Skip to content
This repository has been archived by the owner on Feb 25, 2024. It is now read-only.

[Security] Update rake requirement from ~> 12.3.1 to ~> 13.0.1 #57

Closed
wants to merge 1 commit into from

Conversation

dependabot-preview[bot]
Copy link

Updates the requirements on rake to permit the latest version.

Changelog

Sourced from rake's changelog.

=== 13.0.1

==== Bug fixes

  • Fixed bug: Reenabled task raises previous exception on second invokation
    Pull Request #271 by thorsteneckel
  • Fix an incorrectly resolved arg pattern
    Pull Request #327 by mjbellantoni

=== 13.0.0

==== Enhancements

  • Follows recent changes on keyword arguments in ruby 2.7.
    Pull Request #326 by nobu
  • Make PackageTask be able to omit parent directory while packing files
    Pull Request #310 by tonytonyjan
  • Add order only dependency
    Pull Request #269 by take-cheeze

==== Compatibility changes

  • Drop old ruby versions(< 2.2)

=== 12.3.3

==== Bug fixes

  • Use the application's name in error message if a task is not found.
    Pull Request #303 by tmatilai

==== Enhancements:

  • Use File.open explicitly.
Commits
  • c8251e2 Bump version to 13.0.1
  • 8edd860 Fixed build failure of the latest GitHub Actions
  • b6e2a66 Merge pull request #271 from thorsteneckel/bugfix-reenable_invocation_exception
  • 985abff Merge pull request #327 from mjbellantoni/mjb-order-only-arg-fix
  • 4a90acb Merge pull request #329 from jeremyevans/skip-taint-test-on-2.7
  • 4dc6282 Skip a taint test on Ruby 2.7
  • a08b697 Merge pull request #328 from orien/gem-metadata
  • c3953d4 Add project metadata to the gemspec
  • 46a8f7c Update comments to reflect the current state
  • 00aacdc Fix an incorrectly resolved arg pattern
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Updates the requirements on [rake](https://github.com/ruby/rake) to permit the latest version.
- [Release notes](https://github.com/ruby/rake/releases)
- [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc)
- [Commits](ruby/rake@v12.3.2...v13.0.1)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@coveralls
Copy link

Pull Request Test Coverage Report for Build 190

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • No unchanged relevant lines lost coverage.
  • Overall coverage remained the same at 100.0%

Totals Coverage Status
Change from base Build 156: 0.0%
Covered Lines: 149
Relevant Lines: 149

💛 - Coveralls

@dependabot-preview
Copy link
Author

We've just been alerted that this update fixes a security vulnerability:

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects rake
There is an OS command injection vulnerability in Ruby Rake before 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |.

Affected versions: ["<= 12.3.2"]

@dependabot-preview dependabot-preview bot changed the title Update rake requirement from ~> 12.3.1 to ~> 13.0.1 [Security] Update rake requirement from ~> 12.3.1 to ~> 13.0.1 Feb 28, 2020
@dependabot-preview dependabot-preview bot added the security Pull requests that address a security vulnerability label Feb 28, 2020
@dependabot-preview
Copy link
Author

Superseded by #81.

@dependabot-preview dependabot-preview bot deleted the dependabot/bundler/rake-tw-13.0.1 branch January 1, 2021 04:54
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies security Pull requests that address a security vulnerability
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant