Rails-related advisory files out-of-date? (v4.2.6 recently released)

[dcarral]

We've an application using Rails v.4.2.5.2 where bundler-audit doesn't complain about anything.

However, when upgrading Rails dependency to v.4.2.6 (which has been released a few days ago), bundler-audit warns about several vulnerabilities.

The reported vulnerabilities are the following ones:

• CVE-2016-0753
• CVE-2016-0752
• CVE-2015-7581
• CVE-2015-7577
• CVE-2016-2098
• CVE-2015-7576
• CVE-2016-0751

[dcarral]

Fwiw, I've just seen that @reedloden applied an optimistic version constraint approach in order to fix the very-related (and already closed) #243.

[spickermann]

+1