4 ms·
I feel versions in Gemfile tend to make things harder to update and often end up accidentally retaining some old version. You won't get a random version bump un
by riffraff 3y ago
I feel versions in Gemfile tend to make things harder to update and often end up accidentally retaining some old version. You won't get a random version bump unless you do `bundle update` anyway, since you have a lock file.
Unless you really need a specific version, let those gems be free :)
- rad_gruchalski 3y ago> Unless you really need a specific version, let those gems be free A wet dream of anyone looking for a method to perform a supply chain attack.
- riffraff 3y agothat is what Gemfile.lock is for. You are not getting a new version unless you do ask for it explicitly.
- rad_gruchalski 3y agoYeah, that’s actually true. I looked at it from a wrong angle.
- CodesInChaos 3y agoThose are just as easy when using the standard "semver compatible with the specified version" approach. The lockfile will prevent such attacks on build, and on upgrade it doesn't really matter security wise if the new version has the same major version.
- brink 3y agoBeing harder to update is the point. With ruby being untyped and lazy evaluated, it's even worse. If any library's api changes between versions, unless you're sure you have a unit test for that function, it'll happily deploy and crash in production. Plus as long as you're using a service like snyk.io to make sure that you're covering security vulnerabilities, there's usually not much reason to updating if it works.