rubion 0.3.11 → 0.3.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/rubion/scanner.rb +48 -34
- data/lib/rubion/version.rb +1 -1
- data/rubion.gemspec +1 -144
- metadata +5 -72
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7e44746a0b8ff53ccdc236e43a182d060ace64e38790450f10c04fb4d09550ed
|
|
4
|
+
data.tar.gz: 9c05871fdf57aef1e1e2ff82bc2c58015eb18865c999afc3ae13b46ccb0c2341
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 3bee4acf0c1d91670bd811eb2c01c1e4d2192616ba3ce49a7b27f1e1577b8daed57fb35bb0c9a7f77dce0afe6f0698cadcc64ce2145e1ca38bc583afbadfa5ba
|
|
7
|
+
data.tar.gz: f9092694ecd11f85b03fecd7e3021ae6d0e3904022c7384d0c161f35aaf703887b4162a35162fd39c2af45f912221e981c1c0d91538d979b7cceaf08543794cc
|
data/lib/rubion/scanner.rb
CHANGED
|
@@ -102,30 +102,37 @@ module Rubion
|
|
|
102
102
|
stdout, stderr, status = Open3.capture3('bundle-audit check 2>&1', chdir: @project_path)
|
|
103
103
|
|
|
104
104
|
# bundle-audit returns exit code 1 when vulnerabilities are found, 0 when none found
|
|
105
|
-
#
|
|
106
|
-
|
|
105
|
+
# Exit code 1 is expected when vulnerabilities exist, so we still parse the output
|
|
106
|
+
# Exit code 0 means no vulnerabilities found
|
|
107
|
+
# Any other exit code or error means the command failed
|
|
108
|
+
if status.exitstatus == 1 || status.success?
|
|
109
|
+
# Exit code 1 (vulnerabilities found) or 0 (no vulnerabilities) - parse output
|
|
107
110
|
parse_bundler_audit_output(stdout)
|
|
111
|
+
elsif !stdout.empty? && (stdout.include?('vulnerabilities found') || stdout.include?('Name:'))
|
|
112
|
+
# Try to parse if output looks valid even if exit code is unexpected
|
|
113
|
+
parse_bundler_audit_output(stdout)
|
|
114
|
+
elsif status.exitstatus.nil?
|
|
115
|
+
# Command not found or failed to execute
|
|
116
|
+
raise "bundle-audit command failed or is not installed. Error: #{stderr}"
|
|
108
117
|
else
|
|
109
|
-
#
|
|
110
|
-
|
|
118
|
+
# Unexpected exit code
|
|
119
|
+
raise "bundle-audit failed with exit code #{status.exitstatus}. Output: #{stdout}#{stderr.empty? ? '' : "\nError: #{stderr}"}"
|
|
111
120
|
end
|
|
112
|
-
rescue StandardError => e
|
|
113
|
-
puts " ⚠️ Could not run bundle-audit (#{e.message}). Skipping gem vulnerability check."
|
|
114
|
-
@result.gem_vulnerabilities = []
|
|
115
121
|
end
|
|
116
122
|
|
|
117
123
|
def check_gem_versions
|
|
118
124
|
stdout, stderr, status = Open3.capture3('bundle outdated --parseable', chdir: @project_path)
|
|
119
125
|
|
|
120
|
-
if status.success?
|
|
126
|
+
if status.success?
|
|
127
|
+
# Command succeeded - parse output (may be empty if all gems are up to date)
|
|
121
128
|
parse_bundle_outdated_output(stdout)
|
|
129
|
+
elsif status.exitstatus.nil?
|
|
130
|
+
# Command not found or failed to execute
|
|
131
|
+
raise "bundle outdated command failed or is not available. Error: #{stderr}"
|
|
122
132
|
else
|
|
123
|
-
#
|
|
124
|
-
|
|
133
|
+
# Command failed with non-zero exit code
|
|
134
|
+
raise "bundle outdated failed with exit code #{status.exitstatus}. Output: #{stdout}#{stderr.empty? ? '' : "\nError: #{stderr}"}"
|
|
125
135
|
end
|
|
126
|
-
rescue StandardError => e
|
|
127
|
-
puts " ⚠️ Could not run bundle outdated (#{e.message}). Skipping gem version check."
|
|
128
|
-
@result.gem_versions = []
|
|
129
136
|
end
|
|
130
137
|
|
|
131
138
|
def check_npm_vulnerabilities
|
|
@@ -134,15 +141,20 @@ module Rubion
|
|
|
134
141
|
command = "#{@package_manager} audit --json 2>&1"
|
|
135
142
|
stdout, stderr, status = Open3.capture3(command, chdir: @project_path)
|
|
136
143
|
|
|
144
|
+
if status.exitstatus.nil?
|
|
145
|
+
# Command not found or failed to execute
|
|
146
|
+
raise "#{@package_manager} audit command failed or is not available. Error: #{stderr}"
|
|
147
|
+
elsif !status.success? && status.exitstatus != 1
|
|
148
|
+
# Exit code 1 is expected when vulnerabilities are found, other non-zero codes are errors
|
|
149
|
+
raise "#{@package_manager} audit failed with exit code #{status.exitstatus}. Output: #{stdout}#{stderr.empty? ? '' : "\nError: #{stderr}"}"
|
|
150
|
+
end
|
|
151
|
+
|
|
137
152
|
begin
|
|
138
153
|
data = JSON.parse(stdout)
|
|
139
154
|
parse_npm_audit_output(data)
|
|
140
|
-
rescue JSON::ParserError
|
|
141
|
-
@
|
|
155
|
+
rescue JSON::ParserError => e
|
|
156
|
+
raise "Failed to parse #{@package_manager} audit JSON output: #{e.message}. Raw output: #{stdout}"
|
|
142
157
|
end
|
|
143
|
-
rescue StandardError => e
|
|
144
|
-
puts " ⚠️ Could not run #{@package_manager} audit (#{e.message}). Skipping package vulnerability check."
|
|
145
|
-
@result.package_vulnerabilities = []
|
|
146
158
|
end
|
|
147
159
|
|
|
148
160
|
def check_npm_versions
|
|
@@ -160,16 +172,20 @@ module Rubion
|
|
|
160
172
|
command = 'npm outdated --json 2>&1'
|
|
161
173
|
stdout, stderr, status = Open3.capture3(command, chdir: @project_path)
|
|
162
174
|
|
|
175
|
+
if status.exitstatus.nil?
|
|
176
|
+
# Command not found or failed to execute
|
|
177
|
+
raise "npm outdated command failed or is not available. Error: #{stderr}"
|
|
178
|
+
elsif !status.success? && status.exitstatus != 1
|
|
179
|
+
# Exit code 1 is expected when packages are outdated, other non-zero codes are errors
|
|
180
|
+
raise "npm outdated failed with exit code #{status.exitstatus}. Output: #{stdout}#{stderr.empty? ? '' : "\nError: #{stderr}"}"
|
|
181
|
+
end
|
|
182
|
+
|
|
163
183
|
begin
|
|
164
184
|
data = JSON.parse(stdout) unless stdout.empty?
|
|
165
185
|
parse_npm_outdated_output(data || {})
|
|
166
186
|
rescue JSON::ParserError => e
|
|
167
|
-
|
|
168
|
-
@result.package_versions = []
|
|
187
|
+
raise "Failed to parse npm outdated JSON output: #{e.message}. Raw output: #{stdout}"
|
|
169
188
|
end
|
|
170
|
-
rescue StandardError => e
|
|
171
|
-
puts " ⚠️ Could not run npm outdated (#{e.message}). Skipping package version check."
|
|
172
|
-
@result.package_versions = []
|
|
173
189
|
end
|
|
174
190
|
|
|
175
191
|
def check_yarn_outdated
|
|
@@ -177,15 +193,19 @@ module Rubion
|
|
|
177
193
|
command = 'yarn outdated 2>&1'
|
|
178
194
|
stdout, stderr, status = Open3.capture3(command, chdir: @project_path)
|
|
179
195
|
|
|
196
|
+
if status.exitstatus.nil?
|
|
197
|
+
# Command not found or failed to execute
|
|
198
|
+
raise "yarn outdated command failed or is not available. Error: #{stderr}"
|
|
199
|
+
elsif !status.success? && status.exitstatus != 1
|
|
200
|
+
# Exit code 1 is expected when packages are outdated, other non-zero codes are errors
|
|
201
|
+
raise "yarn outdated failed with exit code #{status.exitstatus}. Output: #{stdout}#{stderr.empty? ? '' : "\nError: #{stderr}"}"
|
|
202
|
+
end
|
|
203
|
+
|
|
180
204
|
begin
|
|
181
205
|
parse_yarn_outdated_output(stdout)
|
|
182
206
|
rescue StandardError => e
|
|
183
|
-
|
|
184
|
-
@result.package_versions = []
|
|
207
|
+
raise "Failed to parse yarn outdated output: #{e.message}. Raw output: #{stdout}"
|
|
185
208
|
end
|
|
186
|
-
rescue StandardError => e
|
|
187
|
-
puts " ⚠️ Could not run yarn outdated (#{e.message}). Skipping package version check."
|
|
188
|
-
@result.package_versions = []
|
|
189
209
|
end
|
|
190
210
|
|
|
191
211
|
# Parsers
|
|
@@ -332,9 +352,6 @@ module Rubion
|
|
|
332
352
|
end
|
|
333
353
|
|
|
334
354
|
@result.package_vulnerabilities = vulnerabilities
|
|
335
|
-
rescue StandardError => e
|
|
336
|
-
puts " ⚠️ Error parsing npm audit data: #{e.message}"
|
|
337
|
-
@result.package_vulnerabilities = []
|
|
338
355
|
end
|
|
339
356
|
|
|
340
357
|
def parse_npm_outdated_output(data)
|
|
@@ -416,9 +433,6 @@ module Rubion
|
|
|
416
433
|
end
|
|
417
434
|
|
|
418
435
|
@result.package_versions = versions
|
|
419
|
-
rescue StandardError => e
|
|
420
|
-
puts " ⚠️ Error parsing npm outdated data: #{e.message}"
|
|
421
|
-
@result.package_versions = []
|
|
422
436
|
end
|
|
423
437
|
|
|
424
438
|
def parse_yarn_outdated_output(output)
|
data/lib/rubion/version.rb
CHANGED
data/rubion.gemspec
CHANGED
|
@@ -9,150 +9,7 @@ Gem::Specification.new do |spec|
|
|
|
9
9
|
spec.email = ['bs_chapagain@hotmail.com']
|
|
10
10
|
|
|
11
11
|
spec.summary = 'Security and version scanner for Ruby and JavaScript projects'
|
|
12
|
-
spec.description =
|
|
13
|
-
Rubion is a comprehensive security and version scanner for Ruby and JavaScript projects.
|
|
14
|
-
It helps you identify vulnerabilities and outdated dependencies in your Ruby gems and NPM/JavaScript packages.
|
|
15
|
-
|
|
16
|
-
## Features
|
|
17
|
-
|
|
18
|
-
- 📛 Gem Vulnerabilities: Scans for known security vulnerabilities in Ruby gems using bundle-audit
|
|
19
|
-
- 📦 Gem Versions: Identifies outdated Ruby gems with release dates and version counts
|
|
20
|
-
- 📛 Package Vulnerabilities: Scans for known security vulnerabilities in NPM/JavaScript packages
|
|
21
|
-
- 📦 Package Versions: Identifies outdated NPM/JavaScript packages with release dates
|
|
22
|
-
- 🎯 Direct Dependencies: Highlights direct dependencies (from Gemfile/package.json) in bold text
|
|
23
|
-
- 🔍 Filtering: Option to show only direct dependencies with --exclude-dependencies flag
|
|
24
|
-
- 📊 Sorting: Sort results by any column (Name, Current, Date, Latest, Behind By(Time), Behind By(Versions))
|
|
25
|
-
- 🚀 Fast & Efficient: Parallel API processing (10 concurrent threads) for quick results
|
|
26
|
-
- 📦 Multi-Package Manager: Supports both npm and yarn with automatic detection
|
|
27
|
-
|
|
28
|
-
## Installation
|
|
29
|
-
|
|
30
|
-
```bash
|
|
31
|
-
gem install rubion
|
|
32
|
-
```
|
|
33
|
-
|
|
34
|
-
Or add to your Gemfile:
|
|
35
|
-
|
|
36
|
-
```ruby
|
|
37
|
-
gem 'rubion', '~> 0.3.10'
|
|
38
|
-
```
|
|
39
|
-
|
|
40
|
-
## Usage
|
|
41
|
-
|
|
42
|
-
### Basic Scan
|
|
43
|
-
|
|
44
|
-
```bash
|
|
45
|
-
rubion scan
|
|
46
|
-
```
|
|
47
|
-
|
|
48
|
-
### Scan Options
|
|
49
|
-
|
|
50
|
-
```bash
|
|
51
|
-
# Scan only Ruby gems
|
|
52
|
-
rubion scan --gems-only
|
|
53
|
-
# or
|
|
54
|
-
rubion scan -g
|
|
55
|
-
|
|
56
|
-
# Scan only NPM packages
|
|
57
|
-
rubion scan --packages-only
|
|
58
|
-
# or
|
|
59
|
-
rubion scan -p
|
|
60
|
-
|
|
61
|
-
# Sort by column
|
|
62
|
-
rubion scan --sort-by Name
|
|
63
|
-
rubion scan --sort-by "Behind By(Time)" --desc
|
|
64
|
-
|
|
65
|
-
# Show only direct dependencies
|
|
66
|
-
rubion scan --exclude-dependencies
|
|
67
|
-
```
|
|
68
|
-
|
|
69
|
-
### Example Output
|
|
70
|
-
|
|
71
|
-
Complete Scan Output:
|
|
72
|
-
|
|
73
|
-
```
|
|
74
|
-
🔍 Scanning project at: /path/to/project
|
|
75
|
-
|
|
76
|
-
📦 Checking Ruby gems... 139/139 ✓
|
|
77
|
-
|
|
78
|
-
Gem Vulnerabilities:
|
|
79
|
-
|
|
80
|
-
+----------+--------+---------+------------------------------------------+
|
|
81
|
-
| Level | Name | Version | Vulnerability |
|
|
82
|
-
+----------+--------+---------+------------------------------------------+
|
|
83
|
-
| 🔴 Critical | rexml | 3.4.1 | REXML has DoS condition when parsing... |
|
|
84
|
-
| 🟠 High | rack | 2.0.8 | Denial of Service vulnerability |
|
|
85
|
-
| 🟡 Medium | nokogiri | 1.13.8 | XML parsing vulnerability |
|
|
86
|
-
| 🟢 Low | json | 2.6.1 | JSON parsing issue |
|
|
87
|
-
+----------+--------+---------+------------------------------------------+
|
|
88
|
-
|
|
89
|
-
Gem Versions:
|
|
90
|
-
|
|
91
|
-
+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
92
|
-
| Name | Current | Current version released on | Latest | Latest version released on | Behind By(Time) ↓ | Behind By(Versions) |
|
|
93
|
-
+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
94
|
-
| sidekiq | 7.30 | 3/5/2024 | 8.1 | 11/11/2025 | 1 year | 15 |
|
|
95
|
-
| rails | 7.0.0 | 12/15/2022 | 7.1.0 | 10/4/2024 | 1 year 10 months | 8 |
|
|
96
|
-
| fastimage | 2.2.7 | 2/2/2025 | 2.3.2 | 9/9/2025 | 7 months | 3 |
|
|
97
|
-
| nokogiri | 1.13.8 | 5/10/2023 | 1.15.0 | 8/20/2024 | 1 year 3 months | 12 |
|
|
98
|
-
| redis | 4.8.0 | 1/15/2023 | 5.0.0 | 11/1/2024 | 1 year 9 months | 20 |
|
|
99
|
-
| pg | 1.4.0 | 3/20/2023 | 1.5.0 | 9/15/2024 | 1 year 5 months | 6 |
|
|
100
|
-
+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
101
|
-
|
|
102
|
-
📦 Checking NPM packages... 45/45 ✓
|
|
103
|
-
|
|
104
|
-
Package Vulnerabilities:
|
|
105
|
-
|
|
106
|
-
+----------+--------+---------+------------------------------------------+
|
|
107
|
-
| Level | Name | Version | Vulnerability |
|
|
108
|
-
+----------+--------+---------+------------------------------------------+
|
|
109
|
-
| 🔴 Critical | lodash | 4.17.20 | Prototype pollution vulnerability |
|
|
110
|
-
| 🟠 High | moment | 2.29.1 | Wrong timezone date calculation |
|
|
111
|
-
| 🟡 Medium | axios | 0.21.1 | Server-Side Request Forgery (SSRF) |
|
|
112
|
-
| 🟢 Low | debug | 4.3.1 | Regular Expression Denial of Service |
|
|
113
|
-
+----------+--------+---------+------------------------------------------+
|
|
114
|
-
|
|
115
|
-
Package Versions:
|
|
116
|
-
|
|
117
|
-
+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
118
|
-
| Name | Current | Current version released on | Latest | Latest version released on | Behind By(Time) ↓ | Behind By(Versions) |
|
|
119
|
-
+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
120
|
-
| react | 17.0.2 | 3/3/2021 | 18.2.0 | 6/14/2023 | 2 years 3 months | 45 |
|
|
121
|
-
| vue | 3.2.0 | 8/5/2021 | 3.3.0 | 5/18/2023 | 1 year 9 months | 8 |
|
|
122
|
-
| jquery | 3.7.1 | 4/5/2024 | 3.9.1 | 10/11/2025 | 1 year | 8 |
|
|
123
|
-
| express | 4.18.0 | 4/25/2022 | 4.18.2 | 8/15/2023 | 1 year 3 months | 2 |
|
|
124
|
-
| webpack | 5.70.0 | 3/1/2022 | 5.88.0 | 6/1/2023 | 1 year 3 months | 18 |
|
|
125
|
-
| typescript | 4.7.0 | 5/24/2022 | 5.1.0 | 5/25/2023 | 1 year | 12 |
|
|
126
|
-
+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
127
|
-
```
|
|
128
|
-
|
|
129
|
-
Direct Dependencies Only (with --exclude-dependencies):
|
|
130
|
-
|
|
131
|
-
```
|
|
132
|
-
Gem Versions:
|
|
133
|
-
|
|
134
|
-
+----------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
135
|
-
| Name | Current | Current version released on | Latest | Latest version released on | Behind By(Time) ↓ | Behind By(Versions) |
|
|
136
|
-
+----------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
137
|
-
| **rails**| 7.0.0 | 12/15/2022 | 7.1.0 | 10/4/2024 | 1 year 10 months | 8 |
|
|
138
|
-
| **sidekiq**| 7.30 | 3/5/2024 | 8.1 | 11/11/2025 | 1 year | 15 |
|
|
139
|
-
| **pg** | 1.4.0 | 3/20/2023 | 1.5.0 | 9/15/2024 | 1 year 5 months | 6 |
|
|
140
|
-
+----------+---------+--------------------------+---------+--------------------------+------------------+-------------------+
|
|
141
|
-
```
|
|
142
|
-
|
|
143
|
-
Note: Direct dependencies (from Gemfile or package.json) are displayed in bold text in the version tables.
|
|
144
|
-
|
|
145
|
-
## Requirements
|
|
146
|
-
|
|
147
|
-
- Ruby 2.6 or higher
|
|
148
|
-
- Bundler (for Ruby gem scanning)
|
|
149
|
-
- NPM or Yarn (optional, for JavaScript package scanning)
|
|
150
|
-
- bundler-audit (optional, install with: gem install bundler-audit)
|
|
151
|
-
|
|
152
|
-
## Documentation
|
|
153
|
-
|
|
154
|
-
For more information, visit: https://github.com/bipashant/rubion
|
|
155
|
-
DESC
|
|
12
|
+
spec.description = 'Rubion scans your project for Ruby gem vulnerabilities, outdated gems, NPM package vulnerabilities, and outdated packages. It provides a clean, organized report with actionable insights.'
|
|
156
13
|
spec.homepage = 'https://github.com/bipashant/rubion'
|
|
157
14
|
spec.license = 'MIT'
|
|
158
15
|
spec.required_ruby_version = '>= 2.6.0'
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: rubion
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.3.
|
|
4
|
+
version: 0.3.13
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- bipashant
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2025-11-
|
|
11
|
+
date: 2025-11-17 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: terminal-table
|
|
@@ -66,76 +66,9 @@ dependencies:
|
|
|
66
66
|
- - "~>"
|
|
67
67
|
- !ruby/object:Gem::Version
|
|
68
68
|
version: '1.21'
|
|
69
|
-
description:
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
Vulnerabilities: Scans for known security vulnerabilities in Ruby gems using bundle-audit\n-
|
|
73
|
-
\U0001F4E6 Gem Versions: Identifies outdated Ruby gems with release dates and version
|
|
74
|
-
counts\n- \U0001F4DB Package Vulnerabilities: Scans for known security vulnerabilities
|
|
75
|
-
in NPM/JavaScript packages\n- \U0001F4E6 Package Versions: Identifies outdated NPM/JavaScript
|
|
76
|
-
packages with release dates\n- \U0001F3AF Direct Dependencies: Highlights direct
|
|
77
|
-
dependencies (from Gemfile/package.json) in bold text\n- \U0001F50D Filtering: Option
|
|
78
|
-
to show only direct dependencies with --exclude-dependencies flag\n- \U0001F4CA
|
|
79
|
-
Sorting: Sort results by any column (Name, Current, Date, Latest, Behind By(Time),
|
|
80
|
-
Behind By(Versions))\n- \U0001F680 Fast & Efficient: Parallel API processing (10
|
|
81
|
-
concurrent threads) for quick results\n- \U0001F4E6 Multi-Package Manager: Supports
|
|
82
|
-
both npm and yarn with automatic detection\n\n## Installation\n\n```bash\ngem install
|
|
83
|
-
rubion\n```\n\nOr add to your Gemfile:\n\n```ruby\ngem 'rubion', '~> 0.3.10'\n```\n\n##
|
|
84
|
-
Usage\n\n### Basic Scan\n\n```bash\nrubion scan\n```\n\n### Scan Options\n\n```bash\n#
|
|
85
|
-
Scan only Ruby gems\nrubion scan --gems-only\n# or\nrubion scan -g\n\n# Scan only
|
|
86
|
-
NPM packages\nrubion scan --packages-only\n# or\nrubion scan -p\n\n# Sort by column\nrubion
|
|
87
|
-
scan --sort-by Name\nrubion scan --sort-by \"Behind By(Time)\" --desc\n\n# Show
|
|
88
|
-
only direct dependencies\nrubion scan --exclude-dependencies\n```\n\n### Example
|
|
89
|
-
Output\n\nComplete Scan Output:\n\n```\n\U0001F50D Scanning project at: /path/to/project\n\n\U0001F4E6
|
|
90
|
-
Checking Ruby gems... 139/139 ✓\n\nGem Vulnerabilities:\n\n+----------+--------+---------+------------------------------------------+\n|
|
|
91
|
-
Level | Name | Version | Vulnerability |\n+----------+--------+---------+------------------------------------------+\n|
|
|
92
|
-
\U0001F534 Critical | rexml | 3.4.1 | REXML has DoS condition when parsing...
|
|
93
|
-
|\n| \U0001F7E0 High | rack | 2.0.8 | Denial of Service vulnerability |\n|
|
|
94
|
-
\U0001F7E1 Medium | nokogiri | 1.13.8 | XML parsing vulnerability |\n|
|
|
95
|
-
\U0001F7E2 Low | json | 2.6.1 | JSON parsing issue |\n+----------+--------+---------+------------------------------------------+\n\nGem
|
|
96
|
-
Versions:\n\n+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n|
|
|
97
|
-
Name | Current | Current version released on | Latest | Latest version
|
|
98
|
-
released on | Behind By(Time) ↓ | Behind By(Versions) |\n+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n|
|
|
99
|
-
sidekiq | 7.30 | 3/5/2024 | 8.1 | 11/11/2025 |
|
|
100
|
-
1 year | 15 |\n| rails | 7.0.0 | 12/15/2022
|
|
101
|
-
\ | 7.1.0 | 10/4/2024 | 1 year 10 months | 8 |\n|
|
|
102
|
-
fastimage | 2.2.7 | 2/2/2025 | 2.3.2 | 9/9/2025 |
|
|
103
|
-
7 months | 3 |\n| nokogiri | 1.13.8 | 5/10/2023
|
|
104
|
-
\ | 1.15.0 | 8/20/2024 | 1 year 3 months | 12 |\n|
|
|
105
|
-
redis | 4.8.0 | 1/15/2023 | 5.0.0 | 11/1/2024 |
|
|
106
|
-
1 year 9 months | 20 |\n| pg | 1.4.0 | 3/20/2023
|
|
107
|
-
\ | 1.5.0 | 9/15/2024 | 1 year 5 months | 6 |\n+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n\n\U0001F4E6
|
|
108
|
-
Checking NPM packages... 45/45 ✓\n\nPackage Vulnerabilities:\n\n+----------+--------+---------+------------------------------------------+\n|
|
|
109
|
-
Level | Name | Version | Vulnerability |\n+----------+--------+---------+------------------------------------------+\n|
|
|
110
|
-
\U0001F534 Critical | lodash | 4.17.20 | Prototype pollution vulnerability |\n|
|
|
111
|
-
\U0001F7E0 High | moment | 2.29.1 | Wrong timezone date calculation |\n|
|
|
112
|
-
\U0001F7E1 Medium | axios | 0.21.1 | Server-Side Request Forgery (SSRF) |\n|
|
|
113
|
-
\U0001F7E2 Low | debug | 4.3.1 | Regular Expression Denial of Service |\n+----------+--------+---------+------------------------------------------+\n\nPackage
|
|
114
|
-
Versions:\n\n+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n|
|
|
115
|
-
Name | Current | Current version released on | Latest | Latest version
|
|
116
|
-
released on | Behind By(Time) ↓ | Behind By(Versions) |\n+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n|
|
|
117
|
-
react | 17.0.2 | 3/3/2021 | 18.2.0 | 6/14/2023 |
|
|
118
|
-
2 years 3 months | 45 |\n| vue | 3.2.0 | 8/5/2021
|
|
119
|
-
\ | 3.3.0 | 5/18/2023 | 1 year 9 months | 8 |\n|
|
|
120
|
-
jquery | 3.7.1 | 4/5/2024 | 3.9.1 | 10/11/2025 |
|
|
121
|
-
1 year | 8 |\n| express | 4.18.0 | 4/25/2022
|
|
122
|
-
\ | 4.18.2 | 8/15/2023 | 1 year 3 months | 2 |\n|
|
|
123
|
-
webpack | 5.70.0 | 3/1/2022 | 5.88.0 | 6/1/2023 |
|
|
124
|
-
1 year 3 months | 18 |\n| typescript | 4.7.0 | 5/24/2022
|
|
125
|
-
\ | 5.1.0 | 5/25/2023 | 1 year | 12 |\n+------------------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n```\n\nDirect
|
|
126
|
-
Dependencies Only (with --exclude-dependencies):\n\n```\nGem Versions:\n\n+----------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n|
|
|
127
|
-
Name | Current | Current version released on | Latest | Latest version released
|
|
128
|
-
on | Behind By(Time) ↓ | Behind By(Versions) |\n+----------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n|
|
|
129
|
-
**rails**| 7.0.0 | 12/15/2022 | 7.1.0 | 10/4/2024 |
|
|
130
|
-
1 year 10 months | 8 |\n| **sidekiq**| 7.30 | 3/5/2024 |
|
|
131
|
-
8.1 | 11/11/2025 | 1 year | 15 |\n| **pg**
|
|
132
|
-
\ | 1.4.0 | 3/20/2023 | 1.5.0 | 9/15/2024 | 1
|
|
133
|
-
year 5 months | 6 |\n+----------+---------+--------------------------+---------+--------------------------+------------------+-------------------+\n```\n\nNote:
|
|
134
|
-
Direct dependencies (from Gemfile or package.json) are displayed in bold text in
|
|
135
|
-
the version tables.\n\n## Requirements\n\n- Ruby 2.6 or higher\n- Bundler (for Ruby
|
|
136
|
-
gem scanning)\n- NPM or Yarn (optional, for JavaScript package scanning)\n- bundler-audit
|
|
137
|
-
(optional, install with: gem install bundler-audit)\n\n## Documentation\n\nFor more
|
|
138
|
-
information, visit: https://github.com/bipashant/rubion\n"
|
|
69
|
+
description: Rubion scans your project for Ruby gem vulnerabilities, outdated gems,
|
|
70
|
+
NPM package vulnerabilities, and outdated packages. It provides a clean, organized
|
|
71
|
+
report with actionable insights.
|
|
139
72
|
email:
|
|
140
73
|
- bs_chapagain@hotmail.com
|
|
141
74
|
executables:
|