🚨 [security] Update rack-cors: 1.1.1 → 2.0.1 (major) #289
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ rack-cors (1.1.1 → 2.0.1) · Repo · Changelog
Release Notes
2.0.1 (from changelog)
2.0.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 52 commits:
Update version, changelog
Update testing
Use factory proc to construct transform headers
Cleanup
Change check for HeaderHash
Refs #259 (#260)
Update badge in README (#257)
Migrate CI to GitHub actions (#256)
Update CHANGELOG about 2.0.0 release date (#253)
Version 2.0
Refs #251, 862a776 Remove Rack::Utils::HeaderHash (#252)
[README] Update readme link (#248)
Update CHANGELOG
Fix case on access-control-allow-headers
Use Rack::Utils::HeaderHash
Moved --api comment in README
Add configuration note
Update custom protocol instructions
Document how to use custom protocols (chrome-extension://, etc.)
Changing to 2.0.0 RC release
Revert "Remove support for support headers as arrays"
Remove support for support headers as arrays
Lower case all header names (rack spec)
Up to version 2.1.0
Major version update
Support custom protocols as origins
README: Exampe for start & end string anchors
Remove incorrect wildcard usage from README
Update Rails6 example
Update rack example
Update Rails5 example
Link to SO about testing CORS
Updates to note common issues.
Update .travis.yml
Update README.md
Revised README for Rails setups
Added Rails6 example
Rails6 example: default install
Add specific help on serving static files
Fix example link in README
Merge pull request #202 from MXfive/refactor
Actually run the test suite in Travis CI
Update version.rb
Try to make Travis run Rubocop
Merge branch 'master' into refactor
Preparing for next release
Rever Rubocop auto corrections to examples applied before excluding it
Drop Ruby 2.2, add 2.7
Try to get travis to run Rubocop
Rubocop apocalypse
Add Rubocop
Refactor classes into their own files
✳️ rack (2.2.3 → 2.2.6.4) · Repo · Changelog
Security Advisories 🚨
🚨 Possible Denial of Service Vulnerability in Rack’s header parsing
🚨 Possible DoS Vulnerability in Multipart MIME parsing
🚨 Denial of service via header parsing in Rack
🚨 Denial of service via multipart parsing in Rack
🚨 Denial of Service Vulnerability in Rack Content-Disposition parsing
🚨 Denial of Service Vulnerability in Rack Multipart Parsing
🚨 Possible shell escape sequence injection vulnerability in Rack
Commits
See the full diff on Github. The new version differs by 34 commits:
bump version
Avoid ReDoS problem
bump version
Limit all multipart parts, not just files
bumping version
Fix ReDoS in Rack::Utils.get_byte_ranges
bump version
Update changelog
Fix ReDoS vulnerability in multipart parser
Forbid control characters in attributes
Bump patch version.
Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2011)
Remove leading dot to fix compatibility with latest cgi gem. (#1988)
Update tests to work on latest Rubies. (#1999)
Bump patch release.
Fix Regexp deprecated third argument with Regexp::NOENCODING (#1998)
fixup changelog
bump version
Better handling of case-insensitive headers for `Rack::Etag` middleware. (#1919)
Add 'custom exception on params too deep error' change to CHANGELOG. (#1914)
Expect additional optional version segment in version test. (#1913)
Merge branch '2-2-sec' into 2-2-stable
update changelog
bump version
Escape untrusted text when logging
Restrict broken mime parsing
Ensure Rack::QueryParser::ParamsTooDeepError is inherited from RangeError. (#1864)
Add Ruby 2.3 compatibility for tests, add Ruby 2.3 to CI. (#1863)
Merge pull request #1839 from RubyElders/2-2-stable-ci
Replace CircleCI with GitHub Actions.
Newer rubies spec compatibility.
Merge pull request #1838 from RubyElders/custom-range-exception-2-2
Use custom exception on params too deep error.
Don't ary.inspect in the lint assertions (backport) (#1765)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.All Depfu comment commands