Support scanning .gemspec files

Open
#307 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
ruby
Domain
cli, security

Research direction

Start by comparing bundler-audit's current Gemfile.lock scanning with the Dependabot Bundler implementation at bundler/lib/dependabot/bundler. Add support for scanning .gemspec files and verify that gems declared there are monitored; the issue also suggests checking Dependabot's other supported files for possible follow-up work.

Written by the indexing model from the issue text.

Description

Ready to Close

I noticed that GitHub's Dependabot checks .gemspec files, as well as Gemfile.lock. We should do the same, as it would let bundler-audit monitor gems directly.

They also check other files as well, so may also want to add that.

See https://github.com/dependabot/dependabot-core/tree/main/bundler/lib/dependabot/bundler for how they do it.

Dominant language
Ruby
Stars
2.8k
Forks
247
Avg merge
1d 9h
Merged PRs (30d)
3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rubysec/bundler-audit

All issues in rubysec/bundler-audit

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.