-
Notifications
You must be signed in to change notification settings - Fork 971
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dependabot can never fix Rails vulnerabilities #4867
Comments
Yeah this is a really annoying limitation, I do think something like what you're suggesting is possible but it's a little tricky given our current implementation. I hope we can prioritize some work around this soon |
dependabot can't update rails automatically at the minute, presumably due to its one update per PR thing: dependabot/dependabot-core#4867
I worked on improving this upstream at rubygems/rubygems#5520. I tried the Even if it worked, the |
This is specific example of the generic problem described in: So closing as a duplicate and let's continue the conversation there. |
Hello 👋! I'm not sure if grouped security updates, or adding explicit groups for all Rails family gems are approaches that work for this issue, I haven't tried. But I do expect changes in rubygems/rubygems#7558 to make security updates for Rails work by default! |
For what it's worth, the fix I mentioned was released with Bundler 2.5.10. I'm hopeful that once Dependabot starts using it, it should be able to create security updates for Rails, but I haven't tried it. |
Package ecosystem: bundler
Updated dependency:
rails
What you expected to see, versus what you actually saw:
rails
is a collection of sub-gems that are all updated in lockstep. OurGemfile
just hasgem "rails"
. Anytime a Rails vulnerability is found, it's reported under the respective sub-gem (likeactivestorage
). We'll get a GitHub security Dependabot alert for it but Dependabot will be unable to make a PR to fix the vulnerability. The security alert (example here) looks something like this:The earliest fixed version is
6.1.4.7
.This happens all the time, since Rails vulnerabilities are unfortunately somewhat common and we have many repos that use Rails as a dependency.
Would it be possible for Dependabot to try updating a dependency's parent when updating the dependency fails for a security fix? (Alternatively, given the popularity of Rails, perhaps a Rails-specific fix would be justified and simpler to implement?)
The text was updated successfully, but these errors were encountered: