diff --git a/e2e/ruby/rails/demo-rails70/Gemfile b/e2e/ruby/rails/demo-rails70/Gemfile index 3fb9a55c34..b6345ce073 100644 --- a/e2e/ruby/rails/demo-rails70/Gemfile +++ b/e2e/ruby/rails/demo-rails70/Gemfile @@ -6,8 +6,9 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" } ruby '~> 3.3.4' # Keep the legacy Rails-family instrumentation coverage on the oldest safe -# Rails 7.1 release line. -gem 'rails', '~> 7.1.5', '>= 7.1.5.2' +# Rails release line. 7.1 no longer receives security patches (see +# GHSA-xr9x-r78c-5hrm, fixed in 7.2.3.2 with no 7.1 backport). +gem 'rails', '~> 7.2.3', '>= 7.2.3.2' # The Rails test runner is incompatible with minitest 6.x (`run` arity changed). gem 'minitest', '~> 5.0' diff --git a/e2e/ruby/rails/demo-rails70/Gemfile.lock b/e2e/ruby/rails/demo-rails70/Gemfile.lock index 21fc39355c..9d4e3d600d 100644 --- a/e2e/ruby/rails/demo-rails70/Gemfile.lock +++ b/e2e/ruby/rails/demo-rails70/Gemfile.lock @@ -31,85 +31,79 @@ PATH GEM remote: https://rubygems.org/ specs: - actioncable (7.1.6) - actionpack (= 7.1.6) - activesupport (= 7.1.6) + actioncable (7.2.3.2) + actionpack (= 7.2.3.2) + activesupport (= 7.2.3.2) nio4r (~> 2.0) websocket-driver (>= 0.6.1) zeitwerk (~> 2.6) - actionmailbox (7.1.6) - actionpack (= 7.1.6) - activejob (= 7.1.6) - activerecord (= 7.1.6) - activestorage (= 7.1.6) - activesupport (= 7.1.6) - mail (>= 2.7.1) - net-imap - net-pop - net-smtp - actionmailer (7.1.6) - actionpack (= 7.1.6) - actionview (= 7.1.6) - activejob (= 7.1.6) - activesupport (= 7.1.6) - mail (~> 2.5, >= 2.5.4) - net-imap - net-pop - net-smtp + actionmailbox (7.2.3.2) + actionpack (= 7.2.3.2) + activejob (= 7.2.3.2) + activerecord (= 7.2.3.2) + activestorage (= 7.2.3.2) + activesupport (= 7.2.3.2) + mail (>= 2.8.0) + actionmailer (7.2.3.2) + actionpack (= 7.2.3.2) + actionview (= 7.2.3.2) + activejob (= 7.2.3.2) + activesupport (= 7.2.3.2) + mail (>= 2.8.0) rails-dom-testing (~> 2.2) - actionpack (7.1.6) - actionview (= 7.1.6) - activesupport (= 7.1.6) + actionpack (7.2.3.2) + actionview (= 7.2.3.2) + activesupport (= 7.2.3.2) cgi nokogiri (>= 1.8.5) racc - rack (>= 2.2.4) + rack (>= 2.2.4, < 3.3) rack-session (>= 1.0.1) rack-test (>= 0.6.3) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - actiontext (7.1.6) - actionpack (= 7.1.6) - activerecord (= 7.1.6) - activestorage (= 7.1.6) - activesupport (= 7.1.6) + useragent (~> 0.16) + actiontext (7.2.3.2) + actionpack (= 7.2.3.2) + activerecord (= 7.2.3.2) + activestorage (= 7.2.3.2) + activesupport (= 7.2.3.2) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.1.6) - activesupport (= 7.1.6) + actionview (7.2.3.2) + activesupport (= 7.2.3.2) builder (~> 3.1) cgi erubi (~> 1.11) rails-dom-testing (~> 2.2) rails-html-sanitizer (~> 1.6) - activejob (7.1.6) - activesupport (= 7.1.6) + activejob (7.2.3.2) + activesupport (= 7.2.3.2) globalid (>= 0.3.6) - activemodel (7.1.6) - activesupport (= 7.1.6) - activerecord (7.1.6) - activemodel (= 7.1.6) - activesupport (= 7.1.6) + activemodel (7.2.3.2) + activesupport (= 7.2.3.2) + activerecord (7.2.3.2) + activemodel (= 7.2.3.2) + activesupport (= 7.2.3.2) timeout (>= 0.4.0) - activestorage (7.1.6) - actionpack (= 7.1.6) - activejob (= 7.1.6) - activerecord (= 7.1.6) - activesupport (= 7.1.6) + activestorage (7.2.3.2) + actionpack (= 7.2.3.2) + activejob (= 7.2.3.2) + activerecord (= 7.2.3.2) + activesupport (= 7.2.3.2) marcel (~> 1.0) - activesupport (7.1.6) + activesupport (7.2.3.2) base64 benchmark (>= 0.3) bigdecimal - concurrent-ruby (~> 1.0, >= 1.0.2) + concurrent-ruby (~> 1.0, >= 1.3.1) connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) logger (>= 1.4.2) - minitest (>= 5.1) - mutex_m + minitest (>= 5.1, < 6) securerandom (>= 0.3) - tzinfo (~> 2.0) + tzinfo (~> 2.0, >= 2.0.5) addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) base64 (0.3.0) @@ -129,7 +123,7 @@ GEM regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) cgi (0.5.2) - concurrent-ruby (1.3.7) + concurrent-ruby (1.3.8) connection_pool (3.0.2) crass (1.0.7) date (3.5.1) @@ -138,7 +132,7 @@ GEM reline (>= 0.3.8) domain_name (0.6.20240107) drb (2.2.3) - erb (6.0.4) + erb (6.0.7) erubi (1.13.1) globalid (1.4.0) activesupport (>= 6.1) @@ -176,7 +170,7 @@ GEM actionpack (>= 6.0.0) activesupport (>= 6.0.0) railties (>= 6.0.0) - io-console (0.8.2) + io-console (0.9.2) irb (1.18.0) pp (>= 0.6.0) prism (>= 1.3.0) @@ -215,8 +209,7 @@ GEM mini_mime (1.1.5) minitest (5.27.0) msgpack (1.8.3) - mutex_m (0.3.0) - net-imap (0.6.4.1) + net-imap (0.6.6) date net-protocol net-pop (0.1.2) @@ -342,13 +335,10 @@ GEM opentelemetry-semantic_conventions opentelemetry-semantic_conventions (1.41.0) opentelemetry-api (~> 1.0) - pp (0.6.3) + pp (0.6.4) prettyprint prettyprint (0.2.0) prism (1.9.0) - psych (5.4.0) - date - stringio public_suffix (7.0.5) puma (7.2.1) nio4r (~> 2.0) @@ -361,20 +351,20 @@ GEM rack (>= 1.3) rackup (2.3.1) rack (>= 3) - rails (7.1.6) - actioncable (= 7.1.6) - actionmailbox (= 7.1.6) - actionmailer (= 7.1.6) - actionpack (= 7.1.6) - actiontext (= 7.1.6) - actionview (= 7.1.6) - activejob (= 7.1.6) - activemodel (= 7.1.6) - activerecord (= 7.1.6) - activestorage (= 7.1.6) - activesupport (= 7.1.6) + rails (7.2.3.2) + actioncable (= 7.2.3.2) + actionmailbox (= 7.2.3.2) + actionmailer (= 7.2.3.2) + actionpack (= 7.2.3.2) + actiontext (= 7.2.3.2) + actionview (= 7.2.3.2) + activejob (= 7.2.3.2) + activemodel (= 7.2.3.2) + activerecord (= 7.2.3.2) + activestorage (= 7.2.3.2) + activesupport (= 7.2.3.2) bundler (>= 1.15.0) - railties (= 7.1.6) + railties (= 7.2.3.2) rails-dom-testing (2.3.0) activesupport (>= 5.0.0) minitest @@ -382,24 +372,29 @@ GEM rails-html-sanitizer (1.7.1) loofah (~> 2.25, >= 2.25.2) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.1.6) - actionpack (= 7.1.6) - activesupport (= 7.1.6) + railties (7.2.3.2) + actionpack (= 7.2.3.2) + activesupport (= 7.2.3.2) cgi - irb + irb (~> 1.13) rackup (>= 1.0.0) rake (>= 12.2) thor (~> 1.0, >= 1.2.2) tsort (>= 0.2) zeitwerk (~> 2.6) rake (13.4.2) - rdoc (7.2.0) + rbs (4.1.3) + logger + prism (>= 1.6.0) + tsort + rdoc (8.0.0) erb - psych (>= 4.0.0) + prism (>= 1.6.0) + rbs (>= 4.0.0) tsort redis (4.8.1) regexp_parser (2.12.0) - reline (0.6.3) + reline (0.7.0) io-console (~> 0.5) rexml (3.4.4) rubyzip (3.4.0) @@ -426,7 +421,6 @@ GEM sqlite3 (1.7.3-x86_64-linux) stimulus-rails (1.3.4) railties (>= 6.0.0) - stringio (3.2.0) thor (1.5.0) timeout (0.6.1) tsort (0.2.0) @@ -435,6 +429,7 @@ GEM railties (>= 6.0.0) tzinfo (2.0.6) concurrent-ruby (~> 1.0) + useragent (0.16.11) web-console (4.2.1) actionview (>= 6.0.0) activemodel (>= 6.0.0) @@ -448,7 +443,7 @@ GEM websocket-extensions (0.1.5) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.8.2) + zeitwerk (2.8.3) zlib (3.2.3) PLATFORMS @@ -474,7 +469,7 @@ DEPENDENCIES launchdarkly-server-sdk (~> 8.0) minitest (~> 5.0) puma (~> 7.2, >= 7.2.1) - rails (~> 7.1.5, >= 7.1.5.2) + rails (~> 7.2.3, >= 7.2.3.2) redis (~> 4.0) selenium-webdriver sprockets-rails diff --git a/e2e/ruby/rails/demo-rails70/README.md b/e2e/ruby/rails/demo-rails70/README.md index 408d3a1db7..beadda0e3f 100644 --- a/e2e/ruby/rails/demo-rails70/README.md +++ b/e2e/ruby/rails/demo-rails70/README.md @@ -3,7 +3,8 @@ A legacy Rails application that pins the LaunchDarkly observability plugin to a known-broken scenario and guards against it regressing. The historical directory name is retained to avoid path churn, while Rails is constrained to the oldest -safe 7.1 release line. +release line that still receives security patches (7.2), and the app keeps +`config.load_defaults 7.0`. ## Why this exists