🚨 [security] Update rack: 1.6.4 → 2.1.4 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ rack (indirect, 1.6.4 → 2.1.4) · Repo · Changelog

Security Advisories 🚨

🚨 Percent-encoded cookies can be used to overwrite existing prefixed cookie names

It is possible to forge a secure or host-only cookie prefix in Rack using
an arbitrary cookie write by using URL encoding (percent-encoding) on the
name of the cookie. This could result in an application that is dependent on
this prefix to determine if a cookie is safe to process being manipulated
into processing an insecure or cross-origin request.
This vulnerability has been assigned the CVE identifier CVE-2020-8184.

Versions Affected: rack < 2.2.3, rack < 2.1.4
Not affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process
Fixed Versions: rack >= 2.2.3, rack >= 2.1.4

Impact

An attacker may be able to trick a vulnerable application into processing an
insecure (non-SSL) or cross-origin request if they can gain the ability to write
arbitrary cookies that are sent to the application.

Workarounds

If your application is impacted but you cannot upgrade to the released versions or apply
the provided patch, this issue can be temporarily addressed by adding the following workaround:

module Rack
  module Utils
    module_function def parse_cookies_header(header)
      return {} unless header
      header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
        next if cookie.empty?
        key, value = cookie.split('=', 2)
        cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
      end
    end
  end
end

🚨 Directory traversal in Rack::Directory app bundled with Rack

There was a possible directory traversal vulnerability in the Rack::Directory app
that is bundled with Rack.

Versions Affected: rack < 2.2.0
Not affected: Applications that do not use Rack::Directory.
Fixed Versions: 2.1.3, >= 2.2.0

Impact

If certain directories exist in a director that is managed by
Rack::Directory, an attacker could, using this vulnerability, read the
contents of files on the server that were outside of the root specified in the
Rack::Directory initializer.

Workarounds

Until such time as the patch is applied or their Rack version is upgraded,
we recommend that developers do not use Rack::Directory in their
applications.

🚨 Possible information leak / session hijack vulnerability

There's a possible information leak / session hijack vulnerability in Rack.

Attackers may be able to find and hijack sessions by using timing attacks
targeting the session id. Session ids are usually stored and indexed in a
database that uses some kind of scheme for speeding up lookups of that
session id. By carefully measuring the amount of time it takes to look up
a session, an attacker may be able to find a valid session id and hijack
the session.

The session id itself may be generated randomly, but the way the session is
indexed by the backing store does not use a secure comparison.

Impact:

The session id stored in a cookie is the same id that is used when querying
the backing session storage engine. Most storage mechanisms (for example a
database) use some sort of indexing in order to speed up the lookup of that
id. By carefully timing requests and session lookup failures, an attacker
may be able to perform a timing attack to determine an existing session id
and hijack that session.

🚨 Possible information leak / session hijack vulnerability

There's a possible information leak / session hijack vulnerability in Rack.

Attackers may be able to find and hijack sessions by using timing attacks
targeting the session id. Session ids are usually stored and indexed in a
database that uses some kind of scheme for speeding up lookups of that
session id. By carefully measuring the amount of time it takes to look up
a session, an attacker may be able to find a valid session id and hijack
the session.

The session id itself may be generated randomly, but the way the session is
indexed by the backing store does not use a secure comparison.

Impact:

The session id stored in a cookie is the same id that is used when querying
the backing session storage engine. Most storage mechanisms (for example a
database) use some sort of indexing in order to speed up the lookup of that
id. By carefully timing requests and session lookup failures, an attacker
may be able to perform a timing attack to determine an existing session id
and hijack that session.

🚨 Possible XSS vulnerability in Rack

There is a possible vulnerability in Rack. This vulnerability has been
assigned the CVE identifier CVE-2018-16471.

Versions Affected: All.
Not affected: None.
Fixed Versions: 2.0.6, 1.6.11

Impact

There is a possible XSS vulnerability in Rack. Carefully crafted requests can
impact the data returned by the scheme method on Rack::Request.
Applications that expect the scheme to be limited to "http" or "https" and do
not escape the return value could be vulnerable to an XSS attack.

Vulnerable code looks something like this:

<%= request.scheme.html_safe %>

Note that applications using the normal escaping mechanisms provided by Rails
may not impacted, but applications that bypass the escaping mechanisms, or do
not use them may be vulnerable.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases

The 2.0.6 and 1.6.11 releases are available at the normal locations.

Workarounds

The following monkey patch can be applied to work around this issue:

require "rack"
require "rack/request"
class Rack::Request

SCHEME_WHITELIST = %w(https http).freeze
def scheme

if get_header(Rack::HTTPS) == 'on'

'https'

elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'

'https'

elsif forwarded_scheme

forwarded_scheme

else

get_header(Rack::RACK_URL_SCHEME)

end

end
def forwarded_scheme

scheme_headers = [

get_header(HTTP_X_FORWARDED_SCHEME),

get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]

]
scheme_headers.each do |header|

return header if SCHEME_WHITELIST.include?(header)

end
nil

end

end

🚨 Possible DoS vulnerability in Rack

There is a possible DoS vulnerability in the multipart parser in Rack. This
vulnerability has been assigned the CVE identifier CVE-2018-16470.

Versions Affected: 2.0.4, 2.0.5
Not affected: <= 2.0.3
Fixed Versions: 2.0.6

Impact

There is a possible DoS vulnerability in the multipart parser in Rack.
Carefully crafted requests can cause the multipart parser to enter a
pathological state, causing the parser to use CPU resources disproportionate to
the request size.

Impacted code can look something like this:

Rack::Request.new(env).params

But any code that uses the multi-part parser may be vulnerable.

Rack users that have manually adjusted the buffer size in the multipart parser
may be vulnerable as well.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases

The 2.0.6 release is available at the normal locations.

Workarounds

To work around this issue, the following code can be used:

require "rack/multipart/parser"
Rack::Multipart::Parser.send :remove_const, :BUFSIZE

Rack::Multipart::Parser.const_set :BUFSIZE, 16384

🚨 Possible XSS vulnerability in Rack

There is a possible vulnerability in Rack. This vulnerability has been
assigned the CVE identifier CVE-2018-16471.

Versions Affected: All.
Not affected: None.
Fixed Versions: 2.0.6, 1.6.11

Impact

There is a possible XSS vulnerability in Rack. Carefully crafted requests can
impact the data returned by the scheme method on Rack::Request.
Applications that expect the scheme to be limited to "http" or "https" and do
not escape the return value could be vulnerable to an XSS attack.

Vulnerable code looks something like this:

<%= request.scheme.html_safe %>

Note that applications using the normal escaping mechanisms provided by Rails
may not impacted, but applications that bypass the escaping mechanisms, or do
not use them may be vulnerable.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Releases

The 2.0.6 and 1.6.11 releases are available at the normal locations.

Workarounds

The following monkey patch can be applied to work around this issue:

require "rack"
require "rack/request"
class Rack::Request

SCHEME_WHITELIST = %w(https http).freeze
def scheme

if get_header(Rack::HTTPS) == 'on'

'https'

elsif get_header(HTTP_X_FORWARDED_SSL) == 'on'

'https'

elsif forwarded_scheme

forwarded_scheme

else

get_header(Rack::RACK_URL_SCHEME)

end

end
def forwarded_scheme

scheme_headers = [

get_header(HTTP_X_FORWARDED_SCHEME),

get_header(HTTP_X_FORWARDED_PROTO).to_s.split(',')[0]

]
scheme_headers.each do |header|

return header if SCHEME_WHITELIST.include?(header)

end
nil

end

end

Release Notes

2.1.2 (from changelog)

• Fix multipart parser for some files to prevent denial of service (@aiomaster)
• Fix Rack::Builder#use with keyword arguments (@kamipo)
• Skip deflating in Rack::Deflater if Content-Length is 0 (@jeremyevans)
• Remove SessionHash#transform_keys, no longer needed (@pavel)
• Add to_hash to wrap Hash and Session classes (@oleh-demyanyuk)
• Handle case where session id key is requested but missing (@jeremyevans)

2.1.1 (from changelog)

• Remove Rack::Chunked from Rack::Server default middleware. (#1475, @ioquatix)
• Restore support for code relying on SessionId#to_s. (@jeremyevans)

2.1.0 (from changelog)

Added

• Add support for SameSite=None cookie value. (@hennikul)
• Add trailer headers. (@eileencodes)
• Add MIME Types for video streaming. (@styd)
• Add MIME Type for WASM. (@buildrtech)
• Add Early Hints(103) to status codes. (@egtra)
• Add Too Early(425) to status codes. (@y-yagi)
• Add Bandwidth Limit Exceeded(509) to status codes. (@CJKinni)
• Add method for custom ip_filter. (@svcastaneda)
• Add boot-time profiling capabilities to rackup. (@tenderlove)
• Add multi mapping support for X-Accel-Mappings header. (@yoshuki)
• Add sync: false option to Rack::Deflater. (Eric Wong)
• Add Builder#freeze_app to freeze application and all middleware instances. (@jeremyevans)
• Add API to extract cookies from Rack::MockResponse. (@petercline)

Changed

• Don't propagate nil values from middleware. (@ioquatix)
• Lazily initialize the response body and only buffer it if required. (@ioquatix)
• Fix deflater zlib buffer errors on empty body part. (@felixbuenemann)
• Set X-Accel-Redirect to percent-encoded path. (@diskkid)
• Remove unnecessary buffer growing when parsing multipart. (@tainoe)
• Expand the root path in Rack::Static upon initialization. (@rosenfeld)
• Make ShowExceptions work with binary data. (@axyjo)
• Use buffer string when parsing multipart requests. (@janko-m)
• Support optional UTF-8 Byte Order Mark (BOM) in config.ru. (@mikegee)
• Handle X-Forwarded-For with optional port. (@dpritchett)
• Use Time#httpdate format for Expires, as proposed by RFC 7231. (@nanaya)
• Make Utils.status_code raise an error when the status symbol is invalid instead of 500. (@adambutler)
• Rename Request::SCHEME_WHITELIST to Request::ALLOWED_SCHEMES.
• Make Multipart::Parser.get_filename accept files with + in their name. (@lucaskanashiro)
• Add Falcon to the default handler fallbacks. (@ioquatix)
• Update codebase to avoid string mutations in preparation for frozen_string_literals. (@pat)
• Change MockRequest#env_for to rely on the input optionally responding to #size instead of #length. (@janko)
• Rename Rack::File -> Rack::Files and add deprecation notice. (@postmodern).
• Prefer Base64 “strict encoding” for Base64 cookies. (@ioquatix)

Removed

• Remove to_ary from Response (@tenderlove)
• Deprecate Rack::Session::Memcache in favor of Rack::Session::Dalli from dalli gem (@fatkodima)

Fixed

• Eliminate warnings for Ruby 2.7. (@osamtimizer)

Documentation

• Update broken example in Session::Abstract::ID documentation. (tonytonyjan)
• Add Padrino to the list of frameworks implmenting Rack. (@wikimatze)
• Remove Mongrel from the suggested server options in the help output. (@tricknotes)
• Replace HISTORY.md and NEWS.md with CHANGELOG.md. (@twitnithegirl)
• CHANGELOG updates. (@drenmi, @p8)

2.0.8 (from changelog)

• [CVE-2019-16782] Prevent timing attacks targeted at session ID lookup. (@tenderlove, @rafaelfranca)

1.6.12 (from changelog)

• [CVE-2019-16782] Prevent timing attacks targeted at session ID lookup. (@tenderlove, @rafaelfranca)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ sinatra (1.4.6 → 2.0.8.1) · Repo · Changelog

Security Advisories 🚨

🚨 XSS via the 400 Bad Request page

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

🚨 Path traversal is possible via backslash characters on Windows.

An issue was discovered in Sinatra 2.x before 2.0.1 on Windows. Path traversal
is possible via backslash characters.

Release Notes

2.0.8.1 (from changelog)

• Allow multiple hashes to be passed in merge and merge! for Sinatra::IndifferentHash #1572 by Shota Iguchi

2.0.8 (from changelog)

• Lookup Tilt class for template engine without loading files #1558. Fixes #1172 by Jordan Owens

• Add request info in NotFound exception #1566 by Stefan Sundin

• Add .yaml support in Sinatra::Contrib::ConfigFile #1564. Fixes #1563 by Emerson Manabu Araki

• Remove only routing parameters from @params hash #1569. Fixes #1567 by Jordan Owens, Horacio

• Support capture and content_for with Hamlit #1580 by Takashi Kokubun

• Eliminate warnings of keyword parameter for Ruby 2.7.0 #1581 by Osamtimizer

2.0.7 (from changelog)

• Fix a regression #1560 by Kunpei Sakai

2.0.6 (from changelog)

• Fix an issue setting environment from command line option #1547, #1554 by Jordan Owens, Kunpei Sakai

• Support pandoc as a new markdown renderer #1533 by Vasiliy

• Remove outdated code for tilt 1.x #1532 by Vasiliy

• Remove an extra logic for force_encoding #1527 by Jordan Owens

• Avoid multiple errors even if params contains special values #1526 by Kunpei Sakai

• Support bundler/inline with require 'sinatra' integration #1520 by Kunpei Sakai

• Avoid TypeError when params contain a key without a value on Ruby < 2.4 #1516 by Samuel Giddins

• Improve development support and documentation and source code by Olle Jonsson, Basavanagowda Kanur, Yuki MINAMIYA

2.0.5 (from changelog)

• Avoid FrozenError when params contains frozen value #1506 by Kunpei Sakai

• Add support for Erubi #1494 by @tkmru

• IndifferentHash monkeypatch warning improvements #1477 by Mike Pastore

• Improve development support and documentation and source code by Anusree Prakash, Jordan Owens, @ceclinux and @krororo.

sinatra-contrib

• Add flush option to content_for #1225 by Shota Iguchi

• Drop activesupport dependency from sinatra-contrib #1448

• Update yield_content to append default to ERB template buffer #1500 by Jordan Owens

rack-protection

• Don't track the Accept-Language header by default #1504 by Artem Chistyakov

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ sinatra-contrib (1.4.6 → 2.0.8.1) · Repo · Changelog

Release Notes

2.0.8.1 (from changelog)

• Allow multiple hashes to be passed in merge and merge! for Sinatra::IndifferentHash #1572 by Shota Iguchi

2.0.8 (from changelog)

• Lookup Tilt class for template engine without loading files #1558. Fixes #1172 by Jordan Owens

• Add request info in NotFound exception #1566 by Stefan Sundin

• Add .yaml support in Sinatra::Contrib::ConfigFile #1564. Fixes #1563 by Emerson Manabu Araki

• Remove only routing parameters from @params hash #1569. Fixes #1567 by Jordan Owens, Horacio

• Support capture and content_for with Hamlit #1580 by Takashi Kokubun

• Eliminate warnings of keyword parameter for Ruby 2.7.0 #1581 by Osamtimizer

2.0.7 (from changelog)

• Fix a regression #1560 by Kunpei Sakai

2.0.6 (from changelog)

• Fix an issue setting environment from command line option #1547, #1554 by Jordan Owens, Kunpei Sakai

• Support pandoc as a new markdown renderer #1533 by Vasiliy

• Remove outdated code for tilt 1.x #1532 by Vasiliy

• Remove an extra logic for force_encoding #1527 by Jordan Owens

• Avoid multiple errors even if params contains special values #1526 by Kunpei Sakai

• Support bundler/inline with require 'sinatra' integration #1520 by Kunpei Sakai

• Avoid TypeError when params contain a key without a value on Ruby < 2.4 #1516 by Samuel Giddins

• Improve development support and documentation and source code by Olle Jonsson, Basavanagowda Kanur, Yuki MINAMIYA

2.0.5 (from changelog)

• Avoid FrozenError when params contains frozen value #1506 by Kunpei Sakai

• Add support for Erubi #1494 by @tkmru

• IndifferentHash monkeypatch warning improvements #1477 by Mike Pastore

• Improve development support and documentation and source code by Anusree Prakash, Jordan Owens, @ceclinux and @krororo.

sinatra-contrib

• Add flush option to content_for #1225 by Shota Iguchi

• Drop activesupport dependency from sinatra-contrib #1448

• Update yield_content to append default to ERB template buffer #1500 by Jordan Owens

rack-protection

• Don't track the Accept-Language header by default #1504 by Artem Chistyakov

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ backports (indirect, 3.6.6 → 3.17.2) · Repo · Changelog

Release Notes

3.16.0 (from changelog)

Note: Next major version (X-mas 2020) will drop support for Ruby < 2.2.

• Ruby 2.7 backports

  • Array

    • intersection

  • Comparable

    • clamp (with range)

  • Complex

    • +<=>+

  • Enumerable

    • filter_map

    • tally

  • Enumerator

    • produce (class method)

  • Time

    • floor, ceil

3.15.0 (from changelog)

* Proc / Method
  * +<<+, +>>+

3.14.0 (from changelog)

* Hash
  * +to_h+ (with block)

3.13.0 (from changelog)

* Hash
  * +merge+, +merge!+/+update+ (with multiple arguments)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ multi_json (indirect, 1.11.2 → 1.14.1) · Repo · Changelog

Release Notes

1.14.1 (from changelog)

• Fix a warning in Ruby 2.7

1.14.0 (from changelog)

• Support Oj 3.x gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 68 commits:

• Version 0.14.1
• Update changelog for 0.14.1
• Fix 2.7 warning
• Merge pull request #193 from orien/gem-metadata
• Add project metadata to the gemspec
• Version 0.14.0
• Remove ssh key signing
• Add changelog for 0.14
• Oj 2 and 3 support
• Fix CI
• Remove gemnasium
• Merge pull request #192 from igas/patch-2
• Fix codeclimate badge
• Version 1.13.1
• Fix missing stdlib set dependency in oj adapter
• Merge pull request #184 from josephpage/patch-1
• add changelog history for 0.13.0 release
• Version 0.13.0
• Fix copyright year in README
• Fix README typo
• Make Oj adapter handle JSON::ParseError correctly
• Sort out the README a bit
• Make CI utilize fresh rubygems and bundler
• Update CI rubies
• Merge pull request #180 from 284km/update_travis
• CI against Ruby 2.2.8/2.3.5/2.4.2
• Version 1.12.2
• Update bundler before running specs in CI
• Bump up some ruby versions for CI
• Renew my cert
• Tidy up gemspec a bit
• Merge pull request #177 from aried3r/patch-1
• Update README.md
• Specify different versions of json gem
• Add ruby 2.4 to travis
• Update some development dependencies
• Merge pull request #173 from jorgebraz/master
• Check if read IO object value is `blank?`
• Merge pull request #169 from app2641/typo
• Fix typo [ci skip]
• Version 1.12.1
• Prevent OptionsCache from leaking memory
• Bump travis ruby 2.3 version to the latest
• Clean up benchmark a bit
• Version 1.12.0
• Changelog
• Refactor global options cache into separate module
• Add simple benchmark
• Merge pull request #167 from petedmarsh/cache-options-in-adapter-dump-and-load
• Cache options generated in MultiJson::Adapter
• Version 1.11.3
• Relax 2.1 version for travis
• Update gem cert
• Specify minor ruby versions for travis
• Use older rake for 1.8 support
• Add ruby 2.3 to Travis config and readme
• Merge pull request #166 from petedmarsh/master
• Add Ruby 2.2.0 to Ruby versions in README
• Bump up the development version of JrJackson
• Depend on newer version of JrJackson for development
• Reverse order of keys and values in REQUIREMENT_MAP
• Update vendored OkJson to version 45
• Cache bundle for faster CI runs
• Test against JRuby 9.0.0.0
• Use consistent coding style
• Update vendored OkJson to version 44
• Merge pull request #160 from victor-o-silva/format-warning
• Format warning in multi_json.rb

↗️ rack-protection (indirect, 1.5.3 → 2.0.8.1) · Repo · Changelog

Security Advisories 🚨

🚨 rack-protection gem timing attack vulnerability when validating CSRF token

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains
a timing attack vulnerability in the CSRF token checking that can result in signatures
can be exposed. This attack appear to be exploitable via network connectivity to
the ruby application.

🚨 rack-protection gem timing attack vulnerability when validating CSRF token

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains
a timing attack vulnerability in the CSRF token checking that can result in signatures
can be exposed. This attack appear to be exploitable via network connectivity to
the ruby application.

🚨 Path traversal is possible via backslash characters on Windows.

An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal
is possible via backslash characters.

🚨 Path traversal is possible via backslash characters on Windows.

An issue was discovered in rack-protection 2.x before 2.0.1 on Windows. Path traversal
is possible via backslash characters.

Release Notes

2.0.8.1 (from changelog)

• Allow multiple hashes to be passed in merge and merge! for Sinatra::IndifferentHash #1572 by Shota Iguchi

2.0.8 (from changelog)

• Lookup Tilt class for template engine without loading files #1558. Fixes #1172 by Jordan Owens

• Add request info in NotFound exception #1566 by Stefan Sundin

• Add .yaml support in Sinatra::Contrib::ConfigFile #1564. Fixes #1563 by Emerson Manabu Araki

• Remove only routing parameters from @params hash #1569. Fixes #1567 by Jordan Owens, Horacio

• Support capture and content_for with Hamlit #1580 by Takashi Kokubun

• Eliminate warnings of keyword parameter for Ruby 2.7.0 #1581 by Osamtimizer

2.0.7 (from changelog)

• Fix a regression #1560 by Kunpei Sakai

2.0.6 (from changelog)

• Fix an issue setting environment from command line option #1547, #1554 by Jordan Owens, Kunpei Sakai

• Support pandoc as a new markdown renderer #1533 by Vasiliy

• Remove outdated code for tilt 1.x #1532 by Vasiliy

• Remove an extra logic for force_encoding #1527 by Jordan Owens

• Avoid multiple errors even if params contains special values #1526 by Kunpei Sakai

• Support bundler/inline with require 'sinatra' integration #1520 by Kunpei Sakai

• Avoid TypeError when params contain a key without a value on Ruby < 2.4 #1516 by Samuel Giddins

• Improve development support and documentation and source code by Olle Jonsson, Basavanagowda Kanur, Yuki MINAMIYA

2.0.5 (from changelog)

• Avoid FrozenError when params contains frozen value #1506 by Kunpei Sakai

• Add support for Erubi #1494 by @tkmru

• IndifferentHash monkeypatch warning improvements #1477 by Mike Pastore

• Improve development support and documentation and source code by Anusree Prakash, Jordan Owens, @ceclinux and @krororo.

sinatra-contrib

• Add flush option to content_for #1225 by Shota Iguchi

• Drop activesupport dependency from sinatra-contrib #1448

• Update yield_content to append default to ERB template buffer #1500 by Jordan Owens

rack-protection

• Don't track the Accept-Language header by default #1504 by Artem Chistyakov

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

• 2.0.8.1 release
• Merge pull request #1585 from sinatra/fix-missing-commit
• bump version to 2.0.8.1
• Merge pull request #1572 from iguchi1124/support-ruby26-merge

↗️ tilt (indirect, 2.0.1 → 2.0.10) · Repo · Changelog

Release Notes

2.0.10 (from changelog)

• Remove test files from bundled gem (#339, greysteil)
• Fix warning when using yield in templates on ruby 2.7 (#343, jeremyevans)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 mustermann (added, 1.1.1)

🆕 ruby2_keywords (added, 0.0.2)

🗑️ rack-test (removed)

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

• Circle CI, Semaphore and Travis-CI are all excellent options.
• If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github.
• If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with depfu/.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)