jefferies_tube 1.6.7 → 1.6.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9e80582fe28bd3365637fbe6a724aea315c7179ee53dafe949b885a45d96844
-  data.tar.gz: 28d47c45e7f3f7c14b8fba4d6e4b0060055fee85629f698b2244983f4523d784
+  metadata.gz: 7b9466c608ebb3036068f91caaacc927e157b03e45dfa83b201f2822683d7d60
+  data.tar.gz: cfef6348b6e2e237312dc8cc3328750832dd57f0cd640dbdb8863ef58a70da32
 SHA512:
-  metadata.gz: c9c137056b8440aad2e4740e4fc3ecac821a108b35592ee540d2460e4ee6e30a995be707e15debf640146c647b1032a369ad3682158a6908c2002cae433ab81e
-  data.tar.gz: b1a468401e87daed3bbc92a7b5facf88da4c1095462376286552309d09e2d5741b59858f4124e1a90e120b60173b02ea54e27f6856c9311cd4fa44240f20e83e
+  metadata.gz: 4cbe0c0a98edf3a57ddd60e74425415fad6f1d59e5cbead19fc5306f5bbb7668bd40cc47f9099a499b3ea28fe1a2eba5172a8acb335ba518621ac051f0e17702
+  data.tar.gz: 6bea0c1b6494d95568c9188dfc00cabd40afc4b2e2d876df545240333c825d55b0ea75a1c6a299ba67be97abffcaf521ebdc01c55e755a43c01c4d1a8d5d46c1

data/CHANGELOG.md

@@ -6,6 +6,9 @@ This project attempts to follow [semantic versioning](https://semver.org/)
 
 ## Unreleased
 
+## 1.6.8
+  * Add support for ignoring CVEs in .bundler-audit.yml, remove support for setting ignored CVEs in deploy.rb via `:bundler_audit_ignore`
+
 ## 1.6.7
   * Add Lint/Syntax to rubocop rules
 

data/README.md

@@ -111,9 +111,12 @@ before 'deploy', 'deploy:create_tag'
 
 By default jefferies_tube will raise an error and stop if it detects any vulnerabilities is your installed gems. If you need to deploy anyway even with vulnerabilities you can do `I_KNOW_GEMS_ARE_INSECURE=true cap <environment> deploy`.
 
-To ignore specific CVE's when running bundler-audit, inside `config/deploy.rb`:
-```ruby
-set :bundler_audit_ignore, ["CVE-1234-5678"]
+To ignore specific CVE's when running bundler-audit, add a .bundler-audit.yml file to your projets root directory, and ignore vulnerabilities like so:
+
+```yml
+---
+ignore:
+  - CVE-2024-6484
 ```
 
 ### Enable/Disable Maintence Mode

data/lib/jefferies_tube/capistrano/deploy.rb

@@ -30,8 +30,8 @@ namespace :deploy do
     Bundler::Audit::Database.update!
     scanner = Bundler::Audit::Scanner.new
     vulnerable = false
-    ignore = fetch(:bundler_audit_ignore, [])
-    scanner.scan(ignore: ignore) do |result|
+
+    scanner.scan do |result|
       vulnerable = true
       case result
       when Bundler::Audit::Results::InsecureSource
@@ -51,4 +51,4 @@ namespace :deploy do
 end
 
 before 'deploy:migrate', 'deploy:backup_database'
-before 'deploy', 'deploy:scan_gems'
+before 'deploy', 'deploy:scan_gems'

data/lib/jefferies_tube/version.rb

@@ -1,7 +1,7 @@
 require 'open-uri'
 
 module JefferiesTube
-  VERSION = "1.6.7"
+  VERSION = "1.6.8"
 
   def self.latest_rubygems_version
     JSON.parse(URI.parse("https://rubygems.org/api/v1/versions/jefferies_tube/latest.json").read)["version"]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jefferies_tube
 version: !ruby/object:Gem::Version
-  version: 1.6.7
+  version: 1.6.8
 platform: ruby
 authors:
 - Brian Samson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-10-24 00:00:00.000000000 Z
+date: 2024-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: awesome_print
@@ -225,7 +225,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.5.18
 signing_key:
 specification_version: 4
 summary: Ten Forward Consulting useful tools.