1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Initial move to SnakeYAML Engine

Browse Source 
See jruby/jruby#7570 for some of the justification for this move. We only
require the parser from SnakeYAML, but in the original form it is
encumbered with Java object serialization code that keeps getting
flagged as a CVE risk. We disagree with the assessment, at least
as it pertains to JRuby (we do not use the code in question) but
our inclusion of the library continues to get flagged by auditing
tools.

This commit starts the process of moving to the successor library,
SnakeYAML Engine. The parser API is largely unchanged, except as
seen in this commit. No Java exceptions are thrown, but a number
of Psych tests fail (possibly due to Engine being YAML 1.2 only).
This commit is contained in:
Charles Oliver Nutter 2023-01-13 02:55:52 -06:00 committed by Hiroshi SHIBATA
parent 29133794a3
commit 0ee819b71d
No known key found for this signature in database
GPG Key ID: F9CF13417264FAC2
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ext/psych/lib/psych/versions.rb
View File

@ -5,6 +5,6 @@ module Psych
VERSION = '5.0.2'
if RUBY_ENGINE == 'jruby'
DEFAULT_SNAKEYAML_VERSION = '1.33'.freeze
DEFAULT_SNAKEYAML_VERSION = '2.6'.freeze
end
end

2
ext/psych/psych.gemspec
View File

@ -55,7 +55,7 @@ DESCRIPTION
"lib/psych_jars.rb",
"lib/psych.jar"
]
s.requirements = "jar org.yaml:snakeyaml, #{version_module::Psych::DEFAULT_SNAKEYAML_VERSION}"
s.requirements = "jar org.snakeyaml:snakeyaml-engine, #{version_module::Psych::DEFAULT_SNAKEYAML_VERSION}"
s.add_dependency 'jar-dependencies', '>= 0.1.7'
else
s.extensions = ["ext/psych/extconf.rb"]