Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apply minor and patch updates for dependencies #4088

Merged
merged 3 commits into from
Feb 10, 2024

Conversation

orien
Copy link
Contributor

@orien orien commented Feb 7, 2024

Apply some minor and patch level dependency updates.

Note

The bundle_audit build step is failing. It correctly identifies a security issue with version 1.15.5 of the nokogiri gem being used. Unfortunately, the patched version 1.16.2 is only available on Ruby 3.0 and above. We'll need to upgrade Ruby for this service to apply the patch.

@orien orien force-pushed the bundle-update branch 3 times, most recently from 8302760 to dd690d5 Compare February 7, 2024 05:38
@@ -243,7 +243,7 @@ GEM
erubi (~> 1.4)
rails-dom-testing (~> 2.0)
rails-html-sanitizer (~> 1.1, >= 1.2.0)
active_hash (3.0.0)
active_hash (3.2.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -266,47 +266,48 @@ GEM
minitest (>= 5.1)
tzinfo (~> 2.0)
zeitwerk (~> 2.3)
addressable (2.8.4)
addressable (2.8.6)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

addressable

Patch version upgrade 📈🔹 2.8.4 → 2.8.6

[change-log, source-code, gem-diff]

public_suffix (>= 2.0.2, < 6.0)
airbrake (11.0.1)
airbrake (11.0.3)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

airbrake-ruby (~> 5.1)
airbrake-ruby (5.2.0)
airbrake-ruby (5.2.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

airbrake-ruby

Patch version upgrade 📈🔹 5.2.0 → 5.2.1

[change-log, source-code, gem-diff]

rbtree3 (~> 0.5)
ansible (0.2.2)
ar_multi_threaded_transactional_tests (0.5.0)
activerecord (>= 4.2.0, < 6.2.0)
ast (2.4.1)
ast (2.4.2)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ast

Patch version upgrade 📈🔹 2.4.1 → 2.4.2

[change-log, source-code, gem-diff]

Commits

A change of 5 commits. See the full changes on the compare page.

These are the individual commits:

attr_encrypted (3.1.0)
encryptor (~> 3.0.0)
audited (5.4.2)
audited (5.4.3)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

activerecord (>= 5.0, < 7.2)
request_store (~> 1.2)
autoprefixer-rails (9.4.8)
autoprefixer-rails (9.8.6.5)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

autoprefixer-rails

Minor version upgrade 📈🔶 9.4.8 → 9.8.6.5

[change-log, source-code, gem-diff]

Commits

A change of 106 commits. See the full changes on the compare page.

These are the first 10 commits:

aws-sdk-core (3.100.0)
aws-eventstream (~> 1, >= 1.0.2)
aws-partitions (~> 1, >= 1.239.0)
awesome_print (1.9.2)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-eventstream (~> 1, >= 1.0.2)
aws-partitions (~> 1, >= 1.239.0)
awesome_print (1.9.2)
aws-eventstream (1.3.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-partitions (~> 1, >= 1.239.0)
awesome_print (1.9.2)
aws-eventstream (1.3.0)
aws-partitions (1.887.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-partitions

Minor version upgrade 📈🔶 1.329.0 → 1.887.0

[change-log, source-code, gem-diff]

awesome_print (1.9.2)
aws-eventstream (1.3.0)
aws-partitions (1.887.0)
aws-sdk-core (3.191.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-sdk-core

Minor version upgrade 📈🔶 3.100.0 → 3.191.0

[change-log, source-code, gem-diff]

aws-partitions (~> 1, >= 1.651.0)
aws-sigv4 (~> 1.8)
jmespath (~> 1, >= 1.6.1)
aws-sdk-ecr (1.69.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-sdk-ecr

Minor version upgrade 📈🔶 1.3.0 → 1.69.0

[change-log, source-code, gem-diff]

aws-sigv4 (~> 1.0)
aws-sdk-kms (1.23.0)
aws-sdk-core (~> 3, >= 3.58.0)
aws-sdk-kms (1.77.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-sdk-kms

Minor version upgrade 📈🔶 1.23.0 → 1.77.0

[change-log, source-code, gem-diff]

aws-sigv4 (~> 1.1)
aws-sdk-s3 (1.45.0)
aws-sdk-core (~> 3, >= 3.58.0)
aws-sdk-s3 (1.143.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-sdk-s3

Minor version upgrade 📈🔶 1.45.0 → 1.143.0

[change-log, source-code, gem-diff]

aws-sigv4 (~> 1.1)
aws-sigv4 (1.6.1)
aws-sigv4 (~> 1.8)
aws-sigv4 (1.8.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-eventstream (~> 1, >= 1.0.2)
base64 (0.1.1)
base64 (0.2.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aws-eventstream (~> 1, >= 1.0.2)
base64 (0.1.1)
base64 (0.2.0)
bigdecimal (3.1.6)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bigdecimal

Gem added ⛄

[change-log, source-code, gem-diff]

binding_of_caller (0.8.0)
debug_inspector (>= 0.0.1)
bootsnap (1.4.5)
bootsnap (1.6.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -315,76 +316,78 @@ GEM
momentjs-rails (>= 2.8.1)
brakeman (5.4.1)
builder (3.2.4)
bundler-audit (0.9.0.1)
bundler-audit (0.9.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

bundler (>= 1.2.0, < 3)
thor (~> 1.0)
byebug (8.2.5)
chef-utils (18.1.29)
chef-utils (18.4.2)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

concurrent-ruby
coderay (1.1.1)
coderay (1.1.3)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

connection_pool (2.2.1)
crack (0.4.3)
safe_yaml (~> 1.0.0)
concurrent-ruby (1.2.3)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

crack (0.4.3)
safe_yaml (~> 1.0.0)
concurrent-ruby (1.2.3)
connection_pool (2.4.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

connection_pool

Minor version upgrade 📈🔶 2.2.1 → 2.4.1

[change-log, source-code, gem-diff]

Commits

A change of 85 commits. See the full changes on the compare page.

These are the first 10 commits:

safe_yaml (~> 1.0.0)
concurrent-ruby (1.2.3)
connection_pool (2.4.1)
crack (0.4.6)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

crass (1.0.6)
dalli (3.2.3)
dalli (3.2.7)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@@ -616,69 +619,68 @@ GEM
sawyer (0.9.2)
addressable (>= 2.3.5)
faraday (>= 0.17.3, < 3)
sentry-rails (5.4.2)
sentry-rails (5.16.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sentry-ruby (~> 5.4.2)
sentry-ruby (5.4.2)
sentry-ruby (~> 5.16.1)
sentry-ruby (5.16.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sexp_processor (4.12.1)
single_cov (1.3.2)
slop (3.6.0)
sexp_processor (4.17.1)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

single_cov (1.3.2)
slop (3.6.0)
sexp_processor (4.17.1)
single_cov (1.5.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

single_cov

Minor version upgrade 📈🔶 1.3.2 → 1.5.0

[change-log, source-code, gem-diff]

Commits

A change of 7 commits. See the full changes on the compare page.

These are the individual commits:

concurrent-ruby (~> 1.0, >= 1.0.2)
sentry-user_informer (0.2.0)
rack
railties (>= 6.1.0, < 7.1.0)
sentry-rails (~> 5.4)
sexp_processor (4.12.1)
single_cov (1.3.2)
slop (3.6.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

slop

Gem removed 🔥

[change-log, source-code, gem-diff]

snaky_hash (2.0.1)
hashie
version_gem (~> 1.1, >= 1.1.1)
socksify (1.7.1)
soft_deletion (1.6.0)
activerecord (>= 4.2.0, < 6.2.0)
soft_deletion (1.9.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

soft_deletion

Minor version upgrade 📈🔶 1.6.0 → 1.9.0

[change-log, source-code, gem-diff]

Commits

A change of 16 commits. See the full changes on the compare page.

These are the first 10 commits:

stackprof (0.2.12)
terminal-table (1.8.0)
unicode-display_width (~> 1.1, >= 1.1.1)
thor (1.3.0)
tilt (2.0.10)
tilt (2.3.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tilt

Minor version upgrade 📈🔶 2.0.10 → 2.3.0

[change-log, source-code, gem-diff]

Commits

A change of 175 commits. See the full changes on the compare page.

These are the first 10 commits:

tzinfo (2.0.6)
concurrent-ruby (~> 1.0)
uglifier (3.2.0)
execjs (>= 0.3.0, < 3)
unf (0.1.4)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unf

Gem removed 🔥

[change-log, source-code, gem-diff]

tzinfo (2.0.6)
concurrent-ruby (~> 1.0)
uglifier (3.2.0)
execjs (>= 0.3.0, < 3)
unf (0.1.4)
unf_ext
unf_ext (0.0.8.2)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

unf_ext

Gem removed 🔥

[change-log, source-code, gem-diff]

rack (>= 1.0)
webmock (3.0.1)
addressable (>= 2.3.6)
warden (1.2.9)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

warden

Patch version upgrade 📈🔹 1.2.7 → 1.2.9

[change-log, source-code, gem-diff]

Commits

A change of 90 commits. See the full changes on the compare page.

These are the first 10 commits:

addressable (>= 2.3.6)
warden (1.2.9)
rack (>= 2.0.9)
webmock (3.20.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

websocket-driver (0.7.6)
websocket-extensions (>= 0.1.0)
websocket-extensions (0.1.5)
zeitwerk (2.6.12)
zeitwerk (2.6.13)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zendesk_api (2.0.1)
faraday (> 2.0.0)
faraday-multipart
hashie (>= 3.5.2, < 6.0.0)
inflection
mini_mime
multipart-post (~> 2.0)
zstd-ruby (1.5.5.0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

zstd-ruby

Gem added ⛄

[change-log, source-code, gem-diff]

@orien orien marked this pull request as ready for review February 7, 2024 06:37
@orien orien requested a review from grosser as a code owner February 7, 2024 06:37
@grosser
Copy link
Contributor

grosser commented Feb 7, 2024

  • this PR does not bump the ruby version though, so this is prep ?
  • did you deploy this to staging/had it running locally ?
  • FYI instead of comments please use something like lock-diff so we have a single comment and the github diff view is still readable

@orien
Copy link
Contributor Author

orien commented Feb 7, 2024

this PR does not bump the ruby version though, so this is prep ?

Regarding the note in the PR description, I'm explaining why the build is not passing. There's more work required to get the project working on Ruby 3, and resolve the CVE.

To keep the CI workflow passing, perhaps we should add an exception for the CVE until the project is migrated to Ruby 3.

sh "bundle-audit check --update --ignore CVE-2015-9284 CVE-2022-0759 GHSA-hjp3-5g2q-7jww CVE-2023-34246"

did you deploy this to staging/had it running locally ?

Yes, this branch has been deployed to a staging environment and looks to be working fine.

FYI instead of comments please use something like lock-diff so we have a single comment and the github diff view is still readable

I'll try that next time. Thanks.

@grosser
Copy link
Contributor

grosser commented Feb 7, 2024

the audit step has an ignore flag that can be used to ignore selcted cves, that should get the PR green

@orien
Copy link
Contributor Author

orien commented Feb 9, 2024

Thanks. The build is passing now.

@orien
Copy link
Contributor Author

orien commented Feb 10, 2024

@grosser, is there anything else I can do to get this pull request accepted? I don't have merge permissions, so I'll need help.

@grosser
Copy link
Contributor

grosser commented Feb 10, 2024

tried that locally and ran into:

Ruby (< 3.4.dev, >= 3.0), which is required by gem 'sqlite3 (= 1.7.2)', is not available in the local ruby installation

https://rubygems.org/gems/sqlite3/versions/1.7.2-arm-linux
so needs to be 1.6.9, can you downgrade it ?

... otherwise worked fine 👍 / I can merge

I assumed you work for zendesk since we just talked about ruby 3 upgrades so I though you'd DIY merge :D

@orien
Copy link
Contributor Author

orien commented Feb 10, 2024

tried that locally and ran into:

Ruby (< 3.4.dev, >= 3.0), which is required by gem 'sqlite3 (= 1.7.2)', is not available in the local ruby installation

It's strange that that wasn't picked up in the CI build, or in my test run. I've downgraded the gem to version 1.6.9.

@grosser
Copy link
Contributor

grosser commented Feb 10, 2024

thx., it's a bug in sqlite on arm, which CI does not run

@grosser grosser merged commit a370be7 into zendesk:master Feb 10, 2024
9 checks passed
@orien orien deleted the bundle-update branch February 11, 2024 00:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants