Hi there, not sure if this is the right channel to...
# pact-jsm
Milda
03/18/2023, 1:15 PMHi there, not sure if this is the right channel to post, but please point me to the correct team if not. We are trying to implement pact across a varied tech stack in the company, one of them being the front end team, so we're using pact-js for them. The problem is that the pact core package, pulled in with pact js, has the standalone pact inside it on ruby version 2.4.0, which is throwing some vulnerability issues with our security checks. Are there options I can use to bump this ruby version, or are there any plans to bump the version by the pact team? Thanks very much in advance.
Milda
03/18/2023, 1:36 PMah I see traveling ruby hasn't had a release for a higher version for a long time.
đź‘Ť 1
m
Matt (pactflow.io / pact-js / pact-go)
03/18/2023, 10:06 PM
Hi Milda, short answer is yes.
We'll be removing it from Pact JS very soon
Matt (pactflow.io / pact-js / pact-go)
03/18/2023, 10:07 PM
Or at the very least, it won't be a required dependency
Matt (pactflow.io / pact-js / pact-go)
03/18/2023, 10:09 PM
This being said, just because the packages have security vulnerabilities associated with them doesn't mean they are actually problematic in real life
Security tools are still not advanced enough to actually tell you if they're applicable or not.
You could literally remove the tiny folder post install and Pact would work, if that workaround is acceptable
m
Milda
03/20/2023, 8:59 AMThanks so much for the thorough response, Matt. We do have a security team to speak to about these if need be, but wanted to see if there's something that can be done on the dev end to prevent them popping up in the first place. Removing the folder seems like a perfectly reasonable workaround for now. Cheers!
đź‘Ť 1
m
Matt (pactflow.io / pact-js / pact-go)
03/21/2023, 1:03 AM
No worries!
Matt (pactflow.io / pact-js / pact-go)
03/21/2023, 1:06 AM
Sorry for the “rant”-ish. We get a lot of this across the board, and the current state of vulnerability management is rather painful for maintainers of libraries, because if you can’t auto-bump versions then your only recourse is to explain why it’s not actually a problem, but that doesn’t make the security people happy