Ruby on Rails: v6.0.3.1 Release

Release date:
August 5, 2020
Previous version:
v6.0.3 (released May 6, 2020)
Magnitude:
343 Diff Delta
Contributors:
4 total committers
Data confidence:
Commits:

Top Contributors in v6.0.3.1

JackMc
tenderlove
dylanahsmith
travisp

Directory Browser for v6.0.3.1

We haven't yet finished calculating and confirming the files and directories changed in this release. Please check back soon.

Release Notes Published

Active Support

  • [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore

  • [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs

Action Pack

  • [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token

  • [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • [CVE-2020-8162] Include Content-Length in signature for ActiveStorage direct upload

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.