Release?

[bmedenwald]

Devise CVE today which forces most of us to upgrade to 5.0.3. Can we get a new release with the changes already committed so this gem and Devise 5 can work together?

For reference:

Name: devise
Version: 4.9.4
GHSA: GHSA-57hq-95w6-v4fc
Criticality: Unknown
URL: https://github.com/heartcombo/devise/security/advisories/GHSA-57hq-95w6-v4fc
Title: Confirmable "change email" race condition permits user to confirm email they have no access to
Solution: update to '>= 5.0.3'

[rctneil]

Yes, would be fantastic to see an update for this!

[rctneil]

Is there a release to support Devise 5.0.3?

[arthteachworks]

We now have devise 5.0.4, is there a release to support?

[christianrolle]

Yeah. The gem supporting the Devise 5.x would be very much appreciated.

[jesselasalle]

Bumping this issue as well

[pkarjala]

Bump; are there any maintainers still on this project? This issue has been open for 3 months.

[strouptl]

Hi all,

I apologize for the delay on this. You caught me in the middle of a large project, and strzibny in the middle of a job transition (along with a few conference talks, I believe:-)

I was hoping to give this a manual review to confirm that the updates are working, and that there are no unintended consequences from the Devise 5.x update. Are any of you running the master branch with Devise 5.x by any chance?

Either way, thank you for your patience, and we'll try to move this forward soon.

Thanks,
Laney