From e74fdbe00cd0f403d34f2bc83eb09e7a5bc56109 Mon Sep 17 00:00:00 2001
From: Gannon McGibbon <gannon.mcgibbon@gmail.com>
Date: Tue, 6 Nov 2018 18:05:40 -0500
Subject: Amend CVE note and security guide section wordings
Reword first sentence of dep management and CVE section of
security guide. Also, reword and move gemspec notes above deps.
[ci skip]
---
railties/railties.gemspec | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
(limited to 'railties')
diff --git a/railties/railties.gemspec b/railties/railties.gemspec
index 98155a35e3..4e4a504c97 100644
--- a/railties/railties.gemspec
+++ b/railties/railties.gemspec
@@ -2,9 +2,6 @@
version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip
-# NOTE: There's no need to update dependencies for CVEs in minor
-# releases when users can simply run `bundle update vulnerable_gem`.
-
Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
s.name = "railties"
@@ -33,6 +30,9 @@ Gem::Specification.new do |s|
"changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/railties/CHANGELOG.md"
}
+ # NOTE: Please read our dependency guidelines before updating versions:
+ # https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves
+
s.add_dependency "activesupport", version
s.add_dependency "actionpack", version
--
cgit v1.2.3