kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Add CVE note to security guide and gemspecs

Browse source 
[ci skip]
This commit is contained in:
Gannon McGibbon 2018-11-06 14:17:23 -05:00
parent 212c28ac86
commit 1c11688b56
11 changed files with 35 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
actioncable/actioncable.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actioncable"

3
actionmailer/actionmailer.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actionmailer"

3
actionpack/actionpack.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actionpack"

3
actionview/actionview.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actionview"

3
activejob/activejob.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activejob"

3
activemodel/activemodel.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activemodel"

3
activerecord/activerecord.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activerecord"

3
activestorage/activestorage.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activestorage"

3
activesupport/activesupport.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activesupport"

5
guides/source/security.md
View file

@ -1235,6 +1235,11 @@ version:
Rails.application.credentials.some_api_key! # => raises KeyError: :some_api_key is blank
```
Dependency Management and CVEs
------------------------------
Please note that we do not accept patches for CVE version bumps. This is because application owners need to manually update their gems regardless of our efforts. Use `bundle update --conservative gem_name` to safely update vulnerable dependencies.
Additional Resources
--------------------

3
railties/railties.gemspec
View file

@ -2,6 +2,9 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "railties"