Find resolution for unpublishing of mimemagic gem

[davefrey]

Our rails repos are dependent on the mimemagic gem, which was removed from gem servers this week.

➜  decidim-module-liquidvoting git:(master) ✗ bundle install
Fetching gem metadata from https://rubygems.org/.......
Your bundle is locked to mimemagic (0.3.5), but that version could not be found in any of the sources listed in your Gemfile. If you haven't changed sources, that means the author of mimemagic (0.3.5) has
removed it. You'll need to update your bundle to a version other than mimemagic (0.3.5) that hasn't been removed in order to install.

➜  decidim-module-liquidvoting git:(master) ✗ grep mimemagic Gem*
Gemfile.lock:      mimemagic (>= 0.3.0)
Gemfile.lock:      mimemagic (~> 0.3.2)
Gemfile.lock:    mimemagic (0.3.5)

➜  decidim-module-liquidvoting git:(master) ✗ gem search mimemagic

*** REMOTE GEMS ***

mimemagic (0.4.2)
mimemagic_action_pack_uploaded_file (0.1.1)
minad-mimemagic (0.1.1)
test_mimemagick (0.3.2)

[davefrey]

https://github.com/rails/rails/issues/41750

[jinjagit]

Looks like only 0.3.7 -> 0.4.2 versions now available:
https://rubygems.org/gems/mimemagic/versions/0.4.2
https://github.com/mimemagicrb/mimemagic/releases

[pjmartorell]

There is a PR addressing this issue in carrierwave replacing mimemagic with marcel. Also the core Rails team is working on releasing an activestorage version with the new marcel version which gets rid of mimemagic.

[davefrey]

https://weblog.rubyonrails.org/2021/3/26/marcel-upgrade-releases/

[davefrey]

Tried putting gem "rails", "5.2.5" in ourGemfile`, but current version constraints in Decidim prevent bundler from changing the patch level:

➜  decidim-module-liquidvoting git:(master) ✗ bundle update rails
Fetching gem metadata from https://rubygems.org/........
Fetching gem metadata from https://rubygems.org/.
Resolving dependencies....
Bundler could not find compatible versions for gem "rails":
  In Gemfile:
    rails (= 5.2.5)

    decidim-dev (= 0.24.0.rc2) was resolved to 0.24.0.rc2, which depends on
      decidim (= 0.24.0.rc2) was resolved to 0.24.0.rc2, which depends on
        decidim-core (= 0.24.0.rc2) was resolved to 0.24.0.rc2, which depends on
          rails (~> 5.2.4.5)

I already looked at the new v0.24.0 release, no change for the rails gem in there.

[pjmartorell]

Yes, you should open an issue on decidim-core because is forcing a semver ~> 5.2.4.5 on Rails so you can only upgrade to a rails version 5.2.4.x but not 5.2.5.0

[pjmartorell]

I opened a PR addressing this issue: decidim/decidim#7762

[oliverbarnes]

https://github.com/decidim/decidim/pull/7753 updates the mimemagic gem to a version fixing the licensing issue. I figure this will patch be released on decidim v0.24.1 or the v0.25 in the works

[davefrey]

I confirm I can unblock our decidim module work by 1) checking out develop on my local decidim workspace, and 2) pointing our module's Gemfile to gem [decidim things], path: ../decidim. Bundle install works, and we can block merging any of our PRs until we can return to a Decidim tag.

The licensing still seems unclear to me, @pjmartorell's PR to bump to 5.2.5 seems an improvement, but I'm okay to follow Decidim's lead for now. Thanks everyone for the contribs.

[oliverbarnes]

We have to work against the v0.24.0.rc2 release tag, though :)

So I'd checkout the tag locally, and then bundle it with the newer mimemagic gem, for now

[davefrey]

My comment above about pointing the Gemfile to a local Decidim workspace was unnecessary: I have a running module by just gem installing 0.3.9 of mimemagic, and pinning that version in the Gemfile.lock.

I'll pause this issue, along with #68, until the fix works its way into a Decidim tag (we're still at v0.24.0.rc2)

[davefrey]

Both our module and our demo app are now running correctly on v0.24.0 bump branches, so I confirm they're both past the mimemagic issue.