Project

General

Profile

Bug #16238

Publish new WEBrick version to rubygems.org

Added by rbjl (Jan Lelis) 2 months ago. Updated 2 months ago.

Status:
Closed
Priority:
Normal
Target version:
-
[ruby-core:95222]

Description

The latest security releases of Ruby include some fixes in the webrick default gem:

However, as of now, the changes have not been published to rubygems:

More confusingly, the version number of webrick has not be changed yet: https://github.com/ruby/ruby/blob/v2_6_5/lib/webrick/version.rb (still 1.4.2 as before the security patches). This is problematic, because now multiple versions of version 1.4.2 of webrick exist... It also prevents people from quickly resolving the webrick-related security issue by just installing the new version of webrick.

In the past, security patches often led to a fourth-place-version-number (see for example, rubygems itself, or rdoc)

I suggest that a new version of webrick should be released to rubygems. I am also curious about how the process of dealing with similar issues in the future can be optimized

History

Updated by hsbt (Hiroshi SHIBATA) 2 months ago

  • Assignee set to hsbt (Hiroshi SHIBATA)
  • Status changed from Open to Assigned

I'm working on it now. I need to triage the changeset from ruby/ruby master.

Please wait a few days.

Updated by hsbt (Hiroshi SHIBATA) 2 months ago

  • Status changed from Assigned to Closed

Updated by rbjl (Jan Lelis) 2 months ago

That was quick, thanks!

Updated by rbjl (Jan Lelis) 2 months ago

I have added a short notice for people interested to https://stdgems.org/webrick/#notes

Btw, do you use a tool assisting with merging the upstream changes? If not I'd offer to build one (not totally automated, but might be helpful for standard tasks)

Also available in: Atom PDF