Update components and update_gems script #70

nmburgan · 2025-11-17T20:38:12Z

Update the update_gems script to also update the projects with any new components, and fixes an issue using the v2 RubyGems API.
Updates many components, including OpenSSL 3.0.18 which addresses CVE-2025-9230 and GHSA-76r2-c3cg-f5r9.
Removes the 7.x runtime and associated Ruby 2.7 references and simplifies some of the code. Should we ever need to build 7.x again, we can branch from a previous commit.
Removes references to AIX 7.1 and SLES 11.

bastelfreak · 2025-11-17T20:47:31Z

stupid question: if we want to see the different version bumps in the changelog, the easiest way would be one PR per changed component. That's a bit more work during the update (until we automate that part), but I think it will provide a big benefit for the users?

Edit: When I do version bumps I always try to do $component: Update $oldver->$newver, so users can easily compare the version range with their internal CVE database, if they have any.

nmburgan · 2025-11-17T20:52:24Z

We could certainly add that to the script. Probably makes sense if we plan to run this in automation.

nmburgan · 2025-11-17T21:00:01Z

I suppose one problem right now is that not all components are used in both projects. So a lot of updates will be for OpenBolt and not OpenVox. But once I get around to breaking up this repo and incorporating them into the project repos, that won't be a problem.

nmburgan · 2025-11-17T21:58:52Z

Quite noisy for the commit log for this PR, but should be much quieter in the future.

configs/components/ruby-augeas.rb

configs/components/ruby-selinux.rb

configs/components/rubygem-openvox-strings.rb

setup.ps1

tasks/build.rake

nmburgan · 2025-11-20T22:22:11Z

Looks like the latest ruby_smb might break OpenBolt (https://github.com/OpenVoxProject/openbolt/actions/runs/19552520911/job/55987566901?pr=140). Need to do some more investigation.

nmburgan · 2025-11-21T20:34:44Z

Reverted ruby_smb back to 1.1.0 (we already had been down this path before, my bad).

This is the only version available besides 3.4. This is really just for the build process and not the build itself. Using 3.4 for this is currently broken.

This updates the update_gems rake task to also add any new gem components to the project files. It will also create a separate commit for each change, so it is more easily ingestible by automation when creating the changelog.

We don't need this since we only have one agent project now. This makes it easier to maintain with automation.

Some of our existing project code has missing dependencies. This script previously only added new ones. Now, it scans the full component list for dependencies.

A new 7.0 has been released, but the addressable gem requires < 7.

…> openfact

Will make the appropriate namespace changes in OpenVox.

Even though the openbolt runtime comment says it's needed for Augeas, it really isn't. It was only needed for Nokogiri.

This streamlines the logic and makes it a bit simpler and easier to follow.

Component updates: - rubygem-CFPropertyList: version 3.0.7 -> 4.0.0, added deps: rubygem-base64, rubygem-nkf, rubygem-rexml - rubygem-addressable: version 2.8.7 -> 2.8.8, added deps: rubygem-public_suffix - rubygem-aws-partitions: version 1.1154.0 -> 1.1188.0 - rubygem-aws-sdk-core: version 3.232.0 -> 3.239.2, added deps: rubygem-aws-eventstream, rubygem-aws-partitions, rubygem-aws-sigv4, rubygem-base64, rubygem-bigdecimal, rubygem-jmespath, rubygem-logger - rubygem-aws-sdk-ec2: version 1.555.0 -> 1.583.0, added deps: rubygem-aws-sdk-core, rubygem-aws-sigv4 - rubygem-aws-sigv4: added deps: rubygem-aws-eventstream - rubygem-benchmark: new component (version 0.5.0) - rubygem-bigdecimal: new component (version 3.3.1) - rubygem-cookiejar: new component (version 0.3.4) - rubygem-date: new component (version 3.5.0) - rubygem-em-http-request: new component (version 1.1.7), added deps: rubygem-addressable, rubygem-cookiejar, rubygem-em-socksify, rubygem-eventmachine, rubygem-http_parser.rb - rubygem-em-socksify: new component (version 0.3.3), added deps: rubygem-base64, rubygem-eventmachine - rubygem-eventmachine: new component (version 1.2.7) - rubygem-excon: new component (version 1.3.1), added deps: rubygem-logger - rubygem-faraday: version 2.13.4 -> 2.14.0, added deps: rubygem-faraday-net_http, rubygem-json, rubygem-logger - rubygem-faraday-em_http: added deps: rubygem-em-http-request, rubygem-faraday - rubygem-faraday-excon: version 2.3.0 -> 2.4.0, added deps: rubygem-excon, rubygem-faraday - rubygem-faraday-follow_redirects: version 0.3.0 -> 0.4.0, added deps: rubygem-faraday - rubygem-faraday-httpclient: added deps: rubygem-httpclient - rubygem-faraday-multipart: added deps: rubygem-multipart-post - rubygem-faraday-net_http: version 3.4.1 -> 3.4.2, added deps: rubygem-net-http - rubygem-faraday-net_http_persistent: added deps: rubygem-faraday, rubygem-net-http-persistent - rubygem-faraday-patron: added deps: rubygem-patron - rubygem-faraday-rack: added deps: rubygem-faraday - rubygem-faraday-retry: added deps: rubygem-faraday - rubygem-fast_gettext: added deps: rubygem-prime - rubygem-forwardable: new component (version 1.3.3) - rubygem-getoptlong: new component (version 0.2.1) - rubygem-gettext: added deps: rubygem-erubi, rubygem-locale, rubygem-prime, rubygem-racc, rubygem-text - rubygem-gettext-setup: added deps: rubygem-fast_gettext, rubygem-gettext, rubygem-locale - rubygem-gssapi: added deps: rubygem-ffi - rubygem-gyoku: added deps: rubygem-builder, rubygem-rexml - rubygem-highline: added deps: rubygem-reline - rubygem-http_parser.rb: new component (version 0.8.0) - rubygem-httpclient: added deps: rubygem-mutex_m - rubygem-io-console: new component (version 0.8.1) - rubygem-json: new component (version 2.16.0) - rubygem-jwt: added deps: rubygem-base64 - rubygem-logging: added deps: rubygem-little-plugger, rubygem-multi_json - rubygem-minitar: version 0.12.1 -> 1.1.0 - rubygem-mutex_m: new component (version 0.3.0) - rubygem-net-ftp: added deps: rubygem-net-protocol, rubygem-time - rubygem-net-http: new component (version 0.8.0), added deps: rubygem-uri - rubygem-net-http-persistent: added deps: rubygem-connection_pool - rubygem-net-protocol: new component (version 0.2.2), added deps: rubygem-timeout - rubygem-net-scp: added deps: rubygem-net-ssh - rubygem-net-ssh-krb: added deps: rubygem-gssapi, rubygem-net-ssh - rubygem-nkf: new component (version 0.2.0) - rubygem-nori: added deps: rubygem-bigdecimal - rubygem-openfact: added deps: rubygem-base64, rubygem-hocon, rubygem-logger, rubygem-thor - rubygem-openvox: added deps: rubygem-base64, rubygem-benchmark, rubygem-ostruct, rubygem-racc - rubygem-orchestrator_client: version 0.7.1 -> 0.7.2, added deps: rubygem-faraday, rubygem-faraday-net_http_persistent - rubygem-ostruct: new component (version 0.6.3) - rubygem-prime: added deps: rubygem-forwardable, rubygem-singleton - rubygem-puppet-resource_api: added deps: rubygem-hocon - rubygem-puppet_forge: version 5.0.4 -> 6.0.0, added deps: rubygem-faraday, rubygem-faraday-follow_redirects, rubygem-minitar, rubygem-semantic_puppet - rubygem-puppetfile-resolver: added deps: rubygem-molinillo, rubygem-semantic_puppet - rubygem-r10k: added deps: rubygem-colored2, rubygem-cri, rubygem-gettext-setup, rubygem-jwt, rubygem-log4r, rubygem-minitar, rubygem-multi_json, rubygem-puppet_forge - rubygem-racc: new component (version 1.8.1) - rubygem-reline: new component (version 0.6.3), added deps: rubygem-io-console - rubygem-rexml: version 3.4.2 -> 3.4.4 - rubygem-ruby_smb: added deps: rubygem-bindata, rubygem-rubyntlm, rubygem-windows_error - rubygem-rubyntlm: version 0.6.3 -> 0.6.5, added deps: rubygem-base64 - rubygem-rubyzip: version 3.0.2 -> 3.2.2 - rubygem-singleton: new component (version 0.3.0) - rubygem-sys-filesystem: version 1.5.3 -> 1.5.4, added deps: rubygem-ffi - rubygem-terminal-table: added deps: rubygem-unicode-display_width - rubygem-time: new component (version 0.4.1), added deps: rubygem-date - rubygem-timeout: new component (version 0.4.4) - rubygem-unicode-display_width: version 3.1.5 -> 3.2.0, added deps: rubygem-unicode-emoji - rubygem-unicode-emoji: new component (version 4.1.0) - rubygem-uri: new component (version 1.1.1) - rubygem-webrick: version 1.9.1 -> 1.9.2 - rubygem-winrm: added deps: rubygem-builder, rubygem-erubi, rubygem-gssapi, rubygem-gyoku, rubygem-httpclient, rubygem-logging, rubygem-nori, rubygem-rexml, rubygem-rubyntlm - rubygem-winrm-fs: added deps: rubygem-erubi, rubygem-logging, rubygem-rubyzip, rubygem-winrm Project component additions: - agent-runtime-main: rubygem-date, rubygem-forwardable, rubygem-io-console, rubygem-net-protocol, rubygem-nkf, rubygem-racc, rubygem-reline, rubygem-singleton, rubygem-time, rubygem-timeout - openbolt-runtime: rubygem-benchmark, rubygem-bigdecimal, rubygem-cookiejar, rubygem-date, rubygem-em-http-request, rubygem-em-socksify, rubygem-eventmachine, rubygem-excon, rubygem-forwardable, rubygem-http_parser.rb, rubygem-io-console, rubygem-json, rubygem-mutex_m, rubygem-net-http, rubygem-net-protocol, rubygem-nkf, rubygem-ostruct, rubygem-patron, rubygem-racc, rubygem-reline, rubygem-rexml, rubygem-singleton, rubygem-time, rubygem-timeout, rubygem-unicode-emoji, rubygem-uri

nmburgan · 2025-11-28T23:27:47Z

Okay, a bit happier with this version. It confines all the updates to a single commit, and we'll build another script to make the changelog and supporting files show diffs in a better way.

nmburgan force-pushed the update_update_gems branch from 2b42513 to bf15a99 Compare November 17, 2025 20:50

nmburgan force-pushed the update_update_gems branch 4 times, most recently from 493100d to d9bc9ea Compare November 17, 2025 21:58

nmburgan force-pushed the update_update_gems branch 4 times, most recently from 0060fad to ffbef26 Compare November 19, 2025 17:48