Skip to content

Commit 301e494

Browse files
Update dependency yard to v0.9.42 [SECURITY] (#799)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [yard](https://yardoc.org) ([changelog](https://rubydoc.info/gems/yard/file/CHANGELOG.md)) | `0.9.41` → `0.9.42` | ![age](https://developer.mend.io/api/mc/badges/age/rubygems/yard/0.9.42?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/rubygems/yard/0.9.41/0.9.42?slim=true) | ### GitHub Vulnerability Alerts #### [GHSA-3jfp-46x4-xgfj](https://redirect.github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj) ### Impact A path traversal vulnerability was discovered in YARD <= 0.9.41 when using yard server to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions. The original patch in [GHSA-xfhh-rx56-rxcr](https://redirect.github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr) was incorrectly applied. ### Patches Please upgrade to YARD v0.9.42 immediately if you are relying on yard server to host documentation in any untrusted environments without WEBrick and rely on `--docroot`. ### Workarounds For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via yard server -s webrick), as can certain rules in your webserver configuration. ##### Severity - CVSS Score: 6.9 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N` --- ### Configuration 📅 **Schedule**: (in timezone Asia/Tokyo) - Branch creation - "" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/line/line-bot-sdk-ruby). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMjMuOCIsInVwZGF0ZWRJblZlciI6IjQzLjEyMy44IiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbImRlcGVuZGVuY3kgdXBncmFkZSJdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
1 parent d57d473 commit 301e494

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Gemfile.lock

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ GEM
153153
crack (>= 0.3.2)
154154
hashdiff (>= 0.4.0, < 2.0.0)
155155
webrick (1.9.2)
156-
yard (0.9.41)
156+
yard (0.9.42)
157157

158158
PLATFORMS
159159
arm64-darwin-21

0 commit comments

Comments
 (0)