Relax Rails dependency to allow security updates
Currently dependabot is failing to upgrade some gems that are part of Rails. For example, when there's a security issue in ActiveRecord or ActiveStorage, we get messages like: ``` Dependabot cannot update activestorage to a non-vulnerable version. The latest possible version that can be installed is 7.1.5.1 because of the following conflicting dependencies: rails (7.1.5.1) requires activestorage (= 7.1.5.1) via actionmailbox (7.1.5.1) rails (7.1.5.1) requires activestorage (= 7.1.5.1) via actiontext (7.1.5.1) rails (7.1.5.1) requires activestorage (= 7.1.5.1) The earliest fixed version is 7.1.5.2. ``` So we're relaxing the dependency in order to make it easier for dependabot to upgrade gems that are part of Rails. Note that, with this configuration, Dependabot wouldn't be able to upgrade to Rails 7.1.6 if this releases fixed a security issues in a gem that is part of Rails. We might still need to upgrade Rails manually in this case.
This commit is contained in:
Reference in New Issue
Block a user