Dependabot - RCE bug with Serialized Columns in Active Record

[tuxmea]

https://github.com/betadots/hdm/security/dependabot/77

 Dependabot cannot update activerecord to a non-vulnerable version

The latest possible version that can be installed is 7.0.2.4 because of the following conflicting dependencies:

rails (7.0.2.4) requires activerecord (= 7.0.2.4) via actionmailbox (7.0.2.4)
rails (7.0.2.4) requires activerecord (= 7.0.2.4) via actiontext (7.0.2.4)
rails (7.0.2.4) requires activerecord (= 7.0.2.4) via activestorage (7.0.2.4)
rails (7.0.2.4) requires activerecord (= 7.0.2.4)

The earliest fixed version is 7.0.3.1.

[tuxmea]

@oneiros Can we update to 7.0.3.x?

[oneiros]

@oneiros Can we update to 7.0.3.x?

Absolutely!

FWIW, hdm (OS) is not vulnerable with regards to the RCE bug. But of course it does not hurt to be on the current version.

[rwaffen]

fixed with 9ab0791