bundler-trivy 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c2c0345563cd0c330d38a21ba84b90a78f7dfb642b4ab94c44e928215023366
-  data.tar.gz: 07b572003bdb6fd18bd6258ce184fefb7dbaf6c189bbce806bbecfd4c4b1d34f
+  metadata.gz: 3079187f7de00f3634dd3f042607d9c4b2f505d96239eec97c5633478b4c3e80
+  data.tar.gz: 1ca3ac43876af2b7eff2b5a0bd10ae0f2af13ee1eaf754d90bfd7f93a4b6e131
 SHA512:
-  metadata.gz: 386e1cc55d8bb433a4220156cc0f58ff16f0fb439ced97324aa54ccbeb74cfb6e0d780b72050e0d209413f0a2c824acdb74c97cd6a5f72f22e938dca824b29ac
-  data.tar.gz: e45a4e4f15ad71bf15da2920c53e8ee29488a2dbd7abad9e30e84ef7bf68f1ab410d5736bf890e176024dd41a89ccd849ac5a2f177587c8f0ba17ece11f7da01
+  metadata.gz: 3f8298ad2fe95f9b1b72c824b93f59bcea9ffc398f3e681c1591cfdde8475850a71632e599eabcb155dcd7cc3903c52afa31395da5889284c76ffa627f911902
+  data.tar.gz: c374956836874f08ed84bab869e2b625155cd0b413f77e9907c05b7631e69729b5162a82fdff3dc7c2daedb5f4d6c80aab53531e906da56652a790e7ae3f205c

data/lib/bundler/trivy/config.rb

@@ -274,12 +274,12 @@ module Bundler
 
         return {} unless File.exist?(config_path)
 
-        config = YAML.load_file(config_path) || {}
+        config = YAML.safe_load_file(config_path, permitted_classes: [Date]) || {}
 
         # Load global config and merge
         global_config_path = File.expand_path("~/.bundle/trivy.yml")
         if File.exist?(global_config_path)
-          global = YAML.load_file(global_config_path) || {}
+          global = YAML.safe_load_file(global_config_path, permitted_classes: [Date]) || {}
           config = deep_merge(global, config)
         end
 

data/lib/bundler/trivy/scanner.rb

@@ -67,11 +67,10 @@ module Bundler
         args = build_trivy_args
         timeout = @config.trivy_timeout
 
-        # Execute Trivy with Open3 for robust command execution
-        stdout, stderr, status = Open3.capture3(
-          *args,
-          timeout: timeout
-        )
+        # Execute Trivy with timeout for robust command execution
+        stdout, stderr, status = Timeout.timeout(timeout) do
+          Open3.capture3(*args)
+        end
 
         # Handle Trivy exit codes:
         # 0 = success, no vulnerabilities

data/lib/bundler/trivy/version.rb

@@ -3,6 +3,6 @@
 module Bundler
   module Trivy
     # Version constant for bundler-trivy-plugin
-    VERSION = "0.1.1"
+    VERSION = "0.1.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler-trivy
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Durable Programming LLC