Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package rubygem-bundler-audit for
openSUSE:Factory checked in at 2026-10-30 18:18:12
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rubygem-bundler-audit (Old)
and /work/SRC/openSUSE:Factory/.rubygem-bundler-audit.new.1255 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-bundler-audit"
Fri Oct 30 18:18:12 2026 rev:10 rq:1393868 version:0.9.3
Changes:
--------
---
/work/SRC/openSUSE:Factory/rubygem-bundler-audit/rubygem-bundler-audit.changes
2024-11-07 16:27:07.913008624 +0100
+++
/work/SRC/openSUSE:Factory/.rubygem-bundler-audit.new.1255/rubygem-bundler-audit.changes
2026-10-30 18:23:58.658597518 +0100
@@ -1,0 +2,10 @@
+Sat Oct 17 15:37:01 UTC 2026 - Andrea Manzini <[email protected]>
+
+- Update to version 0.9.3:
+ * Officially support Ruby 3.4, 3.5, and 4.0
+ * Add support for Bundler 4.x
+ * CLI: ensure `bundler-audit check` honors the `BUNDLER_AUDIT_DB`
+ environment variable
+- Regenerate spec file with gem2rpm and clean up with spec-cleaner
+
+-------------------------------------------------------------------
Old:
----
bundler-audit-0.9.2.gem
New:
----
bundler-audit-0.9.3.gem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rubygem-bundler-audit.spec ++++++
--- /var/tmp/diff_new_pack.BcXrG2/_old 2026-10-30 18:23:59.712641642 +0100
+++ /var/tmp/diff_new_pack.BcXrG2/_new 2026-10-30 18:23:59.716641810 +0100
@@ -1,7 +1,7 @@
#
# spec file for package rubygem-bundler-audit
#
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -16,27 +16,25 @@
#
+%define mod_name bundler-audit
+%define mod_full_name %{mod_name}-%{version}
#
# This file was generated with a gem2rpm.yml and not just plain gem2rpm.
# All sections marked as MANUAL, license headers, summaries and descriptions
# can be maintained in that file. Please consult this file before editing any
# of those fields
#
-
Name: rubygem-bundler-audit
-Version: 0.9.2
+Version: 0.9.3
Release: 0
-%define mod_name bundler-audit
-%define mod_full_name %{mod_name}-%{version}
-BuildRequires: %{ruby >= 2.0.0}
-BuildRequires: %{rubygem gem2rpm}
-BuildRequires: ruby-macros >= 5
-BuildRequires: update-alternatives
+Summary: Patch-level verification for Bundler
+License: GPL-3.0-or-later
URL: https://github.com/rubysec/bundler-audit#readme
Source: https://rubygems.org/gems/%{mod_full_name}.gem
Source1: gem2rpm.yml
-Summary: Patch-level verification for Bundler
-License: GPL-3.0-or-later
+BuildRequires: %{ruby >= 2.0.0}
+BuildRequires: %{rubygem gem2rpm}
+BuildRequires: ruby-macros >= 5
%description
bundler-audit provides patch-level verification for Bundled apps.
@@ -47,6 +45,7 @@
%install
%gem_install \
+ --no-rdoc --no-ri \
--symlink-binaries \
--doc-files="COPYING.txt ChangeLog.md README.md" \
-f
++++++ bundler-audit-0.9.2.gem -> bundler-audit-0.9.3.gem ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.github/workflows/ruby.yml
new/.github/workflows/ruby.yml
--- old/.github/workflows/ruby.yml 2024-08-23 01:56:00.000000000 +0200
+++ new/.github/workflows/ruby.yml 1980-01-02 01:00:00.000000000 +0100
@@ -13,8 +13,16 @@
- '3.1'
- '3.2'
- '3.3'
+ - '3.4'
+ - '3.5'
+ - '4.0'
- jruby
- truffleruby
+ include:
+ - ruby: '3.0'
+ rubygems_version: '3.5.23'
+ - ruby: '3.1'
+ rubygems_version: '3.6.9'
name: Ruby ${{ matrix.ruby }}
steps:
- uses: actions/checkout@v2
@@ -22,6 +30,12 @@
uses: ruby/setup-ruby@v1
with:
ruby-version: ${{ matrix.ruby }}
+ - name: Update RubyGems
+ env:
+ RUBYGEMS_VERSION: ${{ matrix.rubygems_version }}
+ run: |
+ gem update --system ${RUBYGEMS_VERSION:-}
+ gem -v
- name: Install dependencies
run: bundle install --jobs 4 --retry 3
- name: Run tests
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.rubocop.yml new/.rubocop.yml
--- old/.rubocop.yml 2024-08-23 01:56:00.000000000 +0200
+++ new/.rubocop.yml 1980-01-02 01:00:00.000000000 +0100
@@ -1,5 +1,5 @@
AllCops:
- NewCops: enable
+ NewCops: disable
SuggestExtensions: false
TargetRubyVersion: 2.7
Exclude:
@@ -65,6 +65,9 @@
Style/Lambda: { Enabled: false } # Offense count: 2
Style/SafeNavigation: { Enabled: false } # Offense count: 2
Lint/IneffectiveAccessModifier: { Enabled: false } # Offense count: 1
+Gemspec/RequireMFA:
+ Exclude:
+ - 'bundler-audit.gemspec'
Gemspec/DuplicatedAssignment:
Exclude:
- 'bundler-audit.gemspec'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/ChangeLog.md new/ChangeLog.md
--- old/ChangeLog.md 2024-08-23 01:56:00.000000000 +0200
+++ new/ChangeLog.md 1980-01-02 01:00:00.000000000 +0100
@@ -1,3 +1,14 @@
+### 0.9.3 / 2025-11-28
+
+* Officially support Ruby 3.4, 3.5, and 4.0.
+* Added support for Bundler 4.x.
+* Fixed typos in API documentation.
+
+#### CLI
+
+* Ensure that the `bundler-audit check` command honors the
+ `BUNDLER_AUDIT_DB` environment variable.
+
### 0.9.2 / 2024-08-22
* Officially support Ruby 3.2 and 3.3.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Gemfile new/Gemfile
--- old/Gemfile 2024-08-23 01:56:00.000000000 +0200
+++ new/Gemfile 1980-01-02 01:00:00.000000000 +0100
@@ -4,7 +4,7 @@
group :development do
gem 'rake'
- gem 'rubygems-tasks', '~> 0.2'
+ gem 'rubygems-tasks', '~> 0.3'
gem 'rubocop', '~> 1.18'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/README.md new/README.md
--- old/README.md 2024-08-23 01:56:00.000000000 +0200
+++ new/README.md 1980-01-02 01:00:00.000000000 +0100
@@ -24,90 +24,94 @@
Audit a project's `Gemfile.lock`:
- $ bundle-audit
- Name: actionpack
- Version: 3.2.10
- Advisory: OSVDB-91452
- Criticality: Medium
- URL: http://www.osvdb.org/show/osvdb/91452
- Title: XSS vulnerability in sanitize_css in Action Pack
- Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
-
- Name: actionpack
- Version: 3.2.10
- Advisory: OSVDB-91454
- Criticality: Medium
- URL: http://osvdb.org/show/osvdb/91454
- Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
- Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
-
- Name: actionpack
- Version: 3.2.10
- Advisory: OSVDB-89026
- Criticality: High
- URL: http://osvdb.org/show/osvdb/89026
- Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter
Parsing Remote Code Execution
- Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
-
- Name: activerecord
- Version: 3.2.10
- Advisory: OSVDB-91453
- Criticality: High
- URL: http://osvdb.org/show/osvdb/91453
- Title: Symbol DoS vulnerability in Active Record
- Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
-
- Name: activerecord
- Version: 3.2.10
- Advisory: OSVDB-90072
- Criticality: Medium
- URL: http://direct.osvdb.org/show/osvdb/90072
- Title: Ruby on Rails Active Record attr_protected Method Bypass
- Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
-
- Name: activerecord
- Version: 3.2.10
- Advisory: OSVDB-89025
- Criticality: High
- URL: http://osvdb.org/show/osvdb/89025
- Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
- Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
-
- Name: activesupport
- Version: 3.2.10
- Advisory: OSVDB-91451
- Criticality: High
- URL: http://www.osvdb.org/show/osvdb/91451
- Title: XML Parsing Vulnerability affecting JRuby users
- Solution: update to ~> 3.1.12, >= 3.2.13
+```
+$ bundle-audit
+Name: actionpack
+Version: 3.2.10
+Advisory: OSVDB-91452
+Criticality: Medium
+URL: http://www.osvdb.org/show/osvdb/91452
+Title: XSS vulnerability in sanitize_css in Action Pack
+Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+
+Name: actionpack
+Version: 3.2.10
+Advisory: OSVDB-91454
+Criticality: Medium
+URL: http://osvdb.org/show/osvdb/91454
+Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
+Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+
+Name: actionpack
+Version: 3.2.10
+Advisory: OSVDB-89026
+Criticality: High
+URL: http://osvdb.org/show/osvdb/89026
+Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter
Parsing Remote Code Execution
+Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
+
+Name: activerecord
+Version: 3.2.10
+Advisory: OSVDB-91453
+Criticality: High
+URL: http://osvdb.org/show/osvdb/91453
+Title: Symbol DoS vulnerability in Active Record
+Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+
+Name: activerecord
+Version: 3.2.10
+Advisory: OSVDB-90072
+Criticality: Medium
+URL: http://direct.osvdb.org/show/osvdb/90072
+Title: Ruby on Rails Active Record attr_protected Method Bypass
+Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
+
+Name: activerecord
+Version: 3.2.10
+Advisory: OSVDB-89025
+Criticality: High
+URL: http://osvdb.org/show/osvdb/89025
+Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
+Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
+
+Name: activesupport
+Version: 3.2.10
+Advisory: OSVDB-91451
+Criticality: High
+URL: http://www.osvdb.org/show/osvdb/91451
+Title: XML Parsing Vulnerability affecting JRuby users
+Solution: update to ~> 3.1.12, >= 3.2.13
- Unpatched versions found!
+Unpatched versions found!
+```
Update the [ruby-advisory-db] that `bundle audit` uses:
- $ bundle-audit update
- Updating ruby-advisory-db ...
- remote: Counting objects: 44, done.
- remote: Compressing objects: 100% (24/24), done.
- remote: Total 39 (delta 19), reused 29 (delta 10)
- Unpacking objects: 100% (39/39), done.
- From https://github.com/rubysec/ruby-advisory-db
- * branch master -> FETCH_HEAD
- Updating 5f8225e..328ca86
- Fast-forward
- CONTRIBUTORS.md | 1 +
- gems/actionmailer/OSVDB-98629.yml | 17 +++++++++++++++++
- gems/cocaine/OSVDB-98835.yml | 15 +++++++++++++++
- gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
- gems/sounder/OSVDB-96278.yml | 13 +++++++++++++
- gems/wicked/OSVDB-98270.yml | 14 ++++++++++++++
- 6 files changed, 73 insertions(+)
- create mode 100644 gems/actionmailer/OSVDB-98629.yml
- create mode 100644 gems/cocaine/OSVDB-98835.yml
- create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
- create mode 100644 gems/sounder/OSVDB-96278.yml
- create mode 100644 gems/wicked/OSVDB-98270.yml
- ruby-advisory-db: 64 advisories
+```
+$ bundle-audit update
+Updating ruby-advisory-db ...
+remote: Counting objects: 44, done.
+remote: Compressing objects: 100% (24/24), done.
+remote: Total 39 (delta 19), reused 29 (delta 10)
+Unpacking objects: 100% (39/39), done.
+From https://github.com/rubysec/ruby-advisory-db
+ * branch master -> FETCH_HEAD
+Updating 5f8225e..328ca86
+Fast-forward
+ CONTRIBUTORS.md | 1 +
+ gems/actionmailer/OSVDB-98629.yml | 17 +++++++++++++++++
+ gems/cocaine/OSVDB-98835.yml | 15 +++++++++++++++
+ gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
+ gems/sounder/OSVDB-96278.yml | 13 +++++++++++++
+ gems/wicked/OSVDB-98270.yml | 14 ++++++++++++++
+ 6 files changed, 73 insertions(+)
+ create mode 100644 gems/actionmailer/OSVDB-98629.yml
+ create mode 100644 gems/cocaine/OSVDB-98835.yml
+ create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
+ create mode 100644 gems/sounder/OSVDB-96278.yml
+ create mode 100644 gems/wicked/OSVDB-98270.yml
+ruby-advisory-db: 64 advisories
+```
Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs):
@@ -159,7 +163,7 @@
The following `rake` tasks will then become available:
-```bash
+```
$ rake -T
rake bundle:audit
rake bundle:audit:update
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/bundler-audit.gemspec new/bundler-audit.gemspec
--- old/bundler-audit.gemspec 2024-08-23 01:56:00.000000000 +0200
+++ new/bundler-audit.gemspec 1980-01-02 01:00:00.000000000 +0100
@@ -18,6 +18,7 @@
gem.authors = Array(gemspec['authors'])
gem.email = gemspec['email']
gem.homepage = gemspec['homepage']
+ gem.metadata = gemspec['metadata'] if gemspec['metadata']
glob = lambda { |patterns| gem.files & Dir[*patterns] }
Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/gemspec.yml new/gemspec.yml
--- old/gemspec.yml 2024-08-23 01:56:00.000000000 +0200
+++ new/gemspec.yml 1980-01-02 01:00:00.000000000 +0100
@@ -8,9 +8,9 @@
metadata:
documentation_uri: https://rubydoc.info/gems/bundler-audit
- source_code_uri: https://github.com/rubysec/bundler-audit.rb
- bug_tracker_uri: https://github.com/rubysec/bundler-audit.rb/issues
- changelog_uri:
https://github.com/rubysec/bundler-audit.rb/blob/master/ChangeLog.md
+ source_code_uri: https://github.com/rubysec/bundler-audit
+ bug_tracker_uri: https://github.com/rubysec/bundler-audit/issues
+ changelog_uri:
https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md
rubygems_mfa_required: 'true'
required_ruby_version: ">= 2.0.0"
@@ -18,4 +18,4 @@
dependencies:
thor: "~> 1.0"
- bundler: ">= 1.2.0, < 3"
+ bundler: ">= 1.2.0"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/bundler/audit/cli.rb new/lib/bundler/audit/cli.rb
--- old/lib/bundler/audit/cli.rb 2024-08-23 01:56:00.000000000 +0200
+++ new/lib/bundler/audit/cli.rb 1980-01-02 01:00:00.000000000 +0100
@@ -39,7 +39,7 @@
method_option :ignore, type: :array, aliases: '-i'
method_option :update, type: :boolean, aliases: '-u'
method_option :database, type: :string, aliases: '-D',
- default: Database::USER_PATH
+ default: Database::DEFAULT_PATH
method_option :format, type: :string, default: 'text', aliases: '-F'
method_option :config, type: :string, aliases: '-c', default:
'.bundler-audit.yml'
method_option :gemfile_lock, type: :string, aliases: '-G',
@@ -91,7 +91,7 @@
desc 'stats', 'Prints ruby-advisory-db stats'
method_option :quiet, type: :boolean, aliases: '-q'
- def stats(path=Database.path)
+ def stats(path=Database::DEFAULT_PATH)
database = Database.new(path)
puts "ruby-advisory-db:"
@@ -106,7 +106,7 @@
desc 'download', 'Downloads ruby-advisory-db'
method_option :quiet, type: :boolean, aliases: '-q'
- def download(path=Database.path)
+ def download(path=Database::DEFAULT_PATH)
if Database.exists?(path)
say "Database already exists", :yellow
return
@@ -127,7 +127,7 @@
desc 'update', 'Updates the ruby-advisory-db'
method_option :quiet, type: :boolean, aliases: '-q'
- def update(path=Database.path)
+ def update(path=Database::DEFAULT_PATH)
unless Database.exists?(path)
download(path)
return
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/bundler/audit/database.rb
new/lib/bundler/audit/database.rb
--- old/lib/bundler/audit/database.rb 2024-08-23 01:56:00.000000000 +0200
+++ new/lib/bundler/audit/database.rb 1980-01-02 01:00:00.000000000 +0100
@@ -103,7 +103,7 @@
# @option options [Boolean] :quiet
# Specify whether `git` should be `--quiet`.
#
- # @return [Dataase]
+ # @return [Database]
# The newly downloaded database.
#
# @raise [DownloadFailed]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/bundler/audit/version.rb
new/lib/bundler/audit/version.rb
--- old/lib/bundler/audit/version.rb 2024-08-23 01:56:00.000000000 +0200
+++ new/lib/bundler/audit/version.rb 1980-01-02 01:00:00.000000000 +0100
@@ -18,6 +18,6 @@
module Bundler
module Audit
# bundler-audit version
- VERSION = '0.9.2'
+ VERSION = '0.9.3'
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/metadata new/metadata
--- old/metadata 2024-08-23 01:56:00.000000000 +0200
+++ new/metadata 1980-01-02 01:00:00.000000000 +0100
@@ -1,14 +1,13 @@
--- !ruby/object:Gem::Specification
name: bundler-audit
version: !ruby/object:Gem::Version
- version: 0.9.2
+ version: 0.9.3
platform: ruby
authors:
- Postmodern
-autorequire:
bindir: bin
cert_chain: []
-date: 2024-08-22 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
dependencies:
- !ruby/object:Gem::Dependency
name: thor
@@ -31,9 +30,6 @@
- - ">="
- !ruby/object:Gem::Version
version: 1.2.0
- - - "<"
- - !ruby/object:Gem::Version
- version: '3'
type: :runtime
prerelease: false
version_requirements: !ruby/object:Gem::Requirement
@@ -41,9 +37,6 @@
- - ">="
- !ruby/object:Gem::Version
version: 1.2.0
- - - "<"
- - !ruby/object:Gem::Version
- version: '3'
description: bundler-audit provides patch-level verification for Bundled apps.
email: [email protected]
executables:
@@ -129,8 +122,11 @@
licenses:
- GPL-3.0-or-later
metadata:
+ documentation_uri: https://rubydoc.info/gems/bundler-audit
+ source_code_uri: https://github.com/rubysec/bundler-audit
+ bug_tracker_uri: https://github.com/rubysec/bundler-audit/issues
+ changelog_uri:
https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md
rubygems_mfa_required: 'true'
-post_install_message:
rdoc_options: []
require_paths:
- lib
@@ -145,8 +141,7 @@
- !ruby/object:Gem::Version
version: 1.8.0
requirements: []
-rubygems_version: 3.5.11
-signing_key:
+rubygems_version: 3.6.9
specification_version: 4
summary: Patch-level verification for Bundler
test_files: []
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/spec/integration_spec.rb new/spec/integration_spec.rb
--- old/spec/integration_spec.rb 2024-08-23 01:56:00.000000000 +0200
+++ new/spec/integration_spec.rb 1980-01-02 01:00:00.000000000 +0100
@@ -11,7 +11,14 @@
subject { sh(command) }
it "must invoke the CLI class" do
- expect(subject).to eq("bundler-audit #{Bundler::Audit::VERSION}#{$/}")
+ expected = "bundler-audit #{Bundler::Audit::VERSION}#{$/}"
+
+ if RUBY_VERSION.start_with?("3.0") || RUBY_ENGINE == "truffleruby"
+ # Allow `WARN: Unresolved or ambiguous specs during
Gem::Specification.reset:` for Ruby 3.0.x and TruffleRuby
+ expect(subject).to include(expected)
+ else
+ expect(subject).to eq(expected)
+ end
end
end
@@ -26,6 +33,13 @@
subject { sh(command) }
it "must invoke the CLI class" do
- expect(subject).to eq("bundler-audit #{Bundler::Audit::VERSION}#{$/}")
+ expected = "bundler-audit #{Bundler::Audit::VERSION}#{$/}"
+
+ if RUBY_VERSION.start_with?("3.0") || RUBY_ENGINE == "truffleruby"
+ # Allow `WARN: Unresolved or ambiguous specs during
Gem::Specification.reset:` for Ruby 3.0.x and TruffleRuby
+ expect(subject).to include(expected)
+ else
+ expect(subject).to eq(expected)
+ end
end
end
