Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] [ruby] Update bootstrap 4.6.2 → 5.3.3 (major) #1073

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🚨 [security] [ruby] Update bootstrap 4.6.2 → 5.3.3 (major) #1073

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Oct 23, 2024

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ bootstrap (4.6.2 → 5.3.3) · Repo · Changelog

Security Advisories 🚨

🚨 Bootstrap Cross-Site Scripting (XSS) vulnerability

A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

Release Notes

5.3.3

Adds support for other Sass engines: dartsass-sprockets, dartsass-rails, and cssbundling-rails.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ autoprefixer-rails (indirect, 10.4.16.0 → 10.4.19.0) · Repo · Changelog

Release Notes

10.4.19.0 (from changelog)

  • Removed end value has mixed support, consider using flex-end warning since end/start now have good support.
  • Fixed removing -webkit-box-orient on -webkit-line-clamp (@Goodwine).
  • Fixed user-select: contain prefixes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

↗️ execjs (indirect, 2.9.1 → 2.10.0) · Repo

Commits

See the full diff on Github. The new version differs by 20 commits:

↗️ ffi (indirect, 1.16.3 → 1.17.0) · Repo · Changelog

Release Notes

1.17.0 (from changelog)

Fixed:

  • Add FFI::AbstractMemory#read_array_of_string . It was defined but not exposed to Ruby nor tested. #1070

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ popper_js (indirect, 1.16.1 → 2.11.8) · Repo

Commits

See the full diff on Github. The new version differs by 28 commits:

↗️ tilt (indirect, 2.3.0 → 2.4.0) · Repo · Changelog

Release Notes

2.4.0 (from changelog)

  • Support commonmarker 1.0+ API (unasuke) (#10)
  • Make etanni template work with frozen string literals (jeremyevans)
  • Deprecate erubis, wikicloth, and maruku templates as they require modifying frozen string literals (jeremyevans)
  • Make SassTemplate ignore unsupported options when using sass-embedded (jeremyevans)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Oct 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants