Subject: CVS commit: pkgsrc
From: Takahiro Kambe
Date: 2022-07-13 16:46:24
Message id: 20220713144625.2A8E1FB1A@cvs.NetBSD.org

Log Message:
www/ruby-rails61: update to 6.1.6.1

Rails 6.1.6.1 (2022-07-12) updates databases/ruby-activerecord61 only.

databases/ruby-activerecord61

* Change ActiveRecord::Coders::YAMLColumn default to safe_load

  This adds two new configuration options The configuration options are as
  follows:

	o config.active_storage.use_yaml_unsafe_load

  When set to true, this configuration option tells Rails to use the old
  "unsafe" YAML loading strategy, maintaining the existing behavior but
  leaving the possible escalation vulnerability in place.  Setting this
  option to true is *not* recommended, but can aid in upgrading.

	o config.active_record.yaml_column_permitted_classes

  The "safe YAML" loading method does not allow all classes to be
  deserialized by default.  This option allows you to specify classes deemed
  "safe" in your application.  For example, if your application uses Symbol
  and Time in serialized data, you can add Symbol and Time to the allowed
  list as follows:

	config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]

  [CVE-2022-32224]

Files:
RevisionActionfile
1.14modifypkgsrc/databases/ruby-activerecord61/distinfo
1.14modifypkgsrc/devel/ruby-activejob61/distinfo
1.14modifypkgsrc/devel/ruby-activemodel61/distinfo
1.14modifypkgsrc/devel/ruby-activestorage61/distinfo
1.14modifypkgsrc/devel/ruby-activesupport61/distinfo
1.4modifypkgsrc/devel/ruby-railties61/Makefile
1.14modifypkgsrc/devel/ruby-railties61/distinfo
1.131modifypkgsrc/lang/ruby/rails.mk
1.14modifypkgsrc/mail/ruby-actionmailbox61/distinfo
1.14modifypkgsrc/mail/ruby-actionmailer61/distinfo
1.14modifypkgsrc/textproc/ruby-actiontext61/distinfo
1.14modifypkgsrc/www/ruby-actioncable61/distinfo
1.14modifypkgsrc/www/ruby-actionpack61/distinfo
1.14modifypkgsrc/www/ruby-actionview61/distinfo
1.14modifypkgsrc/www/ruby-rails61/distinfo