Repository navigation
Updating activesupport, rest-client and oc-chef-pedant for CVE-2023-22796 - #343
johnmccrae wants to merge 13 commits into
Conversation
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
Signed-off-by: John McCrae <john.mccrae@progress.com>
|
|
|
@johnmccrae - I nuked activesupport altogether. You can rebase this and it should get much easier. |
| # Activesupport 7.1.3.2 also has a CVE in it which requires an upgrade to 7.1.5.2. Activesupport 7.1.5 requires fiddle = 1.1.0, but Chef-19 requires fiddle >= 1.1.6. | ||
| # Also, fiddle is a built-in gem for Ruby 3.1 but is broken out into a separate gem starting in Ruby 3.2. | ||
| if Gem::Version.new(RUBY_VERSION) <= Gem::Version.new("3.1.7") | ||
| s.add_dependency "fiddle", "= 1.1.0" |
There was a problem hiding this comment.
you can't do an if statement in a gemspec
There was a problem hiding this comment.
More specifically, since a gemspec is evaluated at gem build time, and chef-zero is included (at least by Chef) as a gem published to RubyGems, this dependency will match the setup of the machine that built the gem, not the setup of the machine including the gem. (We do have an if or two in gemspecs that aren't subject to this pitfall, regardless of how dubious the practice may be.) cc: @johnmccrae
|
#349 eliminates the need for this PR |
4 participants
Description
Activesupport 7.1.3.2 is subject to a CVE. We're updating all the things here to get past CVE-2023-22796
Related Issue
Types of changes
Checklist:
Gemfile.lockhas changed, I have used--conservativeto do it and included the full output in the Description above.