Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Set new minimum fastlane version to 2.104.0 to fix #129 #130

Merged
5 commits merged into from
Dec 5, 2018
Merged

Set new minimum fastlane version to 2.104.0 to fix #129 #130

5 commits merged into from
Dec 5, 2018

Conversation

ghost
Copy link

@ghost ghost commented Dec 4, 2018 •
edited by ghost
Loading

Fixes CVE 2018-1000544 and resolves #129.

Fastlane 2.104.0 is the first version that has version 1.2.2 of rubyzip as a minimum requirement.

Set new minimum fastlane version to fix #129
efe6a0f 
Fixes CVE 2018-1000544 and resolves #129
@ghost ghost added the security This has security impact label Dec 4, 2018
@ghost ghost self-assigned this Dec 4, 2018
@ghost ghost requested review from carol-mohemian and a user December 4, 2018 14:35
@ghost ghost mentioned this pull request Dec 4, 2018
Closed
@ghost ghost changed the title Set new minimum fastlane version to fix #129 Set new minimum fastlane version to 2.108.0 to fix #129 Dec 4, 2018
@ghost ghost removed their request for review December 4, 2018 17:30
@ghost ghost self-assigned this Dec 4, 2018
@ghost ghost self-requested a review December 4, 2018 17:31
@ghost
Copy link

ghost commented Dec 4, 2018 •
edited by ghost
Loading

I think the build issue was that Travis doesn't run bundle update on every build, so I had to do that locally. We should probably update our .travis.yml and add that call. EDIT: We should not of course, travis should install from the lockfile.. 😅

Anyway, thanks for taking care of the issue @alex-mohemian! 👍

@ghost
Copy link
Author

ghost commented Dec 5, 2018

@daniel-mohemian yeah I saw that. But I also wanted to downgrade to the minimum version of fastlane that includes the fix.

Travis doesn't need to do bundle update, I should have done that locally, of course but I submitted that from my phone, so... 😉

@ghost ghost closed this Dec 5, 2018
@ghost ghost deleted the bugfix/CVE-2018-1000544 branch December 5, 2018 10:13
@ghost ghost restored the bugfix/CVE-2018-1000544 branch December 5, 2018 10:19
@ghost ghost reopened this Dec 5, 2018
marian-mohemian
marian-mohemian approved these changes Dec 5, 2018
View reviewed changes
Copy link

@marian-mohemian marian-mohemian left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM ✅

@ghost ghost changed the title Set new minimum fastlane version to 2.108.0 to fix #129 Set new minimum fastlane version to 2.104.0 to fix #129 Dec 5, 2018
@ghost ghost merged commit 4ed2721 into master Dec 5, 2018
@ghost ghost deleted the bugfix/CVE-2018-1000544 branch December 5, 2018 10:53
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@carol-mohemian carol-mohemian Awaiting requested review from carol-mohemian

Assignees
No one assigned
Labels
security This has security impact
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Security CVE CVE-2018-1000544
2 participants
@marian-mohemian @daniel-moh