From 2a8c76a6d8995f4ae398de4759446e42e7360f4b Mon Sep 17 00:00:00 2001 From: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> Date: Fri, 31 Jul 2026 18:32:48 -0500 Subject: [PATCH 1/3] tie rack/rexml floors to omnibus-config safe_versions.rb Add explicit rack/rexml version floors to the three Gemfiles here that pull in chef and/or chef-zero (chef-server-ctl, oc-id, oc-chef-pedant), sourced dynamically from the same SafeVersions::MINIMUM_SAFE_RACK_VERSION / MINIMUM_SAFE_REXML_VERSION constants that ruby_gems_cleanup.rb enforces on upgrade, reached via the omnibus/ submodule's libraries/safe_versions.rb (bumped in the prior commit). This makes the safety floor a single source of truth instead of two independently maintained values that can drift apart. - src/chef-server-ctl/Gemfile: new rack + rexml floors (had none). - src/oc-id/Gemfile: replaced the previous static `gem 'rack', '>= 3.2.4'` with the dynamic floor; added a new rexml floor (had none). - oc-chef-pedant/Gemfile: new rack floor only (rexml isn't in its resolved dependency graph). Each Gemfile wraps the require_relative in begin/rescue LoadError and fails open (warns, defaults to no floor) if the submodule isn't checked out or the file can't otherwise be reached, or if the expected constants aren't defined/are blank -- so a developer who hasn't run `git submodule update --init` still gets a working `bundle install`, just without the extra floor enforced. A genuine bug in safe_versions.rb's own Ruby (syntax error, etc.) is not swallowed and will still fail the build loudly, by design. Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> extend oc-id's rack/rexml Gemfile floor pattern to net-imap (CHEF-35182) Add a net-imap version floor to oc-id's Gemfile using the same resolve_safe_version.call(:CONSTANT) pattern already used for rack/rexml, sourced from omnibus-config's safe_versions.rb (the same file ruby_gems_cleanup.rb enforces on upgrade): gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}" net-imap isn't a direct oc-id dependency -- it's pulled in transitively via mail -- but CVE-2025-XXXXX (net-imap response injection) affects versions below 0.5.14 (Ruby < 3.2) or 0.6.4 (Ruby >= 3.2). NET_IMAP_FIX_VERSION resolves to whichever floor applies to the Ruby this Gemfile is bundled under, so `bundle install` refuses to resolve a vulnerable net-imap regardless of what mail or any other dependency would otherwise pull in. Comment updated to mention net-imap alongside rack/rexml and to point at NET_IMAP_FIX_VERSION specifically, since (unlike the rack/rexml floors) it's a computed value rather than a fixed one -- see safe_versions.rb for why. Companion change in chef-server-omnibus-config (commit f38c231, "extend safe-versions floors to net-imap") adds the NET_IMAP_FIX_VERSION_0_4/_0_5/_0_6 constants, the generic NET_IMAP_FIX_VERSION resolution, and generalizes ruby_gems_cleanup.rb's vulnerable-gem sweep to cover net-imap; that repo's submodule pointer is bumped in a separate commit here. Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> --- oc-chef-pedant/Gemfile | 79 +++++++++++++++++++++++++++++++++ src/chef-server-ctl/Gemfile | 82 ++++++++++++++++++++++++++++++++++ src/oc-id/Gemfile | 87 ++++++++++++++++++++++++++++++++++++- 3 files changed, 246 insertions(+), 2 deletions(-) diff --git a/oc-chef-pedant/Gemfile b/oc-chef-pedant/Gemfile index 42282686e4..98d45dd02a 100644 --- a/oc-chef-pedant/Gemfile +++ b/oc-chef-pedant/Gemfile @@ -1,5 +1,79 @@ source "https://rubygems.org" +# minimum safe rack version, single-sourced from the +# omnibus-config repo's infra-server cookbook libraries/safe_versions.rb (the +# same file ruby_gems_cleanup.rb uses). This ensures `bundle install` here +# refuses to resolve rack below the version the cleanup script considers +# safe, regardless of what chef-zero or its dependencies would otherwise +# pull in transitively. +# +# safe_versions.rb is copied into this same directory by the omnibus build +# script (config/software/oc-chef-pedant.rb in chef-server-omnibus-config) +# before `bundle install` runs -- it cannot be reached directly via the +# omnibus/ git submodule here, because Omnibus's `source path:` fetcher only +# copies this repo's own named source directory into an isolated build +# folder, never sibling directories like the submodule. +# +# Fails open (no floor enforced this run, warning printed) if the file +# hasn't been copied into place or otherwise can't be reached -- a genuine +# bug in the file's own content (e.g. a syntax error) is NOT caught here and +# will surface loudly instead. +# +# Bumping a resolved version upward for a non-CVE reason (i.e. the floor +# itself does not need to rise): temporarily add an exact requirement +# alongside the floor below (e.g. `">= ...", "= 3.2.10"`), run +# `bundle update ` to force the resolver to that version, then either +# revert the line to floor-only and run `bundle install` (not `update` -- +# the lock already satisfies the floor and won't be touched), or keep the +# exact requirement permanently as a pin (see below). +# +# Pinning a version permanently (e.g. holding back a version for +# compatibility reasons unrelated to security): add the exact version as an +# additional requirement alongside the floor -- never in place of it, e.g. +# gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}", "= 3.2.10" # pinned , YYYY-MM-DD +# Losing the resolve_safe_version.call(...) term off a pinned line is the +# one mistake to avoid: ruby_gems_cleanup.rb's GEM_ROOTS scan reaches this +# app's own embedded gem path, so if a future CVE raises the floor while a +# gem here is pinned bare (no floor term), `bundle install` would keep +# resolving to the now-unsafe pinned version silently, while the cleanup +# recipe -- reading that same raised floor -- would delete that version's +# files out from under this app's still-referencing Gemfile.lock at the +# next reconfigure, breaking it at runtime instead of failing loudly at +# bundle install/CI time the way a floor-plus-pin combination would. +begin + require_relative 'safe_versions' +rescue LoadError => e + warn "[Gemfile] safe_versions.rb not reachable (#{e.message}) -- no rack floor enforced this run." +end + +resolve_safe_version = lambda do |const_name| + # NOTE: intentionally *not* reopening `module SafeVersions; end` here. Bundler + # evaluates this Gemfile via `instance_eval(string, ...)`, which gives a bare + # `module SafeVersions; end` its own lexical scope -- separate from the true + # top-level `::SafeVersions` that require_relative above defines. Reopening + # it that way silently shadows the real module with an empty one, so every + # lookup below would always report "not defined" even when the require + # succeeded. Referencing `::SafeVersions` explicitly (and guarding with + # `defined?`) avoids the shadow entirely. + unless defined?(::SafeVersions) && ::SafeVersions.const_defined?(const_name, false) + warn "[Gemfile] SafeVersions::#{const_name} is not defined -- defaulting to no floor (>= 0)." + next Gem::Version.new('0') + end + + value = ::SafeVersions.const_get(const_name, false) + if value.nil? || value.to_s.strip.empty? + warn "[Gemfile] SafeVersions::#{const_name} is nil/blank -- defaulting to no floor (>= 0)." + next Gem::Version.new('0') + end + + begin + Gem::Version.new(value.to_s) + rescue StandardError, ArgumentError => e + warn "[Gemfile] SafeVersions::#{const_name} has an invalid value (#{value.inspect}) -- defaulting to no floor (>= 0). (#{e.class}: #{e.message})" + Gem::Version.new('0') + end +end + gemspec # For debugging in dvm gem "pry" @@ -12,6 +86,11 @@ gem "rest-client", git: "https://github.com/chef/rest-client.git", branch: "jfm/ # PR #352 merged to main but not released yet - use main branch gem 'chef-zero', git: "https://github.com/chef/chef-zero.git", branch: "main" +# see the SafeVersions setup at the top of this file. +# Example only -- how to pin an exact version: replace X.Y.Z before uncommenting: +# gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}", "= X.Y.Z" # pinned , YYYY-MM-DD +gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}" + # If you want to load debugging tools into the bundle exec sandbox, # # add these additional dependencies into Gemfile.local eval(File.read(__FILE__ + ".local"), binding) if File.exist?(__FILE__ + ".local") diff --git a/src/chef-server-ctl/Gemfile b/src/chef-server-ctl/Gemfile index fd5aaafdb8..e9fd7c2b72 100644 --- a/src/chef-server-ctl/Gemfile +++ b/src/chef-server-ctl/Gemfile @@ -1,5 +1,79 @@ source "https://rubygems.org" +# minimum safe rack/rexml versions, single-sourced from the +# omnibus-config repo's infra-server cookbook libraries/safe_versions.rb (the +# same file ruby_gems_cleanup.rb uses). This ensures `bundle install` here +# refuses to resolve rack/rexml below the versions the cleanup script +# considers safe, regardless of what chef or its dependencies would +# otherwise pull in transitively. +# +# safe_versions.rb is copied into this same directory by the omnibus build +# script (config/software/private-chef-ctl.rb in chef-server-omnibus-config) +# before `bundle install` runs -- it cannot be reached directly via the +# omnibus/ git submodule here, because Omnibus's `source path:` fetcher only +# copies this repo's own named source directory into an isolated build +# folder, never sibling directories like the submodule. +# +# Fails open (no floor enforced this run, warning printed) if the file +# hasn't been copied into place or otherwise can't be reached -- a genuine +# bug in the file's own content (e.g. a syntax error) is NOT caught here and +# will surface loudly instead. +# +# Bumping a resolved version upward for a non-CVE reason (i.e. the floor +# itself does not need to rise): temporarily add an exact requirement +# alongside the floor below (e.g. `">= ...", "= 3.2.10"`), run +# `bundle update ` to force the resolver to that version, then either +# revert the line to floor-only and run `bundle install` (not `update` -- +# the lock already satisfies the floor and won't be touched), or keep the +# exact requirement permanently as a pin (see below). +# +# Pinning a version permanently (e.g. holding back a version for +# compatibility reasons unrelated to security): add the exact version as an +# additional requirement alongside the floor -- never in place of it, e.g. +# gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}", "= 3.2.10" # pinned , YYYY-MM-DD +# Losing the resolve_safe_version.call(...) term off a pinned line is the +# one mistake to avoid: ruby_gems_cleanup.rb's GEM_ROOTS scan reaches this +# app's own embedded gem path, so if a future CVE raises the floor while a +# gem here is pinned bare (no floor term), `bundle install` would keep +# resolving to the now-unsafe pinned version silently, while the cleanup +# recipe -- reading that same raised floor -- would delete that version's +# files out from under this app's still-referencing Gemfile.lock at the +# next reconfigure, breaking it at runtime instead of failing loudly at +# bundle install/CI time the way a floor-plus-pin combination would. +begin + require_relative 'safe_versions' +rescue LoadError => e + warn "[Gemfile] safe_versions.rb not reachable (#{e.message}) -- no rack/rexml floor enforced this run." +end + +resolve_safe_version = lambda do |const_name| + # NOTE: intentionally *not* reopening `module SafeVersions; end` here. Bundler + # evaluates this Gemfile via `instance_eval(string, ...)`, which gives a bare + # `module SafeVersions; end` its own lexical scope -- separate from the true + # top-level `::SafeVersions` that require_relative above defines. Reopening + # it that way silently shadows the real module with an empty one, so every + # lookup below would always report "not defined" even when the require + # succeeded. Referencing `::SafeVersions` explicitly (and guarding with + # `defined?`) avoids the shadow entirely. + unless defined?(::SafeVersions) && ::SafeVersions.const_defined?(const_name, false) + warn "[Gemfile] SafeVersions::#{const_name} is not defined -- defaulting to no floor (>= 0)." + next Gem::Version.new('0') + end + + value = ::SafeVersions.const_get(const_name, false) + if value.nil? || value.to_s.strip.empty? + warn "[Gemfile] SafeVersions::#{const_name} is nil/blank -- defaulting to no floor (>= 0)." + next Gem::Version.new('0') + end + + begin + Gem::Version.new(value.to_s) + rescue StandardError, ArgumentError => e + warn "[Gemfile] SafeVersions::#{const_name} has an invalid value (#{value.inspect}) -- defaulting to no floor (>= 0). (#{e.class}: #{e.message})" + Gem::Version.new('0') + end +end + gemspec gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1" @@ -11,3 +85,11 @@ gem "knife","~> 19.0.105" gem "knife-ec-backup", "~> 3.0.8" gem "public_suffix", "< 7.0" # public_suffix 7.0+ requires Ruby >= 3.2; pin for Ruby 3.1 compatibility + +# see the SafeVersions setup at the top of this file. +# Example only -- how to pin an exact version: replace X.Y.Z before uncommenting: +# gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}", "= X.Y.Z" # pinned , YYYY-MM-DD +gem "rack", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}" +# Example only -- how to pin an exact version: replace X.Y.Z before uncommenting: +# gem "rexml", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_REXML_VERSION)}", "= X.Y.Z" # pinned , YYYY-MM-DD +gem "rexml", ">= #{resolve_safe_version.call(:MINIMUM_SAFE_REXML_VERSION)}" diff --git a/src/oc-id/Gemfile b/src/oc-id/Gemfile index 0e50325f36..41733e7fe0 100644 --- a/src/oc-id/Gemfile +++ b/src/oc-id/Gemfile @@ -1,6 +1,81 @@ source 'https://rubygems.org' git_source(:github) { |repo| "https://github.com/#{repo}.git" } +# minimum safe rack/rexml/net-imap versions, single-sourced from the +# omnibus-config repo's infra-server cookbook libraries/safe_versions.rb (the +# same file ruby_gems_cleanup.rb uses). This ensures `bundle install` here +# refuses to resolve rack/rexml/net-imap below the versions the cleanup +# script considers safe, regardless of what chef or its dependencies would +# otherwise pull in transitively. See that file's NET_IMAP_FIX_VERSION +# constant for why net-imap's floor is computed rather than a fixed value. +# +# safe_versions.rb is copied into this same directory by the omnibus build +# script (config/software/oc_id.rb in chef-server-omnibus-config) before +# `bundle install` runs -- it cannot be reached directly via the omnibus/ +# git submodule here, because Omnibus's `source path:` fetcher only copies +# this repo's own named source directory into an isolated build folder, +# never sibling directories like the submodule. +# +# Fails open (no floor enforced this run, warning printed) if the file +# hasn't been copied into place or otherwise can't be reached -- a genuine +# bug in the file's own content (e.g. a syntax error) is NOT caught here and +# will surface loudly instead. +# +# Bumping a resolved version upward for a non-CVE reason (i.e. the floor +# itself does not need to rise): temporarily add an exact requirement +# alongside the floor below (e.g. `">= ...", "= 3.2.10"`), run +# `bundle update ` to force the resolver to that version, then either +# revert the line to floor-only and run `bundle install` (not `update` -- +# the lock already satisfies the floor and won't be touched), or keep the +# exact requirement permanently as a pin (see below). +# +# Pinning a version permanently (e.g. holding back a version for +# compatibility reasons unrelated to security): add the exact version as an +# additional requirement alongside the floor -- never in place of it, e.g. +# gem 'rack', ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}", "= 3.2.10" # pinned , YYYY-MM-DD +# Losing the resolve_safe_version.call(...) term off a pinned line is the +# one mistake to avoid: ruby_gems_cleanup.rb's GEM_ROOTS scan reaches this +# app's own embedded gem path, so if a future CVE raises the floor while a +# gem here is pinned bare (no floor term), `bundle install` would keep +# resolving to the now-unsafe pinned version silently, while the cleanup +# recipe -- reading that same raised floor -- would delete that version's +# files out from under this app's still-referencing Gemfile.lock at the +# next reconfigure, breaking it at runtime instead of failing loudly at +# bundle install/CI time the way a floor-plus-pin combination would. +begin + require_relative 'safe_versions' +rescue LoadError => e + warn "[Gemfile] safe_versions.rb not reachable (#{e.message}) -- no rack/rexml floor enforced this run." +end + +resolve_safe_version = lambda do |const_name| + # NOTE: intentionally *not* reopening `module SafeVersions; end` here. Bundler + # evaluates this Gemfile via `instance_eval(string, ...)`, which gives a bare + # `module SafeVersions; end` its own lexical scope -- separate from the true + # top-level `::SafeVersions` that require_relative above defines. Reopening + # it that way silently shadows the real module with an empty one, so every + # lookup below would always report "not defined" even when the require + # succeeded. Referencing `::SafeVersions` explicitly (and guarding with + # `defined?`) avoids the shadow entirely. + unless defined?(::SafeVersions) && ::SafeVersions.const_defined?(const_name, false) + warn "[Gemfile] SafeVersions::#{const_name} is not defined -- defaulting to no floor (>= 0)." + next Gem::Version.new('0') + end + + value = ::SafeVersions.const_get(const_name, false) + if value.nil? || value.to_s.strip.empty? + warn "[Gemfile] SafeVersions::#{const_name} is nil/blank -- defaulting to no floor (>= 0)." + next Gem::Version.new('0') + end + + begin + Gem::Version.new(value.to_s) + rescue StandardError, ArgumentError => e + warn "[Gemfile] SafeVersions::#{const_name} has an invalid value (#{value.inspect}) -- defaulting to no floor (>= 0). (#{e.class}: #{e.message})" + Gem::Version.new('0') + end +end + # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' gem 'rails', '7.2.3.1' gem "rest-client", git: "https://github.com/chef/rest-client", branch: "jfm/ucrt_update1" @@ -29,7 +104,15 @@ gem 'veil', '~> 0.3.11', git: "https://github.com/talktovikas/chef_secrets.git", branch: "vikas/debug" -gem 'rack', '>= 3.2.4' +# Example only -- how to pin an exact version: replace X.Y.Z before uncommenting: +# gem 'rack', ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}", "= X.Y.Z" # pinned , YYYY-MM-DD +gem 'rack', ">= #{resolve_safe_version.call(:MINIMUM_SAFE_RACK_VERSION)}" +# Example only -- how to pin an exact version: replace X.Y.Z before uncommenting: +# gem 'rexml', ">= #{resolve_safe_version.call(:MINIMUM_SAFE_REXML_VERSION)}", "= X.Y.Z" # pinned , YYYY-MM-DD +gem 'rexml', ">= #{resolve_safe_version.call(:MINIMUM_SAFE_REXML_VERSION)}" +# Example only -- how to pin an exact version: replace X.Y.Z before uncommenting: +# gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}", "= X.Y.Z" # pinned , YYYY-MM-DD +gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}" gem 'omniauth-chef', '~> 0.4.1', git: "https://github.com/talktovikas/omniauth-chef.git", @@ -71,4 +154,4 @@ group :test do gem 'factory_bot_rails', '~> 6.4' gem 'selenium-webdriver', '~> 4.7.1' gem 'timecop' -end \ No newline at end of file +end From 79329671647a62abaf5f9b808928f397cb7e36d6 Mon Sep 17 00:00:00 2001 From: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> Date: Sun, 2 Aug 2026 18:43:33 -0500 Subject: [PATCH 2/3] regen Gemfile.lock Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> --- oc-chef-pedant/Gemfile.lock | 1 + src/chef-server-ctl/Gemfile.lock | 657 +++++++++---------------------- src/oc-id/Gemfile.lock | 4 +- 3 files changed, 194 insertions(+), 468 deletions(-) diff --git a/oc-chef-pedant/Gemfile.lock b/oc-chef-pedant/Gemfile.lock index 9366e2c42a..bcfb939ba8 100644 --- a/oc-chef-pedant/Gemfile.lock +++ b/oc-chef-pedant/Gemfile.lock @@ -153,6 +153,7 @@ DEPENDENCIES pry pry-byebug pry-stack_explorer + rack (>= 3.2.5) rake rest-client! diff --git a/src/chef-server-ctl/Gemfile.lock b/src/chef-server-ctl/Gemfile.lock index 7bc1d75f66..f8ed8cfed2 100644 --- a/src/chef-server-ctl/Gemfile.lock +++ b/src/chef-server-ctl/Gemfile.lock @@ -10,111 +10,37 @@ GIT mime-types (>= 1.16, < 4.0) netrc (~> 0.8) -GIT - remote: https://github.com/talktovikas/chef_secrets.git - revision: 98c1eea7e8ec67ff10ee9c3057af1e881aa6dd13 - branch: vikas/debug - specs: - veil (0.3.14) - bcrypt (~> 3.1) - pbkdf2 - -GIT - remote: https://github.com/talktovikas/omniauth-chef.git - revision: 65c158d6c406e12cffbdf781e44fbfa5567036fd - branch: vikas/chef-upgrade - specs: - omniauth-chef (0.4.1) - chef (~> 18.7, >= 18.7.10) - omniauth (~> 2.0, >= 2.0.4) - -GIT - remote: https://github.com/talktovikas/unicorn-rails.git - revision: 28921e6f2f7a1e6dc406b0f1e6b4a51b96542b4e - branch: vikas/rack +PATH + remote: . specs: - unicorn-rails (2.2.1) - rack - unicorn + chef-server-ctl (1.1.0) + appbundler + chef (~> 18.10.17) + chef_backup + chef_fixie (>= 1.0.3) + ffi-yajl (>= 1.2.0) + highline (>= 1.6.9, < 3.0) + knife + knife-ec-backup + license-acceptance + mixlib-install + mixlib-log + omnibus-ctl (<= 0.6.10) + pg (~> 1.2, >= 1.2.3, < 1.6) + redis + rest-client + uuidtools (~> 2.1, >= 2.1.3) + veil GEM remote: https://rubygems.org/ specs: - actioncable (7.2.3.1) - actionpack (= 7.2.3.1) - activesupport (= 7.2.3.1) - nio4r (~> 2.0) - websocket-driver (>= 0.6.1) - zeitwerk (~> 2.6) - actionmailbox (7.2.3.1) - actionpack (= 7.2.3.1) - activejob (= 7.2.3.1) - activerecord (= 7.2.3.1) - activestorage (= 7.2.3.1) - activesupport (= 7.2.3.1) - mail (>= 2.8.0) - actionmailer (7.2.3.1) - actionpack (= 7.2.3.1) - actionview (= 7.2.3.1) - activejob (= 7.2.3.1) - activesupport (= 7.2.3.1) - mail (>= 2.8.0) - rails-dom-testing (~> 2.2) - actionpack (7.2.3.1) - actionview (= 7.2.3.1) - activesupport (= 7.2.3.1) - cgi - nokogiri (>= 1.8.5) - racc - rack (>= 2.2.4, < 3.3) - rack-session (>= 1.0.1) - rack-test (>= 0.6.3) - rails-dom-testing (~> 2.2) - rails-html-sanitizer (~> 1.6) - useragent (~> 0.16) - actiontext (7.2.3.1) - actionpack (= 7.2.3.1) - activerecord (= 7.2.3.1) - activestorage (= 7.2.3.1) - activesupport (= 7.2.3.1) - globalid (>= 0.6.0) - nokogiri (>= 1.8.5) - actionview (7.2.3.1) - activesupport (= 7.2.3.1) - builder (~> 3.1) - cgi - erubi (~> 1.11) - rails-dom-testing (~> 2.2) - rails-html-sanitizer (~> 1.6) - activejob (7.2.3.1) - activesupport (= 7.2.3.1) - globalid (>= 0.3.6) - activemodel (7.2.3.1) - activesupport (= 7.2.3.1) - activerecord (7.2.3.1) - activemodel (= 7.2.3.1) - activesupport (= 7.2.3.1) - timeout (>= 0.4.0) - activestorage (7.2.3.1) - actionpack (= 7.2.3.1) - activejob (= 7.2.3.1) - activerecord (= 7.2.3.1) - activesupport (= 7.2.3.1) - marcel (~> 1.0) - activesupport (7.2.3.1) - base64 - benchmark (>= 0.3) - bigdecimal - concurrent-ruby (~> 1.0, >= 1.3.1) - connection_pool (>= 2.2.5) - drb - i18n (>= 1.6, < 2) - logger (>= 1.4.2) - minitest (>= 5.1, < 6) - securerandom (>= 0.3) - tzinfo (~> 2.0, >= 2.0.5) + abbrev (0.1.2) addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) + appbundler (0.13.4) + mixlib-cli (>= 1.4, < 3.0) + mixlib-shellout (>= 2.0, < 4.0) ast (2.4.3) aws-eventstream (1.4.0) aws-partitions (1.1246.0) @@ -140,26 +66,24 @@ GEM aws-eventstream (~> 1, >= 1.0.2) base64 (0.3.0) bcrypt (3.1.22) + bcrypt_pbkdf (1.1.2) benchmark (0.5.0) - better_errors (2.10.1) - erubi (>= 1.0.0) - rack (>= 0.9.0) - rouge (>= 1.0.0) + berkshelf (8.0.22) + chef (>= 18.0.0) + chef-cleanroom (~> 1.0) + chef-config + concurrent-ruby (~> 1.0) + ffi (>= 1.15.5, <= 1.16.3) + minitar (~> 1.0) + mixlib-archive (>= 1.1.4, < 2.0) + mixlib-config (>= 2.2.5) + mixlib-shellout (>= 2.0, < 4.0) + octokit (>= 4.0, < 6.0) + retryable (>= 2.0, < 4.0) + solve (~> 4.0) + thor (>= 0.20, < 1.3.0) bigdecimal (3.1.3) - binding_of_caller (2.0.0) - debug_inspector (>= 1.2.0) builder (3.3.0) - byebug (12.0.0) - capybara (3.40.0) - addressable - matrix - mini_mime (>= 0.1.3) - nokogiri (~> 1.11) - rack (>= 1.6.0) - rack-test (>= 0.6.3) - regexp_parser (>= 1.5, < 3.0) - xpath (~> 3.2) - cgi (0.5.1) chef (18.10.17) addressable aws-sdk-s3 (~> 1.91) @@ -195,6 +119,7 @@ GEM uri (~> 1.0.4) uuidtools (>= 2.1.5, < 3.0) vault (~> 0.18.2) + chef-cleanroom (1.0.5) chef-config (18.10.17) addressable chef-utils (= 18.10.17) @@ -205,12 +130,21 @@ GEM chef-gyoku (1.5.0) builder (>= 2.1.2) rexml (~> 3.4) + chef-licensing (1.4.1) + chef-config (>= 15) + faraday (>= 1, < 3) + faraday-http-cache + mixlib-log (~> 3.0) + ostruct (~> 0.6.0) + pstore (~> 0.1.1) + tty-prompt (~> 0.23) + tty-spinner (~> 0.9.3) chef-telemetry (1.1.1) chef-config concurrent-ruby (~> 1.0) chef-utils (18.10.17) concurrent-ruby - chef-vault (4.2.9) + chef-vault (4.2.12) syslog (~> 0.3) chef-winrm (2.5.0) builder (>= 2.1.2) @@ -233,245 +167,185 @@ GEM erubi (>= 1.7) logging (>= 1.6.1, < 3.0) rubyzip (~> 2.0) - chef-zero (15.1.0) + chef-zero (15.1.11) ffi-yajl (>= 2.2, < 4.0) hashie (>= 2.0, < 6.0) mixlib-log (>= 2.0, < 4.0) - rack (~> 3.1, >= 3.1.16) - rackup (~> 2.2, >= 2.2.1) - unf_ext (~> 0.0.8) - uuidtools (~> 2.1) + rack (~> 3.2, >= 3.2.6) + rackup (~> 2.3, >= 2.3.1) + uuidtools (>= 2.1, < 4.0) webrick + chef_backup (0.3.0) + chef-utils (>= 16.5.54) + mixlib-shellout (>= 2.0, < 4.0) + pastel + tty-prompt (~> 0.21) + chef_fixie (1.0.8) + chef (>= 16) + ffi-yajl (>= 1.2.0) + pg (~> 1.2, >= 1.2.3) + pry (~> 0.13) + sequel (>= 4.11) + uuidtools (~> 2.1, >= 2.1.3) + veil + chefstyle (2.2.3) + rubocop (= 1.25.1) coderay (1.1.3) - coffee-rails (5.0.0) - coffee-script (>= 2.2.0) - railties (>= 5.2.0) - coffee-script (2.4.1) - coffee-script-source - execjs - coffee-script-source (1.12.2) - concurrent-ruby (1.3.6) - config (4.2.1) - deep_merge (~> 1.2, >= 1.2.1) - dry-validation (~> 1.0, >= 1.0.0) + concurrent-ruby (1.3.8) connection_pool (2.5.5) - cookstyle (8.6.10) - rubocop (= 1.84.2) - corefoundation (0.3.13) + corefoundation (0.3.19) ffi (>= 1.15.0) - crass (1.0.6) csv (3.3.5) - daemons (1.4.1) date (3.5.1) - debug_inspector (1.2.0) - deep_merge (1.2.2) diff-lcs (1.5.1) domain_name (0.6.20240107) - doorkeeper (5.9.0) - railties (>= 5) - drb (2.2.3) - dry-configurable (1.3.0) - dry-core (~> 1.1) - zeitwerk (~> 2.6) - dry-core (1.1.0) - concurrent-ruby (~> 1.0) - logger - zeitwerk (~> 2.6) - dry-inflector (1.2.0) - dry-initializer (3.2.0) - dry-logic (1.6.0) - bigdecimal - concurrent-ruby (~> 1.0) - dry-core (~> 1.1) - zeitwerk (~> 2.6) - dry-schema (1.14.1) - concurrent-ruby (~> 1.0) - dry-configurable (~> 1.0, >= 1.0.1) - dry-core (~> 1.1) - dry-initializer (~> 3.2) - dry-logic (~> 1.5) - dry-types (~> 1.8) - zeitwerk (~> 2.6) - dry-types (1.8.3) - bigdecimal (~> 3.0) - concurrent-ruby (~> 1.0) - dry-core (~> 1.0) - dry-inflector (~> 1.0) - dry-logic (~> 1.4) - zeitwerk (~> 2.6) - dry-validation (1.11.1) - concurrent-ruby (~> 1.0) - dry-core (~> 1.1) - dry-initializer (~> 3.2) - dry-schema (~> 1.14) - zeitwerk (~> 2.6) - erb (4.0.4.1) - cgi (>= 0.3.3) + ed25519 (1.4.0) erubi (1.13.1) erubis (2.7.0) - eventmachine (1.2.7) - execjs (2.10.1) - factory_bot (6.6.0) - activesupport (>= 6.1.0) - factory_bot_rails (6.5.1) - factory_bot (~> 6.5) - railties (>= 6.1.0) faraday (2.14.1) faraday-net_http (>= 2.0, < 3.5) json logger faraday-follow_redirects (0.5.0) faraday (>= 1, < 3) + faraday-http-cache (2.5.1) + faraday (>= 0.8) faraday-net_http (3.4.2) net-http (~> 0.5) ffi (1.16.3) ffi-libarchive (1.1.14) ffi (~> 1.0) - ffi-yajl (2.7.7) + ffi-yajl (2.7.11) libyajl2 (>= 2.1) - yajl fuzzyurl (0.9.0) - globalid (1.3.0) - activesupport (>= 6.1) gssapi (1.3.1) ffi (>= 1.0.1) - haml (6.4.0) - temple (>= 0.8.2) - thor - tilt hashie (5.1.0) logger + highline (2.1.0) http-accept (2.1.1) http-cookie (1.1.6) domain_name (~> 0.5) httpclient (2.9.0) mutex_m - i18n (1.14.8) - concurrent-ruby (~> 1.0) iniparse (1.5.0) - inspec-core (5.23.6) + inspec-core (5.22.40) addressable (~> 2.4) chef-telemetry (~> 1.0, >= 1.0.8) - cookstyle faraday (>= 1, < 3) faraday-follow_redirects (~> 0.3) hashie (>= 3.4, < 6.0) license-acceptance (>= 0.2.13, < 3.0) method_source (>= 0.8, < 2.0) - mixlib-log (~> 3.0, < 3.2) + mixlib-log (~> 3.0) multipart-post (~> 2.0) parallel (~> 1.9) parslet (>= 1.5, < 3.0) pry (~> 0.13) - rspec (>= 3.9, <= 3.14) - rspec-its (>= 1.2, < 3.0) - rubyzip (>= 1.2.2, < 4.0) + rspec (>= 3.9, <= 3.12) + rspec-its (~> 1.2) + rubyzip (>= 1.2.2, < 3.0) semverse (~> 3.0) sslshake (~> 1.2) - thor (>= 0.20, < 1.5.0) + thor (>= 0.20, < 1.3.0) tomlrb (>= 1.2, < 2.1) - train-core (~> 3.13, >= 3.13.4) + train-core (~> 3.10) tty-prompt (~> 0.17) tty-table (~> 0.10) io-console (0.8.2) ipaddress (0.8.3) - irb (1.18.0) - pp (>= 0.6.0) - prism (>= 1.3.0) - rdoc (>= 4.0.0) - reline (>= 0.4.2) - jbuilder (2.14.1) - actionview (>= 7.0.0) - activesupport (>= 7.0.0) jmespath (1.6.2) - jquery-rails (4.6.1) - rails-dom-testing (>= 1, < 3) - railties (>= 4.2.0) - thor (>= 0.14, < 2.0) json (2.19.5) - jwt (3.2.0) - base64 - kgio (2.11.4) - language_server-protocol (3.17.0.5) + knife (19.0.134) + abbrev + bcrypt_pbkdf (~> 1.1) + chef-licensing (~> 1.2) + chef-vault + ed25519 (>= 1.2, < 2.0) + erubis (~> 2.7) + ffi (>= 1.15, < 1.18.0) + ffi-yajl (>= 2.2, < 3.0) + highline (>= 1.6.9, < 4) + license-acceptance (>= 1.0.5, < 3) + mixlib-archive (>= 0.4, < 2.0) + mixlib-cli (>= 2.1.1, < 3.0) + net-ssh (>= 5.1, < 8) + net-ssh-multi (~> 1.2, >= 1.2.1) + pastel + proxifier2 (~> 1.1) + train-core (~> 3.13, >= 3.13.4) + train-winrm (>= 0.2.17) + tty-prompt (~> 0.21) + tty-screen (~> 0.6) + tty-table (~> 0.11) + knife-ec-backup (3.0.9) + chef (~> 18.0) + knife-tidy + pg + sequel (~> 5.9) + veil + knife-tidy (2.3.2) + syslog (~> 0.3) libyajl2 (2.1.0) license-acceptance (2.1.13) pastel (~> 0.7) tomlrb (>= 1.2, < 3.0) tty-box (~> 0.6) tty-prompt (~> 0.20) - lint_roller (1.1.0) little-plugger (1.1.4) logger (1.7.0) logging (2.4.0) little-plugger (~> 1.1) multi_json (~> 1.14) - loofah (2.25.1) - crass (~> 1.0.2) - nokogiri (>= 1.12.0) - mail (2.9.0) - logger - mini_mime (>= 0.1.1) - net-imap - net-pop - net-smtp - mailcatcher (0.2.4) - eventmachine - haml - i18n - json - mail - sinatra - skinny (>= 0.1.2) - sqlite3-ruby - thin - marcel (1.2.1) - matrix (0.4.3) method_source (1.1.0) mime-types (3.7.0) logger mime-types-data (~> 3.2025, >= 3.2025.0507) mime-types-data (3.2026.0414) - mini_mime (1.1.5) - minitest (5.27.0) + minitar (1.1.0) mixlib-archive (1.3.3) mixlib-log mixlib-authentication (3.0.10) mixlib-cli (2.1.8) mixlib-config (3.0.27) tomlrb + mixlib-install (3.17.0) + mixlib-shellout + mixlib-versioning + ostruct + thor mixlib-log (3.1.2.1) ffi (< 1.17.0) mixlib-shellout (3.4.10) chef-utils + mixlib-versioning (1.2.12) + molinillo (0.8.0) multi_json (1.19.1) multipart-post (2.4.1) - mustermann (3.1.1) mutex_m (0.3.0) net-ftp (0.3.9) net-protocol time net-http (0.9.1) uri (>= 0.11.1) - net-imap (0.5.14) - date - net-protocol - net-pop (0.1.2) - net-protocol net-protocol (0.2.2) timeout net-scp (4.1.0) net-ssh (>= 2.6.5, < 8.0.0) net-sftp (4.0.0) net-ssh (>= 5.0.0, < 8.0.0) - net-smtp (0.5.1) - net-protocol - net-ssh (7.3.2) + net-ssh (7.3.3) + net-ssh-gateway (2.0.0) + net-ssh (>= 4.0.0) + net-ssh-multi (1.2.1) + net-ssh (>= 2.6.5) + net-ssh-gateway (>= 1.2.0) netrc (0.11.0) - nio4r (2.7.5) - nokogiri (1.18.9-x86_64-linux-gnu) - racc (~> 1.4) nori (2.7.1) bigdecimal + octokit (5.6.1) + faraday (>= 1, < 3) + sawyer (~> 0.9) ohai (18.2.8) chef-config (>= 14.12, < 19) chef-utils (>= 16.0, < 19) @@ -485,13 +359,11 @@ GEM plist (~> 3.1) train-core wmi-lite (~> 1.0) - omniauth (2.1.4) - hashie (>= 3.4.6) - logger - rack (>= 2.2.3) - rack-protection + omnibus-ctl (0.6.10) + chef-utils (>= 16.5.54) + ostruct (0.6.3) parallel (1.28.0) - parser (3.3.11.1) + parser (3.3.12.0) ast (~> 2.4.1) racc parslet (2.0.0) @@ -500,120 +372,54 @@ GEM pbkdf2 (0.1.0) pg (1.5.9) plist (3.7.2) - pp (0.6.3) - prettyprint - prettyprint (0.2.0) prism (1.9.0) proxifier2 (1.1.0) - pry (0.15.2) + pry (0.16.0) coderay (~> 1.1) method_source (~> 1.0) - pry-byebug (3.11.0) - byebug (~> 12.0) - pry (>= 0.13, < 0.16) - psych (5.3.1) - date - stringio - public_suffix (6.0.1) + reline (>= 0.6.0) + pstore (0.1.4) + public_suffix (6.0.2) racc (1.8.1) rack (3.2.6) - rack-protection (4.2.1) - base64 (>= 0.1.0) - logger (>= 1.6.0) - rack (>= 3.0.0, < 4) - rack-session (2.1.2) - base64 (>= 0.1.0) - rack (>= 3.0.0) - rack-test (2.2.0) - rack (>= 1.3) rackup (2.3.1) rack (>= 3) - rails (7.2.3.1) - actioncable (= 7.2.3.1) - actionmailbox (= 7.2.3.1) - actionmailer (= 7.2.3.1) - actionpack (= 7.2.3.1) - actiontext (= 7.2.3.1) - actionview (= 7.2.3.1) - activejob (= 7.2.3.1) - activemodel (= 7.2.3.1) - activerecord (= 7.2.3.1) - activestorage (= 7.2.3.1) - activesupport (= 7.2.3.1) - bundler (>= 1.15.0) - railties (= 7.2.3.1) - rails-controller-testing (1.0.5) - actionpack (>= 5.0.1.rc1) - actionview (>= 5.0.1.rc1) - activesupport (>= 5.0.1.rc1) - rails-dom-testing (2.3.0) - activesupport (>= 5.0.0) - minitest - nokogiri (>= 1.6) - rails-html-sanitizer (1.7.0) - loofah (~> 2.25) - nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) - railties (7.2.3.1) - actionpack (= 7.2.3.1) - activesupport (= 7.2.3.1) - cgi - irb (~> 1.13) - rackup (>= 1.0.0) - rake (>= 12.2) - thor (~> 1.0, >= 1.2.2) - tsort (>= 0.2) - zeitwerk (~> 2.6) rainbow (3.1.1) - raindrops (0.20.1) rake (13.4.2) - rb-readline (0.5.5) - rdoc (7.2.0) - erb - psych (>= 4.0.0) - tsort + redis (5.4.1) + redis-client (>= 0.22.0) + redis-client (0.30.1) + connection_pool regexp_parser (2.12.0) reline (0.6.3) io-console (~> 0.5) - responders (3.2.0) - actionpack (>= 7.0) - railties (>= 7.0) + retryable (3.0.5) rexml (3.4.4) - rouge (4.7.0) - rspec (3.13.2) - rspec-core (~> 3.13.0) - rspec-expectations (~> 3.13.0) - rspec-mocks (~> 3.13.0) - rspec-core (3.13.6) - rspec-support (~> 3.13.0) - rspec-expectations (3.13.5) + rspec (3.12.0) + rspec-core (~> 3.12.0) + rspec-expectations (~> 3.12.0) + rspec-mocks (~> 3.12.0) + rspec-core (3.12.3) + rspec-support (~> 3.12.0) + rspec-expectations (3.12.4) diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.13.0) - rspec-its (2.0.0) - rspec-core (>= 3.13.0) - rspec-expectations (>= 3.13.0) - rspec-mocks (3.13.8) + rspec-support (~> 3.12.0) + rspec-its (1.3.1) + rspec-core (>= 3.0.0) + rspec-expectations (>= 3.0.0) + rspec-mocks (3.12.7) diff-lcs (>= 1.2.0, < 2.0) - rspec-support (~> 3.13.0) - rspec-rails (6.1.5) - actionpack (>= 6.1) - activesupport (>= 6.1) - railties (>= 6.1) - rspec-core (~> 3.13) - rspec-expectations (~> 3.13) - rspec-mocks (~> 3.13) - rspec-support (~> 3.13) - rspec-support (3.13.7) - rubocop (1.84.2) - json (~> 2.3) - language_server-protocol (~> 3.17.0.2) - lint_roller (~> 1.1.0) + rspec-support (~> 3.12.0) + rspec-support (3.12.2) + rubocop (1.25.1) parallel (~> 1.10) - parser (>= 3.3.0.2) + parser (>= 3.1.0.0) rainbow (>= 2.2.2, < 4.0) - regexp_parser (>= 2.9.3, < 3.0) - rubocop-ast (>= 1.49.0, < 2.0) + regexp_parser (>= 1.8, < 3.0) + rexml + rubocop-ast (>= 1.15.1, < 2.0) ruby-progressbar (~> 1.7) - unicode-display_width (>= 2.4.0, < 4.0) + unicode-display_width (>= 1.4.0, < 3.0) rubocop-ast (1.49.1) parser (>= 3.3.7.2) prism (~> 1.7) @@ -621,51 +427,17 @@ GEM rubyntlm (0.6.5) base64 rubyzip (2.4.1) - sass-rails (6.0.0) - sassc-rails (~> 2.1, >= 2.1.1) - sassc (2.4.0) - ffi (~> 1.9) - sassc-rails (2.1.2) - railties (>= 4.0.0) - sassc (>= 2.0) - sprockets (> 3.0) - sprockets-rails - tilt - sdoc (2.6.5) - rdoc (>= 5.0) - securerandom (0.4.1) - selenium-webdriver (4.7.1) - rexml (~> 3.2, >= 3.2.5) - rubyzip (>= 1.2.2, < 3.0) - websocket (~> 1.0) + sawyer (0.9.3) + addressable (>= 2.3.5) + faraday (>= 0.17.3, < 3) semverse (3.0.2) - sinatra (4.2.1) - logger (>= 1.6.0) - mustermann (~> 3.0) - rack (>= 3.0.0, < 4) - rack-protection (= 4.2.1) - rack-session (>= 2.0.0, < 3) - tilt (~> 2.0) - skinny (0.2.2) - eventmachine (~> 1.0) - thin + sequel (5.107.0) + bigdecimal socksify (1.8.1) - spring (4.5.0) - spring-commands-rspec (1.0.4) - spring (>= 0.9.1) - sprockets (4.2.2) - concurrent-ruby (~> 1.0) - logger - rack (>= 2.2.4, < 4) - sprockets-rails (3.5.2) - actionpack (>= 6.1) - activesupport (>= 6.1) - sprockets (>= 3.0.0) - sqlite3 (2.8.1-x86_64-linux-gnu) - sqlite3-ruby (1.3.3) - sqlite3 (>= 1.3.3) + solve (4.0.4) + molinillo (~> 0.6) + semverse (>= 1.1, < 4.0) sslshake (1.3.1) - stringio (3.2.0) strings (0.2.1) strings-ansi (~> 0.2) unicode-display_width (>= 1.5, < 3.0) @@ -674,20 +446,14 @@ GEM syslog (0.4.0) logger syslog-logger (1.6.8) - temple (0.10.4) - thin (2.0.1) - daemons (~> 1.0, >= 1.0.9) - eventmachine (~> 1.0, >= 1.0.4) - logger - rack (>= 1, < 4) - thor (1.4.0) - tilt (2.7.0) + thor (1.2.2) time (0.4.2) date - timecop (0.9.11) timeout (0.6.1) + toml (0.3.0) + parslet (>= 1.8.0, < 3.0.0) tomlrb (1.3.0) - train-core (3.16.3) + train-core (3.16.5) addressable (~> 2.5) ffi (>= 1.16.0, < 1.18) json (>= 2.19.2, < 3.0) @@ -703,7 +469,6 @@ GEM chef-winrm-elevated (>= 1.2.5, < 2.0) chef-winrm-fs (>= 1.4.1, < 2.0) socksify (~> 1.8) - tsort (0.2.0) tty-box (0.7.0) pastel (~> 0.8) strings (~> 0.2.0) @@ -718,85 +483,43 @@ GEM tty-screen (~> 0.8) wisper (~> 2.0) tty-screen (0.8.2) + tty-spinner (0.9.3) + tty-cursor (~> 0.7) tty-table (0.12.0) pastel (~> 0.8) strings (~> 0.2.0) tty-screen (~> 0.8) - turbolinks (5.2.1) - turbolinks-source (~> 5.2) - turbolinks-source (5.2.0) - tzinfo (2.0.6) - concurrent-ruby (~> 1.0) - tzinfo-data (1.2026.2) - tzinfo (>= 1.0.0) - uglifier (4.2.1) - execjs (>= 0.3.0, < 3) unf_ext (0.0.8.2) unicode-display_width (2.6.0) unicode_utils (1.4.0) - unicorn (6.1.0) - kgio (~> 2.6) - raindrops (~> 0.7) uri (1.0.4) - useragent (0.16.11) uuidtools (2.2.0) vault (0.18.2) aws-sigv4 + veil (0.3.11) + bcrypt (~> 3.1) + pbkdf2 webrick (1.9.2) - websocket (1.2.11) - websocket-driver (0.8.0) - base64 - websocket-extensions (>= 0.1.0) - websocket-extensions (0.1.5) wisper (2.0.1) wmi-lite (1.0.7) - xpath (3.2.0) - nokogiri (~> 1.8) - yajl (0.3.4) - zeitwerk (2.6.18) PLATFORMS x86_64-linux DEPENDENCIES - better_errors - bigdecimal (= 3.1.3) - binding_of_caller - capybara (~> 3.39) + berkshelf (~> 8.0.22) chef (~> 18.10.17) - coffee-rails (~> 5.0) - config (~> 4.1) - doorkeeper (~> 5.0) - factory_bot_rails (~> 6.4) - jbuilder (~> 2.11) - jquery-rails - jwt (>= 3.2.0) - mailcatcher - mixlib-authentication (>= 2.1, < 4) - omniauth-chef (~> 0.4.1)! - pg (>= 0.18, < 1.6) - pry-byebug + chef-server-ctl! + chefstyle + knife (~> 19.0.105) + knife-ec-backup (~> 3.0.8) public_suffix (< 7.0) - rack (>= 3.2.4) - rails (= 7.2.3.1) - rails-controller-testing - rb-readline (~> 0.5.2) - responders (~> 3.0, >= 3.0.1) + rack (>= 3.2.5) + rake rest-client! - rspec-rails (~> 6.0) - sass-rails (>= 4.0.3) - sdoc - selenium-webdriver (~> 4.7.1) - spring - spring-commands-rspec - sprockets-rails (>= 3.4.2) - thor (~> 1.4) - timecop - turbolinks (~> 5) - tzinfo-data - uglifier (~> 4.2) - unicorn-rails! - veil (~> 0.3.11)! + rexml (>= 3.4.2) + rspec + toml BUNDLED WITH 2.3.27 diff --git a/src/oc-id/Gemfile.lock b/src/oc-id/Gemfile.lock index 7bc1d75f66..b1e470d81f 100644 --- a/src/oc-id/Gemfile.lock +++ b/src/oc-id/Gemfile.lock @@ -773,16 +773,18 @@ DEPENDENCIES jwt (>= 3.2.0) mailcatcher mixlib-authentication (>= 2.1, < 4) + net-imap (>= 0.5.14) omniauth-chef (~> 0.4.1)! pg (>= 0.18, < 1.6) pry-byebug public_suffix (< 7.0) - rack (>= 3.2.4) + rack (>= 3.2.5) rails (= 7.2.3.1) rails-controller-testing rb-readline (~> 0.5.2) responders (~> 3.0, >= 3.0.1) rest-client! + rexml (>= 3.4.2) rspec-rails (~> 6.0) sass-rails (>= 4.0.3) sdoc From 30ad600a3a8ce96a705caf0baa7a4b899a22f865 Mon Sep 17 00:00:00 2001 From: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> Date: Wed, 5 Aug 2026 23:12:40 -0500 Subject: [PATCH 3/3] submodule advance for testing Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com> --- omnibus | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/omnibus b/omnibus index 079f15a08a..1b1d8a89e4 160000 --- a/omnibus +++ b/omnibus @@ -1 +1 @@ -Subproject commit 079f15a08ae5b9abefd22aea8fbc00458fe3738b +Subproject commit 1b1d8a89e427f08b10def9ad30ee0f21d9b26812