diff options
Diffstat (limited to 'guides')
| -rw-r--r-- | guides/source/security.md | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/guides/source/security.md b/guides/source/security.md index bb996cc39c..dbec3cdd2d 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -1235,6 +1235,11 @@ version: Rails.application.credentials.some_api_key! # => raises KeyError: :some_api_key is blank ``` +Dependency Management and CVEs +------------------------------ + +We don’t bump dependencies just to encourage use of new versions, including for security issues. This is because application owners need to manually update their gems regardless of our efforts. Use `bundle update --conservative gem_name` to safely update vulnerable dependencies. + Additional Resources -------------------- |