activerecord 6.0.3.2 → 6.0.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e6e7a21d9d0019571243579fe5604be74338d7084945f9625457dcd551541af
-  data.tar.gz: 0e9f66ad452fff98d22e5c6be48ab7254cc2738fc26a10bfa379886358bad0c4
+  metadata.gz: bcd8faaaae67978bbcad0411b20e03f1ea5c805fd21333b9d6e0567a5474012e
+  data.tar.gz: 6badedd47d9d3fc5c9e0540a061083f8c5a120915de769a845d64582ba360820
 SHA512:
-  metadata.gz: 1f02229ac678d891f07a9d770e103fe959249bd1a78b972e081bbf2dcf50abe8c9f26d24f6c884c6ae81d8620c8985bda922cd13d34668eeac63268c707c2688
-  data.tar.gz: 407a2a53e280817790f148aa313aa8a2bc8851a2ad587e7a381777d4505c760d7766b289a4626b34a62e6537e4924f3f0b800e42c3474a7414beda38cb9d380a
+  metadata.gz: 203838df8b2326e8f95ce6c37b444d5af091e76a05c81065d466b599b806a38d706ffc47f04614037795810cdc66869bf2e04782f2f115694ed2f2cc2bbc4cd8
+  data.tar.gz: 1e413a33bf013b594a877c785ac79338b4060f4c18a4d2d361e37a2d5b138d1c77ca2c5c98d9495676c8e561529b8d56ce620eec99d7c4c88924a1eb49388318

data/CHANGELOG.md

@@ -1,3 +1,38 @@
+## Rails 6.0.3.7 (May 05, 2021) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.6 (March 26, 2021) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.5 (February 10, 2021) ##
+
+*   Fix possible DoS vector in PostgreSQL money type
+
+    Carefully crafted input can cause a DoS via the regular expressions used
+    for validating the money format in the PostgreSQL adapter.  This patch
+    fixes the regexp.
+
+    Thanks to @dee-see from Hackerone for this patch!
+
+    [CVE-2021-22880]
+
+    *Aaron Patterson*
+
+
+## Rails 6.0.3.4 (October 07, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.3 (September 09, 2020) ##
+
+*   No changes.
+
+
 ## Rails 6.0.3.2 (June 17, 2020) ##
 
 *   No changes.

data/lib/active_record/connection_adapters/postgresql/oid/money.rb

@@ -26,9 +26,9 @@ module ActiveRecord
 
             value = value.sub(/^\((.+)\)$/, '-\1') # (4)
             case value
-            when /^-?\D*[\d,]+\.\d{2}$/  # (1)
+            when /^-?\D*+[\d,]+\.\d{2}$/  # (1)
               value.gsub!(/[^-\d.]/, "")
-            when /^-?\D*[\d.]+,\d{2}$/  # (2)
+            when /^-?\D*+[\d.]+,\d{2}$/  # (2)
               value.gsub!(/[^-\d,]/, "").sub!(/,/, ".")
             end
 

data/lib/active_record/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveRecord
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = "2"
+    PRE   = "7"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 6.0.3.2
+  version: 6.0.3.7
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-06-17 00:00:00.000000000 Z
+date: 2021-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.2
+        version: 6.0.3.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.2
+        version: 6.0.3.7
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.2
+        version: 6.0.3.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.2
+        version: 6.0.3.7
 description: Databases on Rails. Build a persistent domain model by mapping database
   tables to Ruby classes. Strong conventions for associations, validations, aggregations,
   migrations, and testing come baked-in.
@@ -391,10 +391,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.2/activerecord/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3.2/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.7/activerecord/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.7/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.2/activerecord
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.7/activerecord
 post_install_message:
 rdoc_options:
 - "--main"