Maintenance: bundle-audit
This course covers bundler-audit, a Ruby gem that checks every gem version locked in Gemfile.lock against ruby-advisory-db, a community database of known gem vulnerabilities. It separates that job from Brakeman and bin/importmap audit, which already run in this app's CI. The lessons cover the bundle-audit CLI commands and flags, the fields of an Advisory record, how CVSS scores map to severity, and the text report format. They also sketch a CI job that would add the missing check, alongside the step Rails 8.1 generates.
What you'll learn
- ✓How bundler-audit, Brakeman and bin/importmap audit divide the security checks
- ✓The bundle-audit update and check commands and their main flags
- ✓The 13 fields of an Advisory and how vulnerable? decides a match
- ✓How criticality maps CVSS v3 and v2 scores to severity levels
- ✓How to read each field of a bundle-audit text report and its exit status
- ✓How a bundle-audit check could be added to a GitHub Actions CI workflow
Three tools, three jobs: what bundler-audit checks
This app's CI, .github/workflows/ci.yml, runs two jobs whose names both sound like "security". scan_ruby runs bin/brakeman --no-pager, and scan_js runs bin/importmap audit. They are two tools with two different targets. Brakeman reads this app's Ruby and ERB source, looking for vulnerability…
Read the full lesson free →Curriculum
7 lessonsThree tools, three jobs: what bundler-audit checks
Separates what Brakeman, bin/importmap audit and bundler-audit check, and shows this app has no gem audit.
The bundle-audit CLI: commands, flags, and this app's toolchain
Covers the bundle-audit commands and flags, where advisory data comes from, and this app's toolchain requirements.
What lives inside a bundler-audit advisory, read from the gem's source
Reads the Advisory struct from the gem's source, including its id helpers, criticality and vulnerable? methods.
Reading a bundle-audit report, field by field
Walks through each printed field of a finding, the insecure source check, the closing line and exit status.
What adding bundle-audit to this app's CI would look like
Sketches a scan_gems CI job modeled on scan_ruby and compares it with the step Rails 8.1 generates.
bundle-audit, Brakeman, and importmap audit: three tools, small overlap
Compares what the three tools read and check, with a Rails view helper CVE showing their boundary.
Putting it together: this app's dependency checks, and classifying severity yourself
Recaps the missing gem audit in this app, the met requirements, and the two ways CI could add it.