Ruby/actionview/4.2.10
Simple, battle-tested conventions and helpers for building web pages.
https://rubygems.org/gems/actionview
MIT
11 Security Vulnerabilities
Cross site scripting vulnerability in ActionView
- https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv
- https://nvd.nist.gov/vuln/detail/CVE-2020-5267
- https://github.com/advisories/GHSA-65cv-r6x7-79hv
- https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a
- https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html
- http://www.openwall.com/lists/oss-security/2020/03/19/1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-5267.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j
or escape_javascript
methods may be susceptible to XSS attacks.
Impact
There is a possible XSS vulnerability in the j
and escape_javascript
methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:
<script>let a = `<%= j unknown_input %>`</script>
or
<script>let a = `<%= escape_javascript unknown_input %>`</script>
Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
Workarounds
For those that can't upgrade, the following monkey patch may be used:
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
module ActionView::Helpers::JavaScriptHelper
alias :old_ej :escape_javascript
alias :old_j :j
def escape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result = ""
else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
end
alias :j :escape_javascript
end
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 5-2-js-helper-xss.patch - Patch for 5.2 series
- 6-0-js-helper-xss.patch - Patch for 6.0 series
Please note that only the 5.2 and 6.0 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits
Thanks to Jesse Campos from Chef Secure
Path Traversal in Action View
- https://groups.google.com/forum/#!topic/rubyonrails-security/zRNVOUhKHrg
- https://nvd.nist.gov/vuln/detail/CVE-2019-5418
- https://github.com/advisories/GHSA-86g5-2wh3-gc9j
- https://access.redhat.com/errata/RHSA-2019:0796
- https://access.redhat.com/errata/RHSA-2019:1147
- https://access.redhat.com/errata/RHSA-2019:1149
- https://access.redhat.com/errata/RHSA-2019:1289
- https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- https://www.exploit-db.com/exploits/46585/
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
- http://www.openwall.com/lists/oss-security/2019/03/22/1
File Content Disclosure in Action View
Impact
There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file:
can cause arbitrary files on the target server to be rendered, disclosing the file contents.
The impact is limited to calls to render
which render file contents without a specified accept format. Impacted code in a controller looks something like this:
class UserController < ApplicationController
def index
render file: "#{Rails.root}/some/file"
end
end
Rendering templates as opposed to files is not impacted by this vulnerability.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.
Workarounds
This vulnerability can be mitigated by specifying a format for file rendering, like this:
class UserController < ApplicationController
def index
render file: "#{Rails.root}/some/file", formats: [:html]
end
end
In summary, impacted calls to render
look like this:
render file: "#{Rails.root}/some/file"
The vulnerability can be mitigated by changing to this:
render file: "#{Rails.root}/some/file", formats: [:html]
Other calls to render
are not impacted.
Alternatively, the following monkey patch can be applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do
def formats
super().select do |format|
format.symbol || format.ref == "*/*"
end
end
end)
Credits
Thanks to John Hawthorn john@hawthorn.email of GitHub
XSS in Action View
- https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5
- https://nvd.nist.gov/vuln/detail/CVE-2020-15169
- https://github.com/advisories/GHSA-cfjv-5498-mph5
- https://github.com/rails/rails/commit/e663f084460ea56c55c3dc76f78c7caeddeeb02e
- https://www.debian.org/security/2020/dsa-4766
- https://lists.debian.org/debian-lts-announce/2020/10/msg00015.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-15169.yml
- https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc
There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t
and translate
helpers could be susceptible to XSS attacks.
Impact
When an HTML-unsafe string is passed as the default for a missing translation key named html
or ending in _html
, the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>
<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
Patches
Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.
The patches have also been applied to the master
, 6-0-stable
, and 5-2-stable
branches on GitHub. If you track any of these branches, you should update to the latest.
To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 5-2-translate-helper-xss.patch — patch for the 5.2 release series
- 6-0-translate-helper-xss.patch — patch for the 6.0 release series
Please note that only the 5.2 and 6.0 release series are currently supported. Users of earlier, unsupported releases are advised to update as soon as possible, as we cannot provide security fixes for unsupported releases.
Workarounds
Impacted users who can’t upgrade to a patched Rails version can avoid this issue by manually escaping default translations with the html_escape
helper (aliased as h
):
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
XSS Vulnerability in Action View tag helpers
- https://nvd.nist.gov/vuln/detail/CVE-2022-27777
- https://github.com/rails/rails/commit/649516ce0feb699ae06a8c5e81df75d460cc9a85
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
- https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
- https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
- https://github.com/advisories/GHSA-ch3h-j2vf-95pv
- https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://www.debian.org/security/2023/dsa-5372
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.
Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.
Impacted code will look something like this:
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
Where the malicious_input
variable contains untrusted data.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Escape the untrusted data before using it as a key for tag helper methods.
Remote code execution via user-provided local names in ActionView
- https://nvd.nist.gov/vuln/detail/CVE-2020-8163
- https://github.com/advisories/GHSA-cr3x-7m39-c6jq
- https://hackerone.com/reports/304805
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8163.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0
- https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals
argument of a render
call to perform a RCE.
Denial of Service Vulnerability in Action View
- https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI
- https://nvd.nist.gov/vuln/detail/CVE-2019-5419
- https://github.com/advisories/GHSA-m63j-wh5w-c252
- https://access.redhat.com/errata/RHSA-2019:0796
- https://access.redhat.com/errata/RHSA-2019:1147
- https://access.redhat.com/errata/RHSA-2019:1149
- https://access.redhat.com/errata/RHSA-2019:1289
- https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00001.html
- http://www.openwall.com/lists/oss-security/2019/03/22/1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2019-5419.yml
- https://github.com/rails/rails/pull/35708
- https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715
Denial of Service Vulnerability in Action View
Impact
Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.
Workarounds
This vulnerability can be mitigated by wrapping render
calls with respond_to
blocks. For example, the following example is vulnerable:
class UserController < ApplicationController
def index
render "index"
end
end
But the following code is not vulnerable:
class UserController < ApplicationController
def index
respond_to |format|
format.html { render "index" }
end
end
end
Implicit rendering is impacted, so this code is vulnerable:
class UserController < ApplicationController
def index
end
end
But can be changed this this:
class UserController < ApplicationController
def index
respond_to |format|
format.html { render "index" }
end
end
end
Alternatively to specifying the format, the following monkey patch can be applied in an initializer:
$ cat config/initializers/formats_filter.rb
# frozen_string_literal: true
ActionDispatch::Request.prepend(Module.new do
def formats
super().select do |format|
format.symbol || format.ref == "*/*"
end
end
end)
Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Also note that the patches for this vulnerability are the same as CVE-2019-5418.
Credits
Thanks to John Hawthorn john@hawthorn.email of GitHub
Potential XSS vulnerability in Action View
There is a potential Cross-Site Scripting (XSS) vulnerability in Action
View's translation helpers. Views that allow the user to control the
default (not found) value of the t
and translate
helpers could be
susceptible to XSS attacks.
Impact
When an HTML-unsafe string is passed as the default for a missing
translation key named html
or ending in _html
,
the default string is incorrectly marked as HTML-safe and not escaped.
Vulnerable code may look like the following examples:
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>
<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
Workarounds
Impacted users who can’t upgrade to a patched Rails version can avoid
this issue by manually escaping default translations with the
html_escape
helper (aliased as h
):
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
Possible XSS vulnerability in ActionView
There is a possible XSS vulnerability in ActionView's JavaScript literal
escape helpers. Views that use the j
or escape_javascript
methods
may be susceptible to XSS attacks.
Versions Affected: All. Not affected: None. Fixed Versions: 6.0.2.2, 5.2.4.2
Impact
There is a possible XSS vulnerability in the j
and escape_javascript
methods in ActionView. These methods are used for escaping JavaScript string
literals. Impacted code will look something like this:
<script>let a = `<%= j unknown_input %>`</script>
or
<script>let a = `<%= escape_javascript unknown_input %>`</script>
Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
Workarounds
For those that can't upgrade, the following monkey patch may be used:
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
module ActionView::Helpers::JavaScriptHelper
alias :old_ej :escape_javascript
alias :old_j :j
def escape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result = ""
else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
end
alias :j :escape_javascript
end
Potential remote code execution of user-provided local names in ActionView
There was a vulnerability in versions of Rails prior to 5.0.1 that would
allow an attacker who controlled the locals
argument of a render
call.
Versions Affected: rails < 5.0.1 Not affected: Applications that do not allow users to control the names of locals. Fixed Versions: 4.2.11.2
Impact
In the scenario where an attacker might be able to control the name of a
local passed into render
, they can acheive remote code execution.
Workarounds
Until such time as the patch can be applied, application developers should ensure that all user-provided local names are alphanumeric.
CSRF Vulnerability in rails-ujs
There is an vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.
Versions Affected: rails <= 6.0.3 Not affected: Applications which don't use rails-ujs. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
This is a regression of CVE-2015-1840.
In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.
Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.
For example, code like this:
link_to params
to code like this:
link_to filtered_params
def filtered_params
# Filter just the parameters that you trust
end
Possible XSS Vulnerability in Action View tag helpers
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.
Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.
Impacted code will look something like this:
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
Where the malicious_input
variable contains untrusted data.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Escape the untrusted data before using it as a key for tag helper methods.
262 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
7.2.0.beta2 | MIT | 2024-06-04 - 18:14 | 24 days | |
7.2.0.beta1 | MIT | 2024-05-29 - 23:38 | 30 days | |
7.1.3.4 | MIT | 2024-06-04 - 18:00 | 24 days | |
7.1.3.3 | MIT | 2024-05-16 - 19:21 | about 1 month | |
7.1.3.2 | MIT | 2024-02-21 - 21:45 | 4 months | |
7.1.3.1 | MIT | 2024-02-21 - 18:46 | 4 months | |
7.1.3 | MIT | 2024-01-16 - 22:53 | 5 months | |
7.1.2 | MIT | 2023-11-10 - 21:50 | 8 months | |
7.1.1 | MIT | 2023-10-11 - 22:17 | 9 months | |
7.1.0 | MIT | 2023-10-05 - 08:06 | 9 months | |
7.1.0.rc2 | MIT | 2023-10-01 - 21:59 | 9 months | |
7.1.0.rc1 | MIT | 2023-09-27 - 04:00 | 9 months | |
7.1.0.beta1 | MIT | 2023-09-13 - 00:37 | 10 months | |
7.0.8.4 | MIT | 2024-06-04 - 17:56 | 24 days | |
7.0.8.3 | MIT | 2024-05-17 - 19:53 | about 1 month | |
7.0.8.2 | MIT | 2024-05-16 - 18:58 | about 1 month | |
7.0.8.1 | MIT | 2024-02-21 - 18:42 | 4 months | |
7.0.8 | MIT | 2023-09-09 - 19:11 | 10 months | |
7.0.7.2 | MIT | 2023-08-22 - 20:10 | 10 months | |
7.0.7.1 | MIT | 2023-08-22 - 17:20 | 10 months | |
7.0.7 | MIT | 2023-08-09 - 23:56 | 11 months | |
7.0.6 | MIT | 2023-06-29 - 20:54 | 12 months | |
7.0.5.1 | MIT | 2023-06-26 - 21:35 | about 1 year | |
7.0.5 | MIT | 2023-05-24 - 18:58 | about 1 year | |
7.0.4.3 | MIT | 2023-03-13 - 18:53 | over 1 year | |
7.0.4.2 | MIT | 2 | 2023-01-25 - 03:14 | over 1 year |
7.0.4.1 | MIT | 2 | 2023-01-17 - 18:55 | over 1 year |
7.0.4 | MIT | 2 | 2022-09-09 - 18:42 | almost 2 years |
7.0.3.1 | MIT | 2 | 2022-07-12 - 17:31 | almost 2 years |
7.0.3 | MIT | 2 | 2022-05-09 - 13:40 | about 2 years |
7.0.2.4 | MIT | 2 | 2022-04-26 - 19:33 | about 2 years |
7.0.2.3 | MIT | 4 | 2022-03-08 - 17:50 | over 2 years |
7.0.2.2 | MIT | 4 | 2022-02-11 - 19:43 | over 2 years |
7.0.2.1 | MIT | 4 | 2022-02-11 - 18:18 | over 2 years |
7.0.2 | MIT | 4 | 2022-02-08 - 23:12 | over 2 years |
7.0.1 | MIT | 4 | 2022-01-06 - 21:53 | over 2 years |
7.0.0 | MIT | 4 | 2021-12-15 - 23:43 | over 2 years |
7.0.0.rc3 | MIT | 2 | 2021-12-14 - 23:04 | over 2 years |
7.0.0.rc2 | MIT | 2 | 2021-12-14 - 19:39 | over 2 years |
7.0.0.rc1 | MIT | 2 | 2021-12-06 - 21:28 | over 2 years |
7.0.0.alpha2 | MIT | 2 | 2021-09-15 - 23:15 | almost 3 years |
7.0.0.alpha1 | MIT | 2 | 2021-09-15 - 21:56 | almost 3 years |
6.1.7.8 | MIT | 2024-06-04 - 17:55 | 24 days | |
6.1.7.7 | MIT | 2024-02-21 - 18:38 | 4 months | |
6.1.7.6 | MIT | 2023-08-22 - 20:07 | 10 months | |
6.1.7.5 | MIT | 2023-08-22 - 17:15 | 10 months | |
6.1.7.4 | MIT | 2023-06-26 - 21:31 | about 1 year | |
6.1.7.3 | MIT | 2023-03-13 - 18:48 | over 1 year | |
6.1.7.2 | MIT | 1 | 2023-01-25 - 03:23 | over 1 year |
6.1.7.1 | MIT | 1 | 2023-01-17 - 18:54 | over 1 year |
6.1.7 | MIT | 2 | 2022-09-09 - 18:38 | almost 2 years |
6.1.6.1 | MIT | 2 | 2022-07-12 - 17:29 | almost 2 years |
6.1.6 | MIT | 2 | 2022-05-09 - 13:44 | about 2 years |
6.1.5.1 | MIT | 2 | 2022-04-26 - 19:30 | about 2 years |
6.1.5 | MIT | 3 | 2022-03-10 - 21:12 | over 2 years |
6.1.4.7 | MIT | 3 | 2022-03-08 - 17:48 | over 2 years |
6.1.4.6 | MIT | 3 | 2022-02-11 - 19:41 | over 2 years |
6.1.4.5 | MIT | 3 | 2022-02-11 - 18:22 | over 2 years |
6.1.4.4 | MIT | 3 | 2021-12-15 - 22:52 | over 2 years |
6.1.4.3 | MIT | 3 | 2021-12-14 - 23:02 | over 2 years |
6.1.4.2 | MIT | 3 | 2021-12-14 - 19:48 | over 2 years |
6.1.4.1 | MIT | 3 | 2021-08-19 - 16:25 | almost 3 years |
6.1.4 | MIT | 3 | 2021-06-24 - 20:40 | about 3 years |
6.1.3.2 | MIT | 3 | 2021-05-05 - 15:34 | about 3 years |
6.1.3.1 | MIT | 3 | 2021-03-26 - 18:06 | over 3 years |
6.1.3 | MIT | 3 | 2021-02-17 - 18:41 | over 3 years |
6.1.2.1 | MIT | 3 | 2021-02-10 - 20:44 | over 3 years |
6.1.2 | MIT | 3 | 2021-02-09 - 21:28 | over 3 years |
6.1.1 | MIT | 3 | 2021-01-07 - 22:58 | over 3 years |
6.1.0 | MIT | 3 | 2020-12-09 - 19:57 | over 3 years |
6.1.0.rc2 | MIT | 2 | 2020-12-01 - 22:00 | over 3 years |
6.1.0.rc1 | MIT | 2 | 2020-11-02 - 21:14 | over 3 years |
6.0.6.1 | MIT | 2 | 2023-01-17 - 18:53 | over 1 year |
6.0.6 | MIT | 2 | 2022-09-09 - 18:32 | almost 2 years |
6.0.5.1 | MIT | 2 | 2022-07-12 - 17:28 | almost 2 years |
6.0.5 | MIT | 2 | 2022-05-09 - 13:50 | about 2 years |
6.0.4.8 | MIT | 2 | 2022-04-26 - 19:26 | about 2 years |
6.0.4.7 | MIT | 3 | 2022-03-08 - 17:47 | over 2 years |
6.0.4.6 | MIT | 3 | 2022-02-11 - 19:39 | over 2 years |
6.0.4.5 | MIT | 3 | 2022-02-11 - 18:24 | over 2 years |
6.0.4.4 | MIT | 3 | 2021-12-15 - 22:46 | over 2 years |
6.0.4.3 | MIT | 3 | 2021-12-14 - 23:00 | over 2 years |
6.0.4.2 | MIT | 3 | 2021-12-14 - 20:10 | over 2 years |
6.0.4.1 | MIT | 3 | 2021-08-19 - 16:19 | almost 3 years |
6.0.4 | MIT | 3 | 2021-06-15 - 20:14 | about 3 years |
6.0.3.7 | MIT | 3 | 2021-05-05 - 16:01 | about 3 years |
6.0.3.6 | MIT | 3 | 2021-03-26 - 17:32 | over 3 years |
6.0.3.5 | MIT | 3 | 2021-02-10 - 20:39 | over 3 years |
6.0.3.4 | MIT | 3 | 2020-10-07 - 16:50 | over 3 years |
6.0.3.3 | MIT | 3 | 2020-09-09 - 18:19 | almost 4 years |
6.0.3.2 | MIT | 5 | 2020-06-17 - 14:54 | about 4 years |
6.0.3.1 | MIT | 5 | 2020-05-18 - 15:46 | about 4 years |
6.0.3 | MIT | 7 | 2020-05-06 - 18:04 | about 4 years |
6.0.3.rc1 | MIT | 7 | 2020-05-01 - 17:17 | about 4 years |
6.0.2.2 | MIT | 7 | 2020-03-19 - 16:43 | over 4 years |
6.0.2.1 | MIT | 9 | 2019-12-18 - 19:08 | over 4 years |
6.0.2 | MIT | 9 | 2019-12-13 - 18:20 | over 4 years |
6.0.2.rc2 | MIT | 9 | 2019-12-09 - 16:12 | over 4 years |
6.0.2.rc1 | MIT | 9 | 2019-11-27 - 15:10 | over 4 years |
6.0.1 | MIT | 9 | 2019-11-05 - 14:38 | over 4 years |