Auto-update dependencies.#1341
Conversation
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request modifies the Gemfile.lock, but instead of updating dependencies as the title suggests, it introduces several downgrades. Specifically, activesupport is downgraded from 7.2.3.1 to 7.0.10, minitest from 5.27.0 to 5.26.1, and securerandom from 0.4.1 to 0.3.2. The review feedback correctly identifies these changes as regressions that could lead to security vulnerabilities and compatibility issues, contradicting the intended purpose of the PR.
| specs: | ||
| CFPropertyList (3.0.9) | ||
| activesupport (7.2.3.1) | ||
| activesupport (7.0.10) |
There was a problem hiding this comment.
This pull request is titled "Auto-update dependencies", but it significantly downgrades activesupport from 7.2.3.1 to 7.0.10. Downgrading core libraries can re-introduce security vulnerabilities and lead to compatibility issues.
| json (2.19.5) | ||
| logger (1.7.0) | ||
| minitest (5.27.0) | ||
| minitest (5.26.1) |
There was a problem hiding this comment.
This change downgrades minitest from 5.27.0 to 5.26.1. This is a regression that contradicts the pull request's intent to update dependencies.
| rexml (3.4.4) | ||
| ruby-macho (2.5.1) | ||
| securerandom (0.4.1) | ||
| securerandom (0.3.2) |
There was a problem hiding this comment.
This change downgrades securerandom from 0.4.1 to 0.3.2. This is a regression that contradicts the pull request's intent to update dependencies.
dpebot
force-pushed
the
dpebot-repositorygardener
branch
2 times, most recently
from
d150d30 to
b73d81e
Compare
dpebot
force-pushed
the
dpebot-repositorygardener
branch
from
b73d81e to
3d7b7d1
Compare
|
This actually fixes the CI for sample builds and isn't part of the release. We could effectively upgrade Ruby version in the future which would bump transitive dependencies but this is fine for now |
2 participants
Brought to you by your friendly Repository Gardener.