Hi Pact team, quick query re: ruby version of pact ruby standalone. Saw it got bumped to ruby 3.2.2 a few months back, which is fantastic news! My question is, is the pact team gonna track security vulns related to the ruby version and update accordingly? Just need to understand what the maintenance looks like going forward, as our security team will need that info prior to installing the standalone on our end. Thanks a lot!

We are using a fork of the traveling-ruby build system https://github.com/YOU54F/traveling-ruby So have the ability to update as and when. We use dependabot of the pact-ruby-standalone repo to track gem updates. OSS Software is provided without warranty, given or implied. The source can be updated by anyone and PR’s proposed to patch any vulns. What is the expectation of the security team?

Hi Yousaf, thanks for the thorough reply. That is absolutely reasonable. We use dependabot also - so likely whatever flags up for us will flag up for you, too. I think expectation is just that it's not left alone/not updated with suggested patches etc. But as it's an active project and you guys are on top of it, we'll make sure to keep an eye out on anything that can be helped with, too. Thanks again for sorting the higher version of ruby in the project, it's making our life much easier! 😄 🌷