sidekiq 5.2.8 → 5.2.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 736ce0e629bd4a115422342ccb49c3cf8199372ced62e0bb0a9463974d2cb6cd
-  data.tar.gz: 60857bf5d87f618ece94183f4553636ae6221f567ada9489da82bbbbd88e0930
+  metadata.gz: 22b205223a123bbe3a8812f1e2804be148afb5fe91c201ecb9a073eb4a188a06
+  data.tar.gz: '08ab2999267df91afb8f62b9a6b00810299791cad99763d5b16f70bda946410a'
 SHA512:
-  metadata.gz: 363885cb52ed06abe653a9fbb6627e9931064fc7d3c607d605a2c915ff2e2ef236c1afd15d22e29a2ee11807f9682fd404c324a24fcd0163637a89f7b0d97458
-  data.tar.gz: b772dbcd3a911a7a2e48cc75c51f996e59aeca84372188f14972ded218c56a11457e0b3fbd715f28f4c5a2e5b88ededf0ece59933a2e5a2cdb64815d96a02c06
+  metadata.gz: ad90b8ed3b060ce4521326a0dd4173550ee6bf64b0674fc08fbf37770aaec5ca0ea82738ed1730ccfcff4e0b616afcc47789ca8610cdd41a20abc0ef7d734891
+  data.tar.gz: 2ed367f9801d28616a1b56b0b209cfe797c2b5a137d2e67cfb8c6864c8d5ed8f58992924ddce654f1fec53b84a5f18abdf88d4df45373b98f46786d511bac3f2

data/Changes.md

@@ -2,6 +2,19 @@
 
 [Sidekiq Changes](https://github.com/mperham/sidekiq/blob/master/Changes.md) | [Sidekiq Pro Changes](https://github.com/mperham/sidekiq/blob/master/Pro-Changes.md) | [Sidekiq Enterprise Changes](https://github.com/mperham/sidekiq/blob/master/Ent-Changes.md)
 
+5.2.10
+---------
+
+- Backport fix for CVE-2022-23837.
+- Migrate to `exists?` for redis-rb.
+- Lock redis-rb to <4.6 to avoid deprecations.
+
+5.2.9
+---------
+
+- Release Rack lock due to a cascade of CVEs. [#4566]
+  Pro-tip: don't lock Rack.
+
 5.2.8
 ---------
 

data/Gemfile

@@ -5,7 +5,7 @@ gemspec
 gem 'rake'
 gem 'redis-namespace'
 gem 'rails', '~> 5.2'
-gem 'sqlite3', '~> 1.3.6', platforms: :ruby
+gem 'sqlite3', platforms: :ruby
 gem 'activerecord-jdbcsqlite3-adapter', platforms: :jruby
 
 group :test do
@@ -13,10 +13,6 @@ group :test do
   gem 'simplecov'
 end
 
-group :development, :test do
-  gem 'pry-byebug', platforms: :mri
-end
-
 group :load_test do
   gem 'hiredis'
   gem 'toxiproxy'

data/lib/sidekiq/api.rb

@@ -164,6 +164,8 @@ module Sidekiq
 
     class History
       def initialize(days_previous, start_date = nil)
+        #we only store five years of data in Redis
+        raise ArgumentError if days_previous < 1 || days_previous > (5 * 365)
         @days_previous = days_previous
         @start_date = start_date || Time.now.utc.to_date
       end
@@ -904,7 +906,7 @@ module Sidekiq
         procs = sscan(conn, 'processes')
         procs.sort.each do |key|
           valid, workers = conn.pipelined do
-            conn.exists(key)
+            conn.exists?(key)
             conn.hgetall("#{key}:workers")
           end
           next unless valid

data/lib/sidekiq/launcher.rb

@@ -102,7 +102,7 @@ module Sidekiq
         _, exists, _, _, msg = Sidekiq.redis do |conn|
           conn.multi do
             conn.sadd('processes', key)
-            conn.exists(key)
+            conn.exists?(key)
             conn.hmset(key, 'info', to_json, 'busy', curstate.size, 'beat', Time.now.to_f, 'quiet', @done)
             conn.expire(key, 60)
             conn.rpop("#{key}-signals")

data/lib/sidekiq/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Sidekiq
-  VERSION = "5.2.8"
+  VERSION = "5.2.10"
 end

data/lib/sidekiq/web/action.rb

@@ -15,7 +15,7 @@ module Sidekiq
     end
 
     def halt(res)
-      throw :halt, res
+      throw :halt, [res, {"Content-Type" => "text/plain"}, [res.to_s]]
     end
 
     def redirect(location)

data/lib/sidekiq/web/application.rb

@@ -45,7 +45,10 @@ module Sidekiq
 
     get "/" do
       @redis_info = redis_info.select{ |k, v| REDIS_KEYS.include? k }
-      stats_history = Sidekiq::Stats::History.new((params['days'] || 30).to_i)
+      days = (params["days"] || 30).to_i
+      return halt(401) if days < 1 || days > 180
+
+      stats_history = Sidekiq::Stats::History.new(days)
       @processed_history = stats_history.processed
       @failed_history = stats_history.failed
 

data/sidekiq.gemspec

@@ -14,8 +14,8 @@ Gem::Specification.new do |gem|
   gem.version       = Sidekiq::VERSION
   gem.required_ruby_version = ">= 2.2.2"
 
-  gem.add_dependency 'redis', '>= 3.3.5', '< 5'
+  gem.add_dependency "redis", "~> 4.5", "< 4.6.0"
   gem.add_dependency 'connection_pool', '~> 2.2', '>= 2.2.2'
-  gem.add_dependency 'rack', '< 2.1.0'
+  gem.add_dependency 'rack', '~> 2.0'
   gem.add_dependency 'rack-protection', '>= 1.5.0'
 end

metadata

@@ -1,35 +1,35 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq
 version: !ruby/object:Gem::Version
-  version: 5.2.8
+  version: 5.2.10
 platform: ruby
 authors:
 - Mike Perham
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-02-13 00:00:00.000000000 Z
+date: 2022-02-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redis
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.3.5
+        version: '4.5'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5'
+        version: 4.6.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.3.5
+        version: '4.5'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5'
+        version: 4.6.0
 - !ruby/object:Gem::Dependency
   name: connection_pool
   requirement: !ruby/object:Gem::Requirement
@@ -54,16 +54,16 @@ dependencies:
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "<"
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.1.0
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rack-protection
   requirement: !ruby/object:Gem::Requirement
@@ -208,7 +208,7 @@ homepage: http://sidekiq.org
 licenses:
 - LGPL-3.0
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -223,8 +223,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.2.32
+signing_key:
 specification_version: 4
 summary: Simple, efficient background processing for Ruby
 test_files: []