +++++--- NOTICE.txt | 176 ++++++++++++++++++++++++++++++++++++-------- lib/environment.rb | 3 +- spec/spec_helper.rb | 5 ++ 5 files changed, 174 insertions(+), 44 deletions(-) diff --git a/Gemfile b/Gemfile index 82a136e5..7cfcaff4 100644 --- a/Gemfile +++ b/Gemfile @@ -22,7 +22,9 @@ source 'https://rubygems.org' gem 'bundler', supported_bundler_version group :default do - gem 'activesupport', '= 6.1.7.7' + # Pin to Rails 7.2.3.1+ to clear CVE-2026-33176 / CVE-2026-33169 / CVE-2026-33170 + # (DoS / ReDoS / XSS in Active Support number helpers and SafeBuffer#%). + gem 'activesupport', '= 7.2.3.1' gem 'addressable', '>= 2.9.0' gem 'concurrent-ruby', '~> 1.3.7' gem 'dry-cli', '~> 0.7.0' diff --git a/Gemfile.lock b/Gemfile.lock index 8e44153a..61aff6f2 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -10,26 +10,36 @@ PATH GEM remote: https://rubygems.org/ specs: - activesupport (6.1.7.7) - concurrent-ruby (~> 1.0, >= 1.0.2) + activesupport (7.2.3.1) + base64 + benchmark (>= 0.3) + bigdecimal + concurrent-ruby (~> 1.0, >= 1.3.1) + connection_pool (>= 2.2.5) + drb i18n (>= 1.6, < 2) - minitest (>= 5.1) - tzinfo (~> 2.0) - zeitwerk (~> 2.3) + logger (>= 1.4.2) + minitest (>= 5.1, < 6) + securerandom (>= 0.3) + tzinfo (~> 2.0, >= 2.0.5) addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) ast (2.4.2) + base64 (0.3.0) + benchmark (0.5.0) bigdecimal (3.1.8-java) bson (4.15.0-java) cgi (0.5.2-java) coderay (1.1.3) - concurrent-ruby (1.3.7) + concurrent-ruby (1.3.8) + connection_pool (2.5.5) crack (1.0.0) bigdecimal rexml date (3.5.1-java) diff-lcs (1.5.1) docile (1.4.0) + drb (2.2.3) dry-cli (0.7.0) elastic-transport (8.3.2) faraday (< 3) @@ -56,7 +66,7 @@ GEM raabro (~> 1.4) hashdiff (1.1.1) httpclient (2.8.3) - i18n (1.14.4) + i18n (1.15.2) concurrent-ruby (~> 1.0) ipaddr (1.2.6) jruby-openssl (0.16.0-java) @@ -66,7 +76,7 @@ GEM language_server-protocol (3.17.0.3) logger (1.7.0) method_source (1.1.0) - minitest (5.22.3) + minitest (5.27.0) multi_json (1.15.0) net-imap (0.3.10) date @@ -133,6 +143,7 @@ GEM ruby-progressbar (1.13.0) rufus-scheduler (3.9.1) fugit (~> 1.1, >= 1.1.6) + securerandom (0.4.1) simplecov (0.22.0) docile (~> 1.1) simplecov-html (~> 0.11) @@ -157,7 +168,6 @@ GEM crack (>= 0.3.2) hashdiff (>= 0.4.0, < 2.0.0) webrick (1.8.2) - zeitwerk (2.6.13) PLATFORMS universal-java-17 @@ -168,7 +178,7 @@ PLATFORMS universal-java-26 DEPENDENCIES - activesupport (= 6.1.7.7) + activesupport (= 7.2.3.1) addressable (>= 2.9.0) bigdecimal (~> 3.1.7) bson (~> 4.15.0) diff --git a/NOTICE.txt b/NOTICE.txt index c8837de9..7b923453 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -4,11 +4,11 @@ Copyright 2024 Elasticsearch B.V. The Elastic Open Web Crawler contains the following third-party dependencies: -------------------------------------------------------------------------------- -Library: activesupport 6.1.7.7 +Library: activesupport 7.2.3.1 URL: https://rubyonrails.org License: MIT -Copyright (c) 2005-2022 David Heinemeier Hansson +Copyright (c) David Heinemeier Hansson Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the @@ -237,6 +237,62 @@ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. +-------------------------------------------------------------------------------- +Library: base64 0.3.0 +URL: https://github.com/ruby/base64 +License: Ruby OR BSD-2-Clause + +Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. + +-------------------------------------------------------------------------------- +Library: benchmark 0.5.0 +URL: https://github.com/ruby/benchmark +License: Ruby OR BSD-2-Clause + +Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. + -------------------------------------------------------------------------------- Library: bigdecimal 3.1.8 URL: https://github.com/ruby/bigdecimal @@ -552,7 +608,7 @@ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Library: concurrent-ruby 1.3.7 +Library: concurrent-ruby 1.3.8 URL: http://www.concurrent-ruby.com License: MIT @@ -578,6 +634,32 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Library: connection_pool 2.5.5 +URL: https://github.com/mperham/connection_pool +License: MIT + +Copyright (c) 2011 Mike Perham + +Permission is hereby granted, free of charge, to any person obtaining +a copy of this software and associated documentation files (the +"Software"), to deal in the Software without restriction, including +without limitation the rights to use, copy, modify, merge, publish, +distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to +the following conditions: + +The above copyright notice and this permission notice shall be +included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND +NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE +LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION +OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION +WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -------------------------------------------------------------------------------- Library: date 3.5.1 URL: https://github.com/ruby/date @@ -640,6 +722,34 @@ You can redistribute it and/or modify it under either the terms of the WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. +-------------------------------------------------------------------------------- +Library: drb 2.2.3 +URL: https://github.com/ruby/drb +License: Ruby OR BSD-2-Clause + +Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright +notice, this list of conditions and the following disclaimer in the +documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. + -------------------------------------------------------------------------------- Library: dry-cli 0.7.0 URL: https://dry-rb.org/gems/dry-cli @@ -1432,7 +1542,7 @@ Made in Japan -------------------------------------------------------------------------------- -Library: i18n 1.14.4 +Library: i18n 1.15.2 URL: https://github.com/ruby-i18n/i18n License: MIT @@ -1645,8 +1755,8 @@ OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------------------- -Library: minitest 5.22.3 -URL: https://github.com/minitest/minitest +Library: minitest 5.27.0 +URL: https://minite.st/ License: MIT (The MIT License) @@ -1957,6 +2067,34 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------------------- +Library: securerandom 0.4.1 +URL: https://github.com/ruby/securerandom +License: Ruby OR BSD-2-Clause + +Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions +are met: +1. Redistributions of source code must retain the above copyright + notice, this list of conditions and the following disclaimer. +2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + +THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +SUCH DAMAGE. + -------------------------------------------------------------------------------- Library: strscan 3.1.0 URL: https://github.com/ruby/strscan @@ -2213,32 +2351,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --------------------------------------------------------------------------------- -Library: zeitwerk 2.6.13 -URL: https://github.com/fxn/zeitwerk -License: MIT - -Copyright (c) 2019–ω Xavier Noria - -Permission is hereby granted, free of charge, to any person obtaining -a copy of this software and associated documentation files (the -"Software"), to deal in the Software without restriction, including -without limitation the rights to use, copy, modify, merge, publish, -distribute, sublicense, and/or sell copies of the Software, and to -permit persons to whom the Software is furnished to do so, subject to -the following conditions: - -The above copyright notice and this permission notice shall be -included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND -NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE -LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION -OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION -WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -------------------------------------------------------------------------------- Library: jruby 9.4.12.0 URL: https://www.jruby.org diff --git a/lib/environment.rb b/lib/environment.rb index b443b8e8..11963f89 100644 --- a/lib/environment.rb +++ b/lib/environment.rb @@ -18,8 +18,9 @@ Bundler.setup(:default, CRAWLER_ENV) # Load common dependencies -require 'logger' # ActiveSupport 6.1 expects ::Logger to be defined +require 'logger' # ActiveSupport expects ::Logger to be defined require 'active_support' +require 'active_support/inflector' # needed by factory_bot with Active Support 7.2+ require 'active_support/core_ext' require 'active_support/dependencies' diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index 67e7399c..6899d335 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -8,6 +8,11 @@ require 'nokogiri' # https://github.com/sparklemotion/nokogiri/issues/2550 +# Active Support 7.2+ — factory_bot needs Inflector before Delegation loads +require 'logger' +require 'active_support' +require 'active_support/inflector' + require 'factory_bot' # Enable coverage information collection