search

hpc-carpentry / hpc-carpentry.github.io

The HPC Carpentry website
http://www.hpc-carpentry.org/
MIT License
4 stars 7 forks source link

un-track Gemfile.lock, let GitHub specify dependencies #16

Closed tkphd closed 3 years ago

tkphd commented 3 years ago

Least-invasive fix of the Krandown vulnerability is to un-track Gemfile.lock, which is built from scratch when Ruby parses the Gemfile. Let the GitHub gems define their dependency versions.

reid-a commented 3 years ago

Concur that this is a good fix, well-focused and appropriate.

tkphd commented 3 years ago

I'll take that as a review.

ocaisa commented 3 years ago

The Gemfile was required by what we use to deploy the site, but that should be fixed by bumping the Action version