Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rack version, fix bundle audit #21109

Merged
merged 1 commit into from
Mar 5, 2025
Merged

Conversation

rjohnson2011
Copy link
Contributor

Updates Rack version as per the solution to the bundle audit failure below.
Appearing in all PRs during the listing CI check, for example -> https://github.com/department-of-veterans-affairs/vets-api/actions/runs/13685598555/job/38268190857?pr=21080

Logs below:

Run bundle exec bundle-audit check --update --ignore CVE-2024-27456
Download ruby-advisory-db ...
Cloning into '/home/runner/.local/share/ruby-advisory-db'...
ruby-advisory-db:
  advisories:	9[6](https://github.com/department-of-veterans-affairs/vets-api/actions/runs/13685598555/job/38268190857?pr=21080#step:4:7)5 advisories
  last updated:	2025-03-05 12:12:15 -0800
  commit:	8ab1b435ef4029c64d694839e618bd[7](https://github.com/department-of-veterans-affairs/vets-api/actions/runs/13685598555/job/38268190857?pr=21080#step:4:8)375109a6b
Name: rack
Version: 2.2.11
CVE: CVE-2025-27111
GHSA: GHSA-[8](https://github.com/department-of-veterans-affairs/vets-api/actions/runs/13685598555/job/38268190857?pr=21080#step:4:9)cgq-6mh2-7j6v
Criticality: Unknown
URL: https://github.com/rack/rack/security/advisories/GHSA-8cgq-6mh2-7j6v
Title: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection
Solution: update to '~> 2.2.12', '~> 3.0.13', '>= 3.1.[11](https://github.com/department-of-veterans-affairs/vets-api/actions/runs/13685598555/job/38268190857?pr=21080#step:4:12)'

Vulnerabilities found!
Error: Process completed with exit code 1.

@rjohnson2011 rjohnson2011 requested a review from a team as a code owner March 5, 2025 21:28
@rjohnson2011 rjohnson2011 enabled auto-merge (squash) March 5, 2025 21:45
@rjohnson2011 rjohnson2011 disabled auto-merge March 5, 2025 21:54
@rjohnson2011 rjohnson2011 merged commit 641a299 into master Mar 5, 2025
31 checks passed
@rjohnson2011 rjohnson2011 deleted the gemfile-rack-update branch March 5, 2025 21:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants