appfolio / gemsurance

Gem vulnerability checker using rubysec/ruby-advisory-db
MIT License
213 stars 24 forks source link

Error: in 'block in retrieve': undefined method 'index' for #<Bundler::Definition #42

Open bluciam opened 3 years ago

bluciam commented 3 years ago

Running gemsurance produces the error:

gemsurance-0.10.0/lib/gemsurance/gem_info_retriever.rb:122:inblock in retrieve': undefined method index' for #<Bundler::Definition:0x000056301356c6a8> (NoMethodError)

The bundler version is at 2.2.29 as specified in the dependency list in https://rubygems.org/gems/gemsurance/versions/0.10.0/dependencies:

 bundler 2.2.29 >= 1.2, < 3.0
 gems 1.2.0 >= 0.8
 git 1.9.1 ~> 1.2

Looking at the file lib/bundler/definition.rb for bundler version 2.2.29, I found no definition of method index. The method is present in older versions of bundler.

Running bundle _2.1.4_ exec gemsurance produced the desired output, the file gemsurance_report.html

jcody commented 2 years ago

Flagged already on the bundler patch update here: https://github.com/rubygems/rubygems/pull/4609/files#r647496277

Looks like the Bundler::Definition#index method shouldn't have been used in the first place. Unfortunate that a patch bump breaks this gem. Can likely be replace with:

# current/deprecated:
active_spec = @bundle_definition.dependencies.select { |d| d.name == current_spec.name }.sort_by { |b| b.version }

# fix: 
active_spec = @bundle_definition.resolve.find_by_name_and_platform(current_spec.name, current_spec.platform)

active_spec = active_spec.source.specs.search(current_spec.name).select { |spec| spec.match_platform(current_spec.platform) }.sort_by(&:version)

In the meantime, bundler audit and bundler outdated should suffice -- granted without a web dashboard.