code-dot-org
code-dot-org copied to clipboard
Update to Rails 6.0.5.1
The latest version of 6.0, in preparation for updating to 6.1. This picks up a number of bug and security fixes.
Specifically, I ran:
bundle update rails actioncable actionmailbox actionmailer actionpack actiontext actionview activejob activemodel activerecord activestorage activesupport railties sprockets-rails --conservative
To update Rails and all of its direct dependencies.
Note that this did result in the rack-test gem getting updated from 1.1.0 to 2.0.2, which unfortunately broke a cdo-varnish test. I manually undid the rack-test changes to Gemfile.lock, and it seems to be working, but I still don't know exactly what it was in that update that broke.
Links
- [CVE-2022-32224] Possible RCE escalation bug with Serialized Columns in Active Record
- Rails Versions 7.0.3.1, 6.1.6.1, 6.0.5.1, and 5.2.8.1 have been released!
rack-testchangelog
Testing story
Relying on existing tests.
PR Checklist:
- [ ] Tests provide adequate coverage
- [ ] Privacy and Security impacts have been assessed
- [ ] Code is well-commented
- [ ] New features are translatable or updates will not break translations
- [ ] Relevant documentation has been added or updated
- [ ] User impact is well-understood and desirable
- [ ] Pull Request is labeled appropriately
- [ ] Follow-up work items (including potential tech debt) are tracked and linked