Supermarket 3.1.63 released!

[robbkidd]

Supermarket 3.1.63 was released today and is available for download at https://downloads.chef.io/supermarket. This release contains security updates and is a recommended upgrade.

There was a quick succession of two CVEs announced in libraries used by Supermarket just after v3.1.61 was promoted to stable. 3.1.62 and 3.1.63 were built and promoted to address them. The combined set of changes of the three most recent stable versions are listed below.

3.1.63 (2018-03-26)

Merged Pull Requests

• update rails-html-sanitizer (CVE-2018-3741) #1731 (robbkidd)

3.1.62 (2018-03-26)

Merged Pull Requests

• update loofah (CVE-2018-8048) #1730 (robbkidd)

3.1.61 (2018-03-21)

Merged Pull Requests

• disable remote fetching in Paperclip #1719 (robbkidd)
• upgrade to Ruby 2.5.0 #1722 (robbkidd)
• upgrade nokogiri & libxml2 #1726 (robbkidd)
• update rack-protection (addresses underlying CVE audit that does not apply to Supermarket installs) #1728 (robbkidd)
• upgrade Foodcritic to v13.0.0 #1727 (tas50)