Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[ruby] Update rubyzip: 1.2.2 → 1.2.3 (patch) #300

Merged
merged 1 commit into from May 24, 2019

Conversation

Projects
None yet
2 participants
@depfu
Copy link
Contributor

commented May 24, 2019

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rubyzip (1.2.2 → 1.2.3) · Repo · Changelog

Release Notes

1.2.3

  • Allow tilde in zip entry names #391 (fixes regression in 1.2.2 from #376)
  • Support frozen string literals in more files #390
  • Require pathname explicitly #388 (fixes regression in 1.2.2 from #376)

Tooling / Documentation:

  • CI updates #392, #394
    • Bump supported ruby versions and add 2.6
    • JRuby failures are no longer ignored (reverts #375 / part of #371)
  • Add changelog entry that was missing for last release #387
  • Comment cleanup #385

Since the GitHub release information for 1.2.2 is missing, I will also include it here:

1.2.2

NB: This release drops support for extracting symlinks, because there was no clear way to support this securely. See #376 (comment) for details.

  • Fix CVE-2018-1000544 #376 / #371
  • Fix NoMethodError: undefined method `glob' #363
  • Fix handling of stored files (i.e. files not using compression) with general purpose bit 3 set #358
  • Fix close on StringIO-backed zip file #353
  • Add Zip.force_entry_names_encoding option #340
  • Update rubocop, apply auto-fixes, and fix regressions caused by said auto-fixes #332, #355
  • Save temporary files to temporary directory (rather than current directory) #325

Tooling / Documentation:

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 22 commits:


Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label May 24, 2019

@codecov-io

This comment has been minimized.

Copy link

commented May 24, 2019

Codecov Report

Merging #300 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master     #300   +/-   ##
=======================================
  Coverage   89.33%   89.33%           
=======================================
  Files          35       35           
  Lines         619      619           
=======================================
  Hits          553      553           
  Misses         66       66

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fa0c455...0793850. Read the comment docs.

@ruebot ruebot merged commit 05f5d44 into master May 24, 2019

3 checks passed

codecov/patch Coverage not affected when comparing fa0c455...0793850
Details
codecov/project 89.33% remains the same compared to fa0c455
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

@depfu depfu bot deleted the depfu/update/rubyzip-1.2.3 branch May 24, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.