From 965283d81df9a9b9bc133df9192fdf303e16b260 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 19 Mar 2024 02:37:44 +0000 Subject: [PATCH 1/2] Bump devise from 4.9.2 to 4.9.3 Bumps [devise](https://github.com/heartcombo/devise) from 4.9.2 to 4.9.3. - [Release notes](https://github.com/heartcombo/devise/releases) - [Changelog](https://github.com/heartcombo/devise/blob/main/CHANGELOG.md) - [Commits](https://github.com/heartcombo/devise/compare/v4.9.2...v4.9.3) --- updated-dependencies: - dependency-name: devise dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- Gemfile | 2 +- Gemfile.lock | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/Gemfile b/Gemfile index c16ebe9f6..516faa44f 100644 --- a/Gemfile +++ b/Gemfile @@ -18,7 +18,7 @@ gem "cocoon", "~> 1.2.15" gem "daemons", "~> 1.4.1" gem "dalli", "~> 3.2.6" gem "delayed_job_active_record", "~> 4.1.7" -gem "devise", "~> 4.9.2" +gem "devise", "~> 4.9.3" gem "devise-security", "~> 0.18.0" gem "exiftool_vendored", "~> 12.60.0" gem "file_validators", "~> 3.0.0" diff --git a/Gemfile.lock b/Gemfile.lock index cf6510b2c..c6148018a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -98,7 +98,7 @@ GEM babel-source (>= 4.0, < 6) execjs (~> 2.0) base64 (0.1.1) - bcrypt (3.1.19) + bcrypt (3.1.20) better_html (2.0.2) actionview (>= 6.0) activesupport (>= 6.0) @@ -184,7 +184,7 @@ GEM activerecord (>= 3.0, < 8.0) delayed_job (>= 3.0, < 5) device_detector (1.1.1) - devise (4.9.2) + devise (4.9.3) bcrypt (~> 3.0) orm_adapter (~> 0.1) railties (>= 4.1.0) @@ -272,7 +272,7 @@ GEM httpi (2.5.0) rack socksify - i18n (1.14.1) + i18n (1.14.4) concurrent-ruby (~> 1.0) i18n-tasks (0.9.37) activesupport (>= 4.0.2) @@ -348,7 +348,7 @@ GEM mini_magick (4.12.0) mini_mime (1.1.5) mini_portile2 (2.8.5) - minitest (5.22.2) + minitest (5.22.3) mixlib-cli (2.1.8) mixlib-config (3.0.27) tomlrb @@ -369,7 +369,7 @@ GEM net-protocol net-ssh (7.2.0) nio4r (2.7.0) - nokogiri (1.16.2) + nokogiri (1.16.3) mini_portile2 (~> 2.8.2) racc (~> 1.4) nori (2.6.0) @@ -714,7 +714,7 @@ DEPENDENCIES daemons (~> 1.4.1) dalli (~> 3.2.6) delayed_job_active_record (~> 4.1.7) - devise (~> 4.9.2) + devise (~> 4.9.3) devise-security (~> 0.18.0) email_spec (~> 2.2.2) erb_lint (~> 0.5.0) From 8d2c2c473e008178f567c56f6d802a64a4ca59ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javi=20Mart=C3=ADn?= Date: Tue, 19 Mar 2024 22:04:42 +0100 Subject: [PATCH 2/2] Base Devise initializer on the latest version We haven't updated this initializer for years, so here's the updated version. The `expire_auth_token_on_timeout` doesn't seem to exist anymore, and a few more options have been added. Note that the default Devise initializer configures `config.responder.error_status` and `config.responder.redirect_status` so they follow Hotwire/Turbo conventions. For now, I'm commenting these lines because we currently don't use Hotwire/Turbo. --- config/initializers/devise.rb | 71 ++++++++++++++++++++++++++--------- 1 file changed, 54 insertions(+), 17 deletions(-) diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index d351f06ad..23d2d0a6a 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -6,10 +6,14 @@ Devise.setup do |config| # The secret key used by Devise. Devise uses this key to generate # random tokens. Changing this key will render invalid all existing # confirmation, reset password and unlock tokens in the database. - # Devise will use the `secret_key_base` on Rails 4+ applications as its `secret_key` + # Devise will use the `secret_key_base` as its `secret_key` # by default. You can change it below and use your own secret key. config.secret_key = Rails.application.secrets.secret_key_base + # ==> Controller configuration + # Configure the parent class to the devise controllers. + # config.parent_controller = 'DeviseController' + # ==> Mailer Configuration # Configure the e-mail address which will be shown in Devise::Mailer, # note that it will be overwritten if you use your own mailer class @@ -65,7 +69,10 @@ Devise.setup do |config| # Tell if authentication through HTTP Auth is enabled. False by default. # It can be set to an array that will enable http authentication only for the # given strategies, for example, `config.http_authenticatable = [:database]` will - # enable it only for database authentication. The supported strategies are: + # enable it only for database authentication. + # For API-only applications to support authentication "out-of-the-box", you will likely want to + # enable this with :database unless you are using a custom strategy. + # The supported strategies are: # :database = Support basic authentication with authentication key + password # config.http_authenticatable = false @@ -93,26 +100,44 @@ Devise.setup do |config| # from the server. You can disable this option at your own risk. # config.clean_up_csrf_token_on_authentication = true + # When false, Devise will not attempt to reload routes on eager load. + # This can reduce the time taken to boot the app but if your application + # requires the Devise mappings to be loaded during boot time the application + # won't boot properly. + # config.reload_routes = true + # ==> Configuration for :database_authenticatable - # For bcrypt, this is the cost for hashing the password and defaults to 10. If - # using other encryptors, it sets how many times you want the password re-encrypted. + # For bcrypt, this is the cost for hashing the password and defaults to 12. If + # using other algorithms, it sets how many times you want the password to be hashed. + # The number of stretches used for generating the hashed password are stored + # with the hashed password. This allows you to change the stretches without + # invalidating existing passwords. # # Limiting the stretches to just one in testing will increase the performance of # your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use # a value less than 10 in other environments. Note that, for bcrypt (the default - # encryptor), the cost increases exponentially with the number of stretches (e.g. + # algorithm), the cost increases exponentially with the number of stretches (e.g. # a value of 20 is already extremely slow: approx. 60 seconds for 1 calculation). config.stretches = Rails.env.test? ? 1 : 10 # Setup a pepper to generate the encrypted password. # config.pepper = '43d5d80fc0a95d9aa618ca138b747b1d7623020544249e2672bf3a19846fa47baa29117cba30c9edcd3fcd10d379cd65c485a3f931a7a19efb3a794796828432' + # Send a notification to the original email when the user's email is changed. + # config.send_email_changed_notification = false + + # Send a notification email when the user's password is changed. + # config.send_password_change_notification = false + # ==> Configuration for :confirmable # A period that the user is allowed to access the website even without # confirming their account. For instance, if set to 2.days, the user will be # able to access the website for two days without confirming their account, - # access will be blocked just in the third day. Default is 0.days, meaning - # the user cannot access the website without confirming their account. + # access will be blocked just in the third day. + # You can also set it to nil, which will allow the user to access the website + # without confirming their account. + # Default is 0.days, meaning the user cannot access the website without + # confirming their account. # config.allow_unconfirmed_access_for = 2.days # A period that the user is allowed to confirm their account before their @@ -153,16 +178,13 @@ Devise.setup do |config| # Email regex used to validate email formats. It simply asserts that # one (and only one) @ exists in the given string. This is mainly # to give user feedback and not to assert the e-mail validity. - # config.email_regexp = /\A[^@]+@[^@]+\z/ + # config.email_regexp = /\A[^@\s]+@[^@\s]+\z/ # ==> Configuration for :timeoutable # The time you want to timeout the user session without activity. After this # time the user will be asked for credentials again. Default is 30 minutes. # config.timeout_in = 30.minutes - # If true, expires auth token on session timeout. - # config.expire_auth_token_on_timeout = false - # ==> Configuration for :lockable # Defines which strategy will be used to lock an account. # :failed_attempts = Locks an account after a number of failed attempts to sign in. @@ -204,11 +226,11 @@ Devise.setup do |config| # config.sign_in_after_reset_password = true # ==> Configuration for :encryptable - # Allow you to use another encryption algorithm besides bcrypt (default). You can use - # :sha1, :sha512 or encryptors from others authentication tools as :clearance_sha1, - # :authlogic_sha512 (then you should set stretches above to 20 for default behavior) - # and :restful_authentication_sha1 (then you should set stretches to 10, and copy - # REST_AUTH_SITE_KEY to pepper). + # Allow you to use another hashing or encryption algorithm besides bcrypt (default). + # You can use :sha1, :sha512 or algorithms from others authentication tools as + # :clearance_sha1, :authlogic_sha512 (then you should set stretches above to 20 + # for default behavior) and :restful_authentication_sha1 (then you should set + # stretches to 10, and copy REST_AUTH_SITE_KEY to pepper). # # Require the `devise-encryptable` gem when using anything other than bcrypt # config.encryptor = :sha512 @@ -229,7 +251,7 @@ Devise.setup do |config| # ==> Navigation configuration # Lists the formats that should be treated as navigational. Formats like - # :html, should redirect to the sign in page when the user does not have + # :html should redirect to the sign in page when the user does not have # access, but formats like :xml or :json, should return 401. # # If you have any extra navigational formats, like :iphone or :mobile, you @@ -288,6 +310,21 @@ Devise.setup do |config| # When using OmniAuth, Devise cannot automatically set OmniAuth path, # so you need to do it manually. For the users scope, it would be: # config.omniauth_path_prefix = '/my_engine/users/auth' + + # ==> Hotwire/Turbo configuration + # When using Devise with Hotwire/Turbo, the http status for error responses + # and some redirects must match the following. The default in Devise for existing + # apps is `200 OK` and `302 Found` respectively, but new apps are generated with + # these new defaults that match Hotwire/Turbo behavior. + # Note: These might become the new default in future versions of Devise. + # config.responder.error_status = :unprocessable_entity + # config.responder.redirect_status = :see_other + + # ==> Configuration for :registerable + + # When set to false, does not sign a user in automatically after their password is + # changed. Defaults to true, so a user is signed in automatically after changing a password. + # config.sign_in_after_change_password = true end Rails.application.config.to_prepare do