TEST_CODEOWNERS/rails
3
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Amend CVE note and security guide section wordings

Browse Source 
Reword first sentence of dep management and CVE section of
security guide. Also, reword and move gemspec notes above deps.

[ci skip]
This commit is contained in:
Gannon McGibbon 2018-11-06 18:05:40 -05:00
parent bb11a9acab
commit e74fdbe00c
11 changed files with 31 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
actioncable/actioncable.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actioncable"
@ -28,6 +25,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/actioncable/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "actionpack", version
s.add_dependency "nio4r", "~> 2.0"

6
actionmailer/actionmailer.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actionmailer"
@ -29,6 +26,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/actionmailer/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "actionpack", version
s.add_dependency "actionview", version
s.add_dependency "activejob", version

6
actionpack/actionpack.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actionpack"
@ -29,6 +26,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/actionpack/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "activesupport", version
s.add_dependency "rack", "~> 2.0"

6
actionview/actionview.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "actionview"
@ -29,6 +26,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/actionview/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "activesupport", version
s.add_dependency "builder", "~> 3.1"

6
activejob/activejob.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activejob"
@ -28,6 +25,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/activejob/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "activesupport", version
s.add_dependency "globalid", ">= 0.3.6"
end

6
activemodel/activemodel.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activemodel"
@ -28,5 +25,8 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/activemodel/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "activesupport", version
end

6
activerecord/activerecord.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activerecord"
@ -31,6 +28,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/activerecord/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "activesupport", version
s.add_dependency "activemodel", version
end

6
activestorage/activestorage.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activestorage"
@ -28,6 +25,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/activestorage/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "actionpack", version
s.add_dependency "activerecord", version

6
activesupport/activesupport.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "activesupport"
@ -30,6 +27,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/activesupport/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "i18n", ">= 0.7", "< 2"
s.add_dependency "tzinfo", "~> 1.1"
s.add_dependency "minitest", "~> 5.1"

2
guides/source/security.md
View File

@ -1238,7 +1238,7 @@ Rails.application.credentials.some_api_key! # => raises KeyError: :some_api_key
Dependency Management and CVEs
------------------------------
Please note that we do not accept patches for CVE version bumps. This is because application owners need to manually update their gems regardless of our efforts. Use `bundle update --conservative gem_name` to safely update vulnerable dependencies.
We don’t bump dependencies just to encourage use of new versions, including for security issues. This is because application owners need to manually update their gems regardless of our efforts. Use `bundle update --conservative gem_name` to safely update vulnerable dependencies.
Additional Resources
--------------------

6
railties/railties.gemspec
View File

@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
# NOTE: There's no need to update dependencies for CVEs in minor
# releases when users can simply run `bundle update vulnerable_gem`.
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "railties"
@ -33,6 +30,9 @@
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/railties/CHANGELOG.md"
}
# NOTE: Please read our dependency guidelines before updating versions:
# https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
s.add_dependency "activesupport", version
s.add_dependency "actionpack", version