From e8c4e7a7c4090e83a2bc5c63f2c1a04af56099ae Mon Sep 17 00:00:00 2001 From: "depfu[bot]" <23717796+depfu[bot]@users.noreply.github.com> Date: Tue, 26 Mar 2024 14:05:23 +0000 Subject: [PATCH 1/2] Update paper_trail to version 15.1.0 --- Gemfile.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 0e26c882..61fe6493 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -225,7 +225,7 @@ GEM http-accept (1.7.0) http-cookie (1.0.5) domain_name (~> 0.5) - i18n (1.14.1) + i18n (1.14.4) concurrent-ruby (~> 1.0) i18n_data (0.17.1) simple_po_parser (~> 1.1) @@ -289,7 +289,7 @@ GEM mini_magick (4.12.0) mini_mime (1.1.5) mini_portile2 (2.8.5) - minitest (5.22.2) + minitest (5.22.3) momentjs-rails (2.29.4.1) railties (>= 3.1) monetize (1.13.0) @@ -353,9 +353,9 @@ GEM actionpack (>= 4.2) omniauth (~> 2.0) orm_adapter (0.5.0) - paper_trail (12.3.0) - activerecord (>= 5.2) - request_store (~> 1.1) + paper_trail (15.1.0) + activerecord (>= 6.1) + request_store (~> 1.4) parallel (1.24.0) parser (3.3.0.5) ast (~> 2.4.1) From ba8f7e5cf37e877ce5ed49cd4e58f848dcbc41be Mon Sep 17 00:00:00 2001 From: Henne Vogelsang Date: Tue, 26 Mar 2024 16:20:12 +0100 Subject: [PATCH 2/2] Allow to serialize TimeZone classes --- config/application.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/application.rb b/config/application.rb index 1953c529..fc72c02c 100644 --- a/config/application.rb +++ b/config/application.rb @@ -36,6 +36,6 @@ module Osem # This is a nightmare with our current data model, no one ever thought about this. config.active_record.belongs_to_required_by_default = false # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 - config.active_record.yaml_column_permitted_classes = ['Date', 'DateTime', 'Symbol', 'Time'] + config.active_record.yaml_column_permitted_classes = ['Date', 'DateTime', 'Symbol', 'Time', 'ActiveSupport::TimeWithZone', 'ActiveSupport::TimeZone'] end end