Skip to content

Upgrading devise 4 to 5

Review needed4.9.4 → 5.0.4Security2Changed1

Full comparisonBack to devise
Review neededUpgrade verdict

1 changed default and 2 security fixes.

In plain terms
  • Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler
  • Devise has a confirmable "change email" race condition permits user to confirm email they have no access to
Must act 2 items need code or config changes

Ruby requirement changed in 5.0.0.rc: >= 2.1.0 → >= 2.7.0.

What you must change

Security2
Devise has an Open Redirect via Unvalidated request.referrer in Timeoutable Session Timeout Handler
Moderate · CVSS 6.1
5.0.4GitHub AdvisoryOriginalView source
Devise has a confirmable "change email" race condition permits user to confirm email they have no access to
Moderate · CVSS 5.3
5.0.3GitHub AdvisoryOriginalView source

API changes

Generated by DepDelta from published Ruby source. Not mixed with prose notes.

  • removed: const Devise.DeprecatedConstantAccessor
  • removed: static method Devise.activerecord51?()
  • added: static method Devise.mappings()
  • removed: method DeviseGenerator.rails5_and_up?()
  • changed: class DeviseGenerator < ActiveRecord::Generators::Base → class DeviseGenerator < Base
  • removed: class SecretKeyFinder
  • removed: constructor SecretKeyFinder(_)
  • removed: method SecretKeyFinder.find()
  • removed: module DeprecatedConstantAccessor
  • removed: module TestHelpers
  • removed: static method Orm.active_record_51?(_)
  • removed: protected method Helpers.mailer_from(_)
  • removed: protected method Helpers.mailer_reply_to(_)
  • changed: protected method Helpers.mailer_sender(_, _ = …) → protected method Helpers.mailer_sender(_)
  • changed: method DatabaseAuthenticatable.update_with_password(_, *) → method DatabaseAuthenticatable.update_with_password(_)
  • changed: method DatabaseAuthenticatable.update_without_password(_, *) → method DatabaseAuthenticatable.update_without_password(_)
  • removed: method DirtyTrackingNewMethods.devise_email_before_last_save()
  • removed: method DirtyTrackingNewMethods.devise_email_in_database()
  • removed: method DirtyTrackingNewMethods.devise_respond_to_and_will_save_change_to_attribute?(_)
  • removed: method DirtyTrackingNewMethods.devise_saved_change_to_email?()
  • removed: method DirtyTrackingNewMethods.devise_saved_change_to_encrypted_password?()
  • removed: method DirtyTrackingNewMethods.devise_will_save_change_to_email?()
  • removed: method DirtyTrackingOldMethods.devise_email_before_last_save()
  • removed: method DirtyTrackingOldMethods.devise_email_in_database()
  • removed: method DirtyTrackingOldMethods.devise_respond_to_and_will_save_change_to_attribute?(_)
  • removed: method DirtyTrackingOldMethods.devise_saved_change_to_email?()
  • removed: method DirtyTrackingOldMethods.devise_saved_change_to_encrypted_password?()
  • removed: method DirtyTrackingOldMethods.devise_will_save_change_to_email?()
  • removed: module DirtyTrackingNewMethods
  • removed: module DirtyTrackingOldMethods
  • added: method DirtyTrackingActiveRecordMethods.devise_email_before_last_save()
  • added: method DirtyTrackingActiveRecordMethods.devise_email_in_database()
  • added: method DirtyTrackingActiveRecordMethods.devise_respond_to_and_will_save_change_to_attribute?(_)
  • added: method DirtyTrackingActiveRecordMethods.devise_saved_change_to_email?()
  • added: method DirtyTrackingActiveRecordMethods.devise_saved_change_to_encrypted_password?()
  • added: method DirtyTrackingActiveRecordMethods.devise_unconfirmed_email_will_change!()
  • added: method DirtyTrackingActiveRecordMethods.devise_will_save_change_to_email?()
  • added: method DirtyTrackingMongoidMethods.devise_email_before_last_save()
  • added: method DirtyTrackingMongoidMethods.devise_email_in_database()
  • added: method DirtyTrackingMongoidMethods.devise_respond_to_and_will_save_change_to_attribute?(_)
  • added: method DirtyTrackingMongoidMethods.devise_saved_change_to_email?()
  • added: method DirtyTrackingMongoidMethods.devise_saved_change_to_encrypted_password?()
  • added: method DirtyTrackingMongoidMethods.devise_unconfirmed_email_will_change!()
  • added: method DirtyTrackingMongoidMethods.devise_will_save_change_to_email?()
  • added: module DirtyTrackingActiveRecordMethods
  • added: module DirtyTrackingMongoidMethods
  • changed: method ControllerHelpers.sign_in(_, _ = …, scope: …) → method ControllerHelpers.sign_in(_, scope: …)