Skip to content

Commit 9294b48

Browse files
committed
Upgrade @hotwired/turbo-rails to resolve security warning
Details of the security vulnerability are available at: GHSA-qppm-g56g-fpvp > A race condition in Turbo Frames allows delayed HTTP responses to > restore stale session cookies after session-modifying operations. As a result, my project started receiving the following warning: > Dependabot cannot update @hotwired/turbo to a non-vulnerable version > > The latest possible version that can be installed is 7.3.0 because of the following conflicting dependencies: > > rails_admin@3.3.0 requires @hotwired/turbo@^7.3.0 via @hotwired/turbo-rails@7.3.0 > No patched version available for @hotwired/turbo > > The earliest fixed version is 8.0.21.
1 parent d8e0809 commit 9294b48

3 files changed

Lines changed: 5 additions & 5 deletions

File tree

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
"dependencies": {
1717
"@babel/runtime": "^7.16.7",
1818
"@fortawesome/fontawesome-free": ">=5.15.0 <7.0.0",
19-
"@hotwired/turbo-rails": "^7.1.0",
19+
"@hotwired/turbo-rails": "^8.0.21",
2020
"@popperjs/core": "^2.11.0",
2121
"@rails/ujs": "^6.1.4-1",
2222
"bootstrap": "^5.1.3",

spec/controllers/rails_admin/main_controller_spec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -472,7 +472,7 @@ def get(action, params)
472472
'delete_paperclip_asset' => 'test',
473473
'should_not_be_here' => 'test',
474474
}.merge(defined?(ActiveStorage) ? {'active_storage_asset' => 'test', 'remove_active_storage_asset' => 'test', 'active_storage_assets' => 'test', 'remove_active_storage_assets' => 'test'} : {}).
475-
merge(defined?(Shrine) ? {'shrine_asset' => 'test', 'remove_shrine_asset' => 'test'} : {}),
475+
merge(defined?(Shrine) ? {'shrine_asset' => 'test', 'remove_shrine_asset' => 'test'} : {}),
476476
)
477477

478478
controller.send(:sanitize_params_for!, :create, RailsAdmin.config(FieldTest), controller.params['field_test'])

spec/dummy_app/package.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,11 @@
77
"@babel/plugin-proposal-private-property-in-object": "^7.21.11",
88
"@rails/actiontext": "^7.0.3-1",
99
"@rails/activestorage": "^7.0.3-1",
10-
"@rails/webpacker": "5.4.3",
10+
"@rails/webpacker": "5.4.4",
1111
"rails_admin": "file:../..",
1212
"trix": "^2.0.0-beta.0",
13-
"webpack": "^4.46.0",
14-
"webpack-cli": "^3.3.12"
13+
"webpack": "^5.105.4",
14+
"webpack-cli": "^7.0.0"
1515
},
1616
"devDependencies": {
1717
"vite": "^5.0",

0 commit comments

Comments
 (0)