Allow concurrent-ruby >= 1.3.7#231
Conversation
There was a problem hiding this comment.
Pull request overview
Updates dependencies to safely support concurrent-ruby 1.3.7+ and newer Ruby versions.
Changes:
- Loads and declares
loggerexplicitly. - Raises the secure
concurrent-rubyminimum. - Refreshes locked dependencies.
Reviewed changes
Copilot reviewed 2 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
xdrgen.gemspec |
Updates runtime dependencies. |
lib/xdrgen.rb |
Loads logger before ActiveSupport. |
Gemfile.lock |
Locks updated dependency versions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # https://stackoverflow.com/questions/79360526/uninitialized-constant-activesupportloggerthreadsafelevellogger-nameerror | ||
| spec.add_dependency "concurrent-ruby", "<= 1.3.4" | ||
| # >= 1.3.7 fixes GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr | ||
| spec.add_dependency "concurrent-ruby", ">= 1.3.7" |
There was a problem hiding this comment.
Done in 99390b9: required_ruby_version is now >= 2.5.0, matching the floor activesupport 6 already imposes.
| # >= 1.3.7 fixes GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr | ||
| spec.add_dependency "concurrent-ruby", ">= 1.3.7" | ||
| # required at load time by lib/xdrgen.rb; no longer a default gem on Ruby >= 3.5 | ||
| spec.add_dependency "logger" |
There was a problem hiding this comment.
Ruby 3.5 is not released yet (current stable is 3.4.10; 3.5 exists only as a preview), so it cannot go into the required matrix. I also ran the suite on 3.5.0preview1: it fails before reaching this change, because the pry dev dependency hits another Ruby 3.5 default-gem removal (cannot load such file -- ostruct). Bringing xdrgen to Ruby 3.5 therefore needs its own change beyond this security bump; the logger dependency here is forward-looking and has no effect on currently supported Rubies. Happy to follow up with a matrix update once 3.5 is stable, if the maintainers want that.
Require logger before activesupport so that activesupport 6 loads with concurrent-ruby >= 1.3.5, which no longer requires logger transitively, and declare logger as a runtime dependency since it is no longer a default gem on Ruby >= 3.5. Raise the concurrent-ruby constraint to >= 1.3.7 to pull in the fixes for GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr. Set required_ruby_version to >= 2.5.0, matching the floor activesupport 6 already imposes.
fd1ed76 to
99390b9
Compare
The upstream gemspec caps concurrent-ruby at 1.3.4, which is affected by GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr. The fork (proposed upstream in stellar/xdrgen#231) lifts the cap; generated output is unchanged.
The upstream gemspec caps concurrent-ruby at 1.3.4, which is affected by GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr. The fork (proposed upstream in stellar/xdrgen#231) lifts the cap; generated output is unchanged.
The upstream gemspec caps concurrent-ruby at 1.3.4, which is affected by GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr. The fork (proposed upstream in stellar/xdrgen#231) lifts the cap; generated output is unchanged.
The upstream gemspec caps concurrent-ruby at 1.3.4, which is affected by GHSA-h8w8-99g7-qmvj, GHSA-wv3x-4vxv-whpp and GHSA-6wx8-w4f5-wwcr. The fork (proposed upstream in stellar/xdrgen#231) lifts the cap; generated output is unchanged.
concurrent-ruby was pinned to
<= 1.3.4in #206 because 1.3.5 stopped requiringlogger, which activesupport 6 needs at load time (uninitialized constant ActiveSupport::LoggerThreadSafeLevel::Logger).concurrent-ruby
<= 1.3.4is affected by GHSA-h8w8-99g7-qmvj (high), GHSA-wv3x-4vxv-whpp (low) and GHSA-6wx8-w4f5-wwcr (low), all fixed in 1.3.7. The pin propagates these Dependabot alerts to downstream consumers of xdrgen, including the Stellar SDK XDR generators.Changes:
loggerinlib/xdrgen.rbbefore activesupport, which resolves the original load errorloggeras a runtime dependency, since it is no longer a default gem on Ruby >= 3.5>= 1.3.7required_ruby_versionto>= 2.5.0, matching the floor activesupport 6 already imposesGemfile.lockaccordinglyTested with
bundle exec rspecon Ruby 2.7 and 3.3 (20 examples, 0 failures, no changes underspec/output), and validated against the stellar-ios-mac-sdk Swift XDR generator: full generation with concurrent-ruby 1.3.7 produces byte-identical output.