Ruby on Rails: v6.0.6.1 Release

Release date:
January 25, 2023
Previous version:
v6.0.6 (released September 9, 2022)
Magnitude:
40,982 Diff Delta
Contributors:
179 total committers
Data confidence:
Commits:

613 Features Released with v6.0.6.1

Top Contributors in v6.0.6.1

jonathanhefner
byroot
lsylvester
eileencodes
ghiculescu
SkipKayhil
rafaelfranca
fatkodima
tenderlove
amatsuda

Directory Browser for v6.0.6.1

We haven't yet finished calculating and confirming the files and directories changed in this release. Please check back soon.

Release Notes Published

Active Support

  • No changes.

Active Model

  • No changes.

Active Record

  • Make sanitize_as_sql_comment more strict

    Though this method was likely never meant to take user input, it was attempting sanitization. That sanitization could be bypassed with carefully crafted input.

    This commit makes the sanitization more robust by replacing any occurrances of "/" or "/" with "/ " or " /". It also performs a first pass to remove one surrounding comment to avoid compatibility issues for users relying on the existing removal.

    This also clarifies in the documentation of annotate that it should not be provided user input.

    [CVE-2023-22794]

Action View

  • No changes.

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.