Log message:
www/ruby-rails70: update to 7.0.4.1

Rails 7.0.4.1 (2023-01-17)

devel/ruby-activesupport70

* Avoid regex backtracking in Inflector.underscore

  [CVE-2023-22796]

www/ruby-actionpack70

* Fix sec issue with _url_host_allowed?

  Disallow certain strings from `_url_host_allowed?` to avoid a redirect
  to malicious sites.

  [CVE-2023-22797]

* Avoid regex backtracking on If-None-Match header

  [CVE-2023-22795]

* Use string#split instead of regex for domain parts

  [CVE-2023-22792]

databases/ruby-activerecord70

* Make sanitize_as_sql_comment more strict

  Though this method was likely never meant to take user input, it was
  attempting sanitization. That sanitization could be bypassed with
  carefully crafted input.

  This commit makes the sanitization more robust by replacing any
  occurrances of "/*" or "*/" with "/ *" or \ 
"* /". It also performs a
  first pass to remove one surrounding comment to avoid compatibility
  issues for users relying on the existing removal.

  This also clarifies in the documentation of annotate that it should not
  be provided user input.

  [CVE-2023-22794]

* Added integer width check to PostgreSQL::Quoting

  Given a value outside the range for a 64bit signed integer type
  PostgreSQL will treat the column type as numeric. Comparing
  integer values against numeric values can result in a slow
  sequential scan.

  This behavior is configurable via
  ActiveRecord::Base.raise_int_wider_than_64bit which defaults to true.

  [CVE-2022-44566]

Log message:
Switch dependency to www/ruby-rack2

Bump PKGREVISION.

Log message:
Remove lines for Ruby 2.6.

Log message:
www/ruby-actionpack70: update to 7.0.4

* Prevent ActionDispatch::ServerTiming from overwriting existing values in
  Server-Timing.

  Previously, if another middleware down the chain set Server-Timing header,
  it would overwritten by ActionDispatch::ServerTiming.

  Jakub Malinowski

Log message:
www/ruby-rails70: update to 7.0.3.1

Rails 7.0.3.1 (2022-07-12) updates databases/ruby-activerecord70 only.

databases/ruby-activerecord70

* Change ActiveRecord::Coders::YAMLColumn default to safe_load

  This adds two new configuration options The configuration options are as
  follows:

	o config.active_storage.use_yaml_unsafe_load

  When set to true, this configuration option tells Rails to use the old
  "unsafe" YAML loading strategy, maintaining the existing behavior but
  leaving the possible escalation vulnerability in place.  Setting this
  option to true is *not* recommended, but can aid in upgrading.

	o config.active_record.yaml_column_permitted_classes

  The "safe YAML" loading method does not allow all classes to be
  deserialized by default.  This option allows you to specify classes deemed
  "safe" in your application.  For example, if your application uses Symbol
  and Time in serialized data, you can add Symbol and Time to the allowed
  list as follows:

	config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]

  [CVE-2022-32224]

Log message:
www/ruby-actionpack70: update to 7.0.3

7.0.3 (2022-05-12)

* Allow relative redirects when raise_on_open_redirects is enabled.

* Fix authenticate_with_http_basic to allow for missing password.

  Before Rails 7.0 it was possible to handle basic authentication with only
  a username.

	authenticate_with_http_basic do |token, _|
	  ApiClient.authenticate(token)
	end

  This ability is restored.

* Fix content_security_policy returning invalid directives.

  Directives such as self, unsafe-eval and few others were not single quoted
  when the directive was the result of calling a lambda returning an array.

	content_security_policy do |policy|
	  policy.frame_ancestors lambda { [:self, "https://example.com"] }
	end

  With this fix the policy generated from above will now be valid.

* Fix skip_forgery_protection to run without raising an error if forgery
  protection has not been enabled / verify_authenticity_token is not a
  defined callback.

  This fix prevents the Rails 7.0 Welcome Page (/) from raising an
  ArgumentError if default_protect_from_forgery is false.

* Fix ActionController::Live to copy the IsolatedExecutionState in the
  ephemeral thread.

  Since its inception ActionController::Live has been copying thread local
  variables to keep things such as CurrentAttributes set from middlewares
  working in the controller action.

  With the introduction of IsolatedExecutionState in 7.0, some of that
  global state was lost in ActionController::Live controllers.

* Fix setting trailing_slash: true in route definition.

	get '/test' => "test#index", as: :test, trailing_slash: true

	test_path() # => "/test/"

Log message:
www/ruby-actionpack70: update to 7.0.2.4

## Rails 7.0.2.4 (April 26, 2022) ##

*   Allow Content Security Policy DSL to generate for API responses.

    *Tim Wade*

Log message:
rails 7.0 wants ruby 2.7+, mark it as such

Log message:
ruby*: fix rails version in COMMENT

Log message:
www/ruby-rails70: update to 7.0.2.3

Changes are in devel/ruby-activestorage70 only.

Rails 7.0.2.3 (March 08, 2022)

* Added image transformation validation via configurable allow-list.

  Variant now offers a configurable allow-list for
  transformation methods in addition to a configurable deny-list for arguments.

  [CVE-2022-21831]