chelsea 0.0.29 → 0.0.30

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d0d6459a288c51263c75bc0d0d1c114dbbe957b4ea5ab8cd3cda28da1963085
-  data.tar.gz: f9fd826b3d99f646d4f15f163bb4c532219889a6c753a61fa6d78398f36d57e7
+  metadata.gz: cb0f0b89a80068b3f42f99ba3906694c6a580b03ea8dbbb6462ea551d0b90e5e
+  data.tar.gz: e44fcf3b82fea2effa72228b489835e2a84d79a1debd2643bf67d9979aaeea84
 SHA512:
-  metadata.gz: bc23b614556a27acbbef2cd46da6433418b3db05e31ca23f8a0c7324c9a0bc5ba8c42983a53e04eb177a9ee4134b13fe9707c187e6894364462cdd52ded65339
-  data.tar.gz: 4adfafe26cc352759066b6b1dc8b758118dbcdf6cd5e8b555ea67a9ab23b5b40c8a2c7864dd03f1077ad8356e8442d9e2a3d4e0b9da4175fdc4bc3313dff3428
+  metadata.gz: f797161ad92d67d3ff1971e5d7d5ab3717d0c8e8defb28a0fafe5d2ad498a122edf8a1796ab34f17c6984fc6c111988f4717de48daf1f57f3de3f78767c2bb51
+  data.tar.gz: ed7184252d47b4346ee578b3708ec49a9ba7e26e13e871f590ef37df21a08ccdfde31f470a65aad877422d898d333e5baf889bd03c42b96f309bc56d630c50b6

data/README.md

@@ -287,6 +287,12 @@ Perhaps a more palatable approach would be to upgrade to a newer version of the
 the direct dependency (`rubocop`) to a version that does not depend on a vulnerable version of the transitive dependency
 (`rexml`). This approach will make fewer changes overall.
 
+In some cases, no such upgrade of the direct dependency exists that avoids a dependence on the vulnerable component. 
+In such a case, the next step is to file an issue with the direct dependency project for them to update the vulnerable
+sub-dependencies. Be sure to read and follow any vulnerability reporting instructions published by the project: Look for
+a `SECURITY.md` file, or other instructions on how to report vulnerabilities. Some projects may prefer you not report 
+the vulnerability publicly.
+
 In our example, there is a newer version of the direct dependency available:
 ```shell
   $ bundle outdated | grep rubocop

data/lib/chelsea/version.rb

@@ -17,5 +17,5 @@
 #
 
 module Chelsea
-  VERSION = '0.0.29'
+  VERSION = '0.0.30'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chelsea
 version: !ruby/object:Gem::Version
-  version: 0.0.29
+  version: 0.0.30
 platform: ruby
 authors:
 - Allister Beharry
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-13 00:00:00.000000000 Z
+date: 2021-04-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler