Conversation
There is a security vulnerability on lower versions, update accordingly. https://nvd.nist.gov/vuln/detail/CVE-2026-32700
Devise 5 changed send_devise_notification to call deliver_now instead of deliver. The test double only stubbed deliver, causing a failure. This is a test-only change — real ActionMailer objects respond to both methods.
With the major version upgrade of an important dependency (devise), a new minor version is warranted.
BenAkroyd
force-pushed
the
major-devise-bump
branch
from
dc9b280 to
f57901d
Compare
|
Hey @BenAkroyd — thanks for putting this together! We're running into CVE-2026-32700 downstream and this PR is exactly what we need to unblock the devise 5.x upgrade. A few suggestions that might help get this merged smoothly:
Happy to help test once this lands — we'll be one of the first consumers. Thanks again for tackling this! |
|
@BenAkroyd 2.6.0 was just released today, it unblocks Devise v5. |
2 participants
Summary
Updates and requires at least Devise to 5.0.3. Lesser versions have a security vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2026-32700
Notably, with this jump to Devise 5.0.3...
Secret key resolution changed: Devise now uses application.secret_key_base directly instead of searching through credentials/secrets. Existing tokens (recoverable, lockable, confirmable) could be invalidated if the effective key changes.
Also, some deprecations are removed:
sign_in(resource, :bypass)— use bypass_sign_in insteaddevise_error_messages!helper — use render "devise/shared/error_messages" partialsign_in(resource, scope: :admin)keyword arg instead of positionalDevise::TestHelpers— use Devise::Test::ControllerHelpersOf course, there is the vulnerability fix as well.
Checklist
Check out our PR guidelines for more details.
The following are mandatory for all PRs:
The following are not always needed: