Debian Patches

Status for rails/2:6.1.7.10+dfsg-1~deb12u3

Patch Description Author Forwarded Bugs Origin Last update
rails-ruby3.1.patch Merge pull request #44083 from rails/rm-temporary-mail-fix
Temporarily add net-gems as dependencies of frameworks that use mail		 Rafael Mendonça França no 2022-01-05
CVE-2024-54133.patch Add CSP directive validation
Validate directives to make sure they don't include semicolons or
whitespace. These are special and denote lists and termination of
directives.

[CVE-2024-54133]		 Gannon McGibbon <gannon.mcgibbon@gmail.com> no 2024-10-15
rollup-3.patch Fix for rollup3 Nilesh Patra <nilesh@debian.org> no 2022-12-04
0001-Be-careful-with-that-bundler.patch Be careful with that bundler Antonio Terceiro <terceiro@debian.org> no 2016-03-03
0002-disable-uglify-in-activestorage-rollup-config-js.patch rollup-plugin-uglify is not packaged, hence disabling it. no
use-system-yarnpkg.patch Use system yarnpkg instead of yarn In Debian, yarn is packaged as "yarnpkg".
.
This patch will replace all the "bin/yarn" usages to "bin/yarnpkg".		 Jongmin Kim <jmkim@pukyong.ac.kr> no 2019-06-21
use-system-webpacker.patch Use system webpacker Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-08-24
relax-dependencies.patch Relax dependencies
This patch will relax the dependencies version, remove useless
dependencies, or replace the gems to which is already in Debian.

Relax dependencies version:
* selenium-webdriver
* redis-nameserver (use packaged version)
* mysql2
* selenium-webdriver
* webpacker

Remove/replace dependencies:
* minitest-bisect
+ Not packaged in Debian
+ Not used (minitest is used)
* minitest-retry
+ Not packaged in Debian
+ Used only when running on Buildkite CI
* webdrivers
+ Not packaged in Debian
+ Could be replaced by chromedriver-helper (ruby-chromedriver-helper)		 Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-08-24
relax-dependency-sqlite3.patch Relax dependency version - ruby-sqlite3 From Rails 6, it started using `execute_batch2` function [1] which was
introduced in gem sqlite3 1.4.0. This new function was confirmed at [1]
that extremely faster than old `execute_batch` function. However, gem
sqlite3 1.4.0 was not packaged in Debian yet (ruby-sqlite3 is 1.3.13-1+b2
in Debian), so this function could not be used.
.
This patch will rollback the `execute_batch2` usages to `execute_batch`.
This patch should be removed after the ruby-sqlite3 upgraded to 1.4.0.
.
[1] https://github.com/rails/rails/commit/0908184e4c2dca5b941030bbd0d5eb2dfcfed120		 Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-06-12
remove-ignored-dependencies.patch Remove ignored dependencies Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-06-21
skip-test-internet-access.patch Skip the tests which need Internet access .. due to Debian policy 4.9. Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-07-17
skip-test-unpackaged-dependencies.patch Skip the test due to unpackaged dependencies * websocket-client-simple
+ actioncable/client_test.rb
* sneakers
+ actionjob/Rakefile
+ actionjob/test/cases/exceptions_test.rb
* que
+ actionjob/Rakefile
* queue_classic
+ actionjob/Rakefile
* resque
+ actionjob/Rakefile
* sucker_punch
+ actionjob/Rakefile
* backburner
+ actionjob/Rakefile
* minitest-retry
+ railties/test/isolation/abstract_unit.rb		 Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-06-21
skip-test-railties-postgresql.patch Skip the railties test which needs postgresql instance Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-06-24
ignore-test-stuck.patch Ignore test which goes stuck Ignore the test case which makes test stuck. Jongmin Kim <jmkim@pukyong.ac.kr> not-needed 2019-06-21
adapt-to-babel7.patch Adapt to babel7 no
replace-webdrivers.patch Replace webdrivers webdrivers can only go to contrib section no
disable-rack-mini-profiler-gem.patch Disable rack-mini-profiler
We haven't packaged this yet and it is disturbing our tests.		 Daniel Leidert <dleidert@debian.org> not-needed 2021-11-28
temporarily-disable-encoded-key-cache-behavior-test.patch Temporarily disable flaky tests
Upstream discovered several race conditions in their tests. This test is flaky.
Most of the time it works. Let's ignore it for now to be able to do the
transition.

https://github.com/rails/rails/pull/43718/files		 Daniel Leidert <dleidert@debian.org> not-needed 2021-11-29
activesupport-skip-flaky-tests.patch activesupport: skip flaky tests These tests fail randomly on the Debian CI system. This is supposed to be
fixed in rails 7.		 Antonio Terceiro <terceiro@debian.org> not-needed vendor 2022-04-30
replace-uglifier-terser.patch terser is better maintained fork of uglify-js no
CVE-2025-24293.patch Active Storage: Remove dangerous transformations
[CVE-2025-24293]

A subset of transformation methods included in the default allowed list
still present potential command injection risk to applications accepting
arbitrary user input for transformations or their parameters.

Doing so is unsupported behavior and should be considered dangerous.		 Zack Deveau <zack.ref@gmail.com> yes upstream https://github.com/rails/rails/commit/1b1adf6ee6ca0f3104fcfce79360b2ec1e06a354 2025-08-12
CVE-2025-55193.patch Call inspect on ids in RecordNotFound error
[CVE-2025-55193]		 John Hawthorn <john.hawthorn@shopify.com> yes debian upstream backport, https://github.com/rails/rails/commit/3beef20013736fd52c5dcfdf061f7999ba318290 2025-03-10
CVE-2026-66066-block-untrusted-vips.patch Block libvips untrusted loaders when the vips processor is used Rails 6.1 defaults to MiniMagick and has no vips analyzer. An application
that sets the variant processor to :vips still passes uploads to libvips.
ruby-vips 2.1.4 does not bind vips_block_untrusted_set, so attach that
symbol and call it before the first vips variant. BMP, ICO, and PSD
variants then raise Vips::Error. The MiniMagick default is unchanged.		 Simon Quigley <tsimonq2@debian.org> yes debian upstream vendor, based on https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a 2026-10-04
CVE-2026-33168-skip-blank-attribute-names.patch Skip blank HTML attribute names in tag helpers A blank attribute name bypasses escaping and can be read as a second
attribute. tag_options now skips blank keys, including blank data and
aria keys. A blank attribute value is unchanged. Rails 6.1 has the same
tag_options shape as the 7.2 fix.		 Mike Dalessio <mike.dalessio@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c 2026-10-04
CVE-2026-33169-delimit-without-backtracking.patch Delimit numbers without the backtracking expression NumberToDelimitedConverter grouped digits with a regular expression
that backtracks on a long run of digits. The default path now walks
the digit string. A caller-supplied delimiter_pattern is unchanged.
33fbedb1 is included so the linear path is the default.		 Jean Boussier <jean.boussier@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 2026-10-04
CVE-2026-33170-preserve-unsafe-safebuffer.patch Keep an unsafe SafeBuffer unsafe after % Formatting an unsafe buffer marked the result html_safe. The result
now keeps the receiver's html_safe flag. A safe format string stays
safe. Rails 6.1 SafeBuffer#% did not copy the flag.		 Jean Boussier <jean.boussier@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb 2026-10-04
CVE-2026-33173-filter-direct-upload-metadata.patch Drop internal keys from direct-upload metadata analyzed and identified are Active Storage state on Rails 6.1.
composed is not a metadata accessor in this version. A direct upload
can no longer set the internal keys. Other metadata keys are kept.
Hash#except is used because Rails 6.1 has no Hash#without.		 Jean Boussier <jean.boussier@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 2026-10-04
CVE-2026-33176-reject-scientific-notation.patch Do not expand scientific notation in number helpers Rails 6.1 parses helper input with Float and then BigDecimal, not the
7.2 valid_bigdecimal gate. Strings containing d or e notation now stay
text, so a short string cannot expand into a huge number. Ordinary
decimals are unchanged.		 Jean Boussier <jean.boussier@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a 2026-10-04
CVE-2026-33195-reject-disk-path-traversal.patch Reject Active Storage disk keys that leave the storage root DiskService#path_for raises InvalidKeyError for a blank key, a dot
segment, a null byte, or a path outside the service root. The disk
controller answers 404 or 422. A normal key still resolves inside the
root. Custom keys are trusted input.		 Mike Dalessio <mike.dalessio@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c 2026-10-04
CVE-2026-33202-escape-disk-globs.patch Escape glob metacharacters in DiskService#delete_prefixed delete_prefixed passed the key prefix to Dir.glob. A prefix containing
glob metacharacters could delete a different file. Those characters are
now escaped. A prefix that relied on glob expansion no longer does.		 Mike Dalessio <mike.dalessio@gmail.com> yes debian upstream upstream, https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 2026-10-04

All known versions for source package 'rails'

Links