mirror of
https://github.com/react/react-native.git
synced 2026-09-28 13:23:09 +08:00
Christoph Purrer
96d3f91124
Summary: Pull Request resolved: https://github.com/react/react-native/pull/57355 Changelog: [INTERNAL] Fix Dependabot security update for concurrent-ruby in react-native The Dependabot GitHub Action on `react/react-native` `main` has been failing repeatedly because of `concurrent-ruby`. A security advisory marks `concurrent-ruby < 1.3.7` as affected (patched in `1.3.7`), but all three RN Gemfiles pin `gem 'concurrent-ruby', '<= 1.3.4'`. Dependabot cannot satisfy the advisory under that pin, so it opens a security PR to bump to `1.3.7` and then, on every subsequent run, reports `pull_request_exists_for_latest_version` as a hard error — failing the check and regenerating the internal CI task. The `<= 1.3.4` upper bound was originally added because `concurrent-ruby 1.3.5` dropped its `logger` dependency, which broke older `activesupport`/CocoaPods setups. That cause is already mitigated: every Gemfile now explicitly lists `gem 'logger'`. The upper-bound pin is therefore obsolete. This change relaxes the constraint from `<= 1.3.4` to `>= 1.3.7` in all three Gemfiles (root, `private/helloworld`, `packages/rn-tester`) and updates the two corresponding `Gemfile.lock` files to resolve `concurrent-ruby 1.3.7`. `1.3.7` introduces no new transitive dependencies over `1.3.4`, so no other lockfile entries change. With the advisory satisfied on `main`, Dependabot stops recreating the security PR and the recurring check failure stops. Reviewed By: javache Differential Revision: D109967250 fbshipit-source-id: 88f702bc6677053456557591cfd703776bb6c018
110 lines
2.5 KiB
Gemfile.lock
110 lines
2.5 KiB
Gemfile.lock
GEM
|
|
remote: https://rubygems.org/
|
|
specs:
|
|
CFPropertyList (3.0.6)
|
|
rexml
|
|
activesupport (7.0.8)
|
|
concurrent-ruby (~> 1.0, >= 1.0.2)
|
|
i18n (>= 1.6, < 2)
|
|
minitest (>= 5.1)
|
|
tzinfo (~> 2.0)
|
|
addressable (2.9.0)
|
|
public_suffix (>= 2.0.2, < 8.0)
|
|
algoliasearch (1.27.5)
|
|
httpclient (~> 2.8, >= 2.8.3)
|
|
json (>= 1.5.1)
|
|
atomos (0.1.3)
|
|
benchmark (0.4.0)
|
|
bigdecimal (3.1.9)
|
|
claide (1.1.0)
|
|
cocoapods (1.14.2)
|
|
addressable (~> 2.8)
|
|
claide (>= 1.0.2, < 2.0)
|
|
cocoapods-core (= 1.14.2)
|
|
cocoapods-deintegrate (>= 1.0.3, < 2.0)
|
|
cocoapods-downloader (>= 2.0)
|
|
cocoapods-plugins (>= 1.0.0, < 2.0)
|
|
cocoapods-search (>= 1.0.0, < 2.0)
|
|
cocoapods-trunk (>= 1.6.0, < 2.0)
|
|
cocoapods-try (>= 1.1.0, < 2.0)
|
|
colored2 (~> 3.1)
|
|
escape (~> 0.0.4)
|
|
fourflusher (>= 2.3.0, < 3.0)
|
|
gh_inspector (~> 1.0)
|
|
molinillo (~> 0.8.0)
|
|
nap (~> 1.0)
|
|
ruby-macho (>= 2.3.0, < 3.0)
|
|
xcodeproj (>= 1.23.0, < 2.0)
|
|
cocoapods-core (1.14.2)
|
|
activesupport (>= 5.0, < 8)
|
|
addressable (~> 2.8)
|
|
algoliasearch (~> 1.0)
|
|
concurrent-ruby (~> 1.1)
|
|
fuzzy_match (~> 2.0.4)
|
|
nap (~> 1.0)
|
|
netrc (~> 0.11)
|
|
public_suffix (~> 4.0)
|
|
typhoeus (~> 1.0)
|
|
cocoapods-deintegrate (1.0.5)
|
|
cocoapods-downloader (2.0)
|
|
cocoapods-plugins (1.0.0)
|
|
nap
|
|
cocoapods-search (1.0.1)
|
|
cocoapods-trunk (1.6.0)
|
|
nap (>= 0.8, < 2.0)
|
|
netrc (~> 0.11)
|
|
cocoapods-try (1.2.0)
|
|
colored2 (3.1.2)
|
|
concurrent-ruby (1.3.7)
|
|
escape (0.0.4)
|
|
ethon (0.16.0)
|
|
ffi (>= 1.15.0)
|
|
ffi (1.16.3)
|
|
fourflusher (2.3.1)
|
|
fuzzy_match (2.0.4)
|
|
gh_inspector (1.1.3)
|
|
httpclient (2.8.3)
|
|
i18n (1.14.1)
|
|
concurrent-ruby (~> 1.0)
|
|
json (2.6.3)
|
|
logger (1.6.5)
|
|
minitest (5.20.0)
|
|
molinillo (0.8.0)
|
|
mutex_m (0.3.0)
|
|
nanaimo (0.3.0)
|
|
nap (1.1.0)
|
|
netrc (0.11.0)
|
|
public_suffix (4.0.7)
|
|
rexml (3.2.6)
|
|
ruby-macho (2.5.1)
|
|
typhoeus (1.4.0)
|
|
ethon (>= 0.9.0)
|
|
tzinfo (2.0.6)
|
|
concurrent-ruby (~> 1.0)
|
|
xcodeproj (1.23.0)
|
|
CFPropertyList (>= 2.3.3, < 4.0)
|
|
atomos (~> 0.1.3)
|
|
claide (>= 1.0.2, < 2.0)
|
|
colored2 (~> 3.1)
|
|
nanaimo (~> 0.3.0)
|
|
rexml (~> 3.2.4)
|
|
|
|
PLATFORMS
|
|
ruby
|
|
|
|
DEPENDENCIES
|
|
activesupport (>= 6.1.7.5, < 7.1.0)
|
|
benchmark
|
|
bigdecimal
|
|
cocoapods (~> 1.13, != 1.15.1, != 1.15.0)
|
|
concurrent-ruby (>= 1.3.7)
|
|
logger
|
|
mutex_m
|
|
xcodeproj (< 1.26.0)
|
|
|
|
RUBY VERSION
|
|
ruby 3.2.0p0
|
|
|
|
BUNDLED WITH
|
|
2.4.12
|