There is a potential denial of service vulnerability in actionview.
This vulnerability has been assigned the CVE identifier CVE-2019-5419.

Impact

Specially crafted accept headers can cause the Action View template location
code to consume 100% CPU, causing the server unable to process requests. This
impacts all Rails applications that render views.

All users running an affected release should either upgrade or use one of the
workarounds immediately.

Workarounds

This vulnerability can be mitigated by wrapping render calls with
respond_to blocks. For example, the following example is vulnerable:

class UserController < ApplicationController
  def index
    render "index"
  end
end

But the following code is not vulnerable:

class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end

Implicit rendering is impacted, so this code is vulnerable:

class UserController < ApplicationController
  def index
  end
end

But can be changed this this:

class UserController < ApplicationController
  def index
    respond_to |format|
      format.html { render "index" }
    end
  end
end

Alternatively to specifying the format, the following monkey patch can be
applied in an initializer:

$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do

def formats

super().select do |format|

format.symbol || format.ref == "/"

end

end

end)

Credits

Thanks to John Hawthorn john@hawthorn.email of GitHub

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

1.1.5 (from changelog)

concurrent-ruby:

• fix potential leak of context on JRuby and Java 7

concurrent-ruby-edge:

• Add finalized Concurrent::Cancellation
• Add finalized Concurrent::Throttle
• Add finalized Concurrent::Promises::Channel
• Add new Concurrent::ErlangActor

1.1.4 (from changelog)

• (#780) Remove java_alias of 'submit' method of Runnable to let executor service work on java 11
• (#776) Fix NameError on defining a struct with a name which is already taken in an ancestor

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by more commits than we can show here.

1.8.0 (from changelog)

* Support :yield_returns_buffer option in capture_end for always returning the (potentially modified) buffer in <%|= tags (evanleck) (#15)

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 11 commits:

• Bump version to 1.8.0
• Fix and expand on documentation for :yield_returns_buffer
• Rename return_buffer option to yield_returns_buffer
• Modify test to work with new :return_buffer behavior
• Flip `result` and `code` for :return_buffer option
• Disable minitest plugins when testing
• Modify spec to show how :return_buffer can be used when modifying buffers
• Simplify test in attempt to get 1.8.7 passing
• Add return_buffer option to CaptureEndEngine
• Update the README with an example of how to write a method that works with capture_end (Fixes #15)
• Remove has_rdoc from gemspec, since it is deprecated

0.4.2

• Allow configuration in initialisers 3c8f909

• Clear to_global_id memoization on dup #109

• Adds hash equality #108

Commits: v0.4.1...v0.4.2

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 20 commits:

• Ignore pkg directory for releasing.
• Release 0.4.2
• Test against latest Rubies
• Merge pull request #113 from y-yagi/test_against_rails_52
• Specify Rails env in a test of `secret_key_base is not present`
• Use `secret_key_base` instead of deprecated `secret_token`
• Test against Rails 5.2
• Allow configuration in initializers
• Fix typo
• Merge pull request #108 from fattymiller/uniq-equality
• Merge pull request #109 from bradleybuda/master
• Remove memoization of GlobalID::Identification#to_global_id
• GlobalID::Identification clears memoized to_global_id on dup
• minitest 5.11 crashes with old versions of rails
• Ignore .lock files for tests
• Array#uniq to correctly identify == GlobalIDs
• [ci skip] Convert all samples back to Ruby.
• No such thing as labels, all purpose, baby.
• Merge pull request #106 from ideasasylum/ideasasylum-improved-expiration-readme
• Improved documentation clarity around expiration

0.3.3 (from changelog)

Upgrade to shared-mime-info-1.10

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by 14 commits:

• v0.3.3
• update to shared-mime-info-1.10
• Merge pull request #62 from junaruga/feature/minitest
• Change testing framework from bacon to minitest.
• Merge pull request #61 from GBH/patch-2
• Gratipay is no longer a thing
• Merge pull request #56 from GBH/patch-1
• Merge pull request #59 from junaruga/hotfix/travis-rbx
• Set available rbx name on Travis CI.
• Merge pull request #58 from junaruga/feature/update-travis
• Update .travis.yml.
• Fixing API link and adding button to rubygems
• Merge pull request #42 from jaredbeck/introduce_changelog
• Docs: Introduce changelog

See the full diff on Github. The new version differs by 10 commits:

• version bump to v2.4.0
• update CHANGELOG in preparation for v2.4.0
• update dev dependencies
• Merge pull request #86 from eagletmt/skip-progress-when-chunked
• Merge pull request #87 from halfbyte/patch-1
• Make version in changelog fit release version.
• Skip progress report when Content-Length is unavailable
• update test:examples to libiconv 1.15
• concourse: test most-recent two rubies
• convert to using windows-ruby-dev-tools-release

1.10.1

1.10.1 / 2019-01-13

Features

• [MRI] During installation, handle Xcode 10's new library pathOS. [#1801, #1851] (Thanks, @mlj and @deepj!)
• Avoid unnecessary creation of Procs in many methods. [#1776] (Thanks, @chopraanmol1!)

Bug fixes

• CSS selector :has() now correctly matches against any descendant. Previously this selector matched against only direct children). [#350] (Thanks, @Phrogz!)
• NodeSet#attr now returns nil if it's empty. Previously this raised a NoMethodError.
• [MRI] XPath errors are no longer suppressed during XSLT::Stylesheet#transform. Previously these errors were suppressed which led to silent failures and a subsequent segfault. [#1802]

1.10.0

1.10.0 / 2019-01-04

Features

• [MRI] Cross-built Windows gems now support Ruby 2.6 [#1842, #1850]

Backwards incompatibilities

This release ends support for:

• Ruby 2.2, for which official support ended on 2018-03-31 [#1841]
• JRuby 1.7, for which official support ended on 2017-11-21 [#1741]

Dependencies

• [MRI] libxml2 is updated from 2.9.8 to 2.9.9
• [MRI] libxslt is updated from 1.1.32 to 1.1.33

1.9.1

1.9.1 / 2018-12-17

Bug fixes

• Fix a bug introduced in v1.9.0 where XML::DocumentFragment#dup no longer returned an instance of the callee's class, instead always returning an XML::DocumentFragment. This notably broke any subclass of XML::DocumentFragment including HTML::DocumentFragment as well as the Loofah gem's Loofah::HTML::DocumentFragment. [#1846]

1.9.0

1.9.0 / 2018-12-17

Security Notes

• [JRuby] Upgrade Xerces dependency from 2.11.0 to 2.12.0 to address upstream vulnerability CVE-2012-0881 [#1831] (Thanks @grajagandev for reporting.)

Notable non-functional changes

• Decrease installation size by removing many unneeded files (e.g., /test) from the packaged gems. [#1719] (Thanks, @stevecrozz!)

Features

• XML::Attr#value= allows HTML node attribute values to be set to either a blank string or an empty boolean attribute. [#1800]
• Introduce XML::Node#wrap which does what XML::NodeSet#wrap has always done, but for a single node. [#1531] (Thanks, @ethirajsrinivasan!)
• [MRI] Improve installation experience on macOS High Sierra (Darwin). [#1812, #1813] (Thanks, @gpakosz and @nurse!)
• [MRI] Node#dup supports copying a node directly to a new document. See the method documentation for details.
• [MRI] DocumentFragment#dup is now more memory-efficient, avoiding making unnecessary copies. [#1063]
• [JRuby] NodeSet has been rewritten to improve performance! [#1795]

Bug fixes

• NodeSet#each now returns self instead of zero. [#1822] (Thanks, @olehif!)
• [MRI] Address a memory leak when using XML::Builder to create nodes with namespaces. [#1810]
• [MRI] Address a memory leak when unparenting a DTD. [#1784] (Thanks, @stevecheckoway!)
• [MRI] Use RbConfig::CONFIG instead of ::MAKEFILE_CONFIG to fix installations that use Makefile macros. [#1820] (Thanks, @nobu!)
• [JRuby] Decrease large memory usage when making nested XPath queries. [#1749]
• [JRuby] Fix failing tests on JRuby 9.2.x
• [JRuby] Fix default namespaces in nodes reparented into a different document [#1774]
• [JRuby] Fix support for Java 9. [#1759] (Thanks, @Taywee!)

Dependencies

• [MRI] Upgrade mini_portile2 dependency from ~> 2.3.0 to ~> 2.4.0

Does any of this look wrong? Please let us know.

See the full diff on Github. The new version differs by more commits than we can show here.

See the full diff on Github. The new version differs by 3 commits:

• Prep release
• Fix possible dev mode RCE
• Only accept formats from registered mime types

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)