Debian Patches
Status for rails/2:7.2.2.2+dfsg-2~deb13u2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-Be-careful-with-that-bundler.patch | Be careful with that bundler | Antonio Terceiro <terceiro@debian.org> | no | 2025-01-08 | ||
| use-system-yarnpkg.patch | Use system yarnpkg instead of yarn In Debian, yarn is packaged as "yarnpkg". . This patch will replace all the "bin/yarn" usages to "bin/yarnpkg". |
Jongmin Kim <jmkim@pukyong.ac.kr> | no | 2019-06-21 | ||
| relax-dependencies.patch | Relax dependencies This patch will relax the dependencies version, remove useless dependencies, or replace the gems to which is already in Debian. Relax dependencies version: * selenium-webdriver * redis-nameserver (use packaged version) * mysql2 * selenium-webdriver * webpacker Remove/replace dependencies: * minitest-bisect + Not packaged in Debian + Not used (minitest is used) * minitest-retry + Not packaged in Debian + Used only when running on Buildkite CI * webdrivers + Not packaged in Debian + Could be replaced by chromedriver-helper (ruby-chromedriver-helper) |
Jongmin Kim <jmkim@pukyong.ac.kr> | not-needed | 2019-08-24 | ||
| remove-ignored-dependencies.patch | Remove ignored dependencies | Jongmin Kim <jmkim@pukyong.ac.kr> | not-needed | 2019-06-21 | ||
| skip-test-internet-access.patch | Skip the tests which need Internet access .. due to Debian policy 4.9. | Jongmin Kim <jmkim@pukyong.ac.kr> | not-needed | 2019-07-17 | ||
| skip-test-unpackaged-dependencies.patch | Skip the test due to unpackaged dependencies * websocket-client-simple + actioncable/client_test.rb * sneakers + actionjob/Rakefile + actionjob/test/cases/exceptions_test.rb * que + actionjob/Rakefile * queue_classic + actionjob/Rakefile * resque + actionjob/Rakefile * sucker_punch + actionjob/Rakefile * backburner + actionjob/Rakefile * minitest-retry + railties/test/isolation/abstract_unit.rb |
Jongmin Kim <jmkim@pukyong.ac.kr> | not-needed | 2019-06-21 | ||
| skip-test-railties-postgresql.patch | Skip the railties test which needs postgresql instance | Jongmin Kim <jmkim@pukyong.ac.kr> | not-needed | 2019-06-24 | ||
| ignore-test-stuck.patch | Ignore test which goes stuck Ignore the test case which makes test stuck. | Jongmin Kim <jmkim@pukyong.ac.kr> | not-needed | 2019-06-21 | ||
| adapt-to-babel7.patch | Adapt to babel7 | no | ||||
| relax-irb.patch | relax version dependency on irb gem to be dropped when ruby3.3 is the default | Cédric Boutillier | not-needed | 2025-01-27 | ||
| remove-sprockets-rails.patch | no | |||||
| CVE-2026-66066-block-untrusted-vips.patch | Disable libvips unfuzzed loaders and savers Active Storage passed uploaded files to libvips operations that libvips marks unfuzzed. Call Vips.block_untrusted(true) while booting when ruby-vips is installed. BMP, ICO, and PSD variants then raise Vips::Error. Attaching and downloading those files is unchanged. |
Mike Dalessio <mike.dalessio@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/d79b7f4aa17dec8ce4960fef05733c8c0c7ef49a | 2026-10-02 |
| CVE-2026-33168-skip-blank-attribute-names.patch | Skip blank HTML attribute names in tag helpers A blank attribute name bypasses escaping and can be read as a second attribute. tag_options now skips blank keys, including blank data and aria keys. A blank attribute value is unchanged. |
Mike Dalessio <mike.dalessio@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c | 2026-10-04 |
| CVE-2026-33169-delimit-without-backtracking.patch | Delimit numbers without the backtracking expression NumberToDelimitedConverter grouped digits with a regular expression that backtracks on a long run of digits. The default path now walks the digit string. A caller-supplied delimiter_pattern is unchanged. The default was still the old expression after the first upstream commit; 33fbedb1 makes the linear path the default, and that correction is part of this patch. |
Jean Boussier <jean.boussier@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974 | 2026-10-04 |
| CVE-2026-33170-preserve-unsafe-safebuffer.patch | Keep an unsafe SafeBuffer unsafe after % Formatting an unsafe buffer marked the result html_safe. The result now keeps the receiver's html_safe flag. A safe format string stays safe. |
Jean Boussier <jean.boussier@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb | 2026-10-04 |
| CVE-2026-33173-filter-direct-upload-metadata.patch | Drop internal keys from direct-upload metadata analyzed, identified, and composed are Active Storage state. A direct upload can no longer set them. Other metadata keys are kept. |
Jean Boussier <jean.boussier@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53 | 2026-10-04 |
| CVE-2026-33174-limit-streaming-chunk-size.patch | Reject Active Storage byte ranges larger than 100MB A single range or several ranges whose total size is at least config.active_storage.streaming_chunk_max_size now get 416. The default is 100 megabytes. Smaller ranges still stream. |
Gannon McGibbon <gannon.mcgibbon@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b | 2026-10-04 |
| CVE-2026-33176-reject-scientific-notation.patch | Do not expand scientific notation in number helpers BigDecimal accepts d and e notation, so a short string can become a huge number. Those strings are left as text. Ordinary decimals are unchanged. |
Jean Boussier <jean.boussier@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a | 2026-10-04 |
| CVE-2026-33195-reject-disk-path-traversal.patch | Reject Active Storage disk keys that leave the storage root DiskService#path_for raises InvalidKeyError for a blank key, a dot segment, a null byte, or a path outside the service root. The disk controller answers 404 or 422. A normal key still resolves inside the root. Custom keys are trusted input. |
Mike Dalessio <mike.dalessio@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c | 2026-10-04 |
| CVE-2026-33202-escape-disk-globs.patch | Escape glob metacharacters in DiskService#delete_prefixed delete_prefixed passed the key prefix to Dir.glob. A prefix containing glob metacharacters could delete a different file. Those characters are now escaped. A prefix that relied on glob expansion no longer does. |
Mike Dalessio <mike.dalessio@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82 | 2026-10-04 |
| CVE-2026-33658-limit-streaming-ranges.patch | Allow only one byte range on Active Storage proxy requests More than config.active_storage.streaming_max_ranges ranges now get 416. The default is one range. The engine copies that setting onto ActiveStorage.streaming_max_ranges. A single range still streams. |
Jean Boussier <jean.boussier@gmail.com> | yes | debian upstream | upstream, https://github.com/rails/rails/commit/b8a1665824a43d71cd6406cf9adcae842ceb1c22 | 2026-10-04 |
All known versions for source package 'rails'
- 2:7.2.4+dfsg-2 (sid)
- 2:7.2.4+dfsg-1 (forky)
- 2:7.2.2.2+dfsg-2~deb13u2 (trixie-proposed-updates, trixie-security)
- 2:7.2.2.2+dfsg-2~deb13u1 (trixie)
- 2:6.1.7.10+dfsg-1~deb12u3 (bookworm-security)
- 2:6.1.7.10+dfsg-1~deb12u2 (bookworm)