Compare commits

...
Author SHA1 Message Date
dependabot[bot] 3857b36b2a Bump debug from 1.11.0 to 1.11.1
Bumps [debug](https://github.com/ruby/debug) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/ruby/debug/releases)
- [Commits](https://github.com/ruby/debug/compare/v1.11.0...v1.11.1)

---
updated-dependencies:
- dependency-name: debug
  dependency-version: 1.11.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-10-26 22:28:00 +00:00
Mike Dalessio ca9b963961 dep: update sqlite3 and crass (#418)
* dep: update sqlite3 to 2.10.2

sqlite3 2.9.6 truncated SQL strings and bound values longer than
`INT_MAX` bytes, and could crash or deadlock when a callback raised.

ref: https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.10.2
ref: https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-4fqr-96q8-xrfx

* dep: update crass to 1.0.8

crass 1.0.7 tokenized bad URLs incorrectly, which allowed a CSS
sanitizer bypass.

ref: https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29
2026-10-26 18:24:58 -04:00
Jeremy Daer 59d2164b11 Merge pull request #379 from basecamp/check-trusted-ca-certificates
Check the trusted CA certificates at build time
2026-10-24 12:05:52 -07:00
Jeremy Daer d7589951cf Check the trusted CA certificates at build time
ruby:4.0.7-slim already ships ca-certificates 20250419+deb13u1, which removes
emSign ECC Root CA - G3 and AAA Certificate Services. Fail the build if either
root comes back in the store Ruby's OpenSSL loads.
2026-10-21 14:02:55 -07:00
2 changed files with 19 additions and 7 deletions

No files matched your search

+12
View File
@@ -13,6 +13,18 @@ RUN apt-get update -qq && \
ln -s /usr/lib/$(uname -m)-linux-gnu/libjemalloc.so.2 /usr/local/lib/libjemalloc.so && \
rm -rf /var/lib/apt/lists /var/cache/apt/archive
# Fail the build if either of these withdrawn roots is still where Ruby's OpenSSL looks for
# trusted certificates
RUN ruby -ropenssl -e ' \
file = ENV[OpenSSL::X509::DEFAULT_CERT_FILE_ENV] || OpenSSL::X509::DEFAULT_CERT_FILE; \
dir = ENV[OpenSSL::X509::DEFAULT_CERT_DIR_ENV] || OpenSSL::X509::DEFAULT_CERT_DIR; \
pems = [file, *Dir.glob(File.join(dir, "*"))].select { |path| File.file?(path) } \
.flat_map { |path| File.read(path).scan(/-----BEGIN CERTIFICATE-----.+?-----END CERTIFICATE-----/m) }; \
subjects = pems.map { |pem| OpenSSL::X509::Certificate.new(pem).subject.to_s }.uniq; \
abort "Only #{subjects.size} roots in #{file} and #{dir}" if subjects.size < 100; \
withdrawn = subjects.grep(%r{/CN=(emSign ECC Root CA - G3|AAA Certificate Services)\z}); \
abort "Withdrawn roots still trusted: #{withdrawn}" if withdrawn.any?'
# Set production environment
ENV RAILS_ENV="production" \
BUNDLE_DEPLOYMENT="1" \
+7 -7
View File
@@ -167,9 +167,9 @@ GEM
crack (1.0.0)
bigdecimal
rexml
crass (1.0.7)
crass (1.0.8)
date (3.5.1)
debug (1.11.0)
debug (1.11.1)
irb (~> 1.10)
reline (>= 0.3.8)
drb (2.2.3)
@@ -270,7 +270,7 @@ GEM
useragent (~> 0.16.3)
pp (0.6.4)
prettyprint
prettyprint (0.2.0)
prettyprint (0.2.1)
prism (1.9.0)
psych (5.5.0)
date
@@ -390,10 +390,10 @@ GEM
rack-protection (= 4.2.1)
rack-session (>= 2.0.0, < 3)
tilt (~> 2.0)
sqlite3 (2.9.6-aarch64-linux-gnu)
sqlite3 (2.9.6-arm64-darwin)
sqlite3 (2.9.6-x86_64-darwin)
sqlite3 (2.9.6-x86_64-linux-gnu)
sqlite3 (2.10.2-aarch64-linux-gnu)
sqlite3 (2.10.2-arm64-darwin)
sqlite3 (2.10.2-x86_64-darwin)
sqlite3 (2.10.2-x86_64-linux-gnu)
stimulus-rails (1.3.4)
railties (>= 6.0.0)
stringio (3.2.0)