[Security] Bump rubocop from 0.48.1 to 0.49.0 by dependabot-preview[bot] · Pull Request #71 · teencode-org/teencode-backend

dependabot-preview · 2019-04-16T09:37:13Z

Bumps rubocop from 0.48.1 to 0.49.0. This update includes security fixes.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

RuboCop: insecure use of /tmp
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local
users to exploit this to tamper with cache files belonging to other users.

Patched versions: >= 0.49.0
Unaffected versions: none

Release notes

Sourced from rubocop's releases.

RuboCop 0.49

New features

#117: Add --parallel option for running RuboCop in multiple processes or threads. ([@jonas054][])

Add auto-correct support to Style/MixinGrouping. ([@rrosenblum][])

#4236: Add new Rails/ApplicationJob and Rails/ApplicationRecord cops. ([@tjwp][])

#4078: Add new Performance/Caller cop. ([@alpaca-tc][])

#4314: Check slow hash accessing in Array#sort by Performance/CompareWithBlock. ([@pocke][])

#3438: Add new Style/FormatStringToken cop. ([@backus][])

#4342: Add new Lint/ScriptPermission cop. ([@yhirano55][])

#4145: Add new Style/YodaCondition cop. ([@smakagon][])

#4403: Add public API Cop.autocorrect_incompatible_with for specifying other cops that should not autocorrect together. ([@backus][])

#4354: Add autocorrect to Style/FormatString. ([@hoshinotsuyoshi][])

#4021: Add new Style/MultipleComparison cop. ([@dabroz][])

New Lint/RescueType cop. ([@rrosenblum][])

Changes

#4262: Add new MinSize configuration to Style/SymbolArray, consistent with the same configuration in Style/WordArray. ([@scottmatthewman][])

#3400: Remove auto-correct support from Lint/Debugger. ([@ilansh][])

#4278: Move all cops dealing with whitespace into a new department called Layout. ([@jonas054][])

#4320: Update Rails/OutputSafety to disallow wrapping raw or html_safe with safe_join. ([@klesse413][])

#4336: Store rubocop_cache in safer directories. ([@jonas054][])

#4361: Use relative path for offense message in Lint/DuplicateMethods. ([@pocke][])

#4385: Include .jb file by default. ([@pocke][])

Bug fixes

#4265: Require a space before first argument of a method call in Style/SpaceBeforeFirstArg cop. ([@cjlarose][])

#4237: Fix false positive in Lint/AmbiguousBlockAssociation cop for lambdas. ([@smakagon][])

#4242: Add Capfile to the list of known Ruby filenames. ([@bbatsov][])

#4240: Handle ||= in Rails/RelativeDateConstant. ([@bbatsov][])

#4241: Prevent Rails/Blank and Rails/Present from breaking when there is no explicit receiver. ([@rrosenblum][])

#4249: Handle multiple assignment in Rails/RelativeDateConstant. ([@bbatsov][])

#4250: Improve a bit the Ruby code detection config. ([@bbatsov][])

#4283: Fix Style/EmptyCaseCondition autocorrect bug - when first when branch includes comma-delimited alternatives. ([@ilansh][])

#4268: Handle end-of-line comments when autocorrecting Style/EmptyLinesAroundAccessModifier. ([@vergenzt][])

#4275: Prevent Style/MethodCallWithArgsParentheses from blowing up on yield. ([@drenmi][])

#3969: Handle multiline method call alignment for arguments to methods. ([@jonas054][])

#4304: Allow enabling whole departments when DisabledByDefault is true. ([@jonas054][])

#4264: Prevent Rails/SaveBang from blowing up when using the assigned variable in a hash. ([@drenmi][])

#4310: Treat paths containing invalid byte sequences as non-matches. ([@mclark][])

#4063: Fix Rails/ReversibleMigration misdetection. ([@gprado][])

#4339: Fix false positive in Security/Eval cop for multiline string lietral. ([@pocke][])

#4339: Fix false negative in Security/Eval cop for Binding#eval. ([@pocke][])

#4327: Prevent Layout/SpaceInsidePercentLiteralDelimiters from registering offenses on execute-strings. ([@drenmi][])

#4371: Prevent Style/MethodName from complaining about unary operator definitions. ([@drenmi][])

#4366: Prevent Performance/RedundantMerge from blowing up on double splat arguments. ([@drenmi][])

#4352: Fix the auto-correct of Style/AndOr when Enumerable accessors ([]) are used. ([@rrosenblum][])

#4393: Prevent Style/InverseMethods from registering an offense for methods that are double negated. ([@rrosenblum][])

... (truncated)

Changelog

Sourced from rubocop's changelog.

0.49.0 (2017-05-24)

New features

#117: Add --parallel option for running RuboCop in multiple processes or threads. ([@jonas054][])

Add auto-correct support to Style/MixinGrouping. ([@rrosenblum][])

#4236: Add new Rails/ApplicationJob and Rails/ApplicationRecord cops. ([@tjwp][])

#4078: Add new Performance/Caller cop. ([@alpaca-tc][])

#4314: Check slow hash accessing in Array#sort by Performance/CompareWithBlock. ([@pocke][])

#3438: Add new Style/FormatStringToken cop. ([@backus][])

#4342: Add new Lint/ScriptPermission cop. ([@yhirano55][])

#4145: Add new Style/YodaCondition cop. ([@smakagon][])

#4403: Add public API Cop.autocorrect_incompatible_with for specifying other cops that should not autocorrect together. ([@backus][])

#4354: Add autocorrect to Style/FormatString. ([@hoshinotsuyoshi][])

#4021: Add new Style/MultipleComparison cop. ([@dabroz][])

New Lint/RescueType cop. ([@rrosenblum][])

#4328: Add --ignore-parent-exclusion flag to ignore AllCops/Exclude inheritance. ([@nelsonjr][])

Changes

#4262: Add new MinSize configuration to Style/SymbolArray, consistent with the same configuration in Style/WordArray. ([@scottmatthewman][])

#3400: Remove auto-correct support from Lint/Debugger. ([@ilansh][])

#4278: Move all cops dealing with whitespace into a new department called Layout. ([@jonas054][])

#4320: Update Rails/OutputSafety to disallow wrapping raw or html_safe with safe_join. ([@klesse413][])

#4336: Store rubocop_cache in safer directories. ([@jonas054][])

#4361: Use relative path for offense message in Lint/DuplicateMethods. ([@pocke][])

#4385: Include .jb file by default. ([@pocke][])

Bug fixes

#4265: Require a space before first argument of a method call in Style/SpaceBeforeFirstArg cop. ([@cjlarose][])

#4237: Fix false positive in Lint/AmbiguousBlockAssociation cop for lambdas. ([@smakagon][])

#4242: Add Capfile to the list of known Ruby filenames. ([@bbatsov][])

#4240: Handle ||= in Rails/RelativeDateConstant. ([@bbatsov][])

#4241: Prevent Rails/Blank and Rails/Present from breaking when there is no explicit receiver. ([@rrosenblum][])

#4249: Handle multiple assignment in Rails/RelativeDateConstant. ([@bbatsov][])

#4250: Improve a bit the Ruby code detection config. ([@bbatsov][])

#4283: Fix Style/EmptyCaseCondition autocorrect bug - when first when branch includes comma-delimited alternatives. ([@ilansh][])

#4268: Handle end-of-line comments when autocorrecting Style/EmptyLinesAroundAccessModifier. ([@vergenzt][])

#4275: Prevent Style/MethodCallWithArgsParentheses from blowing up on yield. ([@drenmi][])

#3969: Handle multiline method call alignment for arguments to methods. ([@jonas054][])

#4304: Allow enabling whole departments when DisabledByDefault is true. ([@jonas054][])

#4264: Prevent Rails/SaveBang from blowing up when using the assigned variable in a hash. ([@drenmi][])

#4310: Treat paths containing invalid byte sequences as non-matches. ([@mclark][])

#4063: Fix Rails/ReversibleMigration misdetection. ([@gprado][])

#4339: Fix false positive in Security/Eval cop for multiline string lietral. ([@pocke][])

#4339: Fix false negative in Security/Eval cop for Binding#eval. ([@pocke][])

#4327: Prevent Layout/SpaceInsidePercentLiteralDelimiters from registering offenses on execute-strings. ([@drenmi][])

#4371: Prevent Style/MethodName from complaining about unary operator definitions. ([@drenmi][])

#4366: Prevent Performance/RedundantMerge from blowing up on double splat arguments. ([@drenmi][])

... (truncated)

Commits

66b305f Release 0.49.0
fd0a681 Bump the RSpec dep to 3.6
f109b61 [Fix #4393] Prevent InverseMethods from registering an offense when double ne...
fc85af0 Fix a couple of changelog entries
e46cc2e [Fix #4260] Do not register an offense for FileUtils.touch (#4410)
fdc6786 Add new cop Lint/RescueType (#4358)
e929147 Freeze constant in Style/YodaCondition cop
9fea6d3 Add new Style/MultipleComparison cop (#4021)
90e4899 Clean-up and improve a bit Style/YodaCondition
f3ef983 [Fix #4145] Add a new cop checking for Yoda conditions (#4174)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)
Automerge options (never/patch/minor, and dev/runtime dependencies)
Pull request limits (per update run and/or open at any time)
Out-of-range updates (receive only lockfile updates, if desired)
Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.48.1 to 0.49.0. **This update includes security fixes.** - [Release notes](https://github.com/rubocop-hq/rubocop/releases) - [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v0.48.1...v0.49.0) Signed-off-by: dependabot[bot] <support@dependabot.com>

dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Apr 16, 2019

dependabot-preview bot mentioned this pull request Apr 16, 2019

[Security] Bump rubocop from 0.48.1 to 0.67.2 #69

Closed

sofiengwin had a problem deploying to teencode-backend-pr-71 April 16, 2019 09:37 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security] Bump rubocop from 0.48.1 to 0.49.0#71

[Security] Bump rubocop from 0.48.1 to 0.49.0#71
dependabot-preview[bot] wants to merge 1 commit intomasterfrom
dependabot/bundler/rubocop-0.49.0

dependabot-preview bot commented Apr 16, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot-preview bot commented Apr 16, 2019

RuboCop 0.49

New features

Changes

Bug fixes

0.49.0 (2017-05-24)

New features

Changes

Bug fixes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants