3 ms·

The gems have probably been updated by the developers of the gem. The data used in the article contains a list of the versions being used in production by real

• unreal37 12y ago
  Ah, thanks for the clarification.
• vasinov 12y ago
  I think unreal37 meant "once it's been reported, it would be fixed [in the app]." As in updated.
• klochner 12y ago
  Risk also depends on how you're using the gem. If it's a bug in a YAML parser but you're not loading YAML from untrusted sources, then it would be a false positive.
• robotfelix 12y ago
  Yes, after seeing many familiar gems in the graphic I was almost surprised to see that hakiri gave my Gemfile.lock an 'all clear'. The should be able to calculate what percentage of these would still be vulnerable if fully updated - now that would be an interesting stat!