CHEF-37568 - Regenerate oc-id Gemfile.lock for net-imap 0.5.15 - #4229
Open
lbakerchef wants to merge 2 commits into
Open
CHEF-37568 - Regenerate oc-id Gemfile.lock for net-imap 0.5.15#4229lbakerchef wants to merge 2 commits into
lbakerchef wants to merge 2 commits into
Conversation
Re-locks src/oc-id/Gemfile.lock so net-imap resolves to 0.5.15, matching the raised NET_IMAP_FIX_VERSION_0_5 floor in safe_versions.rb (see the companion chef-server-omnibus-config PR). Closes CVE-2026-47240, CVE-2026-47241, and CVE-2026-47242. Regenerated under Ruby 3.1.7 (oc-id's actual CI target) with bundler 2.3.27, matching the existing lockfile's BUNDLED WITH version. Only net-imap's version line changed in the GEM and DEPENDENCIES sections; no other dependencies moved. Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
lbakerchef
force-pushed
the
CHEF-37568/lbaker
branch
from
August 11, 2026 08:04
58669e4 to
2ffd733
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-locks
src/oc-id/Gemfile.lockso net-imap resolves to0.5.15, matching the raisedNET_IMAP_FIX_VERSION_0_5floor insafe_versions.rb(see companionchef-server-omnibus-configPR chef/chef-server-omnibus-config#28).Jira
https://progresssoftware.atlassian.net/browse/CHEF-37568
CVEs closed
CVE-2026-47240, CVE-2026-47241, CVE-2026-47242
Stacked branch note
This branch is based on
CHEF-33469/lbaker(#4227, still open/unmerged), which laid the groundwork for thesafe_versions.rbfloor-enforcement mechanism. Diff will include #4227's commits until that merges — please review only the top commit (Gemfile.lockregeneration).Testing
Regenerated under Ruby 3.1.7 (oc-id's actual CI target — see
.github/workflows/brakeman-analysis.yml) with bundler 2.3.27, matching the existing lockfile'sBUNDLED WITHversion, in an ephemeral Docker container (safe_versions.rbstaged temporarily to mimic the omnibus build's copy step, then removed — it is not part of this repo's tree).Verified:
0.5.15in both theGEMandDEPENDENCIESsections.BUNDLED WITH 2.3.27unchanged.omnibussubmodule pointer untouched (no bump as part of this change set).