Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upReplace therubyracer with mini_racer #29285
Conversation
rails-bot
assigned
rafaelfranca
May 30, 2017
This comment has been minimized.
This comment has been minimized.
rails-bot
commented
May 30, 2017
|
(@rails-bot has picked a reviewer for you, use r? to override) |
This comment has been minimized.
This comment has been minimized.
|
I assume this is already compatible with rails maintained sprockets-dependent libs? |
vipulnsward
added
railties
asset pipeline
labels
May 30, 2017
This comment has been minimized.
This comment has been minimized.
|
Yeah it has been execjs compatible for a very long time. |
guilleiguaran
merged commit 53c8dff
into
rails:master
May 30, 2017
snowfield702
referenced this pull request
May 17, 2018
Closed
Create rails application with skip sprockets #15
added a commit
to sul-dlss/was-thumbnail-service
that referenced
this pull request
Sep 6, 2018
This was referenced Sep 6, 2018
added a commit
to sul-dlss/sul_pub
that referenced
this pull request
Sep 6, 2018
added a commit
to sul-dlss/sul_pub
that referenced
this pull request
Sep 7, 2018
This was referenced Nov 6, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
SamSaffron commentedMay 30, 2017
therubyracer is a relic, it depends on an ancient version of v8 that has multiple known security vulnerabilities
https://github.com/cowboyd/therubyracer/blob/master/therubyracer.gemspec#L20
In particular this is the equivalent of shipping a dependency to Chrome version 31.
Chrome 31 was released 2013-11-12
All places that talk about therubyracer or include it in templates should be replaced with mini_racer that depends on the most recent version of v8.
per: #29276 (comment)