Update cocoapods

[lukeswitz]

Summary:

Cocoapods 1.8.0 -> 1.9.3

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • Gemfile
  • Gemfile.lock

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Deserialization of Untrusted Data SNYK-RUBY-ACTIVESUPPORT-569598	No	No Known Exploit

[farktronix]

Ack! I think I have this same work in progress on my branch at https://github.com/farktronix/relisten-ios/tree/Travis. I've been trying to get Travis to successfully build the project on that branch before making a PR

[farktronix]

Oh- I should have read the diff first. This updates the cocoapod binary, not the pods themselves. Hold off on any pod updates- just work off my branch if you'd like to. I've also been trying to move back on to mainline for any repos that we've forked that have taken our changes.

[lukeswitz]

Edit: By downloading the repo and running your setup script, you include an outdated binary of cocoapods. For users without it, it's not an issue and will update to a patched version. By saying 1.8 is acceptable, those using an outdated build will potentially push back vulnerable code through the underlying dependencies of cocoapods such as activesupport etc.

Oh- I should have read the diff first. This updates the cocoapod binary, not the pods themselves. Hold off on any pod updates- just work off my branch if you'd like to. I've also been trying to move back on to mainline for any repos that we've forked that have taken our changes.

Sorry, I don't want to use the branches from 2017. I'm rewriting the app to work with current libs. I have a lite version that works excellent I've been using for a year or so.

[lukeswitz]

I will leave you to it then, CI is fixed by targeting the right version of Xcode and using proper syntax for Swift

[farktronix]

Sorry, my last comment wasn't clear. Let me try again.

This patch just updates the cocoapod binary, not the libraries like I assumed, so this is a great fix to take!

I was worried that you might be duplicating work that I had done on another branch, and I didn't want you go also go through the drudgery of updating Cocoapods as well 😀 If you want up to date Cocoapods (the libraries themselves, not the pod binary), check out my (poorly named) "Travis" branch and it should save you some work. I hope to merge that into master soon once I get the build passing in Travis (which I believe is blocked on a Cocoapods 1.10 release).

[lukeswitz]

1.10 is still in beta, but right on thanks for the nice response. Wouldn't want to duplicate work, but transition from Fabric to Google is a large one, let alone changing the persistence layer from Realm to sqlite. I'll leave it to your team- apologies for socially ungentle comments; us old tapers take the integrity of show labeling more seriously than that of our children in some cases ; )

[farktronix]

Not a problem at all- I was the one that didn't read my comment before hitting save. Upon re-reading my comment it's very confusing! 😀

None of the changes on that branch are fundamentally different- I'm just trying to get things building with the latest Xcode. I was getting duplicate header import errors for sqlite files, so I commented out the sqlite pods because they exist in the Xcode SDK too.