False negative for a gem

appfolio / gemsurance

Gem vulnerability checker using rubysec/ruby-advisory-db

MIT License

213 stars 24 forks source link

False negative for a gem #33

Open martinstreicher opened 5 years ago

martinstreicher commented 5 years ago

gemsurance reports gems sourced from github are out of date though the version numbers are identical.

gem 'activeadmin-select2', github: 'mfairburn/activeadmin-select2'
gem 'by_star', github: 'radar/by_star'

activeadmin-select2 | 0.1.8 | 0.1.8 | Out of Date  
by_star             | 3.0.0 | 3.0.0 | Out of Date |

martinstreicher commented 5 years ago

I also have this issue with some gems sourced from RubyGems and marked out of date...

cucumber-core | 3.2.1 | 4.0.0 | Out of Date |

$ bundle update cucumber-core
...
Bundler attempted to update cucumber-core but its version stayed the same
$

jonkessler commented 5 years ago

This is listed in the README as a TODO. We don’t really support version checking for gems specified via the git mechanism. As for your second comment, are you sure you don’t have that gem locked down locally?