3 ms·
Shouldn't there be a way for gems maintainers to force/strongly encourage an upgrade when there is a security issue regardless of the transitive nature of the d
by cwzwarich 14y ago
Shouldn't there be a way for gems maintainers to force/strongly encourage an upgrade when there is a security issue regardless of the transitive nature of the dependency?
- reedlaw 14y agoI just patched a project by updating the Gemfile with the latest Rails version and "bundle update rails" updated the json gem along with it.
- travisp 14y agoI think it depends a lot on your particular configuration, since json is only an indirect dependency in rails (i.e. it's not part of rails's gemspec). It's clear that it won't get updated for everyone, which is why this warning (to make sure json gets updated and possibly add the dependency if needed) has gone out on the rails security mailing list.