actionpack 7.1.3.1 → 7.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1b62aeaa57b9cd75f878c9fc01bfb6ea6212efb204b11333d90f612e1c00bfda
-  data.tar.gz: 0b92927142cc52e79ba1e16d8b8ba3dbceb9906978ff0d9292835110c08f6637
+  metadata.gz: 6d6c0075e31a2470da87034e8352742903c176696808a902d17a33b8db79c0cd
+  data.tar.gz: a6c9e27f6650d1356b68de05dd835f7aa663d131410d188034d25c5f745f3a5e
 SHA512:
-  metadata.gz: abcb6dd57c8fea664f4a8c8f9124e48188e4d9042620096a877b9b55d7f20c64ee38a4c9b18435add3c81929884f666651befd678aa109760c42d8f03605888a
-  data.tar.gz: 715bbae4ea354077bd17c50ffcab9916278d245861e34913b8ee457eccb6aefd685474720accc4413b5b7eabb7e62e1b0c8abb336e93854fc244abef2b2833f3
+  metadata.gz: e26080c351f2d9d2218a77a7a4583473eb6ecbec52f8eb5fd2879393f4037459acfaed714c0db8ead7905aa8234b48480d1ab313eb281eda1e9a7c8bb5f2cefe
+  data.tar.gz: bd2fa076443257da863689d42f1ca5e076a91282f374c8389452ec8604fe5e528830cdb5cd7763c79bd4194e1c3345221f2a409e80ae24dc625bba4d08a2d0d1

data/CHANGELOG.md

@@ -1,13 +1,110 @@
+## Rails 7.1.4.1 (October 15, 2024) ##
+
+*   Avoid regex backtracking in HTTP Token authentication
+
+    [CVE-2024-47887]
+
+*   Avoid regex backtracking in query parameter filtering
+
+    [CVE-2024-41128]
+
+## Rails 7.1.4 (August 22, 2024) ##
+
+*   Resolve deprecation warning in latest `selenium-webdriver`.
+
+    *Earlopain*
+
+*   Don't preload Selenium browser when remote.
+
+    *Noah Horton*
+
+*   Fix crash for invalid Content-Type in ShowExceptions middleware.
+
+    *Earlopain*
+
+*   Fix inconsistent results of `params.deep_transform_keys`.
+
+    *Iago Pimenta*
+
+*   Do not report rendered errors except 500.
+
+    *Nikita Vasilevsky*
+
+*   Improve routes source location detection.
+
+    *Jean Boussier*
+
+*   Fix `Request#raw_post` raising `NoMethodError` when `rack.input` is `nil`.
+
+    *Hartley McGuire*
+
+*   Fix url generation in nested engine when script name is empty.
+
+    *zzak*
+
+*   Fix `Mime::Type.parse` handling type parameters for HTTP Accept headers.
+
+    *Taylor Chaparro*
+
+*   Fix the error page that is displayed when a view template is missing to account for nested controller paths in the
+    suggested correct location for the missing template.
+
+    *Joshua Young*
+
+*   Fix a regression in 7.1.3 passing a `to:` option without a controller when the controller is already defined by a scope.
+
+    ```ruby
+    Rails.application.routes.draw do
+      controller :home do
+        get "recent", to: "recent_posts"
+      end
+    end
+    ```
+
+    *Étienne Barrié*
+
+*   Fix `ActionDispatch::Executor` middleware to report errors handled by `ActionDispatch::ShowExceptions`
+
+    In the default production environment, `ShowExceptions` rescues uncaught errors
+    and returns a response. Because of this the executor wouldn't report production
+    errors with the default Rails configuration.
+
+    *Jean Boussier*
+
+
+## Rails 7.1.3.4 (June 04, 2024) ##
+
+*   Include the HTTP Permissions-Policy on non-HTML Content-Types
+    [CVE-2024-28103]
+
+    *Aaron Patterson*
+
+## Rails 7.1.3.3 (May 16, 2024) ##
+
+*   No changes.
+
+
+## Rails 7.1.3.2 (February 21, 2024) ##
+
+*   Fix `raise_on_missing_translations` not working correctly with the
+    `translate` method in controllers after the patch for CVE-2024-26143.
+
+    *John Hawthorn*
+
 ## Rails 7.1.3.1 (February 21, 2024) ##
 
 *   Fix possible XSS vulnerability with the `translate` method in controllers
 
     CVE-2024-26143
 
+    *ooooooo-q + Aaron Patterson*
+
 *   Fix ReDoS in Accept header parsing
 
     CVE-2024-26142
 
+    *Aaron Patterson*
+
 ## Rails 7.1.3 (January 16, 2024) ##
 
 *   Fix including `Rails.application.routes.url_helpers` directly in an
@@ -122,6 +219,11 @@
 
     *Mike Dalessio*
 
+*   Ensure an uncaught exception when rendering a Turbo Frame properly breaks
+    out of the Frame and shows the `DebugView` error page in development.
+
+    *Joé Dupuis*
+
 *   The `with_routing` helper can now be called at the class level. When called at the class level, the routes will
     be setup before each test, and reset after every test. For example:
 

data/lib/abstract_controller/translation.rb

@@ -21,25 +21,16 @@ module AbstractController
         key = "#{path}.#{action_name}#{key}"
       end
 
-      if options[:default]
-        options[:default] = [options[:default]] unless options[:default].is_a?(Array)
-        options[:default] = options[:default].map do |value|
-          value.is_a?(String) ? ERB::Util.html_escape(value) : value
+      if ActiveSupport::HtmlSafeTranslation.html_safe_translation_key?(key)
+        if options[:default]
+          options[:default] = [options[:default]] unless options[:default].is_a?(Array)
+          options[:default] = options[:default].map do |value|
+            value.is_a?(String) ? ERB::Util.html_escape(value) : value
+          end
         end
       end
 
-      if options[:raise].nil?
-        options[:default] = [] unless options[:default]
-        options[:default] << MISSING_TRANSLATION
-      end
-
-      result = ActiveSupport::HtmlSafeTranslation.translate(key, **options)
-
-      if result == MISSING_TRANSLATION
-        +"translation missing: #{key}"
-      else
-        result
-      end
+      ActiveSupport::HtmlSafeTranslation.translate(key, **options)
     end
     alias :t :translate
 
@@ -48,9 +39,5 @@ module AbstractController
       I18n.localize(object, **options)
     end
     alias :l :localize
-
-    private
-      MISSING_TRANSLATION = -(2**60)
-      private_constant :MISSING_TRANSLATION
   end
 end

data/lib/action_controller/metal/http_authentication.rb

@@ -507,14 +507,11 @@ module ActionController
         array_params.each { |param| (param[1] || +"").gsub! %r/^"|"$/, "" }
       end
 
-      WHITESPACED_AUTHN_PAIR_DELIMITERS = /\s*#{AUTHN_PAIR_DELIMITERS}\s*/
-      private_constant :WHITESPACED_AUTHN_PAIR_DELIMITERS
-
       # This method takes an authorization body and splits up the key-value
       # pairs by the standardized <tt>:</tt>, <tt>;</tt>, or <tt>\t</tt>
       # delimiters defined in +AUTHN_PAIR_DELIMITERS+.
       def raw_params(auth)
-        _raw_params = auth.sub(TOKEN_REGEX, "").split(WHITESPACED_AUTHN_PAIR_DELIMITERS)
+        _raw_params = auth.sub(TOKEN_REGEX, "").split(AUTHN_PAIR_DELIMITERS).map(&:strip)
         _raw_params.reject!(&:empty?)
 
         if !_raw_params.first&.start_with?(TOKEN_KEY)

data/lib/action_controller/metal/strong_parameters.rb

@@ -792,7 +792,7 @@ module ActionController
     # from the root hash and from all nested hashes and arrays. The values are unchanged.
     def deep_transform_keys(&block)
       new_instance_with_inherited_permitted_status(
-        @parameters.deep_transform_keys(&block)
+        _deep_transform_keys_in_object(@parameters, &block).to_unsafe_h
       )
     end
 
@@ -800,7 +800,7 @@ module ActionController
     # changed keys. This includes the keys from the root hash and from all
     # nested hashes and arrays. The values are unchanged.
     def deep_transform_keys!(&block)
-      @parameters.deep_transform_keys!(&block)
+      @parameters = _deep_transform_keys_in_object(@parameters, &block).to_unsafe_h
       self
     end
 
@@ -972,7 +972,7 @@ module ActionController
     # the returned array will include empty strings.
     #
     #   params = ActionController::Parameters.new(tags: "ruby,rails,,web")
-    #   params.extract_value(:tags) # => ["ruby", "rails", "", "web"]
+    #   params.extract_value(:tags, delimiter: ",") # => ["ruby", "rails", "", "web"]
     def extract_value(key, delimiter: "_")
       @parameters[key]&.split(delimiter, -1)
     end
@@ -1035,6 +1035,46 @@ module ActionController
         end
       end
 
+      def _deep_transform_keys_in_object(object, &block)
+        case object
+        when Hash
+          object.each_with_object(self.class.new) do |(key, value), result|
+            result[yield(key)] = _deep_transform_keys_in_object(value, &block)
+          end
+        when Parameters
+          if object.permitted?
+            object.to_h.deep_transform_keys(&block)
+          else
+            object.to_unsafe_h.deep_transform_keys(&block)
+          end
+        when Array
+          object.map { |e| _deep_transform_keys_in_object(e, &block) }
+        else
+          object
+        end
+      end
+
+      def _deep_transform_keys_in_object!(object, &block)
+        case object
+        when Hash
+          object.keys.each do |key|
+            value = object.delete(key)
+            object[yield(key)] = _deep_transform_keys_in_object!(value, &block)
+          end
+          object
+        when Parameters
+          if object.permitted?
+            object.to_h.deep_transform_keys!(&block)
+          else
+            object.to_unsafe_h.deep_transform_keys!(&block)
+          end
+        when Array
+          object.map! { |e| _deep_transform_keys_in_object!(e, &block) }
+        else
+          object
+        end
+      end
+
       def specify_numeric_keys?(filter)
         if filter.respond_to?(:keys)
           filter.keys.any? { |key| /\A-?\d+\z/.match?(key) }

data/lib/action_controller/test_case.rb

@@ -284,13 +284,13 @@ module ActionController
   # ActionController::TestCase will also automatically provide the following instance
   # variables for use in the tests:
   #
-  # <b>@controller</b>::
+  # @controller::
   #      The controller instance that will be tested.
-  # <b>@request</b>::
+  # @request::
   #      An ActionController::TestRequest, representing the current HTTP
   #      request. You can modify this object before sending the HTTP request. For example,
   #      you might want to set some session properties before sending a GET request.
-  # <b>@response</b>::
+  # @response::
   #      An ActionDispatch::TestResponse object, representing the response
   #      of the last HTTP response. In the above example, <tt>@response</tt> becomes valid
   #      after calling +post+. If the various assert methods are not sufficient, then you

data/lib/action_controller.rb

@@ -62,8 +62,11 @@ module ActionController
     autoload :ApiRendering
   end
 
-  autoload :TestCase,           "action_controller/test_case"
-  autoload :TemplateAssertions, "action_controller/test_case"
+  autoload_at "action_controller/test_case" do
+    autoload :TestCase
+    autoload :TestRequest
+    autoload :TemplateAssertions
+  end
 end
 
 # Common Active Support usage in Action Controller

data/lib/action_dispatch/http/filter_parameters.rb

@@ -64,12 +64,17 @@ module ActionDispatch
         ActiveSupport::ParameterFilter.new(filters)
       end
 
-      KV_RE   = "[^&;=]+"
-      PAIR_RE = %r{(#{KV_RE})=(#{KV_RE})}
       def filtered_query_string # :doc:
-        query_string.gsub(PAIR_RE) do |_|
-          parameter_filter.filter($1 => $2).first.join("=")
+        parts = query_string.split(/([&;])/)
+        filtered_parts = parts.map do |part|
+          if part.include?("=")
+            key, value = part.split("=", 2)
+            parameter_filter.filter(key => value).first.join("=")
+          else
+            part
+          end
         end
+        filtered_parts.join("")
       end
     end
   end

data/lib/action_dispatch/http/mime_type.rb

@@ -162,8 +162,11 @@ module Mime
       end
 
       def lookup(string)
+        return LOOKUP[string] if LOOKUP.key?(string)
+
         # fallback to the media-type without parameters if it was not found
-        LOOKUP[string] || LOOKUP[string.split(";", 2)[0]&.rstrip] || Type.new(string)
+        string = string.split(";", 2)[0]&.rstrip
+        LOOKUP[string] || Type.new(string)
       end
 
       def lookup_by_extension(extension)

data/lib/action_dispatch/http/permissions_policy.rb

@@ -35,7 +35,6 @@ module ActionDispatch # :nodoc:
       def call(env)
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         request = ActionDispatch::Request.new(env)
@@ -52,12 +51,6 @@ module ActionDispatch # :nodoc:
       end
 
       private
-        def html_response?(headers)
-          if content_type = headers[Rack::CONTENT_TYPE]
-            content_type.include?("html")
-          end
-        end
-
         def policy_present?(headers)
           headers[ActionDispatch::Constants::FEATURE_POLICY]
         end
@@ -96,7 +89,7 @@ module ActionDispatch # :nodoc:
       geolocation:          "geolocation",
       gyroscope:            "gyroscope",
       hid:                  "hid",
-      idle_detection:       "idle_detection",
+      idle_detection:       "idle-detection",
       magnetometer:         "magnetometer",
       microphone:           "microphone",
       midi:                 "midi",

data/lib/action_dispatch/http/request.rb

@@ -229,11 +229,12 @@ module ActionDispatch
     # Early Hints is an HTTP/2 status code that indicates hints to help a client start
     # making preparations for processing the final response.
     #
-    # If the env contains +rack.early_hints+ then the server accepts HTTP2 push for Link headers.
+    # If the env contains +rack.early_hints+ then the server accepts HTTP2 push for
+    # link headers.
     #
     # The +send_early_hints+ method accepts a hash of links as follows:
     #
-    #   send_early_hints("Link" => "</style.css>; rel=preload; as=style\n</script.js>; rel=preload")
+    #   send_early_hints("link" => "</style.css>; rel=preload; as=style,</script.js>; rel=preload")
     #
     # If you are using +javascript_include_tag+ or +stylesheet_link_tag+ the
     # Early Hints headers are included by default if supported.
@@ -339,7 +340,6 @@ module ActionDispatch
     def raw_post
       unless has_header? "RAW_POST_DATA"
         set_header("RAW_POST_DATA", read_body_stream)
-        body_stream.rewind if body_stream.respond_to?(:rewind)
       end
       get_header "RAW_POST_DATA"
     end
@@ -467,9 +467,29 @@ module ActionDispatch
       end
 
       def read_body_stream
-        body_stream.rewind if body_stream.respond_to?(:rewind)
-        return body_stream.read if headers.key?("Transfer-Encoding") # Read body stream until EOF if "Transfer-Encoding" is present
-        body_stream.read(content_length)
+        if body_stream
+          reset_stream(body_stream) do
+            if headers.key?("Transfer-Encoding")
+              body_stream.read # Read body stream until EOF if "Transfer-Encoding" is present
+            else
+              body_stream.read(content_length)
+            end
+          end
+        end
+      end
+
+      def reset_stream(body_stream)
+        if body_stream.respond_to?(:rewind)
+          body_stream.rewind
+
+          content = yield
+
+          body_stream.rewind
+
+          content
+        else
+          yield
+        end
       end
   end
 end

data/lib/action_dispatch/middleware/executor.rb

@@ -12,6 +12,12 @@ module ActionDispatch
       state = @executor.run!(reset: true)
       begin
         response = @app.call(env)
+
+        if env["action_dispatch.report_exception"]
+          error = env["action_dispatch.exception"]
+          @executor.error_reporter.report(error, handled: false, source: "application.action_dispatch")
+        end
+
         returned = response << ::Rack::BodyProxy.new(response.pop) { state.complete! }
       rescue => error
         @executor.error_reporter.report(error, handled: false, source: "application.action_dispatch")

data/lib/action_dispatch/middleware/show_exceptions.rb

@@ -33,8 +33,11 @@ module ActionDispatch
       request = ActionDispatch::Request.new env
       backtrace_cleaner = request.get_header("action_dispatch.backtrace_cleaner")
       wrapper = ExceptionWrapper.new(backtrace_cleaner, exception)
+      request.set_header "action_dispatch.exception", wrapper.unwrapped_exception
+      request.set_header "action_dispatch.report_exception", !wrapper.rescue_response?
+
       if wrapper.show?(request)
-        render_exception(request, wrapper)
+        render_exception(request.dup, wrapper)
       else
         raise exception
       end
@@ -43,7 +46,6 @@ module ActionDispatch
     private
       def render_exception(request, wrapper)
         status = wrapper.status_code
-        request.set_header "action_dispatch.exception", wrapper.unwrapped_exception
         request.set_header "action_dispatch.original_path", request.path_info
         request.set_header "action_dispatch.original_request_method", request.raw_request_method
         fallback_to_html_format_if_invalid_mime_type(request)
@@ -65,9 +67,17 @@ module ActionDispatch
         # If the MIME type for the request is invalid then the
         # @exceptions_app may not be able to handle it. To make it
         # easier to handle, we switch to HTML.
-        request.formats
-      rescue ActionDispatch::Http::MimeNegotiation::InvalidType
-        request.set_header "HTTP_ACCEPT", "text/html"
+        begin
+          request.content_mime_type
+        rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+          request.set_header "CONTENT_TYPE", "text/html"
+        end
+
+        begin
+          request.formats
+        rescue ActionDispatch::Http::MimeNegotiation::InvalidType
+          request.set_header "HTTP_ACCEPT", "text/html"
+        end
       end
 
       def pass_response(status)

data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb

@@ -11,7 +11,7 @@
     </p>
     <p>
       For example, a <code><%= @exception.controller %>#<%= @exception.action_name %></code> action defined in <code>app/controllers/<%= @exception.controller.controller_path %>_controller.rb</code> should have a corresponding view template
-      in a file named <code>app/views/<%= @exception.controller.controller_name %>/<%= @exception.action_name %>.html.erb</code>.
+      in a file named <code>app/views/<%= @exception.controller.controller_path %>/<%= @exception.action_name %>.html.erb</code>.
     </p>
     <p>
       However, if this controller is an API endpoint responding with 204 (No Content), which does not require a view template because it doesn't serve an HTML response, then this error will occur when trying to access it with a browser. In this particular scenario, you can ignore this error.

data/lib/action_dispatch/railtie.rb

@@ -69,7 +69,6 @@ module ActionDispatch
       ActionDispatch::Cookies::CookieJar.always_write_cookie = config.action_dispatch.always_write_cookie
 
       ActionDispatch::Routing::Mapper.route_source_locations = Rails.env.development?
-      ActionDispatch::Routing::Mapper.backtrace_cleaner = Rails.backtrace_cleaner
 
       ActionDispatch.test_app = app
     end

data/lib/action_dispatch/routing/mapper.rb

@@ -10,10 +10,19 @@ require "action_dispatch/routing/endpoint"
 module ActionDispatch
   module Routing
     class Mapper
+      class BacktraceCleaner < ActiveSupport::BacktraceCleaner # :nodoc:
+        def initialize
+          super
+          remove_silencers!
+          add_core_silencer
+          add_stdlib_silencer
+        end
+      end
+
       URL_OPTIONS = [:protocol, :subdomain, :domain, :host, :port]
 
       cattr_accessor :route_source_locations, instance_accessor: false, default: false
-      cattr_accessor :backtrace_cleaner, instance_accessor: false, default: ActiveSupport::BacktraceCleaner.new
+      cattr_accessor :backtrace_cleaner, instance_accessor: false, default: BacktraceCleaner.new
 
       class Constraints < Routing::Endpoint # :nodoc:
         attr_reader :app, :constraints
@@ -220,12 +229,17 @@ module ActionDispatch
               if to.nil?
                 controller = default_controller
                 action = default_action
-              elsif to.is_a?(String) && to.include?("#")
-                to_endpoint = to.split("#").map!(&:-@)
-                controller  = to_endpoint[0]
-                action      = to_endpoint[1]
+              elsif to.is_a?(String)
+                if to.include?("#")
+                  to_endpoint = to.split("#").map!(&:-@)
+                  controller  = to_endpoint[0]
+                  action      = to_endpoint[1]
+                else
+                  controller = default_controller
+                  action = to
+                end
               else
-                raise ArgumentError, ":to must respond to `action` or `call`, or it must be a String that includes '#'"
+                raise ArgumentError, ":to must respond to `action` or `call`, or it must be a String that includes '#', or the controller should be implicit"
               end
 
               controller = add_controller_module(controller, modyoule)
@@ -359,12 +373,35 @@ module ActionDispatch
             Routing::RouteSet::Dispatcher.new raise_on_name_error
           end
 
-          def route_source_location
-            if Mapper.route_source_locations
-              action_dispatch_dir = File.expand_path("..", __dir__)
-              caller_location = caller_locations.find { |location| !location.path.include?(action_dispatch_dir) }
-              cleaned_path = Mapper.backtrace_cleaner.clean([caller_location.path]).first
-              "#{cleaned_path}:#{caller_location.lineno}" if cleaned_path
+          if Thread.respond_to?(:each_caller_location)
+            def route_source_location
+              if Mapper.route_source_locations
+                action_dispatch_dir = File.expand_path("..", __dir__)
+                Thread.each_caller_location do |location|
+                  next if location.path.start_with?(action_dispatch_dir)
+
+                  cleaned_path = Mapper.backtrace_cleaner.clean_frame(location.path)
+                  next if cleaned_path.nil?
+
+                  return "#{cleaned_path}:#{location.lineno}"
+                end
+                nil
+              end
+            end
+          else
+            def route_source_location
+              if Mapper.route_source_locations
+                action_dispatch_dir = File.expand_path("..", __dir__)
+                caller_locations.each do |location|
+                  next if location.path.start_with?(action_dispatch_dir)
+
+                  cleaned_path = Mapper.backtrace_cleaner.clean_frame(location.path)
+                  next if cleaned_path.nil?
+
+                  return "#{cleaned_path}:#{location.lineno}"
+                end
+                nil
+              end
             end
           end
       end
@@ -680,7 +717,7 @@ module ActionDispatch
               def optimize_routes_generation?; false; end
 
               define_method :find_script_name do |options|
-                if options.key? :script_name
+                if options.key?(:script_name) && options[:script_name].present?
                   super(options)
                 else
                   script_namer.call(options)

data/lib/action_dispatch/system_testing/browser.rb

@@ -70,7 +70,12 @@ module ActionDispatch
         end
 
         def resolve_driver_path(namespace)
-          namespace::Service.driver_path = ::Selenium::WebDriver::DriverFinder.path(options, namespace::Service)
+          # The path method has been deprecated in 4.20.0
+          if Gem::Version.new(::Selenium::WebDriver::VERSION) >= Gem::Version.new("4.20.0")
+            namespace::Service.driver_path = ::Selenium::WebDriver::DriverFinder.new(options, namespace::Service.new).driver_path
+          else
+            namespace::Service.driver_path = ::Selenium::WebDriver::DriverFinder.path(options, namespace::Service)
+          end
         end
     end
   end

data/lib/action_dispatch/system_testing/driver.rb

@@ -16,7 +16,7 @@ module ActionDispatch
           gem "selenium-webdriver", ">= 4.0.0"
           require "selenium/webdriver"
           @browser = Browser.new(options[:using])
-          @browser.preload
+          @browser.preload unless @options[:browser] == :remote
         else
           @browser = nil
         end

data/lib/action_pack/gem_version.rb

@@ -9,7 +9,7 @@ module ActionPack
   module VERSION
     MAJOR = 7
     MINOR = 1
-    TINY  = 3
+    TINY  = 4
     PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 7.1.3.1
+  version: 7.1.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-02-21 00:00:00.000000000 Z
+date: 2024-10-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.1
+        version: 7.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.1
+        version: 7.1.4.1
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -128,28 +128,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.1
+        version: 7.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.1
+        version: 7.1.4.1
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.1
+        version: 7.1.4.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.1.3.1
+        version: 7.1.4.1
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -346,12 +346,12 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v7.1.3.1/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v7.1.3.1/
+  changelog_uri: https://github.com/rails/rails/blob/v7.1.4.1/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v7.1.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v7.1.3.1/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v7.1.4.1/actionpack
   rubygems_mfa_required: 'true'
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -367,8 +367,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.4.10
-signing_key:
+rubygems_version: 3.5.16
+signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).
 test_files: []