3 ms·
Yes, but you can easily get in a situation where say Github says "gem X is vulnerable, upgrade it", but can't generate it needs to update version of dependent g
by drchopchop 6y ago
Yes, but you can easily get in a situation where say Github says "gem X is vulnerable, upgrade it", but can't generate it needs to update version of dependent gem Y, and that would break gem Z which is version locked because ruby versions etc...
- lostapathy 6y agoThis happens, but it's not really that common, and it's certainly not insurmountable. You can fork any gem in github, fix whatever issue it has, and point your Gemfile at your fork on github. Bundler treats it as the same package so it doesn't break your dependency tree either above or below it. I've used this to fix an incompatibility in the middle of my dep tree before. It's annoying, but it's not exactly a big deal.