Release OpenProject 13.3.0

.github/workflows/codeql-scan-core.yml

@@ -33,6 +33,7 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
         with:
+          config-file: ./.github/codeql/config.yml
           languages: ${{ matrix.language }}
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
           queries: security-extended,security-and-quality

.ruby-version

@@ -1 +1 @@
-3.2.2
+3.2.3

CONTRIBUTING.md

@@ -4,7 +4,7 @@ We are pleased that you are thinking about contributing to OpenProject! This gui
 
 ## Get in touch
 
-Please get in touch with us using our [develompment forum](https://community.openproject.com/projects/openproject/boards/7) or send us an email to [email protected].
+Please get in touch with us using our [develompment forum](https://community.openproject.org/projects/openproject/boards/7) or send us an email to [email protected].
 
 ## Issue tracking and coordination
 
@@ -63,7 +63,7 @@ git push origin <your feature branch>
 
 If your pull request **does not contain a description** for what it does and what it's intentions are,
 we will reject it.
-If you are working on a specific work package from the [list](https://community.openproject.com/projects/openproject/work_packages),
+If you are working on a specific work package from the [list](https://community.openproject.org/projects/openproject/work_packages),
 you may include a link to that work package in the description, so we can track your work.
 
 The core contributor team will then review your pull request according to our [code review guideline](https://www.openproject.org/open-source/development-free-project-management-software/code-review-guideliness/).

Gemfile

@@ -39,7 +39,7 @@ gem 'activemodel-serializers-xml', '~> 1.0.1'
 gem 'activerecord-import', '~> 1.5.0'
 gem 'activerecord-session_store', '~> 2.1.0'
 gem 'ox'
-gem 'rails', '~> 7.0', '>= 7.0.3.1'
+gem 'rails', '~> 7.1.3'
 gem 'responders', '~> 3.0'
 
 gem 'ffi', '~> 1.15'
@@ -71,7 +71,7 @@ gem 'typed_dag', '~> 2.0.2', require: false
 gem 'addressable', '~> 2.8.0'
 
 # Remove whitespace from model input
-gem "auto_strip_attributes", "~> 2.5"
+gem 'auto_strip_attributes', '~> 2.5'
 
 # Provide timezone info for TZInfo used by AR
 gem 'tzinfo-data', '~> 1.2023.1'
@@ -156,14 +156,14 @@ gem 'structured_warnings', '~> 0.4.0'
 # don't require by default, instead load on-demand when actually configured
 gem 'airbrake', '~> 13.0.0', require: false
 
-gem 'md_to_pdf', git: 'https://github.com/opf/md-to-pdf', ref: 'bbda8ad0054d465eec01c23fcab5c6d62c7baa44'
+gem 'md_to_pdf', git: 'https://github.com/opf/md-to-pdf', ref: '04d22bfa73fbeb549fb1f215a6b9a81cfe820814'
 gem 'prawn', '~> 2.4'
 # prawn implicitly depends on matrix gem no longer in ruby core with 3.1
 gem 'matrix', '~> 0.4.2'
 
 gem 'meta-tags', '~> 2.20.0'
 
-gem "paper_trail", "~> 12.3"
+gem 'paper_trail', '~> 15.1.0'
 
 group :production do
   # we use dalli as standard memcache client
@@ -180,7 +180,7 @@ gem 'sprockets-rails', '~> 3.4.2'
 
 gem 'puma', '~> 6.4'
 gem 'puma-plugin-statsd', '~> 2.0'
-gem 'rack-timeout', '~> 0.6.3', require: "rack/timeout/base"
+gem 'rack-timeout', '~> 0.6.3', require: 'rack/timeout/base'
 
 gem 'nokogiri', '~> 1.16.0'
 
@@ -203,24 +203,24 @@ gem 'mini_magick', '~> 4.12.0', require: false
 gem 'validate_url'
 
 # Storages support code
-gem "dry-container"
+gem 'dry-container'
 
 # ActiveRecord extension which adds typecasting to store accessors
-gem "store_attribute", "~> 1.0"
+gem 'store_attribute', '~> 1.0'
 
 # Appsignal integration
-gem "appsignal", "~> 3.0", require: false
+gem 'appsignal', '~> 3.0', require: false
 
 gem 'view_component'
 # Lookbook
-gem 'lookbook', '~> 2.2.0'
+gem 'lookbook', github: 'ViewComponent/lookbook', ref: '473f86d7e343cd78b74cc293a4de06b9b5e7a3e2'
 
 # Require factory_bot for usage with openproject plugins testing
 gem 'factory_bot', '~> 6.4.0', require: false
 # require factory_bot_rails for convenience in core development
 gem 'factory_bot_rails', '~> 6.4.0', require: false
 
-gem 'turbo-rails', "~> 1.1"
+gem 'turbo-rails', '~> 1.1'
 
 gem 'httpx'
 
@@ -232,11 +232,11 @@ group :test do
   # Test prof provides factories from code
   # and other niceties
   gem 'test-prof', '~> 1.3.0'
-  gem 'turbo_tests', github: "crohr/turbo_tests", ref: "fix/runtime-info"
+  gem 'turbo_tests', github: 'crohr/turbo_tests', ref: 'fix/runtime-info'
 
   gem 'rack_session_access'
   gem 'rspec', '~> 3.12.0'
-  # also add to development group, so "spec" rake task gets loaded
+  # also add to development group, so 'spec' rake task gets loaded
   gem 'rspec-rails', '~> 6.1.0', group: :development
 
   # Retry failures within the same environment
@@ -258,12 +258,12 @@ group :test do
   # brings back testing for 'assigns' and 'assert_template' extracted in rails 5
   gem 'rails-controller-testing', '~> 1.0.2'
 
-  gem 'capybara', '~> 3.39.0'
+  gem 'capybara', '~> 3.40.0'
   gem 'capybara_accessible_selectors', git: 'https://github.com/citizensadvice/capybara_accessible_selectors', branch: 'main'
   gem 'capybara-screenshot', '~> 1.0.17'
   gem 'cuprite', '~> 0.15.0'
   gem 'selenium-devtools'
-  gem 'selenium-webdriver', '~> 4.16.0'
+  gem 'selenium-webdriver', '~> 4.17.0'
 
   gem 'fuubar', '~> 2.5.0'
   gem 'timecop', '~> 0.9.0'
@@ -285,7 +285,7 @@ group :test do
 end
 
 group :ldap do
-  gem 'net-ldap', '~> 0.18.0'
+  gem 'net-ldap', '~> 0.19.0'
 end
 
 group :development do
@@ -317,7 +317,8 @@ group :development, :test do
 
   gem 'pry-byebug', '~> 3.10.0', platforms: [:mri]
   gem 'pry-rails', '~> 0.3.6'
-  gem 'pry-rescue', '~> 1.5.2'
+  gem 'pry-rescue', '~> 1.6.0'
+  gem 'pry-doc'
 
   # ruby linting
   gem 'rubocop', require: false
@@ -327,8 +328,8 @@ group :development, :test do
   gem 'rubocop-rspec', require: false
 
   # erb linting
-  gem "erb_lint", require: false
-  gem "erblint-github", require: false
+  gem 'erb_lint', require: false
+  gem 'erblint-github', require: false
 
   # Brakeman scanner
   gem 'brakeman', '~> 6.1.0'
@@ -364,7 +365,7 @@ platforms :mri, :mingw, :x64_mingw do
 
   # Have application level locks on the database to have a mutex shared between workers/hosts.
   # We e.g. employ this to safeguard the creation of journals.
-  gem 'with_advisory_lock', '~> 5.0.0'
+  gem 'with_advisory_lock', '~> 5.1.0'
 end
 
 # Load Gemfile.modules explicitly to allow dependabot to work
@@ -379,6 +380,6 @@ gemfiles.each do |file|
   send(:eval_gemfile, file) if File.readable?(file)
 end
 
-gem "openproject-octicons", '~>19.8.0'
-gem "openproject-octicons_helper", '~>19.8.0'
-gem "openproject-primer_view_components", '~>0.20.0'
+gem 'openproject-octicons', '~>19.8.0'
+gem 'openproject-octicons_helper', '~>19.8.0'
+gem 'openproject-primer_view_components', '~>0.20.0'