search

david-a-wheeler / railroader

A static analysis security vulnerability scanner for Ruby on Rails applications (OSS fork of Brakeman)
MIT License
47 stars 1 forks source link

Haml upgrade? #8

Open mensfeld opened 5 years ago

mensfeld commented 5 years ago

Hey, is there a chance to unlock the more recent haml versions support?

railroader locks the 5.x completely due to:

haml (>= 3.0, < 5.0)
david-a-wheeler commented 5 years ago

There is certainly a chance :-). If it's just a matter of allowing more versions, that is easy, but if changes to the code are required, then obviously that will have to happen first. I won't have a chance to look at it today. If someone else wants to investigate that would be awesome.

david-a-wheeler commented 5 years ago

Unfortunately, just changing the line to:

spec.add_dependency "haml", ">=3.0", "<6.0"

doesn't work. There are other gems that cause the lock as well, and bundler doesn't have an easy way to determine that (weird!!). I'll have to track it down later.

david-a-wheeler commented 5 years ago

On further investigation: We can't just update haml because slim depends on it, and updating both slim and haml leads to failure. Sadly, there have been some API incompatibilities, so code changes will be needed to make it work.

Patches welcome!