search

beeminder / BeeSwift

Official Beeminder for iOS app
Other
30 stars 6 forks source link

upgrade gems #509

Closed krugerk closed 1 week ago

krugerk commented 2 weeks ago

mostly to bump from REXML 3.3.8

https://www.ruby-lang.org/en/news/2024/10/28/redos-rexml-cve-2024-49761/

theospears commented 1 week ago

When I attempt to run this locally, I see the same infinite stack trace which was showing up in github actions:

> ruby --version
ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [arm64-darwin24]

It looks like you worked around this for github actions via downgrade, but this is a pain locally as brew doesn't carry older versions, so we should probably hold off until this is fixed with latest ruby?

krugerk commented 1 week ago

When I attempt to run this locally, I see the same infinite stack trace which was showing up in github actions:

> ruby --version
ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [arm64-darwin24]

It looks like you worked around this for github actions via downgrade, but this is a pain locally as brew doesn't carry older versions, so we should probably hold off until this is fixed with latest ruby?

Locally I have rbenv where I have set ruby-version 3.3.5 for this repository.

theospears commented 1 week ago

It looks like this works with ruby 3.3.6 if we upgrade to the latest version of bundler (see https://github.com/orgs/community/discussions/143096 and I've also verified locally this works) so maybe let's do that?