Version 2.2.5

carrierwaveuploader · Nov 29, 2023 · 0fcff94 · 0fcff94
1 parent 39b282d
commit 0fcff94
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,10 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## 2.2.5 - 2023-11-29
+### Security
+* Fix Content-Type allowlist bypass vulnerability, possibly leading to XSS (@mshibuya, [39b282d](https://github.com/carrierwaveuploader/carrierwave/commit/39b282db5c1303899b3d3381ce8a837840f983b5), [GHSA-gxhx-g4fq-49hj](https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-gxhx-g4fq-49hj))
+
 ## 2.2.4 - 2023-06-10
 ### Fixed
 * Fix Ruby 2.7 keyword argument warning in uploader process (@SuperTux88 [#2665](https://github.com/carrierwaveuploader/carrierwave/pull/2665), [#2636](https://github.com/carrierwaveuploader/carrierwave/pull/2636), [#2635](https://github.com/carrierwaveuploader/carrierwave/issues/2635))

diff --git a/lib/carrierwave/version.rb b/lib/carrierwave/version.rb
@@ -1,3 +1,3 @@
 module CarrierWave
-  VERSION = "2.2.4"
+  VERSION = "2.2.5"
 end