wpscan 4.0.1 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6e5b02dd5de5e0624c1dca1b8bb3bad6f16ff008fe054957e80c3ce33807a70
-  data.tar.gz: fb7cec3911f60cabbf70ac8e34672e4a41fe68a64bd76e9d7b55f0f5e901d012
+  metadata.gz: c6215ce3d361d0754721dab264b279b43c0064cb2621a14720db0e15167bbc52
+  data.tar.gz: 6c092df8d32bb9f5e0a750c2801fb7cd086c6f258f404023581dc61c194fb962
 SHA512:
-  metadata.gz: 724a6be1ce5d754a9891781e7101bf5b504c056107d1a7dc4cb0bb107a03044ccfff73dd648f32e14bcc0d8299b8b7872e2cbdd8f813d928a2abd64402ed28f0
-  data.tar.gz: 9c31899c0110f312f496a934f585e661103a364cf535da47a49d9002594eb047b942715a299cf275fdc85c1143a725cb5ee9d3f3d86dcbe29a3e53f7a400c432
+  metadata.gz: b74ca0ee959b570d23d23d51936f121e31a16ef73ec896c5b1f6e97f503d6000c129cb3655fac0b6bca8072f7047c2bfad46711b77fb16f4f4cbdd9069a10311
+  data.tar.gz: 3067ba3dc843c74014b1bbda40ca2be6549fc17924aa64456128a667f91d20957ef86c1d79b430767fc2cb9a4a4b1b9fbb3bfd1d3f92c5edf94bb6c993ae8b23

data/README.md

@@ -144,6 +144,8 @@ The WPScan CLI tool uses the [WordPress Vulnerability Database API](https://wpsc
 
 Up to **25** API requests per day are given free of charge, that should be suitable to scan most WordPress websites at least once per day. When the daily 25 API requests are exhausted, WPScan will continue to work as normal but without any vulnerability data.
 
+Enterprise customers can alternatively scan against a local database dump with no request limits — see [Enterprise Local Database (opt-in)](#enterprise-local-database-opt-in).
+
 ### How many API requests do you need?
 
 - Our WordPress scanner makes one API request for the WordPress version, one request per installed plugin, and one request per the installed theme.
@@ -205,6 +207,28 @@ cli_options:
 
 The API Token will be automatically loaded from the ENV variable `WPSCAN_API_TOKEN` if present. If the `--api-token` CLI option is also provided, the value from the CLI will be used.
 
+## Enterprise Local Database (opt-in)
+
+Enterprise customers can scan using a **local vulnerability database dump** instead of the online API, if they prefer to do so for privacy. Supply the enterprise token via the `--enterprise-db-token TOKEN` option:
+
+```bash
+wpscan --url https://example.com --enterprise-db-token YOUR_ENTERPRISE_DB_TOKEN
+```
+
+When this option is used:
+
+- During the normal database update, WPScan additionally downloads `plugins.json.gz`, `themes.json.gz` and `wordpresses.json.gz` from `enterprise-data.wpscan.org` (authenticated with the token). As with the rest of the database, these are only re-downloaded when they change.
+- Plugin, theme and WordPress vulnerability data is then read from those local dumps; no requests are made to the WPScan API.
+
+The token can also be provided via the `WPSCAN_ENTERPRISE_DB_TOKEN` environment variable, or the `enterprise_db_token` key in a configuration file (see [Load CLI options from file/s](#load-cli-options-from-files)):
+
+```yml
+cli_options:
+  enterprise_db_token: 'YOUR_ENTERPRISE_DB_TOKEN'
+```
+
+`--enterprise-db-token` and `--api-token` are mutually exclusive; supplying both (including via their respective environment variables) results in an error.
+
 ## API Service Status
 
 If you experience connection issues with the WPScan API, you can check the service status at https://status.wpscan.com/. When API connection errors occur, WPScan will include a link to the status page in the error message.

data/app/controllers/core.rb

@@ -37,6 +37,12 @@ module WPScan
 
         maybe_output_banner_help_and_version
 
+        # Fail fast on conflicting API tokens, before the DB update (which would download the
+        # enterprise DB dumps) and before any request is sent to the target. Done here rather
+        # than only in VulnApi#before_scan (which runs after this controller) so that the
+        # conflict also aborts DB-update-only runs (--update without --url).
+        VulnApi.validate_api_tokens!
+
         update_db if update_db_required?
         setup_cache
         check_target_availability

data/app/controllers/enumeration.rb

@@ -14,8 +14,10 @@ module WPScan
         # requirement for `vp`/`vt` is irrelevant in that case.
         return if ParsedCli.wp_auth
 
-        # Check if vulnerable plugin/theme enumeration is requested without an API token
-        return unless (enum[:vulnerable_plugins] || enum[:vulnerable_themes]) && DB::VulnApi.token.nil?
+        # Check if vulnerable plugin/theme enumeration is requested without an API token.
+        # The local enterprise DB dump (--enterprise-db-token) provides the same data without a token.
+        return unless (enum[:vulnerable_plugins] || enum[:vulnerable_themes]) &&
+                      DB::VulnApi.token.nil? && !DB::VulnApi.local_db
 
         raise Error::ApiTokenRequiredForVulnerableEnumeration
       end

data/app/controllers/vuln_api.rb

@@ -4,7 +4,28 @@ module WPScan
   module Controller
     # Controller to handle the API token
     class VulnApi < WPScan::Controller::Base
-      ENV_KEY = 'WPSCAN_API_TOKEN'
+      ENV_KEY            = 'WPSCAN_API_TOKEN'
+      ENTERPRISE_ENV_KEY = 'WPSCAN_ENTERPRISE_DB_TOKEN'
+
+      # Class level so that Controller::Core (which runs first) can validate the tokens right after
+      # the CLI options have been parsed, aborting before anything else (DB update, requests to the
+      # target) is done.
+      class << self
+        # @return [ String, nil ] The enterprise DB token (CLI or ENV). Must match DB::Updater's resolution.
+        def enterprise_db_token
+          ParsedCli.enterprise_db_token || ENV.fetch(ENTERPRISE_ENV_KEY, nil)
+        end
+
+        # @return [ String, nil ] The API token (CLI or ENV var)
+        def api_token
+          ParsedCli.api_token || ENV.fetch(ENV_KEY, nil)
+        end
+
+        # @raise [ Error::ConflictingApiTokens ] When both the API and enterprise DB tokens are supplied
+        def validate_api_tokens!
+          raise Error::ConflictingApiTokens if enterprise_db_token && api_token
+        end
+      end
 
       def cli_options
         [
@@ -12,6 +33,14 @@ module WPScan
             ['--api-token TOKEN',
              'The WPScan API Token to display vulnerability data, available at https://wpscan.com/profile']
           ),
+          OptString.new(
+            ['--enterprise-db-token TOKEN',
+             'Use a local enterprise vulnerability database dump instead of the WPScan API. The ' \
+             'plugins/themes/wordpresses dumps are downloaded from enterprise-data.wpscan.org using ' \
+             'this token during the database update, then read locally (no per-finding API calls). Mutually ' \
+             "exclusive with --api-token. Can also be set via the #{ENTERPRISE_ENV_KEY} environment variable."],
+            { advanced: true }
+          ),
           OptBoolean.new(
             ['--proxy-target-only',
              'When used with --proxy, the proxy is only applied to requests made to the target, ' \
@@ -22,9 +51,15 @@ module WPScan
       end
 
       def before_scan
-        return unless ParsedCli.api_token || ENV.key?(ENV_KEY)
+        # Already done by Core#before_scan (before the DB update, to fail as early as possible),
+        # kept as a safety net in case this controller is used in a chain without Core.
+        self.class.validate_api_tokens!
+
+        return setup_enterprise_db if enterprise_db_token
 
-        DB::VulnApi.token = ParsedCli.api_token || ENV.fetch(ENV_KEY, nil)
+        return unless api_token
+
+        DB::VulnApi.token = api_token
 
         api_status = DB::VulnApi.status
 
@@ -36,6 +71,28 @@ module WPScan
       def after_scan
         output('status', status: DB::VulnApi.status, api_requests: WPScan.api_requests)
       end
+
+      private
+
+      # @return [ String, nil ] The enterprise DB token (CLI or ENV)
+      def enterprise_db_token
+        self.class.enterprise_db_token
+      end
+
+      # @return [ String, nil ] The API token (CLI or ENV var)
+      def api_token
+        self.class.api_token
+      end
+
+      # Switches DB::VulnApi to local-dump mode and ensures the dumps are present. Core's DB
+      # update normally downloads them before this controller runs (VulnApi is chained after Core).
+      def setup_enterprise_db
+        DB::VulnApi.local_db = true
+
+        missing = DB::VulnApi::ENTERPRISE_DB_FILES.values.reject { |file| File.exist?(DB_DIR.join(file)) }
+
+        raise Error::MissingEnterpriseDatabaseFile, missing unless missing.empty?
+      end
     end
   end
 end

data/app/models/wp_item.rb

@@ -39,7 +39,7 @@ module WPScan
 
         @vulnerabilities = []
 
-        Array(db_data['vulnerabilities']).each do |json_vuln|
+        Vulnerability.sort_json(db_data['vulnerabilities']).each do |json_vuln|
           vulnerability = Vulnerability.load_from_json(json_vuln)
           vulnerability.detected_version = version || nil
           @vulnerabilities << vulnerability if vulnerable_to?(vulnerability)

data/app/models/wp_version.rb

@@ -57,7 +57,7 @@ module WPScan
 
         @vulnerabilities = []
 
-        Array(db_data['vulnerabilities']).each do |json_vuln|
+        Vulnerability.sort_json(db_data['vulnerabilities']).each do |json_vuln|
           vulnerability = Vulnerability.load_from_json(json_vuln)
           vulnerability.detected_version = self
           @vulnerabilities << vulnerability

data/lib/opt_parse_validator/config_files_loader_merger.rb

@@ -4,7 +4,7 @@ require_relative 'config_files_loader_merger/base'
 require_relative 'config_files_loader_merger/json'
 require_relative 'config_files_loader_merger/yml'
 
-# :nocov:
+# simplecov:disable
 # @param [ String ] path The path of the file to load
 def yaml_safe_load(path)
   if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1') # Ruby 2.6
@@ -13,7 +13,7 @@ def yaml_safe_load(path)
     YAML.safe_load_file(path, [Regexp]) || {}
   end
 end
-# :nocov:
+# simplecov:enable
 
 module OptParseValidator
   # Options Files container

data/lib/wpscan/db/updater.rb

@@ -3,7 +3,7 @@
 module WPScan
   module DB
     # Class used to perform DB updates
-    # :nocov:
+    # simplecov:disable
     class Updater
       # /!\ Might want to also update the Enumeration#cli_options when some filenames are changed here
       FILES = %w[
@@ -17,6 +17,13 @@ module WPScan
         wordpresses.json plugins.json themes.json
       ].freeze
 
+      # Enterprise vulnerability DB dumps, downloaded (in addition to FILES) only when an
+      # --enterprise-db-token is supplied, from ENTERPRISE_HOST using the X-DB-JSON-AUTH header.
+      ENTERPRISE_FILES = %w[wordpresses.json.gz plugins.json.gz themes.json.gz].freeze
+
+      ENTERPRISE_HOST = 'enterprise-data.wpscan.org'
+      DEFAULT_HOST    = 'data.wpscan.org'
+
       attr_reader :repo_directory
 
       def initialize(repo_directory)
@@ -43,6 +50,24 @@ module WPScan
         end
       end
 
+      # @return [ String, nil ] The enterprise DB token. Resolved exactly like Controller::VulnApi
+      #                         does; the two must stay in sync or the dumps won't be downloaded.
+      def enterprise_db_token
+        ParsedCli.enterprise_db_token || ENV.fetch('WPSCAN_ENTERPRISE_DB_TOKEN', nil)
+      end
+
+      # @return [ Array<String> ] The files to keep in sync (plus the enterprise dumps when a token is set)
+      def files
+        return FILES + ENTERPRISE_FILES if enterprise_db_token
+
+        FILES
+      end
+
+      # @return [ Boolean ] Whether the file is an enterprise dump (fetched from ENTERPRISE_HOST with auth)
+      def enterprise_file?(filename)
+        !enterprise_db_token.nil? && ENTERPRISE_FILES.include?(filename)
+      end
+
       # @return [ Time, nil ]
       def last_update
         Time.parse(File.read(last_update_file))
@@ -64,7 +89,7 @@ module WPScan
 
       # @return [ Boolean ]
       def missing_files?
-        FILES.each do |file|
+        files.each do |file|
           return true unless File.exist?(repo_directory.join(file))
         end
         false
@@ -72,35 +97,44 @@ module WPScan
 
       # @return [ Hash ] The params for Typhoeus::Request
       # @note Those params can't be overriden by CLI options
-      def request_params
-        @request_params ||= begin
-          params = Browser.instance.default_request_params.merge(
-            timeout: 600,
-            connecttimeout: 300,
-            accept_encoding: 'gzip, deflate',
-            cache_ttl: 0,
-            headers: { 'User-Agent' => Browser.instance.default_user_agent }
-          )
-
-          if ParsedCli.proxy_target_only
-            params.delete(:proxy)
-            params.delete(:proxyuserpwd)
-          end
-
-          params
+      def request_params(filename = nil)
+        params = Browser.instance.default_request_params.merge(
+          timeout: 600,
+          connecttimeout: 300,
+          accept_encoding: 'gzip, deflate',
+          cache_ttl: 0,
+          headers: { 'User-Agent' => Browser.instance.default_user_agent }
+        )
+
+        if enterprise_file?(filename)
+          params[:headers]['X-DB-JSON-AUTH'] = enterprise_db_token
+          # The dumps are pre-gzipped static objects. If we advertise Accept-Encoding: gzip and the
+          # host responds with Content-Encoding: gzip, libcurl transparently decompresses at the
+          # transfer layer, so res.body would be plain JSON written into a *.json.gz file, breaking
+          # both Zlib::GzipReader and the SHA512 checksum (computed over the raw .gz).
+          params.delete(:accept_encoding)
+        end
+
+        if ParsedCli.proxy_target_only
+          params.delete(:proxy)
+          params.delete(:proxyuserpwd)
         end
+
+        params
       end
 
       # @return [ String ] The raw file URL associated with the given filename
       def remote_file_url(filename)
-        "https://data.wpscan.org/#{filename}"
+        host = enterprise_file?(filename) ? ENTERPRISE_HOST : DEFAULT_HOST
+
+        "https://#{host}/#{filename}"
       end
 
       # @return [ String ] The checksum of the associated remote filename
       def remote_file_checksum(filename)
         url = "#{remote_file_url(filename)}.sha512"
 
-        res = Typhoeus.get(url, request_params)
+        res = Typhoeus.get(url, request_params(filename))
         raise Error::Download, res if res.timed_out? || res.code != 200
 
         res.body.chomp
@@ -142,7 +176,7 @@ module WPScan
         file_path = local_file_path(filename)
         file_url  = remote_file_url(filename)
 
-        res = Typhoeus.get(file_url, request_params)
+        res = Typhoeus.get(file_url, request_params(filename))
         raise Error::Download, res if res.timed_out? || res.code != 200
 
         File.binwrite(file_path, res.body)
@@ -154,7 +188,7 @@ module WPScan
       def update
         updated = []
 
-        FILES.each do |filename|
+        files.each do |filename|
           db_checksum = remote_file_checksum(filename)
 
           # Checking if the file needs to be updated
@@ -179,5 +213,5 @@ module WPScan
       end
     end
   end
-  # :nocov:
+  # simplecov:enable
 end

data/lib/wpscan/db/vuln_api.rb

@@ -1,13 +1,24 @@
 # frozen_string_literal: true
 
+require 'zlib'
+
 module WPScan
   module DB
     # WPVulnDB API
     class VulnApi
       NON_ERROR_CODES = [200, 403].freeze
 
+      # Local (enterprise) vulnerability DB dumps, read instead of the API when local_db is set.
+      # Downloaded to DB_DIR by DB::Updater when --enterprise-db-token is supplied.
+      ENTERPRISE_DB_FILES = {
+        plugins: 'plugins.json.gz',
+        themes: 'themes.json.gz',
+        wordpresses: 'wordpresses.json.gz'
+      }.freeze
+
       class << self
-        attr_accessor :token
+        # local_db switches vuln lookups from the API to the local dumps above
+        attr_accessor :token, :local_db
       end
 
       # @return [ Addressable::URI ]
@@ -15,6 +26,28 @@ module WPScan
         @uri ||= Addressable::URI.parse('https://wpscan.com/api/v4/')
       end
 
+      # @param [ String ] filename The gzipped JSON dump located in DB_DIR
+      #
+      # @return [ Hash ] The parsed content of the dump
+      def self.load_db(filename)
+        JSON.parse(Zlib::GzipReader.open(DB_DIR.join(filename).to_s, &:read))
+      end
+
+      # @return [ Hash ]
+      def self.plugins_db
+        @plugins_db ||= load_db(ENTERPRISE_DB_FILES[:plugins])
+      end
+
+      # @return [ Hash ]
+      def self.themes_db
+        @themes_db ||= load_db(ENTERPRISE_DB_FILES[:themes])
+      end
+
+      # @return [ Hash ]
+      def self.wordpresses_db
+        @wordpresses_db ||= load_db(ENTERPRISE_DB_FILES[:wordpresses])
+      end
+
       # @param [ String ] path
       # @param [ Hash ] params
       #
@@ -52,21 +85,30 @@ module WPScan
 
       # @return [ Hash ]
       def self.plugin_data(slug)
+        return plugins_db&.dig(slug) || {} if local_db
+
         get("plugins/#{slug}")&.dig(slug) || {}
       end
 
       # @return [ Hash ]
       def self.theme_data(slug)
+        return themes_db&.dig(slug) || {} if local_db
+
         get("themes/#{slug}")&.dig(slug) || {}
       end
 
       # @return [ Hash ]
       def self.wordpress_data(version_number)
+        # The dump is keyed by the dotted version; only the API URL strips the dots.
+        return wordpresses_db&.dig(version_number) || {} if local_db
+
         get("wordpresses/#{version_number.tr('.', '')}")&.dig(version_number) || {}
       end
 
       # @return [ Hash ]
       def self.status
+        return { 'plan' => 'enterprise', 'requests_remaining' => 'Unlimited', 'success' => true } if local_db
+
         json = get('status', params: { version: WPScan::VERSION }, cache_ttl: 0)
 
         json['requests_remaining'] = 'Unlimited' if json['requests_remaining'] == -1

data/lib/wpscan/errors/http.rb

@@ -61,20 +61,20 @@ module WPScan
 
     # HTTP Authentication Required Error
     class HTTPAuthRequired < Standard
-      # :nocov:
+      # simplecov:disable
       def to_s
         'HTTP authentication required (or was invalid), please provide it with --http-auth'
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     # Proxy Authentication Required Error
     class ProxyAuthRequired < Standard
-      # :nocov:
+      # simplecov:disable
       def to_s
         'Proxy authentication required (or was invalid), please provide it with --proxy-auth'
       end
-      # :nocov:
+      # simplecov:enable
     end
 
     # Access Forbidden Error

data/lib/wpscan/errors/scan.rb

@@ -4,11 +4,11 @@ module WPScan
   module Error
     # Used instead of the Timeout::Error
     class MaxScanDurationReached < Standard
-      # :nocov:
+      # simplecov:disable
       def to_s
         'Max Scan Duration Reached'
       end
-      # :nocov:
+      # simplecov:enable
     end
   end
 end

data/lib/wpscan/errors/vuln_api.rb

@@ -40,5 +40,29 @@ module WPScan
           'Please check https://status.wpscan.com/ for service status.'
       end
     end
+
+    # Error raised when both --api-token and --enterprise-db-token are supplied
+    class ConflictingApiTokens < Standard
+      def to_s
+        '--api-token and --enterprise-db-token are mutually exclusive, please provide only one ' \
+          '(this also applies to the WPSCAN_API_TOKEN and WPSCAN_ENTERPRISE_DB_TOKEN environment variables).'
+      end
+    end
+
+    # Error raised when --enterprise-db-token is set but a local DB dump is missing
+    class MissingEnterpriseDatabaseFile < Standard
+      attr_reader :files
+
+      def initialize(files = [])
+        @files = Array(files)
+        super()
+      end
+
+      def to_s
+        "Missing enterprise database dump(s): #{files.join(', ')}. " \
+          'Run without --no-update so they can be downloaded from enterprise-data.wpscan.org, ' \
+          'and check that your --enterprise-db-token is valid.'
+      end
+    end
   end
 end

data/lib/wpscan/scan.rb

@@ -27,6 +27,7 @@ module WPScan
       # not secrets themselves, just references to files
       sensitive_args = %w[
         --api-token
+        --enterprise-db-token
         --http-auth
         --proxy-auth
         --cookie-string
@@ -95,7 +96,7 @@ module WPScan
 
     # Hook to be able to have an exit code returned
     # depending on the findings / errors
-    # :nocov:
+    # simplecov:disable
     def exit_hook
       # Avoid registering this hook when the RSpec suite is running, otherwise it
       # can override RSpec's exit status and hide failed builds.
@@ -109,7 +110,7 @@ module WPScan
         exit(WPScan::ExitCode::OK)
       end
     end
-    # :nocov:
+    # simplecov:enable
 
     def rspec_running?
       defined?(RSpec)

data/lib/wpscan/version.rb

@@ -2,5 +2,5 @@
 
 # Version
 module WPScan
-  VERSION = '4.0.1'
+  VERSION = '4.1.0'
 end

data/lib/wpscan/vulnerability.rb

@@ -56,13 +56,38 @@ module WPScan
         json_data['title'],
         references: references,
         type: json_data['vuln_type'],
-        affected_versions: json_data['affected_versions'],
+        affected_versions: affected_versions_from(json_data),
         cvss: json_data['cvss']&.symbolize_keys,
         poc: json_data['poc'],
         uuid: json_data['id'].to_s # The 'id' field IS the UUID in WPScan API
       )
     end
 
+    # Reads the :affected_versions ranges used by both the API and the DB dumps.
+    # Legacy flat fixed_in / introduced_in entries are wrapped into a single range
+    # so they still get version-filtered instead of matching every version.
+    #
+    # @param [ Hash ] json_data
+    # @return [ Array<Hash>, nil ]
+    def self.affected_versions_from(json_data)
+      return json_data['affected_versions'] if json_data['affected_versions']
+      return nil unless json_data.key?('fixed_in') || json_data.key?('introduced_in')
+
+      [{ 'fixed_in' => json_data['fixed_in'], 'introduced_in' => json_data['introduced_in'] }]
+    end
+
+    # Orders entries oldest-first (created_at, updated_at, id) to match the API's
+    # order, so the API and the reverse-ordered DB dump report the same sequence.
+    # The trailing index keeps the sort stable when those fields are absent.
+    #
+    # @param [ Array<Hash> ] json_vulns Raw entries from the API or a DB dump
+    # @return [ Array<Hash> ]
+    def self.sort_json(json_vulns)
+      Array(json_vulns).each_with_index.sort_by do |vuln, index|
+        [vuln['created_at'].to_s, vuln['updated_at'].to_s, vuln['id'].to_s, index]
+      end.map(&:first)
+    end
+
     # Whether this vulnerability covers a given version. True when no
     # affected_versions are declared (advisory with no fix metadata) or when at
     # least one backported range covers the version.

data/lib/wpscan/web_site.rb

@@ -45,11 +45,11 @@ module WPScan
     # @return [ Typhoeus::Response ]
     #
     # As webmock does not support redirects mocking, coverage is ignored
-    # :nocov:
+    # simplecov:disable
     def homepage_res
       @homepage_res ||= WPScan::Browser.get_and_follow_location(url)
     end
-    # :nocov:
+    # simplecov:enable
 
     # @return [ String ]
     def homepage_url
@@ -108,7 +108,7 @@ module WPScan
     # @return [ String ] The redirection url or nil
     #
     # As webmock does not support redirects mocking, coverage is ignored
-    # :nocov:
+    # simplecov:disable
     def redirection(url = nil)
       url ||= @uri.to_s
 
@@ -118,7 +118,7 @@ module WPScan
 
       res.effective_url == url ? nil : res.effective_url
     end
-    # :nocov:
+    # simplecov:enable
 
     # @return [ Hash ] The Typhoeus params to use to perform head requests
     def head_or_get_params

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wpscan
 version: !ruby/object:Gem::Version
-  version: 4.0.1
+  version: 4.1.0
 platform: ruby
 authors:
 - WPScanTeam
@@ -351,14 +351,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: 1.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.22.0
+        version: 1.0.0
 - !ruby/object:Gem::Dependency
   name: simplecov-lcov
   requirement: !ruby/object:Gem::Requirement