12 ms·
> Unless you really need a specific version, let those gems be free A wet dream of anyone looking for a method to perform a supply chain attack.
by rad_gruchalski 3y ago
> Unless you really need a specific version, let those gems be free
A wet dream of anyone looking for a method to perform a supply chain attack.
- riffraff 3y agothat is what Gemfile.lock is for. You are not getting a new version unless you do ask for it explicitly.
- rad_gruchalski 3y agoYeah, that’s actually true. I looked at it from a wrong angle.
- CodesInChaos 3y agoThose are just as easy when using the standard "semver compatible with the specified version" approach. The lockfile will prevent such attacks on build, and on upgrade it doesn't really matter security wise if the new version has the same major version.