Update Nokogiri because of security problems #285
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
oh, damn. I didn't see this until just now, and I created and merged in #294 to do the same thing. I actually like this a bit better because it doesn't modify the Thanks for your help! |
c-lliope
added a commit
that referenced
this pull request
Dec 7, 2015
Problem: Our app doesn't directly depend on nokogiri - the test suite depends on Capybara, which in turn depends on Nokogiri. Because of this, we should not have `nokogiri` referenced explicitly in our Gemfile. Commit 12e0db4 upgraded nokogiri by explicitly setting the desired version in the Gemfile. Solution: Several PRs (#285, #293) have used a different approach for upgrading Nokogiri, in order to get their build passing. They ran `bundle update nokogiri` without explicitly setting the desired version in the Gemfile. The most recent version of nokogiri contains the required security fix, so it solves the original problem. This commit reverts the changes made in 12e0db4, and updates nokogiri using the standard `bundle update nokogiri` approach.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In the CircleCi checks on my other PR #282 i saw that there are vulnerabilities for the current Nokogiri version in the Gemfile.lock