search

rubysec / bundler-audit

Patch-level verification for Bundler
GNU General Public License v3.0
2.68k stars 229 forks source link

Filter on dependencies - exclude dev and test #389

Open so87 opened 11 months ago

so87 commented 11 months ago

Description

other tools like npm-audit can filter on production dependencies with "--prod". This cuts down on findings in general, but allows developers to focus on the most important issues.

postmodern commented 11 months ago

Bundler does support dependency groups, however those are only used to activate specific sets of dependencies. The information isn't stored in the Gemfile.lock. We'd need to load the Gemfile, filter by dependency group, then parse the Gemfile.lock and filter the gems that belong to that group.

so87 commented 11 months ago

@postmodern ok so i should do a build command then audit on that gemfile.lock.

Last question - do you guys support any type of audit fix command, or plan to in the future?

postmodern commented 11 months ago

@postmodern ok so i should do a build command then audit on that gemfile.lock.

bundle-audit is designed to audit the current versions in Gemfile.lock, which represents the versions that will be installed and ran in production.

Last question - do you guys support any type of audit fix command, or plan to in the future?

That already exists in the form of bundle update. Most security advisories can be solved by simply upgrading to the latest version of the effected gem. Unless you have specifically locked down a gem's version to ~> X.Y.Z in the Gemfile (~> X.Y is a safer dependency range), it should be possible to upgrade to the latest patch-version with bundle up gem-name-here.