lockfile_audit 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6f02ad30c5d73027023967b15462cf39489383751cd89acb440fb0c6eb993e70
-  data.tar.gz: a4d6a9fbd40231af0c64935759faf225f5891bb93a617723cc540bd1adacd2c2
+  metadata.gz: 9a40680aa11ae2f41281b039b0aabe9d75a447e62df4a48cef08eda71fb39af3
+  data.tar.gz: a6fd341f09f84792cc3ecfb13dacfce27ba31142552f73452756ef5cac238eb4
 SHA512:
-  metadata.gz: 7c0fc2776fe8bc32ae760225ac8d76ed805dc8e839fb85fb27d60aae31894608a41b6f341eecdef0e396149a7bc4bd8da7cf136ea79a782e53e73b018c73bbb9
-  data.tar.gz: 6b62f3b0e60043aa76e4bc771adb14082df5f36f6a2afe34f621dbc299b7f1bdc59852666e855f0c1bf6548e1442cd3468b5065cbbc80a2558b6b5b96f2ca03b
+  metadata.gz: 29745b256e0a86f9817a06ab48476ea711bbc325f7f17476a08db4b64f8488608ee401f4d3b5e197beaa8d1b1f5540b925303f6c676109f126402010d57f2b99
+  data.tar.gz: 6569e296605666ec7424908121924f7580ec00906c44f83597edadc89e44defe2fe53be41220923c84f71856e7d541990feef6281838be9e47aa931de1de6db2

data/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-10-03
+
+### Changed
+
+- Source moved to the `betterwebsites/ror_gems` monorepo. Gemspec metadata
+  links updated. No code changes.
+## [0.1.1] - 2026-09-26
+
+### Fixed
+
+- `VulnerabilityCollector` now invokes `bundle-audit` using the same Ruby
+  as the host application (`RbConfig.ruby`) and resolves the exact binary
+  path via `Gem.bin_path`, instead of relying on `PATH`. This prevents
+  `Bundler::RubyVersionMismatch` errors when the app's Ruby differs from
+  the one on `PATH`.
+- Added a missing `raise_not_installed` helper so the collector raises a
+  clear `BundlerAuditNotInstalled` error (with stderr detail) instead of
+  a `NoMethodError`.
+
 ## [0.1.0] - 2026-09-26
 
 ### Added
@@ -26,5 +45,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `LockfileAudit::Errors` namespace with `LockfileNotFound`,
   `BundlerAuditNotInstalled`, and `InvalidAuditJson`.
 
-[Unreleased]: https://github.com/Behnam1369/lockfile_audit/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/Behnam1369/lockfile_audit/compare/v0.1.1...HEAD
+[0.1.1]: https://github.com/Behnam1369/lockfile_audit/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/Behnam1369/lockfile_audit/releases/tag/v0.1.0

data/README.md

@@ -116,16 +116,12 @@ All errors inherit from `LockfileAudit::Errors::Error`.
 
 ## Development
 
+    cd lockfile_audit
     bundle install
-    bundle exec rspec
-    bundle exec standardrb
+    bundle exec rake
 
-To release a new version:
-
-1. Bump `lib/lockfile_audit/version.rb`.
-2. Update `CHANGELOG.md`.
-3. `gem build lockfile_audit.gemspec`
-4. `gem push lockfile_audit-<version>.gem`
+To release, see the "Releasing a gem" section of the
+[repo README](../README.md).
 
 ## License
 

data/lib/lockfile_audit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module LockfileAudit
-  VERSION = "0.1.0"
+  VERSION = "0.1.2"
 end

data/lib/lockfile_audit/vulnerability_collector.rb

@@ -15,13 +15,9 @@ module LockfileAudit
   #
   # When invoking the CLI, the collector runs with a scrubbed environment so
   # the parent process's Bundler state (BUNDLE_*, RUBYOPT, etc.) does not leak
-  # into the subprocess. Without this, running from inside a Rails console
-  # causes Bundler to re-validate the Ruby version in the subprocess and abort
-  # with Bundler::RubyVersionMismatch.
-  #
-  # The CLI is invoked directly (never via `bundle exec` or `gem exec`) so the
-  # subprocess stays independent of the parent's Bundler context and does not
-  # trigger dependency installation or RDoc generation as a side effect.
+  # into the subprocess. It also invokes bundler-audit using the *current*
+  # Ruby (RbConfig.ruby) and the exact installed binary path (Gem.bin_path),
+  # so the subprocess uses the same Ruby as the host application.
   class VulnerabilityCollector
     # Environment variables that must not leak into the bundler-audit
     # subprocess. These are set by Bundler when the parent process is a
@@ -76,28 +72,30 @@ module LockfileAudit
     private
 
     def run_bundler_audit
-      stdout, stderr, status = invoke(["bundle-audit"])
+      stdout, stderr, status = invoke
       return stdout if usable?(stdout, status)
 
+      raise_not_installed(stderr)
+    rescue Gem::Exception
       raise Errors::BundlerAuditNotInstalled,
-        "bundle-audit could not be invoked. " \
-        "Ensure the `bundler-audit` gem is installed and on your PATH " \
-        "(e.g. `gem install bundler-audit`). " \
-        "stderr: #{stderr.to_s.strip}"
+        "bundler-audit is not installed for #{RbConfig.ruby} (#{RUBY_VERSION}). " \
+        "Install it for this Ruby: gem install bundler-audit"
     rescue Errno::ENOENT
-      raise Errors::BundlerAuditNotInstalled,
-        "bundle-audit is not installed or not on PATH. " \
-        "Install it with `gem install bundler-audit`."
+      raise_not_installed(nil)
     end
 
-    def invoke(command)
+    def invoke
       Open3.capture3(
         clean_env,
-        *command, "check", "--format", "json",
+        RbConfig.ruby, bundle_audit_path, "check", "--format", "json",
         chdir: File.dirname(File.expand_path(@lockfile_path))
       )
     end
 
+    def bundle_audit_path
+      Gem.bin_path("bundler-audit", "bundle-audit")
+    end
+
     # Builds an environment hash that removes the inherited Bundler state.
     # Passing nil as the value to Open3 unsets the variable in the child.
     def clean_env
@@ -116,6 +114,18 @@ module LockfileAudit
       false
     end
 
+    # Raises BundlerAuditNotInstalled with an actionable message that
+    # includes stderr when available.
+    def raise_not_installed(stderr)
+      detail = stderr.to_s.strip
+      message = "bundler-audit could not be invoked. " \
+                "Ensure the `bundler-audit` gem is installed for this Ruby " \
+                "(#{RUBY_VERSION}) and run `bundle-audit update` to fetch the " \
+                "advisory database."
+      message += " stderr: #{detail}" unless detail.empty?
+      raise Errors::BundlerAuditNotInstalled, message
+    end
+
     # Maps a single bundler-audit finding onto the public schema.
     #
     # bundler-audit has used slightly different key names across versions, so

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lockfile_audit
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - behnam1369
@@ -27,12 +27,13 @@ files:
 - lib/lockfile_audit/report.rb
 - lib/lockfile_audit/version.rb
 - lib/lockfile_audit/vulnerability_collector.rb
-homepage: https://github.com/Behnam1369/lockfile_audit
+homepage: https://github.com/betterwebsites/ror_gems/tree/main/lockfile_audit
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/Behnam1369/lockfile_audit
-  changelog_uri: https://github.com/Behnam1369/lockfile_audit/blob/main/CHANGELOG.md
+  homepage_uri: https://github.com/betterwebsites/ror_gems/tree/main/lockfile_audit
+  source_code_uri: https://github.com/betterwebsites/ror_gems/tree/main/lockfile_audit
+  changelog_uri: https://github.com/betterwebsites/ror_gems/blob/main/lockfile_audit/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib