search

iay / md-validator-rails-poc

Proof-of-concept Rails front-end for the Metadata Validator web service
0 stars 0 forks source link

Remove webpacker dependency #22

Open iay opened 2 years ago

iay commented 2 years ago

This application was initially built under a version of Rails that used the webpacker gem to do bundling of things like Javascript and CSS. This gem is no longer supported, and is no longer necessary in Rails 7.

The webpacker gem has historically been a source of potential security issues, although the application is probably not vulnerable due to it not being used at runtime but only for asset precompilation. It should be possible to migrate away from webpacker to reduce the amount of ongoing maintenance.

Retired package: https://github.com/rails/webpacker

Migration description: https://github.com/rails/jsbundling-rails/blob/main/docs/switch_from_webpacker.md

iay commented 2 years ago

Another route out of the vulnerabilities (but perhaps not all of the maintenance) might be to use the two-stage build (see #12) to avoid bundling any of the Node components in the executable container image.

iay commented 2 years ago

The two-stage build doesn't improve things, as the problem is with the webpacker gem, which needs to be in the Gemfile whether it's actually used or not. #12 is still worth doing, though, it just doesn't help with this issue.