Merge pull request #270 from cyberark/update-rails-and-puma

Upgrade rails components and puma

CHANGELOG.md

@@ -5,7 +5,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+## [1.2.4] - 2022-02-14
 ### Security
+- Upgraded rails components to 5.2.6.2 and puma to 5.6.2 to resolve CVE-2022-23633 and 
+  CVE-2022-23634 [cyberark/conjur-service-broker#270](https://github.com/cyberark/conjur-service-broker/pull/270)
 - Updated puma to 5.5.1
   [cyberark/conjur-service-broker#267](https://github.com/cyberark/conjur-service-broker/pull/267)
 

Gemfile

@@ -12,15 +12,15 @@ end
 ruby '2.5.8'
 
 gem 'conjur-api', '~> 5.3.4'
-gem 'activesupport', '~> 5.2.4.6'
-gem 'railties', '~> 5.2.4.6'
-gem 'actionview', '~> 5.2.4.6'
+gem 'activesupport', '~> 5.2.6'
+gem 'railties', '~> 5.2.6'
+gem 'actionview', '~> 5.2.6'
 gem 'rack', '~> 2.2.3'
 gem 'json-schema', '~> 2.8'
 gem 'listen', '>= 3.0.5', '< 3.2'
 
 # Use Puma as the app server
-gem 'puma', '5.5.1'
+gem 'puma', '5.6.2'
 
 # Use Rack CORS for handling Cross-Origin Resource Sharing (CORS), making cross-origin AJAX possible
 # gem 'rack-cors'

Gemfile.lock

@@ -1,20 +1,20 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionpack (5.2.4.6)
-      actionview (= 5.2.4.6)
-      activesupport (= 5.2.4.6)
+    actionpack (5.2.6.2)
+      actionview (= 5.2.6.2)
+      activesupport (= 5.2.6.2)
       rack (~> 2.0, >= 2.0.8)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.4.6)
-      activesupport (= 5.2.4.6)
+    actionview (5.2.6.2)
+      activesupport (= 5.2.6.2)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activesupport (5.2.4.6)
+    activesupport (5.2.6.2)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -39,7 +39,7 @@ GEM
       ci_reporter (~> 2.0)
       rspec (>= 2.14, < 4)
     coderay (1.1.3)
-    concurrent-ruby (1.1.8)
+    concurrent-ruby (1.1.9)
     conjur-api (5.3.4)
       activesupport
       rest-client
@@ -65,7 +65,7 @@ GEM
     http-accept (1.7.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
-    i18n (1.8.10)
+    i18n (1.9.1)
       concurrent-ruby (~> 1.0)
     json-schema (2.8.0)
       addressable (>= 2.4)
@@ -83,15 +83,15 @@ GEM
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
       ruby_dep (~> 1.2)
-    loofah (2.9.1)
+    loofah (2.14.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     method_source (1.0.0)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2020.1104)
     mini_portile2 (2.6.1)
-    minitest (5.14.4)
+    minitest (5.15.0)
     multi_json (1.15.0)
     multi_test (0.1.2)
     netrc (0.11.0)
@@ -108,24 +108,24 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.13.0)
     public_suffix (4.0.6)
-    puma (5.5.1)
+    puma (5.6.2)
       nio4r (~> 2.0)
-    racc (1.5.2)
+    racc (1.6.0)
     rack (2.2.3)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rails-dom-testing (2.0.3)
       activesupport (>= 4.2.0)
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.3.0)
+    rails-html-sanitizer (1.4.2)
       loofah (~> 2.3)
-    railties (5.2.4.6)
-      actionpack (= 5.2.4.6)
-      activesupport (= 5.2.4.6)
+    railties (5.2.6.2)
+      actionpack (= 5.2.6.2)
+      activesupport (= 5.2.6.2)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
-    rake (13.0.3)
+    rake (13.0.6)
     rb-fsevent (0.10.4)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
@@ -180,8 +180,8 @@ PLATFORMS
   x86_64-darwin-18
 
 DEPENDENCIES
-  actionview (~> 5.2.4.6)
-  activesupport (~> 5.2.4.6)
+  actionview (~> 5.2.6)
+  activesupport (~> 5.2.6)
   aruba
   bundler-audit
   byebug
@@ -193,9 +193,9 @@ DEPENDENCIES
   license_finder
   listen (>= 3.0.5, < 3.2)
   pry-byebug
-  puma (= 5.5.1)
+  puma (= 5.6.2)
   rack (~> 2.2.3)
-  railties (~> 5.2.4.6)
+  railties (~> 5.2.6)
   rest-client
   rspec (~> 3)
   rspec-rails (~> 3.7)

NOTICES.txt

@@ -12,16 +12,16 @@ SECTION 1: Apache-2.0
 
 SECTION 2: BSD-3-Clause
 
->>> https://rubygems.org/gems/puma/versions/5.5.1
+>>> https://rubygems.org/gems/puma/versions/5.6.2
 
 SECTION 3: MIT
 
->>> https://rubygems.org/gems/actionview/versions/5.2.4.6
->>> https://rubygems.org/gems/activesupport/versions/5.2.4.6
+>>> https://rubygems.org/gems/actionview/versions/5.2.6.2
+>>> https://rubygems.org/gems/activesupport/versions/5.2.6.2
 >>> https://rubygems.org/gems/json-schema/versions/2.8.0
 >>> https://rubygems.org/gems/listen/versions/3.1.5
 >>> https://rubygems.org/gems/rack/versions/2.2.3
->>> https://rubygems.org/gems/railties/versions/5.2.4.6
+>>> https://rubygems.org/gems/railties/versions/5.2.6.2
 
 
 APPENDIX: Standard License Files and Templates
@@ -56,7 +56,7 @@ limitations under the License.
 
 BSD-3-Clause License is applicable to the following component(s).
 
->>> https://rubygems.org/gems/puma/versions/5.5.1
+>>> https://rubygems.org/gems/puma/versions/5.6.2
 
 Copyright (c) 2019, Evan Phoenix. Some code by Zed Shaw, (c) 2005.
 All rights reserved.
@@ -90,7 +90,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 MIT License is applicable to the following component(s).
 
->>> https://rubygems.org/gems/actionview/versions/5.2.4.6
+>>> https://rubygems.org/gems/actionview/versions/5.2.6.2
 
 Copyright (c) 2005-2018 David Heinemeier Hansson'
 
@@ -112,7 +112,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
->>> https://rubygems.org/gems/activesupport/versions/5.2.4.6
+>>> https://rubygems.org/gems/activesupport/versions/5.2.6.2
 
 Copyright (c) 2005-2018 David Heinemeier Hansson'
 
@@ -200,7 +200,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
->>> https://rubygems.org/gems/railties/versions/5.2.4.6
+>>> https://rubygems.org/gems/railties/versions/5.2.6.2
 
 Copyright (c) 2005-2018 David Heinemeier Hansson'