[Snyk] Fix for 43 vulnerabilities

Gemfile

@@ -19,14 +19,14 @@ else
   #
   # To issue a rails update bump the version number here
   rails_version = "7.0.7"
-  gem "actionmailer", rails_version
-  gem "actionpack", rails_version
-  gem "actionview", rails_version
+  gem "actionmailer", ">= 7.1.0", rails_version
+  gem "actionpack", ">= 7.1.0", rails_version
+  gem "actionview", ">= 7.0.7.1", rails_version
   gem "activemodel", rails_version
   gem "activerecord", rails_version
   gem "activesupport", rails_version
-  gem "railties", rails_version
-  gem "sprockets-rails"
+  gem "railties", ">= 7.1.0", rails_version
+  gem "sprockets-rails", ">= 3.5.0"
 end
 
 gem "json"
@@ -37,7 +37,7 @@ gem "sprockets", git: "https://github.com/rails/sprockets", branch: "3.x"
 
 # this will eventually be added to rails,
 # allows us to precompile all our templates in the unicorn master
-gem "actionview_precompiler", require: false
+gem "actionview_precompiler", ">= 0.4.0", require: false
 
 gem "discourse-seed-fu"
 
@@ -59,15 +59,15 @@ gem "redis-namespace"
 # we used an old branch which is the fastest one out there
 # are long term goal here is to fork this gem so we have a
 # better maintained living fork
-gem "active_model_serializers", "~> 0.8.3"
+gem "active_model_serializers", "~> 0.9.0"
 
 gem "http_accept_language", require: false
 
 gem "discourse-fonts", require: "discourse_fonts"
 
-gem "message_bus"
+gem "message_bus", ">= 4.3.9"
 
-gem "rails_multisite"
+gem "rails_multisite", ">= 5.0.1"
 
 gem "fast_xs", platform: :ruby
 
@@ -84,17 +84,17 @@ gem "image_optim"
 gem "multi_json"
 gem "mustache"
 gem "nokogiri"
-gem "loofah"
+gem "loofah", ">= 2.21.4"
 gem "css_parser", require: false
 
-gem "omniauth"
-gem "omniauth-facebook"
+gem "omniauth", ">= 2.1.0"
+gem "omniauth-facebook", ">= 10.0.0"
 gem "omniauth-twitter"
-gem "omniauth-github"
+gem "omniauth-github", ">= 2.0.0"
 
-gem "omniauth-oauth2", require: false
+gem "omniauth-oauth2", ">= 1.8.0", require: false
 
-gem "omniauth-google-oauth2"
+gem "omniauth-google-oauth2", ">= 1.0.0"
 
 gem "oj"
 
@@ -108,8 +108,8 @@ gem "rake"
 gem "thor", require: false
 gem "diffy", require: false
 gem "rinku"
-gem "sidekiq"
-gem "mini_scheduler"
+gem "sidekiq", ">= 6.5.10"
+gem "mini_scheduler", ">= 0.18.0"
 
 gem "execjs", require: false
 gem "mini_racer"
@@ -118,9 +118,9 @@ gem "highline", require: false
 
 gem "rack"
 
-gem "rack-protection" # security
+gem "rack-protection" , ">= 3.2.0" # security
 gem "cbor", require: false
-gem "cose", require: false
+gem "cose", ">= 1.3.1", require: false
 gem "addressable"
 gem "json_schemer"
 
@@ -136,14 +136,14 @@ group :assets do
 end
 
 group :test do
-  gem "capybara", require: false
-  gem "webmock", require: false
+  gem "capybara", ">= 3.40.0", require: false
+  gem "webmock", ">= 3.20.0", require: false
   gem "fakeweb", require: false
   gem "minitest", require: false
   gem "simplecov", require: false
-  gem "selenium-webdriver", "~> 4.11", require: false
+  gem "selenium-webdriver", "~> 4.13", ">= 4.13.0", require: false
   gem "test-prof"
-  gem "rails-dom-testing", require: false
+  gem "rails-dom-testing", ">= 2.3.0", require: false
   gem "minio_runner", require: false
 end
 
@@ -156,15 +156,15 @@ group :test, :development do
 
   gem "rb-fsevent", require: RUBY_PLATFORM =~ /darwin/i ? "rb-fsevent" : false
 
-  gem "rspec-rails"
+  gem "rspec-rails", ">= 6.0.4"
 
   gem "shoulda-matchers", require: false, github: "thoughtbot/shoulda-matchers"
   gem "rspec-html-matchers"
   gem "byebug", require: ENV["RM_INFO"].nil?, platform: :mri
-  gem "rubocop-discourse", require: false
+  gem "rubocop-discourse", ">= 3.4.0", require: false
   gem "parallel_tests"
 
-  gem "rswag-specs"
+  gem "rswag-specs", ">= 2.11.0"
 
   gem "annotate"
 
@@ -174,7 +174,7 @@ end
 
 group :development do
   gem "ruby-prof", require: false, platform: :mri
-  gem "bullet", require: !!ENV["BULLET"]
+  gem "bullet", ">= 7.1.0", require: !!ENV["BULLET"]
   gem "better_errors", platform: :mri, require: !!ENV["BETTER_ERRORS"]
   gem "binding_of_caller"
   gem "yaml-lint"
@@ -205,32 +205,32 @@ gem "htmlentities", require: false
 #  If you want to amend mini profiler to do the monkey patches in the railties
 #  we are open to it. by deferring require to the initializer we can configure discourse installs without it
 
-gem "rack-mini-profiler", require: ["enable_rails_patches"]
+gem "rack-mini-profiler", ">= 3.2.0", require: ["enable_rails_patches"]
 
 gem "unicorn", require: false, platform: :ruby
 gem "puma", require: false
 gem "rbtrace", require: false, platform: :mri
 gem "gc_tracer", require: false, platform: :mri
 
 # required for feed importing and embedding
-gem "ruby-readability", require: false
+gem "ruby-readability", ">= 0.7.1", require: false
 
 # rss gem is a bundled gem from Ruby 3 onwards
-gem "rss", require: false
+gem "rss", ">= 0.3.1", require: false
 
 gem "stackprof", require: false, platform: :mri
 gem "memory_profiler", require: false, platform: :mri
 
 gem "cppjieba_rb", require: false
 
-gem "lograge", require: false
+gem "lograge", ">= 0.14.0", require: false
 gem "logstash-event", require: false
 gem "logstash-logger", require: false
 gem "logster"
 
 # These are forks of sassc and sassc-rails with dart-sass support
-gem "dartsass-ruby"
-gem "dartsass-sprockets"
+gem "dartsass-ruby", ">= 3.0.2"
+gem "dartsass-sprockets", ">= 3.1.0"
 
 gem "rotp", require: false
 
@@ -243,7 +243,7 @@ gem "sshkey", require: false
 gem "rchardet", require: false
 gem "lz4-ruby", require: false, platform: :ruby
 
-gem "sanitize"
+gem "sanitize", ">= 6.1.0"
 
 if ENV["IMPORT"] == "1"
   gem "mysql2"
@@ -264,18 +264,18 @@ if ENV["GENERIC_IMPORT"] == "1"
   gem "redcarpet"
 end
 
-gem "web-push"
+gem "web-push", ">= 3.0.1"
 gem "colored2", require: false
 gem "maxminddb"
 
-gem "rails_failover", require: false
+gem "rails_failover", ">= 2.1.0", require: false
 
 gem "faraday"
 gem "faraday-retry"
 
 # workaround for faraday-net_http, see
 # https://github.com/ruby/net-imap/issues/16#issuecomment-803086765
-gem "net-http"
+gem "net-http", ">= 0.4.0"
 
 # Workaround until Ruby ships with cgi version 0.3.6 or higher.
 gem "cgi", ">= 0.3.6", require: false

README.md

@@ -1,3 +1,5 @@
+x
+
 <a href="https://www.discourse.org/">
   <img src="images/discourse-readme-logo.png" width="300px">
 </a>