зеркало из https://github.com/github/ruby.git
Initial move to SnakeYAML Engine
See jruby/jruby#7570 for some of the justification for this move. We only require the parser from SnakeYAML, but in the original form it is encumbered with Java object serialization code that keeps getting flagged as a CVE risk. We disagree with the assessment, at least as it pertains to JRuby (we do not use the code in question) but our inclusion of the library continues to get flagged by auditing tools. This commit starts the process of moving to the successor library, SnakeYAML Engine. The parser API is largely unchanged, except as seen in this commit. No Java exceptions are thrown, but a number of Psych tests fail (possibly due to Engine being YAML 1.2 only).
This commit is contained in:
Родитель
29133794a3
Коммит
0ee819b71d
|
@ -5,6 +5,6 @@ module Psych
|
|||
VERSION = '5.0.2'
|
||||
|
||||
if RUBY_ENGINE == 'jruby'
|
||||
DEFAULT_SNAKEYAML_VERSION = '1.33'.freeze
|
||||
DEFAULT_SNAKEYAML_VERSION = '2.6'.freeze
|
||||
end
|
||||
end
|
||||
|
|
|
@ -55,7 +55,7 @@ DESCRIPTION
|
|||
"lib/psych_jars.rb",
|
||||
"lib/psych.jar"
|
||||
]
|
||||
s.requirements = "jar org.yaml:snakeyaml, #{version_module::Psych::DEFAULT_SNAKEYAML_VERSION}"
|
||||
s.requirements = "jar org.snakeyaml:snakeyaml-engine, #{version_module::Psych::DEFAULT_SNAKEYAML_VERSION}"
|
||||
s.add_dependency 'jar-dependencies', '>= 0.1.7'
|
||||
else
|
||||
s.extensions = ["ext/psych/extconf.rb"]
|
||||
|
|
Загрузка…
Ссылка в новой задаче