Bump json to 2.20.0 (CVE-2026-54696)

Fixes a heap buffer overflow in the JSON generator when streaming an oversized object to an IO (JSON.dump(obj, io) / JSON::State#generate). Affects json 2.9.0-2.19.8; patched in 2.19.9. Bumps to the current 2.20.0 line via `bundle update json --conservative` (lockfile-only). GHSA-x2f5-4prf-w687 / https://nvd.nist.gov/vuln/detail/CVE-2026-54696 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update brakeman
2026-10-29 00:44:05 +09:00 · 2026-07-06 10:09:20 +02:00 · 2026-06-29 14:35:42 +02:00 · 2026-06-29 14:35:42 +02:00 · 2026-06-29 13:32:23 +02:00 · 2026-06-29 13:32:14 +02:00
18 changed files with 294 additions and 76 deletions
@@ -1,4 +1,4 @@
-<% if (session_token = `op signin --account basecamp --raw`.strip) != "" %># Generated by mrsk envify
+<% if (session_token = `op signin --account 23QPQDKZC5BKBIIG7UGT5GR5RM --raw`.strip) != "" %># Generated by mrsk envify
 MRSK_REGISTRY_PASSWORD=<%= `op read "op://Deploy/Docker Hub MRSK/password" -n --session  #{session_token}` %>
 RAILS_MASTER_KEY=<%= `op read "op://Development/Chat-in-a-box/RAILS_MASTER_KEY" -n --session  #{session_token}` %>
 <% else raise ArgumentError, "Session token missing" end %>
@@ -0,0 +1,32 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: bundler
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      semver-major-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 2
+      default-days: 7
+
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      semver-major-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 2
+      default-days: 7
@@ -6,16 +6,22 @@ on:
  pull_request:
    branches: [ main ]

+permissions: {}
+
 jobs:
  scan:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read

    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        with:
          ruby-version: .ruby-version
          bundler-cache: true
@@ -25,12 +31,16 @@ jobs:

  lint:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    steps:
      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        with:
          ruby-version: .ruby-version
          bundler-cache: true
@@ -38,11 +48,32 @@ jobs:
      - name: Lint code for consistent style
        run: bin/rubocop

+  lint-actions:
+    name: GitHub Actions audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false
+
  test:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    services:
      redis:
-        image: redis
+        image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
        ports:
          - 6379:6379
        options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
@@ -51,10 +82,12 @@ jobs:
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg

      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        env:
          REDIS_URL: redis://localhost:6379/0
        with:
@@ -66,9 +99,11 @@ jobs:

  test_system:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
    services:
      redis:
-        image: redis
+        image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
        ports:
          - 6379:6379
        options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
@@ -77,10 +112,12 @@ jobs:
        run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg

      - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false

      - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
        env:
          REDIS_URL: redis://localhost:6379/0
        with:
@@ -13,11 +13,7 @@ concurrency:
  group: publish-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

-permissions:
-  contents: read
-  packages: write
-  id-token: write
-  attestations: write
+permissions: {}

 env:
  IMAGE_DESCRIPTION: Campfire is a web-based chat application with multiple rooms, direct messages, file attachments with previews, search, web push notifications, @mentions, and bot integrations. Single-tenant; production-ready image with web app, background jobs, caching, file serving, and SSL.
@@ -27,6 +23,11 @@ jobs:
  build:
    name: Build and push image (${{ matrix.arch }})
    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
    timeout-minutes: 45
    strategy:
      fail-fast: false
@@ -43,13 +44,15 @@ jobs:
      IMAGE_NAME: ${{ github.repository }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Log in to GHCR
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -66,7 +69,7 @@ jobs:

      - name: Extract Docker metadata (tags, labels) with arch suffix
        id: meta
-        uses: docker/metadata-action@v5.8.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        with:
          images: ${{ steps.vars.outputs.canonical }}
          tags: |
@@ -84,7 +87,7 @@ jobs:

      - name: Build and push (${{ matrix.platform }})
        id: build
-        uses: docker/build-push-action@v6.18.0
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          file: Dockerfile
@@ -102,7 +105,7 @@ jobs:

      - name: Attest image provenance (per-arch)
        if: github.event_name != 'pull_request'
-        uses: actions/attest-build-provenance@v3.0.0
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
        with:
          subject-name: ${{ steps.vars.outputs.canonical }}
          subject-digest: ${{ steps.build.outputs.digest }}
@@ -113,16 +116,20 @@ jobs:
    needs: build
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
    timeout-minutes: 20
    env:
      REGISTRY: ghcr.io
      IMAGE_NAME: ${{ github.repository }}
    steps:
      - name: Set up Docker Buildx (for imagetools)
-        uses: docker/setup-buildx-action@v3.11.1
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

      - name: Log in to GHCR
-        uses: docker/login-action@v3.5.0
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
@@ -139,7 +146,7 @@ jobs:

      - name: Compute base tags (no suffix)
        id: meta
-        uses: docker/metadata-action@v5.8.0
+        uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
        with:
          images: ${{ steps.vars.outputs.canonical }}
          tags: |
@@ -157,9 +164,11 @@ jobs:

      - name: Create multi-arch manifests
        shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
          echo "Creating manifests for tags:"
          printf '%s\n' "$tags"
          while IFS= read -r tag; do
@@ -185,13 +194,15 @@ jobs:
          done <<< "$tags"

      - name: Install Cosign
-        uses: sigstore/cosign-installer@v3.9.2
+        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2

      - name: Cosign sign all tags (keyless OIDC)
        shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
        run: |
          set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
          printf '%s\n' "$tags"
          while IFS= read -r tag; do
            [ -z "$tag" ] && continue
@@ -26,7 +26,7 @@ FROM base AS build

 # Install packages need to build gems
 RUN apt-get update -qq && \
-    apt-get install -y build-essential git pkg-config libyaml-dev  && \
+    apt-get install -y build-essential git pkg-config libyaml-dev libssl-dev && \
    rm -rf /var/lib/apt/lists /var/cache/apt/archives

 # Install application gems
@@ -12,7 +12,7 @@ gem "sqlite3"
 gem "redis", "~> 5.4"

 # Deployment
-gem "puma", "~> 6.6"
+gem "puma", "~> 7.2", ">= 7.2.1"

 # Jobs
 gem "resque", "~> 2.7.0"
@@ -48,6 +48,7 @@ gem "thruster"
 group :development, :test do
  gem "debug"
  gem "rubocop-rails-omakase", require: false
+  gem "bundler-audit", require: false
  gem "faker", require: false
  gem "brakeman", require: false
 end
@@ -128,18 +128,21 @@ GIT
 GEM
  remote: https://rubygems.org/
  specs:
-    action_text-trix (2.1.15)
+    action_text-trix (2.1.19)
      railties
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
    ast (2.4.3)
    base64 (0.3.0)
-    bcrypt (3.1.20)
+    bcrypt (3.1.22)
    benchmark (0.5.0)
    bigdecimal (3.3.1)
-    brakeman (7.1.1)
+    brakeman (8.0.5)
      racc
    builder (3.3.0)
+    bundler-audit (0.9.3)
+      bundler (>= 1.2.0)
+      thor (~> 1.0)
    capybara (3.40.0)
      addressable
      matrix
@@ -150,18 +153,18 @@ GEM
      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
    chunky_png (1.4.0)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.7)
    connection_pool (2.5.5)
    crack (1.0.0)
      bigdecimal
      rexml
-    crass (1.0.6)
-    date (3.5.0)
+    crass (1.0.7)
+    date (3.5.1)
    debug (1.11.0)
      irb (~> 1.10)
      reline (>= 0.3.8)
    drb (2.2.3)
-    erb (6.0.0)
+    erb (6.0.4)
    erubi (1.13.1)
    faker (3.5.2)
      i18n (>= 1.8.11, < 2)
@@ -188,8 +191,8 @@ GEM
    jbuilder (2.14.1)
      actionview (>= 7.0.0)
      activesupport (>= 7.0.0)
-    json (2.13.2)
-    jwt (3.1.2)
+    json (2.20.0)
+    jwt (3.2.0)
      base64
    kredis (1.8.0)
      activemodel (>= 6.0.0)
@@ -221,7 +224,7 @@ GEM
      ruby2_keywords (~> 0.0.1)
    net-http-persistent (4.0.6)
      connection_pool (~> 2.2, >= 2.2.4)
-    net-imap (0.5.12)
+    net-imap (0.6.4.1)
      date
      net-protocol
    net-pop (0.1.2)
@@ -231,13 +234,13 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.18.10-aarch64-linux-gnu)
+    nokogiri (1.19.4-aarch64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.18.10-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.18.10-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
    openssl (3.3.0)
    ostruct (0.6.3)
@@ -256,15 +259,15 @@ GEM
      date
      stringio
    public_suffix (6.0.2)
-    puma (6.6.1)
+    puma (7.2.1)
      nio4r (~> 2.0)
    racc (1.8.1)
-    rack (3.2.4)
-    rack-protection (4.1.1)
+    rack (3.2.6)
+    rack-protection (4.2.1)
      base64 (>= 0.1.0)
      logger (>= 1.6.0)
      rack (>= 3.0.0, < 4)
-    rack-session (2.1.1)
+    rack-session (2.1.2)
      base64 (>= 0.1.0)
      rack (>= 3.0.0)
    rack-test (2.2.0)
@@ -305,12 +308,12 @@ GEM
    resque-pool (0.7.1)
      rake (>= 10.0, < 14.0)
      resque (>= 1.22, < 3)
-    rexml (3.4.1)
-    rqrcode (3.1.0)
+    rexml (3.4.4)
+    rqrcode (3.2.0)
      chunky_png (~> 1.0)
      rqrcode_core (~> 2.0)
-    rqrcode_core (2.0.0)
-    rubocop (1.80.0)
+    rqrcode_core (2.1.0)
+    rubocop (1.80.2)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -357,11 +360,11 @@ GEM
    sentry-ruby (5.26.0)
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.0.2)
-    sinatra (4.1.1)
+    sinatra (4.2.1)
      logger (>= 1.6.0)
      mustermann (~> 3.0)
      rack (>= 3.0.0, < 4)
-      rack-protection (= 4.1.1)
+      rack-protection (= 4.2.1)
      rack-session (>= 2.0.0, < 3)
      tilt (~> 2.0)
    sqlite3 (2.7.3-aarch64-linux-gnu)
@@ -377,13 +380,13 @@ GEM
    thruster (0.1.15-x86_64-darwin)
    thruster (0.1.15-x86_64-linux)
    tilt (2.6.1)
-    timeout (0.4.4)
+    timeout (0.6.1)
    tsort (0.2.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
-    unicode-display_width (3.1.5)
-      unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.2.0)
    uri (1.1.1)
    useragent (0.16.11)
    web-push (3.0.2)
@@ -412,6 +415,7 @@ DEPENDENCIES
  bcrypt
  benchmark
  brakeman
+  bundler-audit
  capybara
  debug
  faker
@@ -425,7 +429,7 @@ DEPENDENCIES
  ostruct
  platform_agent
  propshaft!
-  puma (~> 6.6)
+  puma (~> 7.2, >= 7.2.1)
  rails!
  rails_autolink
  redis (~> 5.4)
@@ -444,4 +448,4 @@ DEPENDENCIES
  webmock

 BUNDLED WITH
-   2.5.9
+  4.0.13
@@ -67,17 +67,27 @@ module Authentication
      authenticated_as session
    end

+    def terminate_current_session
+      Current.session&.destroy!
+      reset_session
+      remove_authentication_cookie
+    end
+
    def authenticated_as(session)
-      Current.user = session.user
+      Current.session = session
      set_authenticated_by(:session)
-      cookies.signed.permanent[:session_token] = { value: session.token, httponly: true, same_site: :lax }
+      set_authentication_cookie(session)
    end

    def post_authenticating_url
      session.delete(:return_to_after_authenticating) || root_url
    end

-    def reset_authentication
+    def set_authentication_cookie(session)
+      cookies.signed.permanent[:session_token] = { value: session.token, httponly: true, same_site: :lax }
+    end
+
+    def remove_authentication_cookie
      cookies.delete(:session_token)
    end

@@ -18,7 +18,7 @@ class SessionsController < ApplicationController

  def destroy
    remove_push_subscription
-    reset_authentication
+    terminate_current_session
    redirect_to root_url
  end

@@ -16,7 +16,7 @@ class Users::SidebarsController < ApplicationController

    def find_direct_placeholder_users
      exclude_user_ids = user_ids_already_in_direct_rooms_with_current_user.including(Current.user.id)
-      User.active.where.not(id: exclude_user_ids).order(:created_at).limit(DIRECT_PLACEHOLDERS - exclude_user_ids.count)
+      User.active.where.not(id: exclude_user_ids).order(:created_at).limit([ DIRECT_PLACEHOLDERS - exclude_user_ids.count, 0 ].max)
    end

    def user_ids_already_in_direct_rooms_with_current_user
@@ -1,8 +1,16 @@
 class Current < ActiveSupport::CurrentAttributes
-  attribute :user, :request
+  attribute :session, :user, :request

  delegate :host, :protocol, to: :request, prefix: true, allow_nil: true

+  def session=(value)
+    super(value)
+
+    if value.present?
+      self.user = session.user
+    end
+  end
+
  def account
    Account.first
  end
@@ -60,7 +60,10 @@ echo
 if command -v brew &>/dev/null; then
  step "Installing packages" brew install sqlite ffmpeg mise
 elif command -v pacman &>/dev/null; then
-  step "Installing packages" sudo pacman -S --noconfirm --needed sqlite ffmpeg mise
+  packages=(sqlite ffmpeg mise)
+  if ! pacman -Q "${packages[@]}" >/dev/null 2>&1; then
+    step "Installing packages" sudo pacman -S --noconfirm --needed "${packages[@]}"
+  fi
 elif command -v apt &>/dev/null; then
  step "Installing packages" sudo apt-get install --no-install-recommends -y libsqlite3-0 ffmpeg
 fi
@@ -100,6 +103,20 @@ if ! redis_running; then
  fi
 fi

+# Install GitHub Actions linting tools
+for tool in actionlint shellcheck zizmor; do
+  if ! command -v "$tool" &> /dev/null; then
+    if command -v brew &> /dev/null; then
+      step "Installing $tool" brew install "$tool"
+    elif command -v pacman &> /dev/null; then
+      step "Installing $tool" sudo pacman -S --noconfirm "$tool"
+    else
+      echo "Error: install $tool manually" >&2
+      exit 1
+    fi
+  fi
+done
+
 step "Cleaning up logs and tempfiles" rails log:clear tmp:clear

 step "Restarting services" rails restart
@@ -4,6 +4,8 @@ CI.run do
  step "Setup", "bin/setup --skip-server"

  step "Style: Ruby", "bin/rubocop"
+  step "Style: GitHub Actions (actionlint)", "actionlint"
+  step "Style: GitHub Actions (zizmor)", "zizmor ."

  step "Security: Gem audit", "bin/bundler-audit"
  step "Security: Importmap vulnerability audit", "bin/importmap audit"
@@ -5,7 +5,7 @@ pin "@hotwired/stimulus-loading", to: "stimulus-loading.js"
 pin "@hotwired/turbo-rails", to: "turbo.js"
 pin "@rails/actioncable", to: "actioncable.esm.js"
 pin "@rails/request.js", to: "@rails--request.js" # @0.0.8
-pin "trix", to: "trix.esm.min.js" # @2.0.10
+pin "trix", to: "trix.esm.min.js" # @2.1.19
 pin "@rails/actiontext", to: "actiontext.js"
 pin "highlight.js", to: "highlight.js/core.js"

@@ -16,7 +16,7 @@ module RestrictedHTTP

    def private_ip?(ip)
      IPAddr.new(ip).then do |ipaddr|
-        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? || ipaddr.ipv4_mapped? || LOCAL_IP.include?(ipaddr)
+        ipaddr.private? || ipaddr.loopback? || ipaddr.link_local? || ipaddr.ipv4_mapped? || ipaddr.ipv4_compat? || LOCAL_IP.include?(ipaddr)
      end
    rescue IPAddr::InvalidAddressError
      true
@@ -28,7 +28,9 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest
  end

  test "create with valid credentials" do
-    post session_url, params: { email_address: "david@37signals.com", password: "secret123456" }
+    assert_difference -> { Session.count }, +1 do
+      post session_url, params: { email_address: "david@37signals.com", password: "secret123456" }
+    end

    assert_redirected_to root_url
    assert parsed_cookies.signed[:session_token]
@@ -43,11 +45,15 @@ class SessionsControllerTest < ActionDispatch::IntegrationTest

  test "destroy" do
    sign_in :david
+    session = users(:david).sessions.last

-    delete session_url
+    assert_difference -> { Session.count }, -1 do
+      delete session_url
+    end

    assert_redirected_to root_url
    assert_not cookies[:session_token].present?
+    assert_nil Session.find_by(id: session.id)
  end

  test "destroy removes the push subscription for the device" do
@@ -0,0 +1,89 @@
+require "test_helper"
+require "restricted_http/private_network_guard"
+
+class RestrictedHTTP::PrivateNetworkGuardTest < ActiveSupport::TestCase
+  test "private_ip? returns true for 'This' network (RFC1700)" do
+    assert_private_ip "0.0.0.0"
+    assert_private_ip "0.255.255.255"
+  end
+
+  test "private_ip? returns true for loopback addresses" do
+    assert_private_ip "127.0.0.0"
+    assert_private_ip "127.0.0.1"
+    assert_private_ip "127.255.255.255"
+  end
+
+  test "private_ip? returns true for RFC1918 private addresses" do
+    assert_private_ip "10.0.0.0"
+    assert_private_ip "10.255.255.255"
+    assert_private_ip "172.16.0.0"
+    assert_private_ip "172.31.255.255"
+    assert_private_ip "192.168.0.0"
+    assert_private_ip "192.168.255.255"
+  end
+
+  test "private_ip? returns true for link-local addresses" do
+    assert_private_ip "169.254.0.1"
+    assert_private_ip "169.254.169.254"  # AWS IMDS
+    assert_private_ip "169.254.255.255"
+  end
+
+  test "private_ip? returns false for public addresses" do
+    assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("93.184.216.34")
+    assert_not RestrictedHTTP::PrivateNetworkGuard.private_ip?("8.8.8.8")
+  end
+
+  # IPv6 address format tests (SSRF bypass prevention)
+
+  test "private_ip? returns true for IPv4-mapped IPv6 addresses with private IPs" do
+    assert_private_ip "::ffff:192.168.1.1"
+    assert_private_ip "::ffff:10.0.0.1"
+    assert_private_ip "::ffff:172.16.0.1"
+  end
+
+  test "private_ip? returns true for IPv4-mapped IPv6 addresses with link-local IPs" do
+    assert_private_ip "::ffff:169.254.169.254"  # AWS metadata via mapped format
+  end
+
+  test "private_ip? returns true for IPv4-mapped IPv6 addresses even with public IPs" do
+    # Block all ipv4_mapped? since DNS never returns this format legitimately
+    assert_private_ip "::ffff:93.184.216.34"
+  end
+
+  test "private_ip? returns true for IPv4-compatible IPv6 addresses with private IPs" do
+    assert_private_ip "::192.168.1.1"
+    assert_private_ip "::10.0.0.1"
+  end
+
+  test "private_ip? returns true for IPv4-compatible IPv6 addresses with link-local IPs" do
+    assert_private_ip "::169.254.169.254"  # AWS metadata via compat format - the reported bypass
+  end
+
+  test "private_ip? returns true for IPv4-compatible IPv6 addresses even with public IPs" do
+    # Block all ipv4_compat? since DNS never returns this format legitimately
+    assert_private_ip "::93.184.216.34"
+  end
+
+  test "private_ip? returns true for invalid addresses" do
+    assert RestrictedHTTP::PrivateNetworkGuard.private_ip?("not-an-ip")
+    assert RestrictedHTTP::PrivateNetworkGuard.private_ip?("")
+  end
+
+  test "resolve raises Violation for private hostname" do
+    Resolv.stubs(:getaddress).returns("192.168.1.1")
+    assert_raises RestrictedHTTP::Violation do
+      RestrictedHTTP::PrivateNetworkGuard.resolve("private.example.com")
+    end
+  end
+
+  test "resolve returns IP for public hostname" do
+    Resolv.stubs(:getaddress).returns("93.184.216.34")
+    assert_equal "93.184.216.34", RestrictedHTTP::PrivateNetworkGuard.resolve("example.com")
+  end
+
+  private
+    def assert_private_ip(address)
+      assert RestrictedHTTP::PrivateNetworkGuard.private_ip?(address),
+        "Expected #{address} to be classified as private"
+    end
+end
@@ -1,6 +1,7 @@
 /*
-Trix 2.0.10
-Copyright © 2024 37signals, LLC
+Trix 2.1.19
+Copyright © 2026 37signals, LLC
 */
-var t="2.0.10";const e="[data-trix-attachment]",i={preview:{presentation:"gallery",caption:{name:!0,size:!0}},file:{caption:{size:!0}}},n={default:{tagName:"div",parse:!1},quote:{tagName:"blockquote",nestable:!0},heading1:{tagName:"h1",terminal:!0,breakOnReturn:!0,group:!1},code:{tagName:"pre",terminal:!0,text:{plaintext:!0}},bulletList:{tagName:"ul",parse:!1},bullet:{tagName:"li",listAttribute:"bulletList",group:!1,nestable:!0,test(t){return r(t.parentNode)===n[this.listAttribute].tagName}},numberList:{tagName:"ol",parse:!1},number:{tagName:"li",listAttribute:"numberList",group:!1,nestable:!0,test(t){return r(t.parentNode)===n[this.listAttribute].tagName}},attachmentGallery:{tagName:"div",exclusive:!0,terminal:!0,parse:!1,group:!1}},r=t=>{var e;return null==t||null===(e=t.tagName)||void 0===e?void 0:e.toLowerCase()},o=navigator.userAgent.match(/android\s([0-9]+.*Chrome)/i),s=o&&parseInt(o[1]);var a={composesExistingText:/Android.*Chrome/.test(navigator.userAgent),recentAndroid:s&&s>12,samsungAndroid:s&&navigator.userAgent.match(/Android.*SM-/),forcesObjectResizing:/Trident.*rv:11/.test(navigator.userAgent),supportsInputEvents:"undefined"!=typeof InputEvent&&["data","getTargetRanges","inputType"].every((t=>t in InputEvent.prototype))},l={attachFiles:"Attach Files",bold:"Bold",bullets:"Bullets",byte:"Byte",bytes:"Bytes",captionPlaceholder:"Add a caption…",code:"Code",heading1:"Heading",indent:"Increase Level",italic:"Italic",link:"Link",numbers:"Numbers",outdent:"Decrease Level",quote:"Quote",redo:"Redo",remove:"Remove",strike:"Strikethrough",undo:"Undo",unlink:"Unlink",url:"URL",urlPlaceholder:"Enter a URL…",GB:"GB",KB:"KB",MB:"MB",PB:"PB",TB:"TB"};const c=[l.bytes,l.KB,l.MB,l.GB,l.TB,l.PB];var h={prefix:"IEC",precision:2,formatter(t){switch(t){case 0:return"0 ".concat(l.bytes);case 1:return"1 ".concat(l.byte);default:let e;"SI"===this.prefix?e=1e3:"IEC"===this.prefix&&(e=1024);const i=Math.floor(Math.log(t)/Math.log(e)),n=(t/Math.pow(e,i)).toFixed(this.precision).replace(/0*$/,"").replace(/\.$/,"");return"".concat(n," ").concat(c[i])}}};const u="\ufeff",d=" ",g=function(t){for(const e in t){const i=t[e];this[e]=i}return this},m=document.documentElement,p=m.matches,f=function(t){let{onElement:e,matchingSelector:i,withCallback:n,inPhase:r,preventDefault:o,times:s}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};const a=e||m,l=i,c="capturing"===r,h=function(t){null!=s&&0==--s&&h.destroy();const e=A(t.target,{matchingSelector:l});null!=e&&(null==n||n.call(e,t,e),o&&t.preventDefault())};return h.destroy=()=>a.removeEventListener(t,h,c),a.addEventListener(t,h,c),h},b=function(t){let{onElement:e,bubbles:i,cancelable:n,attributes:r}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};const o=null!=e?e:m;i=!1!==i,n=!1!==n;const s=document.createEvent("Events");return s.initEvent(t,i,n),null!=r&&g.call(s,r),o.dispatchEvent(s)},v=function(t,e){if(1===(null==t?void 0:t.nodeType))return p.call(t,e)},A=function(t){let{matchingSelector:e,untilNode:i}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};for(;t&&t.nodeType!==Node.ELEMENT_NODE;)t=t.parentNode;if(null!=t){if(null==e)return t;if(t.closest&&null==i)return t.closest(e);for(;t&&t!==i;){if(v(t,e))return t;t=t.parentNode}}},x=t=>document.activeElement!==t&&y(t,document.activeElement),y=function(t,e){if(t&&e)for(;e;){if(e===t)return!0;e=e.parentNode}},C=function(t){var e;if(null===(e=t)||void 0===e||!e.parentNode)return;let i=0;for(t=t.previousSibling;t;)i++,t=t.previousSibling;return i},R=t=>{var e;return null==t||null===(e=t.parentNode)||void 0===e?void 0:e.removeChild(t)},S=function(t){let{onlyNodesOfType:e,usingFilter:i,expandEntityReferences:n}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};const r=(()=>{switch(e){case"element":return NodeFilter.SHOW_ELEMENT;case"text":return NodeFilter.SHOW_TEXT;case"comment":return NodeFilter.SHOW_COMMENT;default:return NodeFilter.SHOW_ALL}})();return document.createTreeWalker(t,r,null!=i?i:null,!0===n)},E=t=>{var e;return null==t||null===(e=t.tagName)||void 0===e?void 0:e.toLowerCase()},k=function(t){let e,i,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};"object"==typeof t?(n=t,t=n.tagName):n={attributes:n};const r=document.createElement(t);if(null!=n.editable&&(null==n.attributes&&(n.attributes={}),n.attributes.contenteditable=n.editable),n.attributes)for(e in n.attributes)i=n.attributes[e],r.setAttribute(e,i);if(n.style)for(e in n.style)i=n.style[e],r.style[e]=i;if(n.data)for(e in n.data)i=n.data[e],r.dataset[e]=i;return n.className&&n.className.split(" ").forEach((t=>{r.classList.add(t)})),n.textContent&&(r.textContent=n.textContent),n.childNodes&&[].concat(n.childNodes).forEach((t=>{r.appendChild(t)})),r};let L;const D=function(){if(null!=L)return L;L=[];for(const t in n){const e=n[t];e.tagName&&L.push(e.tagName)}return L},w=t=>B(null==t?void 0:t.firstChild),T=function(t){let{strict:e}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{strict:!0};return e?B(t):B(t)Line truncated
+var t="2.1.19";const e="[data-trix-attachment]",i={preview:{presentation:"gallery",caption:{name:!0,size:!0}},file:{caption:{size:!0}}},n={default:{tagName:"div",parse:!1},quote:{tagName:"blockquote",nestable:!0},heading1:{tagName:"h1",terminal:!0,breakOnReturn:!0,group:!1},code:{tagName:"pre",terminal:!0,htmlAttributes:["language"],text:{plaintext:!0}},bulletList:{tagName:"ul",parse:!1},bullet:{tagName:"li",listAttribute:"bulletList",group:!1,nestable:!0,test(t){return r(t.parentNode)===n[this.listAttribute].tagName}},numberList:{tagName:"ol",parse:!1},number:{tagName:"li",listAttribute:"numberList",group:!1,nestable:!0,test(t){return r(t.parentNode)===n[this.listAttribute].tagName}},attachmentGallery:{tagName:"div",exclusive:!0,terminal:!0,parse:!1,group:!1}},r=t=>{var e;return null==t||null===(e=t.tagName)||void 0===e?void 0:e.toLowerCase()},o=navigator.userAgent.match(/android\s([0-9]+.*Chrome)/i),s=o&&parseInt(o[1]);var a={composesExistingText:/Android.*Chrome/.test(navigator.userAgent),recentAndroid:s&&s>12,samsungAndroid:s&&navigator.userAgent.match(/Android.*SM-/),forcesObjectResizing:/Trident.*rv:11/.test(navigator.userAgent),supportsInputEvents:"undefined"!=typeof InputEvent&&["data","getTargetRanges","inputType"].every((t=>t in InputEvent.prototype))},l={ADD_ATTR:["language"],SAFE_FOR_XML:!1,RETURN_DOM:!0},c={attachFiles:"Attach Files",bold:"Bold",bullets:"Bullets",byte:"Byte",bytes:"Bytes",captionPlaceholder:"Add a caption…",code:"Code",heading1:"Heading",indent:"Increase Level",italic:"Italic",link:"Link",numbers:"Numbers",outdent:"Decrease Level",quote:"Quote",redo:"Redo",remove:"Remove",strike:"Strikethrough",undo:"Undo",unlink:"Unlink",url:"URL",urlPlaceholder:"Enter a URL…",GB:"GB",KB:"KB",MB:"MB",PB:"PB",TB:"TB"};const u=[c.bytes,c.KB,c.MB,c.GB,c.TB,c.PB];var h={prefix:"IEC",precision:2,formatter(t){switch(t){case 0:return"0 ".concat(c.bytes);case 1:return"1 ".concat(c.byte);default:let e;"SI"===this.prefix?e=1e3:"IEC"===this.prefix&&(e=1024);const i=Math.floor(Math.log(t)/Math.log(e)),n=(t/Math.pow(e,i)).toFixed(this.precision).replace(/0*$/,"").replace(/\.$/,"");return"".concat(n," ").concat(u[i])}}};const d="\ufeff",g=" ",m=function(t){for(const e in t){const i=t[e];this[e]=i}return this},p=document.documentElement,f=p.matches,b=function(t){let{onElement:e,matchingSelector:i,withCallback:n,inPhase:r,preventDefault:o,times:s}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};const a=e||p,l=i,c="capturing"===r,u=function(t){null!=s&&0==--s&&u.destroy();const e=x(t.target,{matchingSelector:l});null!=e&&(null==n||n.call(e,t,e),o&&t.preventDefault())};return u.destroy=()=>a.removeEventListener(t,u,c),a.addEventListener(t,u,c),u},v=function(t){let{bubbles:e,cancelable:i,attributes:n}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};e=!1!==e,i=!1!==i;const r=document.createEvent("Events");return r.initEvent(t,e,i),null!=n&&m.call(r,n),r},A=function(t){let{onElement:e,bubbles:i,cancelable:n,attributes:r}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};const o=null!=e?e:p,s=v(t,{bubbles:i,cancelable:n,attributes:r});return o.dispatchEvent(s)},y=function(t,e){if(1===(null==t?void 0:t.nodeType))return f.call(t,e)},x=function(t){let{matchingSelector:e,untilNode:i}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};for(;t&&t.nodeType!==Node.ELEMENT_NODE;)t=t.parentNode;if(null!=t){if(null==e)return t;if(t.closest&&null==i)return t.closest(e);for(;t&&t!==i;){if(y(t,e))return t;t=t.parentNode}}},C=t=>document.activeElement!==t&&E(t,document.activeElement),E=function(t,e){if(t&&e)for(;e;){if(e===t)return!0;e=e.parentNode}},S=function(t){var e;if(null===(e=t)||void 0===e||!e.parentNode)return;let i=0;for(t=t.previousSibling;t;)i++,t=t.previousSibling;return i},R=t=>{var e;return null==t||null===(e=t.parentNode)||void 0===e?void 0:e.removeChild(t)},T=function(t){let{onlyNodesOfType:e,usingFilter:i,expandEntityReferences:n}=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};const r=(()=>{switch(e){case"element":return NodeFilter.SHOW_ELEMENT;case"text":return NodeFilter.SHOW_TEXT;case"comment":return NodeFilter.SHOW_COMMENT;default:return NodeFilter.SHOW_ALL}})();return document.createTreeWalker(t,r,null!=i?i:null,!0===n)},k=t=>{var e;return null==t||null===(e=t.tagName)||void 0===e?void 0:e.toLowerCase()},w=function(t){let e,i,n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:{};"object"==typeof t?(n=t,t=n.tagName):n={attributes:n};const r=document.createElement(t);if(null!=n.editable&&(null==n.attributes&&(n.attributes={}),n.attributes.contenteditable=n.editable),n.attributes)for(e in n.attributes)i=n.attributes[e],r.setAttribute(e,i);if(n.style)for(e in n.style)i=n.style[e],r.style[e]=i;if(n.data)for(e in n.data)i=n.data[e],r.dataset[e]=i;return n.className&&n.className.split(" ").forEach((t=>{r.classList.add(t)})),n.textContent&&(r.textContent=n.textContent),n.childNodes&&[].concat(n.childNodes).forEach((t=>{r.appendChild(t)})),r};let D;const L=funLine truncated
+/*! @license DOMPurify 3.4.2 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.4.2/LICENSE */const{entries:oe,setPrototypeOf:se,isFrozen:ae,getPrototypeOf:le,getOwnPropertyDescriptor:ce}=Object;let{freeze:ue,seal:he,create:de}=Object,{apply:ge,construct:me}="undefined"!=typeof Reflect&&Reflect;ue||(ue=function(t){return t}),he||(he=function(t){return t}),ge||(ge=function(t,e){for(var i=arguments.length,n=new Array(i>2?i-2:0),r=2;r<i;r++)n[r-2]=arguments[r];return t.apply(e,n)}),me||(me=function(t){for(var e=arguments.length,i=new Array(e>1?e-1:0),n=1;n<e;n++)i[n-1]=arguments[n];return new t(...i)});const pe=Me(Array.prototype.forEach),fe=Me(Array.prototype.lastIndexOf),be=Me(Array.prototype.pop),ve=Me(Array.prototype.push),Ae=Me(Array.prototype.splice),ye=Array.isArray,xe=Me(String.prototype.toLowerCase),Ce=Me(String.prototype.toString),Ee=Me(String.prototype.match),Se=Me(String.prototype.replace),Re=Me(String.prototype.indexOf),Te=Me(String.prototype.trim),ke=Me(Number.prototype.toString),we=Me(Boolean.prototype.toString),De="undefined"==typeof BigInt?null:Me(BigInt.prototype.toString),Le="undefined"==typeof Symbol?null:Me(Symbol.prototype.toString),Ne=Me(Object.prototype.hasOwnProperty),Ie=Me(Object.prototype.toString),Oe=Me(RegExp.prototype.test),Fe=(Pe=TypeError,function(){for(var t=arguments.length,e=new Array(t),i=0;i<t;i++)e[i]=arguments[i];return me(Pe,e)});var Pe;function Me(t){return function(e){e instanceof RegExp&&(e.lastIndex=0);for(var i=arguments.length,n=new Array(i>1?i-1:0),r=1;r<i;r++)n[r-1]=arguments[r];return ge(t,e,n)}}function Be(t,e){let i=arguments.length>2&&void 0!==arguments[2]?arguments[2]:xe;if(se&&se(t,null),!ye(e))return t;let n=e.length;for(;n--;){let r=e[n];if("string"==typeof r){const t=i(r);t!==r&&(ae(e)||(e[n]=t),r=t)}t[r]=!0}return t}function _e(t){for(let e=0;e<t.length;e++){Ne(t,e)||(t[e]=null)}return t}function je(t){const e=de(null);for(const[i,n]of oe(t)){Ne(t,i)&&(ye(n)?e[i]=_e(n):n&&"object"==typeof n&&n.constructor===Object?e[i]=je(n):e[i]=n)}return e}function We(t,e){for(;null!==t;){const i=ce(t,e);if(i){if(i.get)return Me(i.get);if("function"==typeof i.value)return Me(i.value)}t=le(t)}return function(){return null}}const Ue=ue(["a","abbr","acronym","address","area","article","aside","audio","b","bdi","bdo","big","blink","blockquote","body","br","button","canvas","caption","center","cite","code","col","colgroup","content","data","datalist","dd","decorator","del","details","dfn","dialog","dir","div","dl","dt","element","em","fieldset","figcaption","figure","font","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","img","input","ins","kbd","label","legend","li","main","map","mark","marquee","menu","menuitem","meter","nav","nobr","ol","optgroup","option","output","p","picture","pre","progress","q","rp","rt","ruby","s","samp","search","section","select","shadow","slot","small","source","spacer","span","strike","strong","style","sub","summary","sup","table","tbody","td","template","textarea","tfoot","th","thead","time","tr","track","tt","u","ul","var","video","wbr"]),Ve=ue(["svg","a","altglyph","altglyphdef","altglyphitem","animatecolor","animatemotion","animatetransform","circle","clippath","defs","desc","ellipse","enterkeyhint","exportparts","filter","font","g","glyph","glyphref","hkern","image","inputmode","line","lineargradient","marker","mask","metadata","mpath","part","path","pattern","polygon","polyline","radialgradient","rect","stop","style","switch","symbol","text","textpath","title","tref","tspan","view","vkern"]),ze=ue(["feBlend","feColorMatrix","feComponentTransfer","feComposite","feConvolveMatrix","feDiffuseLighting","feDisplacementMap","feDistantLight","feDropShadow","feFlood","feFuncA","feFuncB","feFuncG","feFuncR","feGaussianBlur","feImage","feMerge","feMergeNode","feMorphology","feOffset","fePointLight","feSpecularLighting","feSpotLight","feTile","feTurbulence"]),He=ue(["animate","color-profile","cursor","discard","font-face","font-face-format","font-face-name","font-face-src","font-face-uri","foreignobject","hatch","hatchpath","mesh","meshgradient","meshpatch","meshrow","missing-glyph","script","set","solidcolor","unknown","use"]),qe=ue(["math","menclose","merror","mfenced","mfrac","mglyph","mi","mlabeledtr","mmultiscripts","mn","mo","mover","mpadded","mphantom","mroot","mrow","ms","mspace","msqrt","mstyle","msub","msup","msubsup","mtable","mtd","mtext","mtr","munder","munderover","mprescripts"]),Je=ue(["maction","maligngroup","malignmark","mlongdiv","mscarries","mscarry","msgroup","mstack","msline","msrow","semantics","annotation","annotation-xml","mprescripts","none"]),Ke=ue(["#text"]),Ge=ue(["accept","action","align","alt","autocapitalize","autocomplete","autopictureinpicture","autoplay","background","bgcolor","border","capture","cellpadding","cellspacing","checked","cite","class","clear","color","cols","colspan","contLine truncated
 //# sourceMappingURL=trix.esm.min.js.map
Author	SHA1	Message	Date
Rosa GutierrezandClaude Opus 4.8	9ebc47a8f0	Bump json to 2.20.0 (CVE-2026-54696) Fixes a heap buffer overflow in the JSON generator when streaming an oversized object to an IO (JSON.dump(obj, io) / JSON::State#generate). Affects json 2.9.0-2.19.8; patched in 2.19.9. Bumps to the current 2.20.0 line via `bundle update json --conservative` (lockfile-only). GHSA-x2f5-4prf-w687 / https://nvd.nist.gov/vuln/detail/CVE-2026-54696 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 10:09:20 +02:00
Rosa Gutierrez	962c48af13	Update `brakeman`	2026-06-29 14:35:42 +02:00
Rosa GutierrezandClaude Opus 4.8	0920ceab6b	Upgrade crass to 1.0.7 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 14:35:42 +02:00
dependabot[bot]	12bb943af8	Bump concurrent-ruby from 1.3.5 to 1.3.7 Bumps [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) from 1.3.5 to 1.3.7. - [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases) - [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md) - [Commits](https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.5...v1.3.7) --- updated-dependencies: - dependency-name: concurrent-ruby dependency-version: 1.3.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 13:32:23 +02:00
dependabot[bot]	e4f88b425a	Bump nokogiri from 1.19.3 to 1.19.4 Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.19.3 to 1.19.4. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.19.3...v1.19.4) --- updated-dependencies: - dependency-name: nokogiri dependency-version: 1.19.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 13:32:14 +02:00
dependabot[bot]	bfa9f66633	Bump net-imap from 0.6.4 to 0.6.4.1 Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.4 to 0.6.4.1. - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](https://github.com/ruby/net-imap/compare/v0.6.4...v0.6.4.1) --- updated-dependencies: - dependency-name: net-imap dependency-version: 0.6.4.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 13:31:57 +02:00
Mike Dalessio	8d3c2bbd2b	Merge pull request #211 from basecamp/clean-202606 Security dependency updates and general maintenance	2026-06-09 12:47:49 -04:00
Mike Dalessio	03fa883f98	dep: update puma 6.6.1 → 7.2.1 (major) Security bump for CVE-2026-47736 (PROXY Protocol v1 parser memory exhaustion) and CVE-2026-47737 (PROXY v1 repeated headers). Not exposed: PROXY protocol is opt-in via set_remote_address proxy_protocol:, which campfire never calls — default remote_address :socket leaves the parser unreachable. Thruster/kamal-proxy front campfire over HTTP X-Forwarded-*, not PROXY protocol. No 6.x fix exists, so this is a major v6→v7 bump: - Gemfile pin "~> 6.6" → "~> 7.2", ">= 7.2.1" - config/puma.rb needs NO changes — every DSL method used (threads, worker_timeout, bind, environment, pidfile, workers, plugin :tmp_restart) is unchanged in v7; tmp_restart.rb is byte-identical. Behavior notes (no action): preload_app effectively defaults on for clustered mode (safe — Rails eager-loaded in master, Membership. disconnect_all handles pre-fork conns); persistent_timeout default 20→65s (internal keep-alive). Min Ruby 3.0; campfire runs 3.4.5. Direct gem. 137 commits triaged, 0 mitigations. Verified green via full unit + system suites (system tests boot Puma 7.2.1). https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-puma_v6.6.1..v7.2.1.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	8e0aa7d636	dep: update nokogiri 1.18.10 → 1.19.3 Security bump clearing 3 advisories: GHSA-c4rq-3m3g-8wgx (High, CSS selector tokenizer ReDoS), GHSA-v2fc-qm4h-8hqv (XSLT transform memory leak), GHSA-wx95-c6cv-8532 (unchecked xmlC14NExecute return). None exposed: loofah/rails-html-sanitizer use DOM/XPath not CSS selectors, every app CSS selector is a compile-time literal, and campfire uses no XSLT or XML canonicalization. The 1.18→1.19 minor bump is a Ruby-4-support/packaging milestone — bundled libxml2 2.13.9 / libxslt 1.1.43 are unchanged, so HTML parsing and ActionText sanitization output are identical. Ruby floor 3.2 (campfire runs 3.4.5); all 4 locked platforms still ship. Transitive dep via Rails/loofah (no Gemfile change). 33 commits analyzed, 0 mitigations. Verified green via full unit + system suites. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-nokogiri_v1.18.10..v1.19.3.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	efaae642b0	dep: update rack 3.2.4 → 3.2.6 Security bump clearing ~11 CVEs (multipart parser differentials/DoS, Host header validation, byte-range DoS, Forwarded injection, Rack::Static/ Directory/Sendfile disclosures). Reachable fixes (multipart uploads, AS byte-range streaming, host parsing) apply transparently via corrective behavior and generous new defaults; the Static/Directory/Sendfile/ Deflater CVEs are not reachable (campfire uses none of those middlewares). No app changes required. Optional hardening noted in plan: new env knob RACK_MULTIPART_PARSER_BYTESIZE_LIMIT (default 10 GiB) could be tuned to campfire's real max attachment size — left at default here. Transitive dep via Rails (no Gemfile change). 23 commits analyzed, 0 required mitigations. Verified green via full unit + system suites. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-rack_v3.2.4..v3.2.6.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	28525bec5d	dep: update sinatra 4.1.1 → 4.2.1 Security bump for CVE-2025-61921 (ReDoS via ETag header generation). Not exposed: sinatra reaches campfire only through resque-web, which is never mounted — config.ru runs plain Rails, no `require "resque/server"` anywhere, so Sinatra::Base is never defined. Dead code at runtime. Conservative update also bumped rack-protection 4.1.1 → 4.2.1 (same monorepo); its shipped lib is byte-identical bar the version string. Transitive dep (no Gemfile change). 14 commits analyzed, 0 mitigations. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-sinatra_v4.1.1..v4.2.1.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	52ccd24efa	dep: update action_text-trix 2.1.15 → 2.1.19 Security fix for 3 stored/DOM XSS advisories in Trix: GHSA-g9jg-w8vm-g96v (attachment attribute), GHSA-qmpg-8xg6-ph5q (serialized attributes), GHSA-53p3-c7vp-4mcc (JSON deserialization bypass in drag-and-drop). EXPOSED: campfire's composer/editor use Trix for message bodies, and the browser actually ran the hand-vendored vendor/javascript/trix.esm.min.js pinned at 2.0.10 — which lacks the DOMPurify/isValidAttribute sanitizers. The gem bump alone is a no-op for the browser; the real fix is re-vendoring the ESM build: - bump gem to 2.1.19 (Gemfile.lock) - re-vendor vendor/javascript/trix.esm.min.js from Trix 2.1.19 (2.0.10 → 2.1.19; bundles DOMPurify 3.4.2, rangy 1.3.2) - update importmap pin comment @2.0.10 → @2.1.19 89 commits analyzed. Verified green via full unit + system suites (system tests drive the Trix composer via fill_in_rich_text_area). https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-action_text-trix_v2.1.15..v2.1.19.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	c189ddea41	dep: update net-imap 0.5.12 → 0.6.4 Security bump clearing 5 CVEs (CVE-2026-42245/42246/42256/42257/42258: literal DoS, STARTTLS stripping, SCRAM DoS, command injection ×2). Not exposed: all require acting as an IMAP client. net-imap is autoloaded by mail only when retriever_method :imap is set; campfire configures no retriever and has no inbound email — net/imap is never required. Conservative update landed 0.6.4 (minor jump, dormant dep). Ruby floor raised to >= 3.2.0; campfire runs 3.4.5. 206 commits triaged, 0 mitigations. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-net-imap_v0.5.12..v0.6.4.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	7ffb043cf3	dep: update erb 6.0.0 → 6.0.4 Security bump for CVE-2026-41316 (High, @_init deserialization guard bypass via def_module/def_method/def_class). Not exposed: ActionView renders via Erubi, not Ruby's ERB class; no def_* calls or Marshal of ERB objects anywhere — vulnerable path absent. Transitive dep (no Gemfile change). 24 commits analyzed, 0 mitigations. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-erb_v6.0.0..v6.0.4.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	17f81d4fa0	dep: update jwt 3.1.2 → 3.2.0 Security bump for CVE-2026-45363 (High, empty-key HMAC bypass). Not exposed: jwt reaches campfire only via web-push VAPID signing, which uses ES256 (asymmetric ECDSA), not HMAC — the vulnerable JWA::Hmac path is unreachable. web-push requires jwt ~> 3.0; minor bump, encode API unchanged. Transitive dep (no Gemfile change). 15 commits analyzed, 0 mitigations. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-jwt_v3.1.2..v3.2.0.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	905165b7e2	dep: update bcrypt 3.1.20 → 3.1.22 Security bump for CVE-2026-33306 (integer overflow → zero KDF iterations at Cost=31). Not exposed: JRuby-only bug; campfire runs MRI (Ruby 3.4.5), no java platform in lockfile, ActiveModel default cost is 10-12. Direct gem (no version constraint, unchanged). 33 commits analyzed, 2 no-action mitigations (constant-time password compare hardening on the has_secure_password path) — auth tests green. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-bcrypt_v3.1.20..v3.1.22.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	ce62fd0814	dep: update addressable 2.8.7 → 2.9.0 Security bump for CVE-2026-35611 (High, ReDoS in Addressable::Template). Not exposed: campfire never reaches Addressable::Template — runtime use is geared_pagination's URI.parse; templates appear only in webmock test stubs (all string/Regexp, never templates). Transitive dep (no Gemfile change). 49 commits analyzed, 0 mitigations. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-addressable_2.8.7..2.9.0.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	47cdbb2a0f	dep: update rexml 3.4.1 → 3.4.4 Security bump for CVE-2025-58767 (DoS on malformed XML). Conservative update landed 3.4.4 (latest patch, above advisory floor of 3.4.2). Test/build-only transitive dep (webmock→crack, selenium-webdriver); absent from app runtime. 34 commits analyzed, 1 test-only mitigation (no-root-element parse change) — verified green via full unit + system test suites. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-rexml_3.4.1..3.4.4.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	6ec04cbc28	dep: update rack-session 2.1.1 → 2.1.2 Security bump for CVE-2026-39324 (Rack::Session::Cookie secretless session forgery). Campfire uses Rails ActionDispatch CookieStore, not Rack::Session::Cookie, so was never exposed — hygiene update. Transitive dep (no Gemfile change). 10 commits analyzed, 0 mitigations. https://github.com/basecamp/37signals-hq/blob/main/upgrade-analysis/campfire-20260609-rack-session_2.1.1..2.1.2.md 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	e74d192aec	dep: explicitly add bundler-audit	2026-06-09 12:42:51 -04:00
Mike Dalessio	67ca61da1f	fix(docker): install libssl-dev to build the openssl gem The build stage was missing the OpenSSL headers, so bundle install failed compiling the openssl gem's native extension. 🤖 Assisted by Claude	2026-06-09 12:42:51 -04:00
Mike Dalessio	0febc9f415	dep: update to bundler 4	2026-06-09 12:20:38 -04:00
Mike Dalessio	4a75954080	style(rubocop): Layout/SpaceInsideArrayLiteralBrackets	2026-06-09 12:20:37 -04:00
Mike Dalessio	69c94b6594	bin/setup only asks for pacman install password when needed	2026-06-09 12:20:37 -04:00
Stanko Krtalić	ba11a0a67f	Merge pull request #192 from ESH13/fix-negative-limit-direct-placeholders Fix crash when user has 20+ direct conversations	2026-04-13 16:47:16 +02:00
Eric Hiler	8c7f49e003	Fix crash when user has 20+ direct conversations	2026-04-10 09:23:30 -04:00
Mike DalessioandClaude Opus 4.6	3fada3d997	ci: harden GitHub Actions workflows (#185 ) * Add GitHub Actions audit job (actionlint + zizmor) to CI Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Configure dependabot for GitHub Actions, bundler, and Docker Batches all action updates into a single weekly PR. Adds cooldown periods to all ecosystems. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add local GitHub Actions linting (actionlint + zizmor) to bin/setup and bin/ci Install actionlint, shellcheck, and zizmor in bin/setup. Run both linters as CI steps in config/ci.rb alongside existing style checks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Pin all GitHub Actions to SHA hashes Run pinact to pin action versions to specific commit SHAs, preventing supply chain attacks from tag mutation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix high severity zizmor findings - Suppress unpinned-images for redis service containers (digest pinning is nontrivial for service containers) - Move workflow-level permissions to job-level in publish-image.yml (build gets full set, manifest gets only what it needs) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix medium severity zizmor findings - Add persist-credentials: false to all checkout steps - Add permissions: {} at workflow level in ci.yml - Add job-level permissions (contents: read) to all CI jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix informational template-injection findings in publish-image.yml Move steps.meta.outputs.tags from inline ${{ }} expressions to env vars in both the manifest creation and cosign signing steps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update brakeman to 8.0.4 bin/brakeman uses --ensure-latest which fails if not on the newest version. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-03-20 19:26:25 -04:00
Rosa GutierrezandClaude Opus 4.5	dde94b06ed	Delete server-side session on logout When it's set. Also, store it in current attributes for convenience. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-16 09:31:22 +01:00
Jeremy Daer	1852adb06c	Fix 1Password account ID (was user UUID) (#156 )	2025-12-31 13:59:12 -08:00
Jeremy Daer	e983e3f79f	Block IPv6 SSRF bypass via ipv4_compat addresses (#153 ) Adds ipv4_mapped? and ipv4_compat? checks to PrivateNetworkGuard.private_ip? to block SSRF bypass attempts using IPv6 address formats like: - ::ffff:169.254.169.254 (IPv4-mapped) - ::169.254.169.254 (IPv4-compatible) These formats could previously bypass the link_local? check since Ruby treats them as IPv6 addresses, not IPv4. Ref: HackerOne #3481701	2025-12-31 13:01:43 -08:00
Jeremy Daer	53e36a16ea	Latest Brakeman	2025-12-31 12:56:01 -08:00
Jeremy Daer	a05292f548	Switch 1Password account to 37signals.1password.com (#154 )	2025-12-31 11:54:27 -08:00