🚨 [security] Update railties 8.0.0 → 8.0.0.1 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ railties (8.0.0 → 8.0.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 3 commits:

• Preparing for 8.0.0.1 release
• Update vendored trix version to 2.1.10
• Add CSP directive validation

✳️ actionpack (8.0.0 → 8.0.0.1) · Repo · Changelog

Security Advisories 🚨

🚨 Possible Content Security Policy bypass in Action Dispatch

There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.

Impact

Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.

Releases

The fixed releases are available at the normal locations.

Workarounds

Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Credits

Thanks to ryotak for the report!

Commits

See the full diff on Github. The new version differs by 3 commits:

• Preparing for 8.0.0.1 release
• Update vendored trix version to 2.1.10
• Add CSP directive validation

✳️ actionview (8.0.0 → 8.0.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 3 commits:

• Preparing for 8.0.0.1 release
• Update vendored trix version to 2.1.10
• Add CSP directive validation

✳️ activemodel (8.0.0 → 8.0.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 3 commits:

• Preparing for 8.0.0.1 release
• Update vendored trix version to 2.1.10
• Add CSP directive validation

✳️ activerecord (8.0.0 → 8.0.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 3 commits:

• Preparing for 8.0.0.1 release
• Update vendored trix version to 2.1.10
• Add CSP directive validation

✳️ activesupport (8.0.0 → 8.0.0.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 3 commits:

• Preparing for 8.0.0.1 release
• Update vendored trix version to 2.1.10
• Add CSP directive validation

↗️ nokogiri (indirect, 1.17.0 → 1.17.1) · Repo · Changelog

Release Notes

1.17.1

v1.17.1 / 2024-12-10

Fixed

• Fixed a potential segfault when using Node#dup and DocumentFragment#dup. [#3359] @byroot @flavorjones
• Node#dup and Node#clone now correctly decorate the new node with the document's Node decorators. [#3363] @flavorjones

sha256 checksums

b3fce09bddfab61ae587f83af97bf0d0834352bcd23ad99831f2993d978627bd  nokogiri-1.17.1-aarch64-linux.gem
0e79badf832783e81439c3211562ed904a5c8eaaa0038c8fdfdb3778e873f3d0  nokogiri-1.17.1-arm64-darwin.gem
b8e9909ff893b257a58066e6bfc39456be18b87f4af1e22ca18d7c0dbc9925e5  nokogiri-1.17.1-arm-linux.gem
910fe0f194db99677f7ddb21b19a1d071ceffc4a0e39d44c08736d9b1e558cfc  nokogiri-1.17.1.gem
baf2cf6785f83c8cb3cdc427d0eb8b7f91d76748bfeb6c2612ce639e82c1ecee  nokogiri-1.17.1-java.gem
601a8bca523bf2b1a576c728ad4901c57263d0c29e4f9e6d2abe654c6a929841  nokogiri-1.17.1-x64-mingw32.gem
299ab9cd2c4ce882112e79fc31f82915920cb3e54ba526287e86d9a5fbfafebe  nokogiri-1.17.1-x64-mingw-ucrt.gem
94bcacacd123379229a8ece0d31c38af36d0ef6f86f399d5813be5ca0f566c88  nokogiri-1.17.1-x86_64-darwin.gem
2234250605b03433747e8d21de947b38b79f33a4280930e58bec179fd95d415d  nokogiri-1.17.1-x86_64-linux.gem
d09565316ffc8f8bb522bd6d1b460dec2a57d23d6e479c2d0d49d9ccbb11076c  nokogiri-1.17.1-x86-linux.gem
8f720dd62bf5d3791aa67f933085be5d2a2ab06afc120d4f210f40a5d184fafb  nokogiri-1.17.1-x86-mingw32.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• version bump to v1.17.1
• fix: Node#dup adds the new node to the document's node cache (backport to v1.17.x) (#3364)
• fix: Node#dup adds the new node to the document's node cache
• doc: update CHANGELOG bullet lists to render with mkdocs
• doc: extract older changelog entries into misc/CHANGELOG-archive.md

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)