December 2016 Summaries

Snyk has launched an updated version of its Ruby support, which now includes a command-line interface (CLI) for managing dependencies and detecting vulnerabilities in Ruby projects. This new CLI allows users to test their projects continuously and monitor their dependencies for new vulnerabilities. Additionally, Snyk's fix feature now takes into account the project's Gemfile.lock file and proposes changes to the Gemfile when necessary, making it easier to detect and fix Ruby vulnerabilities. The update also includes improved commit messages that provide more detail about the fixes applied during the process.

RubyGems and npm are two popular package managers for Ruby and Node.js respectively, with subtle differences in version handling that can cause issues when working with both ecosystems. The Semantic Versioning standard provides a framework for comparing software versions, but it is not part of either package manager's syntax. RubyGems allows for more flexible version numbers than npm, including unlimited parts, while npm requires strict compliance with Semantic Versioning 2.0. Despite these differences, both package managers use similar range operators and allow for "pessimistic" ranges to specify a safe version range. The differences in range semantics between RubyGems and npm can cause issues when working with automated test reports, leading to false positives and false negatives. To overcome this challenge, Snyk created a library called ruby-semver that provides RubyGems-style version handling with the same API as the npm semver package, using Opal to transpile the RubyGems code into JavaScript.