chore(deps): update dependency puma to v6.4.3 [security] #948
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/rubygems-puma-vulnerability
branch
from
771452c to
86d1af5
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## staging #948 +/- ##
========================================
Coverage 52.37% 52.37%
========================================
Files 55 55
Lines 1178 1178
========================================
Hits 617 617
Misses 561 561 ☔ View full report in Codecov by Sentry. |
lodewiges
approved these changes
Nov 27, 2024
DrumsnChocolate
added a commit
that referenced
this pull request
Nov 29, 2024
* chore(deps): update dependency paranoia to v3 (#931) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Edited the env file (#944) * edited the env file * changed company name to UTF-8 * chore(deps): update dependency puma to '~> 6.4.0' [security] (#935) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update actions/delete-package-versions action to v5 (#906) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency rails to v7.0.8.1 [security] (#918) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update docker/build-push-action action to v6 (#928) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update docker/login-action action to v3 (#886) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * feat(tests): add code coverage reporting (#891) * feat(tests): add code coverage reporting * fix: correct coverage path * refactor: use simplecov-lcov * fix: indentation in Gemfile.lock * fix: remove test filters * feat(README): add badge * refactor: try tokenless report uploading * chore: update codecov-action * chore: update codecov-action * fix(cd): pass CODECOV_TOKEN To ci * Revert "chore(deps): update docker/login-action action to v3 (#886)" (#951) This reverts commit d546681. due to CI failure * chore(deps): update codecov/codecov-action action to v5 (#950) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update dependency puma to v6.4.3 [security] (#948) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update actions/upload-artifact action to v4 (#949) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * Refractor/tomato to sofia (#947) * Intial commit * updated apliction.rb * Fixed mistake in credentials * Made it so the file is backwards compatiable * Fixed a typo * Update amber_oauth2.rb remove tomato paramater * Remove development title lux ad mosam (#946) * intial commit * Fix typo * update tomato to sofia * updated with suggestion --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: lodewiges <[email protected]> Co-authored-by: Guido de Jong <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
6.4.2->6.4.3GitHub Vulnerability Alerts
CVE-2024-45614
Impact
Clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users trusting headers set by their proxy may be affected. Attackers may be able to downgrade connections to HTTP (non-SSL) or redirect responses, which could cause confidentiality leaks if combined with a separate MITM attack.
Patches
v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win.
Workarounds
Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level.
Any users that are implicitly trusting the proxy defined headers for security or availability should immediately cease doing so until upgraded to the fixed versions.
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Amsterdam, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.