[Security] Bump i18n from 0.6.1 to 1.8.10

Open dependabot-preview[bot] opened this issue 5 years ago • 0 comments

Bumps i18n from 0.6.1 to 1.8.10. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

i18n Gem for Ruby lib/i18n/core_ext/hash.rb Hash#slice() Function Hash Handling DoS i18n Gem for Ruby contains a flaw in the Hash#slice() function in lib/i18n/core_ext/hash.rb that is triggered when calling a hash when :some_key is in keep_keys but not in the hash. This may allow an attacker to cause the program to crash.

Patched versions: >= 0.8.0 Unaffected versions: none

Sourced from The Ruby Advisory Database.

i18n missing translation error message XSS The HTML exception message raised by I18n::MissingTranslation fails to escape the keys.

Patched versions: ~> 0.5.1; >= 0.6.6 Unaffected versions: none

Release notes

Sourced from i18n's releases.

1.8.10

Fix string locale will trigger on_fallback hook - #562

1.8.9

Rely on Ruby 3's native Hash#except method -- #557

This release also contains several build related updates -- rather than listing them out here, you can see the compare view between 1.8.8 and 1.8.9.

1.8.8

Fixed threadsafety issues in Simple backend: #554

Re-attempt to fix threadsafety of fallbacks: #548

Use OpenSSL::Digest instead of usual Digest libraries: #549

Goodbye, post-install message #552

Use Rails' main branch, instead of master #553

1.8.7

Fixed a regression with fallback logic: see issues #547, #546 and #542.

1.8.6

Fallbacks are now stored in Thread.current for multi-threading compatibility: #542

no-op arguments are no longer allowed for I18n.t calls -- fixes an incompatibility with Ruby 3.0: #545

This gem's GitHub workflow files have been updated to ensure compatibility between new Rails versions (6.1) and the new Ruby release (3.0). See the "Actions" tab on GitHub for the full range of supported Rails and Ruby versions.

v1.8.5

Fixed an issue where users could not use their own custom fallback classes - #536

v1.8.4

Fixed issue where fallbacks were not working when I18n.fallbacks was an array - #534

Fixed conditional around deprecating constant of INTERPOLATION_PATTERN - #531

v1.8.3

Compare view: https://github.com/ruby-i18n/i18n/compare/v1.8.2...v1.8.3

Features / Improvements

Memory and speed improvements - #527+ #528

Add option to disable fallbacks for I18n.exists? check - #482

Add an on_fallback hook to allow users to be notified when a fallback happens - #520

Bug Fixes

Fix an issue with deep_merge and chain fallback backends - #499 & #509

Fix an issue with Rails ordinal number proc and keyword splatting - #521

Pass options as keyword arguments to translation procs - #529

... (truncated)

Commits

0888807 Bump to 1.8.10
a469561 Merge pull request #562 from piecehealth/fix_on_fallback
ff6e0b4 Fix string locale will trigger on_fallback hook.
aec9d66 Bump to 1.8.9
aae36c2 Only attempt to set fallbacks= in tests if method is defined
3951eee Merge pull request #557 from ruby-i18n/ca-except-ruby3
7a262de Merge pull request #558 from ruby-i18n/ca-build
7a885fd Merge pull request #550 from taki/update-require
cead3e5 Prevent overwriting Hash#except method present in Ruby 3+
bb7b689 Exclude Ruby 3+ with all Rails 5.x versions
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)
Pull request limits (per update run and/or open at any time)
Out-of-range updates (receive only lockfile updates, if desired)
Security updates (receive only security updates, if desired)

Mar 31 '21 04:03 dependabot-preview[bot]