Skip to content
This repository has been archived by the owner on Mar 15, 2021. It is now read-only.

Commit

Permalink
fix: upgrade spreadsheet_architect to remove hard axlsx dependency
Browse files Browse the repository at this point in the history
spreadsheet_architect already pulls-in a newer version of axlsx that
does not have the security vulnerability[1] in it. Ideally we should keep
an eye on the imminent release[2] of spreadsheet_architect that moves
away from axlsx in favour of the community-maintained caxlsx[3].

[1]: randym/axlsx#536
[2]: westonganger/spreadsheet_architect#28 (comment)
[3]: westonganger/spreadsheet_architect@3a6f02d#diff-4ac32a78649ca5bdd8e0ba38b7006a1e
  • Loading branch information
freesteph committed Feb 11, 2020
1 parent 09f2353 commit 52ff9aa
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 13 deletions.
2 changes: 0 additions & 2 deletions Gemfile
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,6 @@ gem 'bluecloth'

# ODS
gem 'spreadsheet_architect', '~> 3.2'
gem 'axlsx', git: 'https://github.com/NoRedInk/axlsx.git',
ref: '1a4a6387bf398e2782933ee6607e5589cd15bee3' # 2.1.0-pre-with-new-rubyzip, see https://github.com/randym/axlsx/issues/536

group :development, :test do
gem 'govuk-lint', '~> 3.10'
Expand Down
16 changes: 5 additions & 11 deletions Gemfile.lock
Original file line number Diff line number Diff line change
@@ -1,13 +1,3 @@
GIT
remote: https://github.com/NoRedInk/axlsx.git
revision: 1a4a6387bf398e2782933ee6607e5589cd15bee3
ref: 1a4a6387bf398e2782933ee6607e5589cd15bee3
specs:
axlsx (2.1.0.pre)
htmlentities (~> 4.3.1)
nokogiri (>= 1.4.1)
rubyzip (~> 1.2.1)

GIT
remote: https://github.com/mailtop/email_validator.git
revision: 83fe71a4731b0a01e84d1221264cc9802196820e
Expand Down Expand Up @@ -76,6 +66,11 @@ GEM
ast (2.4.0)
autoprefixer-rails (9.5.1.1)
execjs
axlsx (3.0.0.pre)
htmlentities (~> 4.3, >= 4.3.4)
mimemagic (~> 0.3)
nokogiri (~> 1.8, >= 1.8.2)
rubyzip (~> 1.2, >= 1.2.1)
axlsx_styler (0.2.0)
activesupport (>= 3.1)
axlsx (>= 2.0, < 4)
Expand Down Expand Up @@ -421,7 +416,6 @@ PLATFORMS
DEPENDENCIES
activerecord-import
autoprefixer-rails
axlsx!
bluecloth
canonical-rails
capybara
Expand Down

0 comments on commit 52ff9aa

Please sign in to comment.