Update Sidekiq to enable rack upgrade #4499
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
LindseySaari
reviewed
Jul 9, 2020
| @@ -14,7 +14,7 @@ task security: :environment do | |||
|
|
|||
| puts 'running bundle-audit to check for insecure dependencies...' | |||
| exit!(1) unless ShellCommand.run('bundle-audit update') | |||
| audit_result = ShellCommand.run('bundle-audit check --ignore CVE-2020-8161 CVE-2020-8184') | |||
| audit_result = ShellCommand.run('bundle-audit check') | |||
This was referenced Jul 17, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Sidekiq 5.2.8 had blocked upgrading the rack gem that mitigated CVE-2020-8184.
The be-tools team applied the recommended patch, but with several
rackCVEseither mitigated through monkeypatching or deemed low-risk, the tech debt was piling up.
The Sidekiq team released a point release of the older 5.x branch that relaxed the
overerly tight dependency on
rackversions so these CVE fix releases could be applied.Description of change
Sidekiq upgraded to support
rackupgrade and CVE mitigationOriginal issue(s)
department-of-veterans-affairs/va.gov-team#9057
Things to know about this PR