Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] Update aws-sdk-rails 3.8.0 → 3.13.0 (minor) #1318

Closed
wants to merge 1 commit into from
Closed

🚨 [security] Update aws-sdk-rails 3.8.0 → 3.13.0 (minor) #1318

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Jun 7, 2024

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ aws-sdk-rails (3.8.0 → 3.13.0) · Repo · Changelog

Release Notes

3.13.0

Tag release v3.13.0

References: #118, #119, #121, #122, #124, #126

  • Feature - Use Concurrent.available_processor_count to set default thread pool max threads (#125).
  • Issue - No longer rely on caller_runs for backpressure in sqs active job executor (#123).

3.12.0

Tag release v3.12.0

References: #116, #117

  • Feature - Drop support for Ruby 2.3 and Ruby 2.4 (#117).
  • Issue - Fix EbsSqsActiveJobMiddleware to detect Docker container with cgroup2. (#116).

3.11.0

  • Feature - Add retry_standard_errors (default true) in SQS ActiveJob and improve retry logic (#114).

3.10.0

Tag release v3.10.0

References: #108, #109, #110

  • Feature - Support enqueue_all in the SQS ActiveJob adapter.

  • Issue - Improve to_h method's performance of Aws::Rails::SqsActiveJob::Configuration.

3.9.1

Tag release v3.9.1

References: #107

  • Issue - Fix negative delay_seconds being passed to parameter in the SQS adapter.

3.9.0

Tag release v3.9.0

References: #102, #103, #104

  • Feature - Add support for selectively choosing deduplication keys.

  • Feature - Set required Ruby version to >= 2.3 (#104)

  • Issue - Run rubocop on all files. (#104)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ aws-partitions (indirect, 1.907.0 → 1.941.0) · Repo

Sorry, we couldn't find anything useful about this release.

↗️ aws-record (indirect, 2.11.0 → 2.13.0) · Repo · Changelog

Release Notes

2.13.0

Tag release v2.13.0

References: #138

  • Feature - Allow custom update_expression to be passed through to the
    underlying client calls. (#137)

2.12.0

Tag release v2.12.0

References: #112, #133, #134, #135, #136

  • Feature - Allow put, update, and delete item options to be passed through to
    the underlying client calls.

  • Feature - Add an original_error accessor to Errors::ConditionalWriteFailed
    which contains the Aws::DynamoDB::Errors::ConditionalCheckFailedException
    error. If :return_values_on_condition_check_failure was provided to a put,
    update, or delete item call, this error will contain the item data that failed
    the condition check.

  • Issue - Fix default value for String/Numeric Sets to be unset. (#133)

  • Feature - Set required Ruby version to >= 2.3 (#134)

  • Issue - Run Rubocop on all files. (#135)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ aws-sdk-core (indirect, 3.191.6 → 3.197.0) · Repo · Changelog

Release Notes

3.196.1 (from changelog)

  • Issue - Fix ConnectionPool for .empty! and .clear! since it prevented adding a new key from being added to the pool (#3020).

3.196.0 (from changelog)

  • Feature - Updated Aws::STS::Client with the latest API changes.

  • Feature - Updated Aws::SSOOIDC::Client with the latest API changes.

  • Feature - Updated Aws::SSO::Client with the latest API changes.

3.195.0 (from changelog)

  • Feature - Updated Aws::SSOOIDC::Client with the latest API changes.

  • Feature - Updated request parameters for PKCE support.

3.194.2 (from changelog)

  • Issue - Fix issue where ConnectionPool size iteration would prevent a new key from being added to the pool.

3.194.1 (from changelog)

  • Issue - Update EC2 protocol to not serialize empty lists.

3.194.0 (from changelog)

  • Feature - Add an API private cache for S3 Express and Access Grants.

3.193.0 (from changelog)

  • Feature - Updated Aws::STS::Client with the latest API changes.

  • Feature - Updated Aws::SSOOIDC::Client with the latest API changes.

  • Feature - Updated Aws::SSO::Client with the latest API changes.

  • Issue - Update event stream documentation.

  • Issue - Move InvocationId plugin to all clients.

  • Issue - Handle event streaming content-sha256 header in the signer plugin.

  • Issue - Add the event stream content type to initial requests.

  • Issue - Fix standard and adaptive retry mode for event streams.

  • Issue - Add authority to http2 headers.

  • Issue - Do not treat single members in event stream structures as implicit payloads.

  • Issue - Do not wait for initial response headers to start sending input events.

3.192.1 (from changelog)

  • Issue - Drop key/value pair if value is nil when deserializing json maps.

3.192.0 (from changelog)

  • Feature - Updated Aws::STS::Client with the latest API changes.

  • Feature - Update serializing/deserializing for all protocols to align with Smithy protocol-tests.

  • Issue - Allow nil values in lists and maps.

  • Issue - Populate headers for XML and JSON error responses.

  • Issue - Support fractional seconds when parsing DateTime timestamps.

  • Issue - Correctly serialize flattened lists for Query protocol.

  • Issue - Correctly serialize payload name in Rest-XML requests.

  • Issue - Fix an issue where Rest-XML requests do not have a default Content-Type header applied.

  • Issue - Apply appropriate Content-Type header for payloads in Rest services.

  • Issue - Correctly serialize URI label bindings in Rest requests.

  • Issue - Correctly serialize and parse header bindings in Rest services.

  • Issue - Ensure that null and empty headers are not sent in Rest requests.

  • Issue - Ensure keys in query maps do not override modeled keys in Rest requests.

  • Issue - Ensure empty blob payloads are omitted in Rest requests.

  • Issue - Support parsing of NaN, Infinity and -Infinity float values.

  • Issue - Apply appropriate xmlName for flattened lists and maps in Rest-XML services.

  • Issue - Handle serializing of different formats of xmlNamespace on shapes.

  • Issue - Fix deserializing of an empty blob to produce an empty string.

  • Issue - Fix deserializing an empty self-closed blob to produce an empty string.

  • Issue - Support parsing of different formats of error data in Rest-XML services.

Does any of this look wrong? Please let us know.

↗️ aws-sdk-dynamodb (indirect, 1.93.1 → 1.112.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ aws-sdk-ses (indirect, 1.55.0 → 1.63.0) · Repo · Changelog

Release Notes

1.63.0

References: #692

  • Feature - Aws::CloudFront - Added support for the 2014-11-06 API version.
  • Feature - Aws::IAM - Added support for managed policies.

1.62.0

References: #241, #574, #640, #641, #645, #656, #657, #669, #672, #681, #691, #693

  • Feature - AWS::AutoScaling - Added support for classic link to launch configurations.
    Closes #691.

  • Feature - AWS::EC2 - AWS::EC2::InstanceCollection#create now passes through the
    optional :client_token. Resolves #640.

  • Feature - AWS::S3 - Added a :request_payer option to AWS::S3::Client#get_object
    that sets the "x-amz-request-payer" header with the given value.

  • Issue - AWS::S3 - Resolved an issue with AWS::S3::Client#get_bucket_location
    for buckets in the eu-central-1 region.

  • Issue - AWS::S3 - Backported the "Expect: 100-continue" patch from the v2
    AWS SDK for Ruby and enabled expect 100 continue behavior by default
    when working with Amazon S3. Fixes #241.

  • Issue - AWS::S3 - Added :secure to the list of special fields for the
    pre-signed post tool. Fixes #641.

  • Issue - AWS::S3 - The AWS::S3::S3Object#restore method now passes through
    all additional options. Fixes #574.

  • Issue - AWS::Route53 - Resolved an issue that caused the following code
    to raise an error:

    AWS::Route53.new.hosted_zones.first
#=> was previously raising an ArgumentError

1.61.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.60.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.59.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.58.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.57.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.56.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

↗️ aws-sdk-sesv2 (indirect, 1.39.0 → 1.50.0) · Repo · Changelog

Release Notes

1.50.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.49.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.48.0 (from changelog)

  • Feature - Adds support for specifying replacement headers per BulkEmailEntry in SendBulkEmail in SESv2.

1.47.0 (from changelog)

  • Feature - Fixes ListContacts and ListImportJobs APIs to use POST instead of GET.

1.46.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.45.0 (from changelog)

  • Feature - Adds support for providing custom headers within SendEmail and SendBulkEmail for SESv2.

1.44.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.43.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.42.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

1.41.0 (from changelog)

  • Feature - This release provides enhanced visibility into your SES identity verification status. This will offer you more actionable insights, enabling you to promptly address any verification-related issues.

1.40.0 (from changelog)

  • Feature - Code Generated Changes, see ./build_tools or aws-sdk-core's CHANGELOG.md for details.

Does any of this look wrong? Please let us know.

↗️ aws-sdk-sqs (indirect, 1.62.0 → 1.76.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

↗️ aws-sessionstore-dynamodb (indirect, 2.1.0 → 2.2.0) · Repo · Changelog

Release Notes

2.2.0

Tag release v2.2.0

References: #34

  • Feature - Drop support for Ruby 2.3 and 2.4.

  • Issue - Relax rack dependency to allow version 3. Adds rack-session to the gemspec.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ builder (indirect, 3.2.4 → 3.3.0) · Repo · Changelog

↗️ concurrent-ruby (indirect, 1.2.3 → 1.3.2) · Repo · Changelog

Release Notes

1.3.1

This release is essentially v1.3.0, but with a properly packaged gem. There was an issue publishing v1.3.0 and that gem needed to be yanked to avoid breaking downstream projects. The v1.3.0 changelog is reproduced below.

What's Changed

  • Add Concurrent.usable_processor_count that is cgroups aware by @casperisfine in #1038
  • Align Java Executor Service behavior for shuttingdown?, shutdown? by @bensheldon in #1042

New Contributors

Full Changelog: v1.2.3...v1.3.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.14.4 → 1.14.5) · Repo · Changelog

Release Notes

1.14.5

What's Changed

  • Explicitly bundle racc gem for Ruby 3.3+ by @amatsuda in #690
  • Optimize I18n::Locale::Fallbacks#[] for recursive locale mappings by @uiur in #692
  • Add I18n.interpolation_keys by @tom-lord in #682
  • Fix syntax in documentation for I18n::Backend::Base.interpolate by @tom-lord in #691
  • Fix that escaped interpolations with reserved keywords raised ReservedInterpolationKey by @Bilka2 in #688

New Contributors

Full Changelog: v1.14.4...v1.14.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ method_source (indirect, 1.0.0 → 1.1.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mini_portile2 (indirect, 2.8.5 → 2.8.7) · Repo · Changelog

Release Notes

2.8.7

2.8.7 / 2024-05-31

Added

  • When setting the C compiler through the MiniPortile constructor, the preferred keyword argument is now :cc_command. The original :gcc_command is still supported. (#144 by @flavorjones)
  • Add support for extracting xz-compressed tarballs on OpenBSD. (#141 by @postmodern)
  • Add OpenBSD support to the experimental method MakeMakefile#mkmf_config. (#141 by @flavorjones)

Changed

  • MiniPortileCMake now detects the C and C++ compiler the same way MiniPortile does: by examining environment variables, then using kwargs, then looking in RbConfig (in that order). (#144 by @flavorjones)
  • GPG file verification error messages are captured in the raised exception. Previously these errors went to stderr. (#145 by @flavorjones)

2.8.6

2.8.6 / 2024-04-14

Added

  • When using CMake on FreeBSD, default to clang's "cc" and "c++" compilers. (#139 by @mudge)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ minitest (indirect, 5.22.3 → 5.23.1) · Repo · Changelog

Release Notes

5.23.1 (from changelog)

  • 1 bug fix:

    • Fully qualify the Queue class to avoid conflicts with other libraries. (rafaelfranca)

5.23.0 (from changelog)

  • 3 minor enhancements:

    • Added -Werror to raise on any warning output. (byroot)

    • Added UnexpectedWarning as a failure summary type, added count to output if activated.

    • Added minitest/manual_plugins.rb w/ new Minitest.load method. (tenderlove)

  • 2 bug fixes:

    • Allow empty_run! and reporter to display summary for empty runs. (zzak)

    • Make test task verbose using either rake’s -v or -t (was just -t).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nokogiri (indirect, 1.16.3 → 1.16.5) · Repo · Changelog

Security Advisories 🚨

🚨 Nokogiri updates packaged libxml2 to v2.12.7 to resolve CVE-2024-34459

Summary

Nokogiri v1.16.5 upgrades its dependency libxml2 to 2.12.7 from 2.12.6.

libxml2 v2.12.7 addresses CVE-2024-34459:

Impact

There is no impact to Nokogiri users because the issue is present only in libxml2's xmllint tool which Nokogiri does not provide or expose.

Timeline

  • 2024-05-13 05:57 EDT, libxml2 2.12.7 release is announced
  • 2024-05-13 08:30 EDT, nokogiri maintainers begin triage
  • 2024-05-13 10:05 EDT, nokogiri v1.16.5 is released and this GHSA made public
Release Notes

1.16.5

v1.16.5 / 2024-05-13

Security

Dependencies

sha256 checksums:

af0f44fa3e664dfb2aa10de8b551447d720c1e8d1f0aa3f35783dcc43e40a874  nokogiri-1.16.5-aarch64-linux.gem
23dc2357b26409a5c33b7e32a82902f0e9995305420f16d1a03ab3ea1a482fec  nokogiri-1.16.5-arm-linux.gem
950d037530edb49f75ad35de0b8038b970a7dda57e2b6326895b0e49fadf6214  nokogiri-1.16.5-arm64-darwin.gem
b7aefc94370c62476b8528e8d8abb6160203abd84a1f4eceda8f1aa8974d9989  nokogiri-1.16.5-java.gem
ec2167160df8fec3137bf95d574ed80ebc1d002bb3b281546b60b4aa9002466e  nokogiri-1.16.5-x64-mingw-ucrt.gem
6984200491fac69974005ecfa2de129d61843d345eafa5d6f58e8b908d1cf107  nokogiri-1.16.5-x64-mingw32.gem
abdc389ab1ec6604492da16bd9d06ad746fdb6bd6a1bd274c400d61ffcadb3c4  nokogiri-1.16.5-x86-linux.gem
63d24981345856f2baf7f4089870a62d3042fb8d3021b280fb04fc052532e3c4  nokogiri-1.16.5-x86-mingw32.gem
71b5f54e378c433d13df67c3b71acc4716129da62402d8181f310c4216a63279  nokogiri-1.16.5-x86_64-darwin.gem
0ca238da870066bed2f7837af6f35791bb9b76c4c5638999c46aac44818a6a97  nokogiri-1.16.5-x86_64-linux.gem
ec36162c68984fa0a90a5c4ae7ab7759460639e716cc1ce75f34c3cb54158ad2  nokogiri-1.16.5.gem

1.16.4

v1.16.4 / 2024-04-10

Dependencies

  • [CRuby] Vendored zlib in the precompiled native gems is updated to v1.3.1 from v1.3. Nokogiri is not affected by the minizip CVE patched in this version, but this update may satisfy some security scanners. Related, see this discussion about removing the compression libraries altogether in a future version of Nokogiri.

sha256 checksums:

bdb1dc4378ebcf3ade8f440c7df68f6d76946a1a96c4823a2b4c53c01a320cd5  nokogiri-1.16.4-aarch64-linux.gem
0c994b9996d5576eddcc3201a94ef2bff6fc3627c4ae4d2708b0ec9b9743ec6a  nokogiri-1.16.4-arm-linux.gem
8e86abb64c93c06d3c588042a0e757279e8f1dc88b5210a00be892a9a7a27196  nokogiri-1.16.4-arm64-darwin.gem
bf84fa28be4943692bd64772186e0832fb1061f80714ccb93e111e9d72b1cadc  nokogiri-1.16.4-java.gem
a46808467c1f63a2031e1ca0715cd5336bb4ec759e9c0e2f4c951c1cc30994ae  nokogiri-1.16.4-x64-mingw-ucrt.gem
4cdf64bc5e9443ec3e0b595347ecc8affe21968d9ae934c0825d26630ef96468  nokogiri-1.16.4-x64-mingw32.gem
d86d21bae47dd9f6f5223055e45d33fae08b0b89aad94cbc0ece4f4274fa7af5  nokogiri-1.16.4-x86-linux.gem
d488b872884844686780fda7cf5da44ee884d32faa713a55aeb4736d76718168  nokogiri-1.16.4-x86-mingw32.gem
a896e52a56951ffb0e6a9279afbf485d683e357a053d27f4cfcb2a73b0824628  nokogiri-1.16.4-x86_64-darwin.gem
92ff4f09910255fec84b3bc4c4b182e94cada3ed12b9f7a6ea058e0af186fb31  nokogiri-1.16.4-x86_64-linux.gem
62c116c3a14b4ed4e1faec786da266c4bd4c717a0bd04a9916164a7046040f45  nokogiri-1.16.4.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ racc (indirect, 1.7.3 → 1.8.0) · Repo · Changelog

Release Notes

1.8.0

What's Changed

  • Generate jar to build gem by @nobu in #255
  • Fix trivial typos by @ydah in #257
  • Try to fix test failure with Ruby 3.3 by @hsbt in #260
  • Reformat the rdoc so it renders correctly both locally and on github. by @zenspider in #258
  • Allow racc cmdline to read from stdin if no path specified. by @zenspider in #259
  • Add more grammars by @nurse in #222
  • Exclude 2.5 on macos-latest by @nobu in #263
  • Drop code for Ruby 1.6 by @nobu in #264
  • Refactor command line options by @nobu in #265
  • Change encode EUC-JP to UTF-8 by @ydah in #267
  • Organize README.ja.rdoc by @ydah in #266
  • Support error_on_expect_mismatch declaration in Racc grammar file by @yui-knk in #262
  • Bump up v1.8.0 by @yui-knk in #268

New Contributors

Full Changelog: v1.7.3...v1.8.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rake (indirect, 13.2.0 → 13.2.1) · Repo · Changelog

Release Notes

13.2.1

What's Changed

  • Suppressed "internal:array:52:in 'Array#each'" from backtrace by @hsbt in #554
  • Bump actions/configure-pages from 4 to 5 by @dependabot in #553

Full Changelog: v13.2.0...v13.2.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ zeitwerk (indirect, 2.6.13 → 2.6.15) · Repo · Changelog

Release Notes

2.6.15 (from changelog)

  • Internal improvements.

2.6.14 (from changelog)

  • Implements Zeitwerk::Loader#all_expected_cpaths, which returns a hash that maps the absolute paths of the files and directories managed by the receiver to their expected constant paths.

    Please, check its documentation for further details.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 rack-session (added, 1.0.2)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Jun 7, 2024
@mitlib mitlib temporarily deployed to thesis-submit-pr-1318 June 7, 2024 21:47 Inactive
@depfu depfu bot mentioned this pull request Jun 7, 2024
Closed
@depfu Depfu
Copy link
Contributor Author

depfu bot commented Jul 1, 2024

Closing because this update has already been applied

@depfu depfu bot closed this Jul 1, 2024
@depfu depfu bot deleted the depfu/update/aws-sdk-rails-3.13.0 branch July 1, 2024 14:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@mitlib