mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-06-04 21:02:35 +08:00
94daf26ead
This PR updates two dependencies — `faraday` (2.14.1 → 2.14.2) and `jwt` (2.10.1 → 2.10.3) — to pick up security patches flagged by `bundle-audit`. Both are bumped to the minimal patched release within their existing major lines to keep the blast radius small. ### Faraday `Faraday::Connection#build_exclusive_url` still allowed a protocol-relative host override when the request target was passed as a `URI` object (rather than a `String`), bypassing the earlier fix for the string-based variant (CVE-2026-25765 / GHSA-33mh-2634-fwr2). On a fixed-base connection this could redirect a request to an attacker-controlled host while still forwarding connection-scoped headers such as `Authorization` — i.e. off-host request forgery (CVE-2026-33637 / GHSA-5rv5-xj5j-3484). The fix is a clean patch bump to `2.14.2`, within Faraday's existing version range — no API changes and no other gems affected. ### JWT `jwt` 2.10.1 accepts an empty/`nil` HMAC key during verification: `JWT.decode(token, "", true, algorithm: 'HS256')` (and keyfinder paths returning `""`/`nil`) verify a forged token, because the empty-key HMAC digest is treated as valid and `enforce_hmac_key_length` defaults to `false` (CVE-2026-45363, High). The advisory offers two fixes — `~> 2.10.3` or `>= 3.2.0`. We chose **2.10.3** deliberately: jumping to 3.x cascaded into upgrading `oauth2`, `twilio-ruby`, `googleauth`, `web-push`, and `signet` (all pinned `jwt < 3.0`), and `jwt` is used directly in 8+ places here (token services, OAuth callbacks, integration helpers), so a major bump carries real breakage risk for no extra security benefit. The Gemfile is pinned `'~> 2.10', '>= 2.10.3'` to hold the 2.x line. **Spec changes.** 2.10.3 tightens key handling: HMAC sign/verify now raises on a `nil`, empty, or non-`String` key instead of silently coercing it. A few specs relied on the old lax behaviour and needed updating: - `microsoft` / `google` callback specs built unsigned ID tokens via `JWT.encode(payload, false)`. Replaced with the correct unsigned form, `JWT.encode(payload, nil, 'none')`. - `instagram` / `linear` / `shopify` helper specs have a "client secret not configured" context where `client_secret` is `nil`. Their shared `valid_token` `let` signed with that `nil` secret, which Ruby evaluates before the helper runs — now raising. Since the helper short-circuits on the blank secret and never decodes the token, those contexts now override `valid_token` with a throwaway string. **Production is unaffected.** Every production HMAC path uses a real, non-empty key — `Rails.application.secret_key_base` (`BaseTokenService`, `Widget::TokenService`) or a client secret guarded by `return if client_secret.blank?` (Instagram/TikTok/Shopify/Linear helpers). The one `nil`-key call, `JWT.decode(id_token, nil, false)` in `OauthCallbackController`, runs with verification disabled, so the key is never inspected. Twilio voice tokens use `Twilio::JWT::AccessToken` from `twilio-ruby`, not this gem. The specs failed precisely because they exercised the unsafe empty-key pattern the patch now blocks — production never did.
281 lines
7.2 KiB
Ruby
281 lines
7.2 KiB
Ruby
source 'https://rubygems.org'
|
|
|
|
ruby '3.4.4'
|
|
|
|
##-- base gems for rails --##
|
|
gem 'rack-cors', '2.0.0', require: 'rack/cors'
|
|
gem 'rails', '~> 7.1'
|
|
# Reduces boot times through caching; required in config/boot.rb
|
|
gem 'bootsnap', require: false
|
|
|
|
##-- rails application helper gems --##
|
|
gem 'acts-as-taggable-on'
|
|
gem 'attr_extras'
|
|
gem 'browser'
|
|
gem 'hashie'
|
|
gem 'jbuilder'
|
|
gem 'kaminari'
|
|
gem 'responders', '>= 3.1.1'
|
|
gem 'rest-client'
|
|
gem 'telephone_number'
|
|
gem 'time_diff'
|
|
gem 'tzinfo-data'
|
|
gem 'valid_email2'
|
|
gem 'email-provider-info'
|
|
gem 'gemoji'
|
|
# compress javascript config.assets.js_compressor
|
|
gem 'uglifier'
|
|
##-- used for single column multiple binary flags in notification settings/feature flagging --##
|
|
gem 'flag_shih_tzu'
|
|
# Random name generator for user names
|
|
gem 'haikunator'
|
|
# Template parsing safely
|
|
gem 'liquid'
|
|
# Parse Markdown to HTML
|
|
gem 'commonmarker'
|
|
# Validate Data against JSON Schema
|
|
gem 'json_schemer'
|
|
# used in swagger build
|
|
gem 'json_refs'
|
|
# Rack middleware for blocking & throttling abusive requests
|
|
gem 'rack-attack', '>= 6.7.0'
|
|
# a utility tool for streaming, flexible and safe downloading of remote files
|
|
gem 'down'
|
|
# SSRF-safe URL fetching
|
|
gem 'ssrf_filter', '~> 1.5'
|
|
# authentication type to fetch and send mail over oauth2.0
|
|
gem 'gmail_xoauth'
|
|
# Lock net-smtp to 0.3.4 to avoid issues with gmail_xoauth2
|
|
gem 'net-smtp', '~> 0.3.4'
|
|
# Prevent CSV injection
|
|
gem 'csv-safe'
|
|
|
|
##-- for active storage --##
|
|
gem 'aws-sdk-s3', require: false
|
|
# original gem isn't maintained actively
|
|
# we wanted updated version of faraday which is a dependency for slack-ruby-client
|
|
gem 'azure-storage-blob', git: 'https://github.com/chatwoot/azure-storage-ruby', branch: 'chatwoot', require: false
|
|
gem 'google-cloud-storage', '>= 1.48.0', require: false
|
|
gem 'image_processing'
|
|
|
|
##-- for actionmailbox --##
|
|
gem 'aws-actionmailbox-ses', '~> 0'
|
|
|
|
##-- gems for database --#
|
|
gem 'groupdate'
|
|
gem 'pg'
|
|
gem 'redis'
|
|
gem 'redis-namespace'
|
|
# super fast record imports in bulk
|
|
gem 'activerecord-import'
|
|
|
|
gem 'searchkick'
|
|
gem 'opensearch-ruby'
|
|
gem 'faraday_middleware-aws-sigv4'
|
|
|
|
##--- gems for server & infra configuration ---##
|
|
gem 'dotenv-rails', '>= 3.0.0'
|
|
gem 'foreman'
|
|
gem 'puma'
|
|
gem 'vite_rails'
|
|
# metrics on heroku
|
|
gem 'barnes'
|
|
|
|
##--- gems for authentication & authorization ---##
|
|
gem 'devise', '>= 4.9.4'
|
|
gem 'devise-secure_password', git: 'https://github.com/chatwoot/devise-secure_password', branch: 'chatwoot'
|
|
gem 'devise_token_auth', '>= 1.2.3'
|
|
gem 'rails-i18n', '~> 7.0'
|
|
# two-factor authentication
|
|
gem 'devise-two-factor', '>= 5.0.0'
|
|
# authorization
|
|
gem 'jwt', '~> 2.10', '>= 2.10.3'
|
|
gem 'pundit'
|
|
|
|
# super admin
|
|
gem 'administrate', '>= 0.20.1'
|
|
gem 'administrate-field-active_storage', '>= 1.0.3'
|
|
gem 'administrate-field-belongs_to_search', '>= 0.9.0'
|
|
|
|
##--- gems for pubsub service ---##
|
|
# https://karolgalanciak.com/blog/2019/11/30/from-activerecord-callbacks-to-publish-slash-subscribe-pattern-and-event-driven-design/
|
|
gem 'wisper', '2.0.0'
|
|
|
|
##--- gems for channels ---##
|
|
gem 'facebook-messenger'
|
|
gem 'line-bot-api'
|
|
gem 'twilio-ruby'
|
|
# twitty will handle subscription of twitter account events
|
|
# gem 'twitty', git: 'https://github.com/chatwoot/twitty'
|
|
gem 'twitty', '~> 0.1.5'
|
|
# facebook client
|
|
gem 'koala'
|
|
# slack client
|
|
gem 'slack-ruby-client', '~> 2.7.0'
|
|
# for dialogflow integrations
|
|
gem 'google-cloud-dialogflow-v2', '>= 0.24.0'
|
|
gem 'grpc'
|
|
# Translate integrations
|
|
# 'google-cloud-translate' gem depends on faraday 2.0 version
|
|
# this dependency breaks the slack-ruby-client gem
|
|
gem 'google-cloud-translate-v3', '>= 0.7.0'
|
|
|
|
##-- apm and error monitoring ---#
|
|
# loaded only when environment variables are set.
|
|
# ref application.rb
|
|
gem 'datadog', '~> 2.0', require: false
|
|
gem 'elastic-apm', require: false
|
|
gem 'newrelic_rpm', require: false
|
|
gem 'newrelic-sidekiq-metrics', '>= 1.6.2', require: false
|
|
gem 'scout_apm', require: false
|
|
gem 'sentry-rails', '>= 5.19.0', require: false
|
|
gem 'sentry-ruby', require: false
|
|
gem 'sentry-sidekiq', '>= 5.19.0', require: false
|
|
|
|
##-- background job processing --##
|
|
gem 'sidekiq', '~> 7.3', '>= 7.3.1'
|
|
# We want cron jobs
|
|
gem 'sidekiq-cron', '>= 2.4.0'
|
|
# for sidekiq healthcheck
|
|
gem 'sidekiq_alive'
|
|
|
|
##-- Push notification service --##
|
|
gem 'fcm'
|
|
gem 'web-push', '>= 3.0.1'
|
|
|
|
##-- geocoding / parse location from ip --##
|
|
# http://www.rubygeocoder.com/
|
|
gem 'geocoder'
|
|
# to parse maxmind db
|
|
gem 'maxminddb'
|
|
|
|
# to create db triggers
|
|
gem 'hairtrigger'
|
|
|
|
gem 'procore-sift'
|
|
|
|
# parse email
|
|
gem 'email_reply_trimmer'
|
|
|
|
gem 'html2text'
|
|
|
|
# to calculate working hours
|
|
gem 'working_hours'
|
|
|
|
# full text search for articles
|
|
gem 'pg_search'
|
|
|
|
# Subscriptions, Billing
|
|
gem 'stripe', '~> 18.0'
|
|
|
|
## - helper gems --##
|
|
## to populate db with sample data
|
|
gem 'faker'
|
|
|
|
# Include logrange conditionally in intializer using env variable
|
|
gem 'lograge', '~> 0.14.0', require: false
|
|
|
|
# worked with microsoft refresh token
|
|
gem 'omniauth-oauth2'
|
|
|
|
gem 'audited', '~> 5.4', '>= 5.4.1'
|
|
|
|
# need for google auth
|
|
gem 'omniauth', '>= 2.1.2'
|
|
gem 'omniauth-saml'
|
|
gem 'omniauth-google-oauth2', '>= 1.1.3'
|
|
gem 'omniauth-rails_csrf_protection', '~> 1.0', '>= 1.0.2'
|
|
|
|
## Gems for reponse bot
|
|
# adds cosine similarity to postgres using vector extension
|
|
gem 'neighbor'
|
|
gem 'pgvector'
|
|
# Convert Website HTML to Markdown
|
|
gem 'reverse_markdown'
|
|
|
|
gem 'iso-639'
|
|
gem 'ruby-openai'
|
|
gem 'ai-agents', '>= 0.10.0'
|
|
|
|
# TODO: Move this gem as a dependency of ai-agents
|
|
gem 'ruby_llm', '>= 1.14.1'
|
|
gem 'ruby_llm-schema'
|
|
|
|
gem 'cld3', '~> 3.7'
|
|
|
|
# OpenTelemetry for LLM observability
|
|
gem 'opentelemetry-sdk'
|
|
gem 'opentelemetry-exporter-otlp'
|
|
|
|
gem 'shopify_api'
|
|
|
|
gem 'firecrawl-sdk', '~> 1.0', require: 'firecrawl'
|
|
|
|
### Gems required only in specific deployment environments ###
|
|
##############################################################
|
|
|
|
group :production do
|
|
# we dont want request timing out in development while using byebug
|
|
gem 'rack-timeout'
|
|
# for heroku autoscaling
|
|
gem 'judoscale-rails', require: false
|
|
gem 'judoscale-sidekiq', require: false
|
|
end
|
|
|
|
group :development do
|
|
gem 'annotaterb'
|
|
gem 'bullet'
|
|
gem 'letter_opener'
|
|
gem 'scss_lint', require: false
|
|
gem 'web-console', '>= 4.2.1'
|
|
|
|
# When we want to squash migrations
|
|
gem 'squasher'
|
|
|
|
# profiling
|
|
gem 'rack-mini-profiler', '>= 3.2.0', require: false
|
|
gem 'stackprof'
|
|
# Should install the associated chrome extension to view query logs
|
|
gem 'meta_request', '>= 0.8.3'
|
|
|
|
gem 'tidewave'
|
|
end
|
|
|
|
group :test do
|
|
# fast cleaning of database
|
|
gem 'database_cleaner'
|
|
# mock http calls
|
|
gem 'webmock'
|
|
# test profiling
|
|
gem 'test-prof'
|
|
gem 'simplecov_json_formatter', require: false
|
|
end
|
|
|
|
group :development, :test do
|
|
gem 'active_record_query_trace'
|
|
##--- gems for debugging and error reporting ---##
|
|
# static analysis
|
|
gem 'brakeman'
|
|
gem 'bundle-audit', require: false
|
|
gem 'byebug', platform: :mri
|
|
gem 'climate_control'
|
|
gem 'debug', '~> 1.8'
|
|
gem 'factory_bot_rails', '>= 6.4.3'
|
|
gem 'listen'
|
|
gem 'mock_redis'
|
|
gem 'pry-rails'
|
|
gem 'rspec_junit_formatter'
|
|
gem 'rspec-rails', '>= 6.1.5'
|
|
gem 'rubocop', require: false
|
|
gem 'rubocop-performance', require: false
|
|
gem 'rubocop-rails', require: false
|
|
gem 'rubocop-rspec', require: false
|
|
gem 'rubocop-factory_bot', require: false
|
|
gem 'seed_dump'
|
|
gem 'shoulda-matchers'
|
|
gem 'simplecov', '>= 0.21', require: false
|
|
gem 'skooma'
|
|
gem 'spring'
|
|
gem 'spring-watcher-listen'
|
|
end
|