Merge commit from fork

* Fix GHSA-7jvv-fhmg-wpfw

* Fix GHSA-hx34-2pfw-2qfj

* Fix GHSA-vwhj-3g83-v276

* Bump version to v4.6.4

app/controllers/api/v1/admin/measures_controller.rb

@@ -17,9 +17,9 @@ class Api::V1::Admin::MeasuresController < Api::BaseController
 
   def set_measures
     @measures = Admin::Metrics::Measure.retrieve(
-      params[:keys],
-      params[:start_at],
-      params[:end_at],
+      params.require(:keys),
+      params.require(:start_at),
+      params.require(:end_at),
       params
     )
   end

app/controllers/api/v1/admin/retention_controller.rb

@@ -4,22 +4,22 @@ class Api::V1::Admin::RetentionController < Api::BaseController
   include Authorization
 
   before_action -> { authorize_if_got_token! :'admin:read' }
-  before_action :set_cohorts
+  before_action :set_retention
 
   after_action :verify_authorized
 
   def create
     authorize :dashboard, :index?
-    render json: @cohorts, each_serializer: REST::Admin::CohortSerializer
+    render json: @retention.cohorts, each_serializer: REST::Admin::CohortSerializer
   end
 
   private
 
-  def set_cohorts
-    @cohorts = Admin::Metrics::Retention.new(
-      params[:start_at],
-      params[:end_at],
+  def set_retention
+    @retention = Admin::Metrics::Retention.new(
+      params.require(:start_at),
+      params.require(:end_at),
       params[:frequency]
-    ).cohorts
+    )
   end
 end