All Versions
13
Latest Version
Avg Release Cycle
246 days
Latest Release
475 days ago
Changelog History
Page 1
Changelog History
Page 1
-
v0.8.0 Changes
March 10, 2021- ๐ No longer vendor [ruby-advisory-db].
- โ Added {Bundler::Audit::Configuration}.
- Supports loading YAML configuration data from a
.bundler-audit.yml
file.
- Supports loading YAML configuration data from a
- โ Added {Bundler::Audit::Results}.
- โ Added {Bundler::Audit::Report}.
- โ Added {Bundler::Audit::CLI::Formats}.
- โ Added {Bundler::Audit::CLI::Formats::Text}.
- โ Added {Bundler::Audit::CLI::Formats::JSON}.
- โ Added {Bundler::Audit::Database::DEFAULT_PATH}.
- โ Added {Bundler::Audit::Database.exists?}.
- โ Added {Bundler::Audit::Database#git?}.
- โ Added {Bundler::Audit::Database#update!}.
- Will raise a {Bundler::Audit::Database::UpdateFailed UpdateFailed}
exception, if the
git pull
command fails.
- Will raise a {Bundler::Audit::Database::UpdateFailed UpdateFailed}
exception, if the
- โก๏ธ Added {Bundler::Audit::Database#last_updated_at}.
- โ Added {Bundler::Audit::Scanner#report}.
- {Bundler::Audit::Database::USER_PATH} is now
Gem.user_home
aware.Gem.user_home
will try to inferHOME
, even if it is not set.
- {Bundler::Audit::Database#download} will now raise a
{Bundler::Audit::Database::DownloadFailed DownloadFailed} exception, if the
git clone
command fails. - {Bundler::Audit::Scanner#initialize}:
- Now accepts an additional
database
andconfig_dot_file
arguments. - Will now raise a
Bundler::GemfileLockNotFound
exception, if the givenGemfile.lock
file cannot be found.
- Now accepts an additional
- {Bundler::Audit::Scanner#scan_sources} will now ignore any source with a
127.0.0.0/8
or::1/128
IP address. - {Bundler::Audit::Scanner#scan_specs} will ignore any advisories listed in
{Bundler::Audit::Configuration#ignore}, which is loaded from the
.bundler-audit.yml
file. - โก๏ธ Deprecated {Bundler::Audit::Database.update!} in favor of {Bundler::Audit::Database#update! #update!}.
- โ Removed
Bundler::Audit::Database::VENDORED_PATH
. - โ Removed
Bundler::Audit::Database::VENDORED_TIMESTAMP
.
CLI
- Require [thor] ~> 1.0.
- โ Added
bundler-audit stats
. - โ Added
bundler-audit download
. bundler-audit check
:- Now accepts a optional
DIR
argument for the project directory. bundler-audit check
will now print an explicit error message and exit, if the givenDIR
does not exist.- Will now auto-download [ruby-advisory-db] to ensure the latest advisory information is used on first run.
- Now supports a
--database
option for specifying a path to an alternative [ruby-advisory-db] copy. - Now supports a
--gemfile-lock
option for specifying a customGemfile.lock
file within the project directory. - Now supports a
--format
option for specifying the desired format.text
andjson
are supported, but other custom formats can be loaded. See {Bundler::Audit::CLI::Formats}. - Now supports a
--output
option for writing the report output to a file. - Prints both CVE and GHSA IDs.
- Now accepts a optional
- ๐จ Print all error messages to stderr.
- ๐จ No longer print number of advisories in
bundler-audit version
.
-
v0.7.0 Changes
June 12, 2020- Require [thor] >= 0.18, < 2.
- โ Added {Bundler::Audit::Advisory#ghsa} (@rschultheis).
- โ Added {Bundler::Audit::Advisory#cvss_v3} (@ahamlin-nr).
- โ Added {Bundler::Audit::Advisory#identifiers} (@rschultheis).
- ๐ Updated {Bundler::Audit::Advisory#criticality} ranges (@reedloden).
- โก๏ธ Avoid rebasing the ruby-advisory-db when updating (@nicknovitski).
- ๐ Fixed issue with Bundler 2.x where source URIs are no longer parsed as
URI::HTTP
objects, but asBundler::URI::HTTP
objects. (@milgner) - โก๏ธ Make it more explicit that git is required for database updates (@fatkodima)
-
v0.7.0.1 Changes
June 12, 2020- ๐ Forgot to populate
data/ruby-advisory-db
.
- ๐ Forgot to populate
-
v0.6.1 Changes
January 18, 2019- ๐ Require bundler
>= 1.2.0, < 3
to support [bundler] 2.0.
- ๐ Require bundler
-
v0.6.0 Changes
July 18, 2017- โ Added
--quiet
option tocheck
andupdate
commands (@jaredbeck). - โ Added
bin/bundler-audit
which will be executed whenbundle audit
is ran (@vassilevsky).
- โ Added
-
v0.5.0 Changes
February 29, 2016- โ Added {Bundler::Audit::Task}.
- โ Added {Bundler::Audit::Advisory#date}.
- โ Added {Bundler::Audit::Advisory#cve_id}.
- โ Added {Bundler::Audit::Advisory#osvdb_id}.
- ๐ Allow insecure gem sources (
http://
andgit://
), if they are hosted on a private network.
CLI
- โ Added the
--update
option tobundler-audit check
. - โก๏ธ
bundler-audit update
now returns a non-zero exit status on error. - โก๏ธ
bundler-audit update
only updates~/.local/share/ruby-advisory-db
, if it is a git repository.
-
v0.4.0 Changes
June 30, 2015- ๐ Require ruby >= 1.9.3 due to i18n gem deprecating < 1.9.3.
- โ Added {Bundler::Audit::Advisory#osvdb}.
- Resolve the IP addresses of gem sources and ignore intranet gem sources. (PR #90)
- ๐ Use ISO8601 date format when querying the git timestamp of ruby-advisory-db. (PR #92)
CLI
- ๐จ Print the CVE or OSVDB id.
- ๐จ No longer print "Unpatched versions found!" when an insecure gem source is detected. (PR #84)
-
v0.3.1 Changes
April 20, 2014- โ Added thor ~> 0.18 as a dependency.
- No longer rely on the vendored version of thor within bundler.
- โก๏ธ Store the timestamp of when
data/ruby-advisory-db
was last updated indata/ruby-advisory-db.ts
. - ๐ Use
data/ruby-advisory-db.ts
instead of the creation time of thedataruby-advisory-db
directory, which is always the install time of the rubygem.
-
v0.3.0 Changes
November 01, 2013- โ Added {Bundler::Audit::Database.update!} which uses
git
to download [ruby-advisory-db] to~/.local/share/ruby-advisory-db
. - {Bundler::Audit::Database.path} now returns the path to either
~/.local/share/ruby-advisory-db
or the vendored copy, depending on which is more recent.
CLI
- โ Added the
bundler-audit update
sub-command.
- โ Added {Bundler::Audit::Database.update!} which uses
-
v0.2.0 Changes
August 27, 2013- ๐ Require RubyGems >= 1.8.0. Prior versions of RubyGems could not correctly
parse approximate version requirements (
~> 1.2.3
). - โก๏ธ Updated the [ruby-advisory-db].
- โ Added {Bundler::Audit::Advisory#unaffected_versions}.
- โ Added {Bundler::Audit::Advisory#unaffected?}.
- โ Added {Bundler::Audit::Advisory#patched?}.
- ๐ Renamed
Advisory#cve
to {Bundler::Audit::Advisory#id}.
- ๐ Require RubyGems >= 1.8.0. Prior versions of RubyGems could not correctly
parse approximate version requirements (