licensed 4.4.0 → 5.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0aa51288268aeff291057d44b430bd4e8b03a1d396eaa1073f2f5401a69a75d5
-  data.tar.gz: 340dcf2edab467791df510d35abcf8a48f14239d5edb7d1f09b5df9cf04b40df
+  metadata.gz: 418a3151f8331f3377eb4ff5b1a322733c006478c1bb84de7c023b2b1e567876
+  data.tar.gz: ffceca317c9924f12d732781aec5a9311bccac316ca9cf0b4e5e2a02b5b5967a
 SHA512:
-  metadata.gz: 23f1ac2d64039e0942ebd6e39dca3d8fd17d4143308cf0d5d03b9d7b7d6efda6ca7ea998af78caf8f00755631f63960d640c75deeb15fb1f76512895d1f5611a
-  data.tar.gz: a7f32b2517e130a2f645678b775c7a0a6b8ae4ce64514a9763fe0d3f174f8f4a28afb79d6c88b49b5e47a225d837ad2cff943142bcc0c00cec80b508827035fd
+  metadata.gz: d6a33da199f2e60fd5ed19c08ad830aab62b8c2c0016c40844af94ba7b002ba58a2aa87e05b7a771054f9e95b333ed7f9bab7934d0cee6bdf981482f0b1f4a82
+  data.tar.gz: 60da525db6d11b5df8aef42042ad11e0d796bae937e894510764ab8c3eb2dcea36501441382f97d2896f8f9d3fea162e788516038c07156b584c090a61ac9d4f

data/CHANGELOG.md

@@ -6,6 +6,23 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 5.0.0
+
+### Breaking change
+
+- Only supports Ruby 3.0+ due to nokogiri upgrade
+
+### Changed
+
+- Ensure homepage string is not too long in cabal.rb to avoid DOS attack
+- Update dependencies
+
+## 4.5.0
+
+### Changed
+
+- Bumped a number of dependencies for security fixes
+
 ## 4.4.0
 
 ### Added
@@ -132,7 +149,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 ### Fixed
 
 - Comparing dependency license contents now finds matching contents regardless of the order of the licenses (https://github.com/github/licensed/pull/516)
-- Fixed typo in a link in README.md (https://github.com/github/licensed/pull/514) 
+- Fixed typo in a link in README.md (https://github.com/github/licensed/pull/514)
 
 ### Changed
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    licensed (4.4.0)
+    licensed (5.0.0)
       json (~> 2.6)
       licensee (~> 9.16)
       parallel (~> 1.22)
@@ -14,24 +14,33 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.4.3)
+    activesupport (7.1.3.2)
+      base64
+      bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
+      connection_pool (>= 2.2.5)
+      drb
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
+      mutex_m
       tzinfo (~> 2.0)
     addressable (2.8.1)
       public_suffix (>= 2.0.2, < 6.0)
     ast (2.4.2)
+    base64 (0.2.0)
+    bigdecimal (3.1.7)
     byebug (11.1.3)
-    concurrent-ruby (1.2.2)
+    concurrent-ruby (1.2.3)
+    connection_pool (2.4.1)
     dotenv (2.8.1)
+    drb (2.2.1)
     faraday (2.7.4)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
     faraday-net_http (3.0.2)
-    i18n (1.12.0)
+    i18n (1.14.4)
       concurrent-ruby (~> 1.0)
-    json (2.6.3)
+    json (2.7.2)
     licensee (9.16.0)
       dotenv (~> 2.0)
       octokit (>= 4.20, < 7.0)
@@ -39,30 +48,32 @@ GEM
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
     mini_portile2 (2.8.1)
-    minitest (5.18.0)
-    minitest-hooks (1.5.0)
+    minitest (5.25.1)
+    minitest-hooks (1.5.2)
       minitest (> 5.3)
-    mocha (2.0.2)
+    mocha (2.4.5)
       ruby2_keywords (>= 0.0.5)
-    nokogiri (1.14.3)
+    mutex_m (0.2.0)
+    nokogiri (1.16.5)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
     octokit (6.1.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
-    parallel (1.23.0)
+    parallel (1.26.3)
     parser (3.2.0.0)
       ast (~> 2.4.1)
-    pathname-common_prefix (0.0.1)
+    pathname-common_prefix (0.0.2)
     public_suffix (5.0.1)
     racc (1.6.2)
-    rack (3.0.7)
+    rack (3.0.9.1)
     rainbow (3.1.1)
-    rake (13.0.6)
+    rake (13.2.1)
     regexp_parser (2.6.2)
     reverse_markdown (2.1.1)
       nokogiri
-    rexml (3.2.5)
+    rexml (3.3.6)
+      strscan
     rubocop (1.45.1)
       json (~> 2.3)
       parallel (~> 1.10)
@@ -93,7 +104,8 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
-    thor (1.2.2)
+    strscan (3.1.0)
+    thor (1.3.2)
     tomlrb (2.0.3)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)

data/README.md

@@ -8,7 +8,7 @@ Licensed is **not** a complete open source license compliance solution. Please u
 
 ![Build status](https://github.com/github/licensed/workflows/Test/badge.svg)
 
-Licensed is in active development and currently used at GitHub.  See the [open issues](https://github.com/github/licensed/issues) for a list of potential work.
+Licensed is currently in **low maintenance mode**. At this point, we're only looking to maintain this repository for security fixes.
 
 ## Licensed v4 - **Removed support for non-Ruby environments**
 
@@ -21,7 +21,7 @@ Licensed v3 includes a breaking change if both of the following are true:
 1. a project uses bundler to manage ruby dependencies
 2. a project uses the self-contained executable build of licensed
 
-All other usages of licensed should not encounter any major changes migrating from the latest 2.x build to 3.0.  
+All other usages of licensed should not encounter any major changes migrating from the latest 2.x build to 3.0.
 
 See [CHANGELOG.md](./CHANGELOG.md) for more details on what's changed.
 See the [v3 migration documentation](./docs/migrations/v3.md) for more info on migrating to v3.
@@ -94,7 +94,7 @@ To get started after checking out the repo, run
 
 You can also run `script/console` for an interactive prompt that will allow you to experiment.
 
-To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then create a release on GitHub.
 
 ### Adding a new source
 

data/docs/configuration/customizing_licensee.md

@@ -1,6 +1,6 @@
 # Customize Licensee's behavior
 
-Licensed uses [Licensee](https://github.com/licensee/licensee) to detect and evaluate OSS licenses for project dependencies found during source enumeration.  Licensed can optionally [customize Licensee's behavior](https://github.com/licensee/licensee/blob/jonabc-patch-1/docs/customizing.md#customizing-licensees-behavior) based on options set in the configuration file.
+Licensed uses [Licensee](https://github.com/licensee/licensee) to detect and evaluate OSS licenses for project dependencies found during source enumeration. Licensed can optionally [customize Licensee's behavior](https://github.com/licensee/licensee/blob/main/docs/customizing.md#customizing-licensees-behavior) based on options set in the configuration file.
 
 **NOTE** Matching licenses based on package manager metadata and README references is always enabled and cannot currently be configured.
 
@@ -8,6 +8,6 @@ Licensed uses [Licensee](https://github.com/licensee/licensee) to detect and eva
 licensee:
   # the confidence threshold is an integer between 1 and 100. the value represents
   # the minimum percentage confidence that Licensee must have to report a matched license
-  # https://github.com/licensee/licensee/blob/master/docs/customizing.md#adjusting-the-confidence-threshold
+  # https://github.com/licensee/licensee/blob/main/docs/customizing.md#adjusting-the-confidence-threshold
   confidence_threshold: 90 # default value: 98
 ```

data/docs/migrations/v3.md

@@ -14,11 +14,11 @@ When using licensed v3 with bundler dependencies, licensed must be installed fro
 
 Using licensed to enumerate bundler dependencies in a GitHub Actions workflow will require ruby to be available in the actions VM environment.  Ruby can be setup in an actions workflow using [ruby/setup-ruby](https://github.com/ruby/setup-ruby)(preferred) or [actions/setup-ruby](https://github.com/actions/setup-ruby)(deprecated).
 
-If you are using licensed in a GitHub Actions workflow, [jonabc/setup-licensed](https://github.com/jonabc/setup-licensed) has been updated according to this breaking change.  `setup-licensed` will install the licensed gem when ruby is available, or the licensed executable when ruby is not available.  Alternatively, you can `gem install` licensed directly as an actions step.
+If you are using licensed in a GitHub Actions workflow, [github/setup-licensed](https://github.com/github/setup-licensed) has been updated according to this breaking change.  `setup-licensed` will install the licensed gem when ruby is available, or the licensed executable when ruby is not available.  Alternatively, you can `gem install` licensed directly as an actions step.
 
-This is an example workflow definition that runs [jonabc/licensed-ci](https://github.com/jonabc/licensed-ci)'s opinionated license compliance workflow in CI.  It includes jobs that demonstrate installing licensed using 
+This is an example workflow definition that runs [github/licensed-ci](https://github.com/github/licensed-ci)'s opinionated license compliance workflow in CI.  It includes jobs that demonstrate installing licensed using 
 - `gem install`
-- [jonabc/setup-licensed](https://github.com/jonabc/setup-licensed)
+- [github/setup-licensed](https://github.com/github/setup-licensed)
 - installing when included in a bundler gem file
 
 ```yml
@@ -50,7 +50,7 @@ jobs:
           ruby-version: "3.0"
 
       # install licensed gem using setup-licensed
-      - uses: jonabc/setup-licensed@v1
+      - uses: github/setup-licensed@v1
         with:
           version: '3.x'
 
@@ -58,7 +58,7 @@ jobs:
       - run: bundle install
 
       # run licensed-ci to cache any metadata changes and verify compliance
-      - uses: jonabc/licensed-ci@v1
+      - uses: github/licensed-ci@v1
 
   # OR 
   
@@ -82,7 +82,7 @@ jobs:
       - run: bundle install
 
       # run licensed-ci to cache any metadata changes and verify compliance
-      - uses: jonabc/licensed-ci@v1
+      - uses: github/licensed-ci@v1
 
   # OR
 
@@ -103,7 +103,7 @@ jobs:
       - run: bundle install
 
       # run licensed-ci to cache any metadata changes and verify compliance
-      - uses: jonabc/licensed-ci@v1
+      - uses: github/licensed-ci@v1
         with:
           command: 'bundle exec licensed' # run licensed within the bundler context
 ```

data/docs/sources/cocoapods.md

@@ -2,7 +2,7 @@
 
 The cocoapods source will detect dependencies when `Podfile` and `Podfile.lock` are found at an app's `source_path`.  The cocoapods source uses the [cocoapods-dependencies-list](https://github.com/jonabc/cocoapods-dependencies-list) plugin to enumerate dependencies and gather metadata on each package.
 
-**NOTE:  Licensed does not install the [cocoapods-dependencies-list](https://github.com/jonanc/cocoapods-dependencies-list) plugin.  Users must install the gem alongside the cocoapods gem to enumerate cocoapods dependencies.**
+**NOTE:  Licensed does not install the [cocoapods-dependencies-list](https://github.com/jonabc/cocoapods-dependencies-list) plugin.  Users must install the gem alongside the cocoapods gem to enumerate cocoapods dependencies.**
 
 ## Evaluating dependencies from a specific target
 

data/lib/licensed/sources/cabal.rb

@@ -71,6 +71,12 @@ module Licensed
       # Returns a homepage url that enforces https and removes url fragments
       def safe_homepage(homepage)
         return unless homepage
+        # Ensure there's no denial of service issue with a long homepage
+        # 1000 characters is likely enough for any real project homepage
+        # See https://github.com/github/licensed/security/code-scanning/1
+        if homepage.length > 1000
+          raise ArgumentError, "Input too long"
+        end
         # use https and remove url fragment
         homepage.gsub(/http:/, "https:")
                 .gsub(/#[^?]*\z/, "")

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "4.4.0".freeze
+  VERSION = "5.0.0".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -21,7 +21,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.7.0"
+  spec.required_ruby_version = ">= 3.0.0"
 
   spec.add_dependency "licensee", "~> 9.16"
   spec.add_dependency "thor", "~> 1.2"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 4.4.0
+  version: 5.0.0
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-05-26 00:00:00.000000000 Z
+date: 2024-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -335,7 +335,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.7.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="