Skip to content

Conversation

@binford2k
Copy link
Contributor

Updates to the latest 1.8.x semver to mitigate CVE-2025-6442 and CVE-2024-47220

Copy link
Member

@smortex smortex left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Maybe we can update to the latest version 1.9.1?

@binford2k
Copy link
Contributor Author

@smortex happy to move to 1.9.1 if someone verifies that it's API compatible. I think that would require running an agent through the test suite.

@bastelfreak
Copy link
Contributor

@binford2k this is just a bolt dependency, right? I don't think the openvox-agent pulls in webrick:

puppet-runtime $ git grep -i webrick
configs/components/rubygem-webrick.rb:#   https://rubygems.org/gems/webrick
configs/components/rubygem-webrick.rb:#   https://github.com/ruby/webrick/releases
configs/components/rubygem-webrick.rb:component 'rubygem-webrick' do |pkg, settings, platform|
configs/projects/bolt-runtime.rb:  proj.component 'rubygem-webrick'

@nmburgan
Copy link
Member

Yep, it's just for Bolt. Why Bolt needs webrick, I don't know. Might have been for PE bolt server. If so, we should remove it sometime. But for now, might as well be up to date.

@nmburgan nmburgan merged commit 3e14ca6 into main Aug 22, 2025
5 checks passed
@nmburgan nmburgan deleted the binford2k-patch-1 branch August 22, 2025 16:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants