Project

General

Profile

Actions

Feature #19776

closed

Warn bundled gems when it called from `require`

Added by hsbt (Hiroshi SHIBATA) over 1 year ago. Updated about 1 year ago.

Status:
Closed
Target version:
-
[ruby-core:114241]

Description

We should warn when users try to load default gems that will be promoted bundled gems at next version. We will warn them only under the bundler environment without Gemfile.

  • Ruby 3.3:
    • Warn for adding bundled gems to be addressed Ruby 3.4 to Gemfile when user load its gem without gem 'foo' in their Gemfile.
      • Target libraries are TBD
    • Also warn existing bundled gems was loaded without gem 'foo' of Gemfile. Ex. net-smtp, rexml etc.
  • Ruby 3.4:
    • Promote bundled gems.
      • Raise LoadError same as current behavior with warnings of Ruby 3.3.
    • Warn same as Ruby 3.3.

I implemented PoC for this: https://github.com/ruby/ruby/pull/8096


Related issues 3 (0 open3 closed)

Related to Ruby master - Feature #19351: Promote bundled gems at Ruby 3.3Closedhsbt (Hiroshi SHIBATA)Actions
Related to Ruby master - Feature #19843: Promote bigdecimal as bundled gems at Ruby 3.4ClosedActions
Related to Ruby master - Bug #19885: Invalid Warning for Default Gems That Will Move to Bundled GemsClosedhsbt (Hiroshi SHIBATA)Actions
Actions #1

Updated by hsbt (Hiroshi SHIBATA) over 1 year ago

Updated by vo.x (Vit Ondruch) over 1 year ago

Isn't it time that upstream should start to encourage that every part of the StdLib should be listed in Gemfile? How long it is the URI gem fixing MEDIUM rated CVE was released and who uses it? Who added it into their Gemfile? Who even noticed that there is some vulnerability to fix?

Really, the current practice "it is part of StdLib, therefore I don't list it anywhere among dependencies" should be discouraged. The PR should actually be updated to warn when any part of StdLib is loaded without being listed as a dependency in either Gemfile or transitively via different gem.

Actions #4

Updated by jeremyevans0 (Jeremy Evans) about 1 year ago

  • Status changed from Assigned to Closed
Actions #5

Updated by hsbt (Hiroshi SHIBATA) about 1 year ago

  • Related to Feature #19843: Promote bigdecimal as bundled gems at Ruby 3.4 added
Actions #6

Updated by hsbt (Hiroshi SHIBATA) about 1 year ago

  • Tracker changed from Bug to Feature
  • Backport deleted (3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN)
Actions #7

Updated by Eregon (Benoit Daloze) about 1 year ago

  • Related to Bug #19885: Invalid Warning for Default Gems That Will Move to Bundled Gems added
Actions

Also available in: Atom PDF

Like2
Like0Like2Like0Like0Like0Like0Like0