bundler-audit 0.9.2 → 0.9.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/ruby.yml +14 -0
  3. data/.rubocop.yml +4 -1
  4. data/ChangeLog.md +11 -0
  5. data/Gemfile +1 -1
  6. data/README.md +86 -82
  7. data/bundler-audit.gemspec +1 -0
  8. data/gemspec.yml +4 -4
  9. data/lib/bundler/audit/cli.rb +4 -4
  10. data/lib/bundler/audit/database.rb +1 -1
  11. data/lib/bundler/audit/version.rb +1 -1
  12. data/spec/integration_spec.rb +16 -2
  13. metadata +7 -12
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 91fab22bb836ac9e1b56f525051f80003c4c0515a8d01e779b9ba71f079ba05d
4
- data.tar.gz: f312f73a62453f2002d58465002ab7bb8396f53ba5d51ca363e84b422f0216a1
3
+ metadata.gz: 2e40ebbca24535f65142ee863e6a2acb44802481243959ea75dbaa1f7ab5e33c
4
+ data.tar.gz: 41d763068c36318312395dfacfd626b95928939d4358a682984aab3fc26287dd
5
5
  SHA512:
6
- metadata.gz: 2067a4b037050d7f928e805335ea6cf053a83978888477af56d3e44199409bbf9923f46dec0963bf40906c6e8afeec39aba32722daecdfe8576410d1431733a7
7
- data.tar.gz: 88c4b7e6c8a5d390743706dafb90ce3431df698bca07348185f0ebf0d28c3842b922d52936e743911bd56d9c4db373cdf19e309f955a44e0d1c7d7b388c7eb31
6
+ metadata.gz: 00cee5ad01c98a6933e65b2823ff09ca89b7a2b69a01b0192468c871469121b95df622faa871ac1b62764838f9c263a86eb8180b2f47eab0a94f2823231ba965
7
+ data.tar.gz: 646566832c37e1a4b65502832bae8452b2c061b24f9caefae55f74b326d2f3f13ac88c742fffcb824d65a48f73f9e667634b86c94fc2c063e30b45225f397630
data/.github/workflows/ruby.yml CHANGED
@@ -13,8 +13,16 @@ jobs:
13
13
  - '3.1'
14
14
  - '3.2'
15
15
  - '3.3'
16
+ - '3.4'
17
+ - '3.5'
18
+ - '4.0'
16
19
  - jruby
17
20
  - truffleruby
21
+ include:
22
+ - ruby: '3.0'
23
+ rubygems_version: '3.5.23'
24
+ - ruby: '3.1'
25
+ rubygems_version: '3.6.9'
18
26
  name: Ruby ${{ matrix.ruby }}
19
27
  steps:
20
28
  - uses: actions/checkout@v2
@@ -22,6 +30,12 @@ jobs:
22
30
  uses: ruby/setup-ruby@v1
23
31
  with:
24
32
  ruby-version: ${{ matrix.ruby }}
33
+ - name: Update RubyGems
34
+ env:
35
+ RUBYGEMS_VERSION: ${{ matrix.rubygems_version }}
36
+ run: |
37
+ gem update --system ${RUBYGEMS_VERSION:-}
38
+ gem -v
25
39
  - name: Install dependencies
26
40
  run: bundle install --jobs 4 --retry 3
27
41
  - name: Run tests
data/.rubocop.yml CHANGED
@@ -1,5 +1,5 @@
1
1
  AllCops:
2
- NewCops: enable
2
+ NewCops: disable
3
3
  SuggestExtensions: false
4
4
  TargetRubyVersion: 2.7
5
5
  Exclude:
@@ -65,6 +65,9 @@ Style/WordArray: { Enabled: false } # Offense count: 1
65
65
  Style/Lambda: { Enabled: false } # Offense count: 2
66
66
  Style/SafeNavigation: { Enabled: false } # Offense count: 2
67
67
  Lint/IneffectiveAccessModifier: { Enabled: false } # Offense count: 1
68
+ Gemspec/RequireMFA:
69
+ Exclude:
70
+ - 'bundler-audit.gemspec'
68
71
  Gemspec/DuplicatedAssignment:
69
72
  Exclude:
70
73
  - 'bundler-audit.gemspec'
data/ChangeLog.md CHANGED
@@ -1,3 +1,14 @@
1
+ ### 0.9.3 / 2025-11-28
2
+
3
+ * Officially support Ruby 3.4, 3.5, and 4.0.
4
+ * Added support for Bundler 4.x.
5
+ * Fixed typos in API documentation.
6
+
7
+ #### CLI
8
+
9
+ * Ensure that the `bundler-audit check` command honors the
10
+ `BUNDLER_AUDIT_DB` environment variable.
11
+
1
12
  ### 0.9.2 / 2024-08-22
2
13
 
3
14
  * Officially support Ruby 3.2 and 3.3.
data/Gemfile CHANGED
@@ -4,7 +4,7 @@ gemspec
4
4
 
5
5
  group :development do
6
6
  gem 'rake'
7
- gem 'rubygems-tasks', '~> 0.2'
7
+ gem 'rubygems-tasks', '~> 0.3'
8
8
 
9
9
  gem 'rubocop', '~> 1.18'
10
10
 
data/README.md CHANGED
@@ -24,90 +24,94 @@ Patch-level verification for [bundler].
24
24
 
25
25
  Audit a project's `Gemfile.lock`:
26
26
 
27
- $ bundle-audit
28
- Name: actionpack
29
- Version: 3.2.10
30
- Advisory: OSVDB-91452
31
- Criticality: Medium
32
- URL: http://www.osvdb.org/show/osvdb/91452
33
- Title: XSS vulnerability in sanitize_css in Action Pack
34
- Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
35
-
36
- Name: actionpack
37
- Version: 3.2.10
38
- Advisory: OSVDB-91454
39
- Criticality: Medium
40
- URL: http://osvdb.org/show/osvdb/91454
41
- Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
42
- Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
43
-
44
- Name: actionpack
45
- Version: 3.2.10
46
- Advisory: OSVDB-89026
47
- Criticality: High
48
- URL: http://osvdb.org/show/osvdb/89026
49
- Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
50
- Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
51
-
52
- Name: activerecord
53
- Version: 3.2.10
54
- Advisory: OSVDB-91453
55
- Criticality: High
56
- URL: http://osvdb.org/show/osvdb/91453
57
- Title: Symbol DoS vulnerability in Active Record
58
- Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
59
-
60
- Name: activerecord
61
- Version: 3.2.10
62
- Advisory: OSVDB-90072
63
- Criticality: Medium
64
- URL: http://direct.osvdb.org/show/osvdb/90072
65
- Title: Ruby on Rails Active Record attr_protected Method Bypass
66
- Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
67
-
68
- Name: activerecord
69
- Version: 3.2.10
70
- Advisory: OSVDB-89025
71
- Criticality: High
72
- URL: http://osvdb.org/show/osvdb/89025
73
- Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
74
- Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
75
-
76
- Name: activesupport
77
- Version: 3.2.10
78
- Advisory: OSVDB-91451
79
- Criticality: High
80
- URL: http://www.osvdb.org/show/osvdb/91451
81
- Title: XML Parsing Vulnerability affecting JRuby users
82
- Solution: update to ~> 3.1.12, >= 3.2.13
83
-
84
- Unpatched versions found!
27
+ ```
28
+ $ bundle-audit
29
+ Name: actionpack
30
+ Version: 3.2.10
31
+ Advisory: OSVDB-91452
32
+ Criticality: Medium
33
+ URL: http://www.osvdb.org/show/osvdb/91452
34
+ Title: XSS vulnerability in sanitize_css in Action Pack
35
+ Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
36
+
37
+ Name: actionpack
38
+ Version: 3.2.10
39
+ Advisory: OSVDB-91454
40
+ Criticality: Medium
41
+ URL: http://osvdb.org/show/osvdb/91454
42
+ Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
43
+ Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
44
+
45
+ Name: actionpack
46
+ Version: 3.2.10
47
+ Advisory: OSVDB-89026
48
+ Criticality: High
49
+ URL: http://osvdb.org/show/osvdb/89026
50
+ Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
51
+ Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
52
+
53
+ Name: activerecord
54
+ Version: 3.2.10
55
+ Advisory: OSVDB-91453
56
+ Criticality: High
57
+ URL: http://osvdb.org/show/osvdb/91453
58
+ Title: Symbol DoS vulnerability in Active Record
59
+ Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
60
+
61
+ Name: activerecord
62
+ Version: 3.2.10
63
+ Advisory: OSVDB-90072
64
+ Criticality: Medium
65
+ URL: http://direct.osvdb.org/show/osvdb/90072
66
+ Title: Ruby on Rails Active Record attr_protected Method Bypass
67
+ Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
68
+
69
+ Name: activerecord
70
+ Version: 3.2.10
71
+ Advisory: OSVDB-89025
72
+ Criticality: High
73
+ URL: http://osvdb.org/show/osvdb/89025
74
+ Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
75
+ Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
76
+
77
+ Name: activesupport
78
+ Version: 3.2.10
79
+ Advisory: OSVDB-91451
80
+ Criticality: High
81
+ URL: http://www.osvdb.org/show/osvdb/91451
82
+ Title: XML Parsing Vulnerability affecting JRuby users
83
+ Solution: update to ~> 3.1.12, >= 3.2.13
84
+
85
+ Unpatched versions found!
86
+ ```
85
87
 
86
88
  Update the [ruby-advisory-db] that `bundle audit` uses:
87
89
 
88
- $ bundle-audit update
89
- Updating ruby-advisory-db ...
90
- remote: Counting objects: 44, done.
91
- remote: Compressing objects: 100% (24/24), done.
92
- remote: Total 39 (delta 19), reused 29 (delta 10)
93
- Unpacking objects: 100% (39/39), done.
94
- From https://github.com/rubysec/ruby-advisory-db
95
- * branch master -> FETCH_HEAD
96
- Updating 5f8225e..328ca86
97
- Fast-forward
98
- CONTRIBUTORS.md | 1 +
99
- gems/actionmailer/OSVDB-98629.yml | 17 +++++++++++++++++
100
- gems/cocaine/OSVDB-98835.yml | 15 +++++++++++++++
101
- gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
102
- gems/sounder/OSVDB-96278.yml | 13 +++++++++++++
103
- gems/wicked/OSVDB-98270.yml | 14 ++++++++++++++
104
- 6 files changed, 73 insertions(+)
105
- create mode 100644 gems/actionmailer/OSVDB-98629.yml
106
- create mode 100644 gems/cocaine/OSVDB-98835.yml
107
- create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
108
- create mode 100644 gems/sounder/OSVDB-96278.yml
109
- create mode 100644 gems/wicked/OSVDB-98270.yml
110
- ruby-advisory-db: 64 advisories
90
+ ```
91
+ $ bundle-audit update
92
+ Updating ruby-advisory-db ...
93
+ remote: Counting objects: 44, done.
94
+ remote: Compressing objects: 100% (24/24), done.
95
+ remote: Total 39 (delta 19), reused 29 (delta 10)
96
+ Unpacking objects: 100% (39/39), done.
97
+ From https://github.com/rubysec/ruby-advisory-db
98
+ * branch master -> FETCH_HEAD
99
+ Updating 5f8225e..328ca86
100
+ Fast-forward
101
+ CONTRIBUTORS.md | 1 +
102
+ gems/actionmailer/OSVDB-98629.yml | 17 +++++++++++++++++
103
+ gems/cocaine/OSVDB-98835.yml | 15 +++++++++++++++
104
+ gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
105
+ gems/sounder/OSVDB-96278.yml | 13 +++++++++++++
106
+ gems/wicked/OSVDB-98270.yml | 14 ++++++++++++++
107
+ 6 files changed, 73 insertions(+)
108
+ create mode 100644 gems/actionmailer/OSVDB-98629.yml
109
+ create mode 100644 gems/cocaine/OSVDB-98835.yml
110
+ create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
111
+ create mode 100644 gems/sounder/OSVDB-96278.yml
112
+ create mode 100644 gems/wicked/OSVDB-98270.yml
113
+ ruby-advisory-db: 64 advisories
114
+ ```
111
115
 
112
116
  Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs):
113
117
 
@@ -159,7 +163,7 @@ Bundler::Audit::Task.new
159
163
 
160
164
  The following `rake` tasks will then become available:
161
165
 
162
- ```bash
166
+ ```
163
167
  $ rake -T
164
168
  rake bundle:audit
165
169
  rake bundle:audit:update
data/bundler-audit.gemspec CHANGED
@@ -18,6 +18,7 @@ Gem::Specification.new do |gem|
18
18
  gem.authors = Array(gemspec['authors'])
19
19
  gem.email = gemspec['email']
20
20
  gem.homepage = gemspec['homepage']
21
+ gem.metadata = gemspec['metadata'] if gemspec['metadata']
21
22
 
22
23
  glob = lambda { |patterns| gem.files & Dir[*patterns] }
23
24
 
data/gemspec.yml CHANGED
@@ -8,9 +8,9 @@ homepage: https://github.com/rubysec/bundler-audit#readme
8
8
 
9
9
  metadata:
10
10
  documentation_uri: https://rubydoc.info/gems/bundler-audit
11
- source_code_uri: https://github.com/rubysec/bundler-audit.rb
12
- bug_tracker_uri: https://github.com/rubysec/bundler-audit.rb/issues
13
- changelog_uri: https://github.com/rubysec/bundler-audit.rb/blob/master/ChangeLog.md
11
+ source_code_uri: https://github.com/rubysec/bundler-audit
12
+ bug_tracker_uri: https://github.com/rubysec/bundler-audit/issues
13
+ changelog_uri: https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md
14
14
  rubygems_mfa_required: 'true'
15
15
 
16
16
  required_ruby_version: ">= 2.0.0"
@@ -18,4 +18,4 @@ required_rubygems_version: ">= 1.8.0"
18
18
 
19
19
  dependencies:
20
20
  thor: "~> 1.0"
21
- bundler: ">= 1.2.0, < 3"
21
+ bundler: ">= 1.2.0"
data/lib/bundler/audit/cli.rb CHANGED
@@ -39,7 +39,7 @@ module Bundler
39
39
  method_option :ignore, type: :array, aliases: '-i'
40
40
  method_option :update, type: :boolean, aliases: '-u'
41
41
  method_option :database, type: :string, aliases: '-D',
42
- default: Database::USER_PATH
42
+ default: Database::DEFAULT_PATH
43
43
  method_option :format, type: :string, default: 'text', aliases: '-F'
44
44
  method_option :config, type: :string, aliases: '-c', default: '.bundler-audit.yml'
45
45
  method_option :gemfile_lock, type: :string, aliases: '-G',
@@ -91,7 +91,7 @@ module Bundler
91
91
  desc 'stats', 'Prints ruby-advisory-db stats'
92
92
  method_option :quiet, type: :boolean, aliases: '-q'
93
93
 
94
- def stats(path=Database.path)
94
+ def stats(path=Database::DEFAULT_PATH)
95
95
  database = Database.new(path)
96
96
 
97
97
  puts "ruby-advisory-db:"
@@ -106,7 +106,7 @@ module Bundler
106
106
  desc 'download', 'Downloads ruby-advisory-db'
107
107
  method_option :quiet, type: :boolean, aliases: '-q'
108
108
 
109
- def download(path=Database.path)
109
+ def download(path=Database::DEFAULT_PATH)
110
110
  if Database.exists?(path)
111
111
  say "Database already exists", :yellow
112
112
  return
@@ -127,7 +127,7 @@ module Bundler
127
127
  desc 'update', 'Updates the ruby-advisory-db'
128
128
  method_option :quiet, type: :boolean, aliases: '-q'
129
129
 
130
- def update(path=Database.path)
130
+ def update(path=Database::DEFAULT_PATH)
131
131
  unless Database.exists?(path)
132
132
  download(path)
133
133
  return
data/lib/bundler/audit/database.rb CHANGED
@@ -103,7 +103,7 @@ module Bundler
103
103
  # @option options [Boolean] :quiet
104
104
  # Specify whether `git` should be `--quiet`.
105
105
  #
106
- # @return [Dataase]
106
+ # @return [Database]
107
107
  # The newly downloaded database.
108
108
  #
109
109
  # @raise [DownloadFailed]
data/lib/bundler/audit/version.rb CHANGED
@@ -18,6 +18,6 @@
18
18
  module Bundler
19
19
  module Audit
20
20
  # bundler-audit version
21
- VERSION = '0.9.2'
21
+ VERSION = '0.9.3'
22
22
  end
23
23
  end
data/spec/integration_spec.rb CHANGED
@@ -11,7 +11,14 @@ describe "bin/bundler-audit" do
11
11
  subject { sh(command) }
12
12
 
13
13
  it "must invoke the CLI class" do
14
- expect(subject).to eq("bundler-audit #{Bundler::Audit::VERSION}#{$/}")
14
+ expected = "bundler-audit #{Bundler::Audit::VERSION}#{$/}"
15
+
16
+ if RUBY_VERSION.start_with?("3.0") || RUBY_ENGINE == "truffleruby"
17
+ # Allow `WARN: Unresolved or ambiguous specs during Gem::Specification.reset:` for Ruby 3.0.x and TruffleRuby
18
+ expect(subject).to include(expected)
19
+ else
20
+ expect(subject).to eq(expected)
21
+ end
15
22
  end
16
23
  end
17
24
 
@@ -26,6 +33,13 @@ describe "bin/bundle-audit" do
26
33
  subject { sh(command) }
27
34
 
28
35
  it "must invoke the CLI class" do
29
- expect(subject).to eq("bundler-audit #{Bundler::Audit::VERSION}#{$/}")
36
+ expected = "bundler-audit #{Bundler::Audit::VERSION}#{$/}"
37
+
38
+ if RUBY_VERSION.start_with?("3.0") || RUBY_ENGINE == "truffleruby"
39
+ # Allow `WARN: Unresolved or ambiguous specs during Gem::Specification.reset:` for Ruby 3.0.x and TruffleRuby
40
+ expect(subject).to include(expected)
41
+ else
42
+ expect(subject).to eq(expected)
43
+ end
30
44
  end
31
45
  end
metadata CHANGED
@@ -1,14 +1,13 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: bundler-audit
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.9.2
4
+ version: 0.9.3
5
5
  platform: ruby
6
6
  authors:
7
7
  - Postmodern
8
- autorequire:
9
8
  bindir: bin
10
9
  cert_chain: []
11
- date: 2024-08-22 00:00:00.000000000 Z
10
+ date: 1980-01-02 00:00:00.000000000 Z
12
11
  dependencies:
13
12
  - !ruby/object:Gem::Dependency
14
13
  name: thor
@@ -31,9 +30,6 @@ dependencies:
31
30
  - - ">="
32
31
  - !ruby/object:Gem::Version
33
32
  version: 1.2.0
34
- - - "<"
35
- - !ruby/object:Gem::Version
36
- version: '3'
37
33
  type: :runtime
38
34
  prerelease: false
39
35
  version_requirements: !ruby/object:Gem::Requirement
@@ -41,9 +37,6 @@ dependencies:
41
37
  - - ">="
42
38
  - !ruby/object:Gem::Version
43
39
  version: 1.2.0
44
- - - "<"
45
- - !ruby/object:Gem::Version
46
- version: '3'
47
40
  description: bundler-audit provides patch-level verification for Bundled apps.
48
41
  email: postmodern.mod3@gmail.com
49
42
  executables:
@@ -129,8 +122,11 @@ homepage: https://github.com/rubysec/bundler-audit#readme
129
122
  licenses:
130
123
  - GPL-3.0-or-later
131
124
  metadata:
125
+ documentation_uri: https://rubydoc.info/gems/bundler-audit
126
+ source_code_uri: https://github.com/rubysec/bundler-audit
127
+ bug_tracker_uri: https://github.com/rubysec/bundler-audit/issues
128
+ changelog_uri: https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md
132
129
  rubygems_mfa_required: 'true'
133
- post_install_message:
134
130
  rdoc_options: []
135
131
  require_paths:
136
132
  - lib
@@ -145,8 +141,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
145
141
  - !ruby/object:Gem::Version
146
142
  version: 1.8.0
147
143
  requirements: []
148
- rubygems_version: 3.5.11
149
- signing_key:
144
+ rubygems_version: 3.6.9
150
145
  specification_version: 4
151
146
  summary: Patch-level verification for Bundler
152
147
  test_files: []