>>>>> "Geoff" == Geoff Petrie <notifications@github.com> writes:

    Geoff> In Gemfile:
    >> @@ -8,7 +8,7 @@ source :rubygems
    >> 
    >> gem 'nokogiri'
    >> 
    >> -gem 'rails', '~> 3.2.1'
    >> +gem 'rails', '~> 3.2.11'

    Geoff> The pessimistic operator ~> makes sure that rails is
    Geoff> updated to anything lower than rails 3.3. Meaning that the
    Geoff> way this Gemfile is written updating to 3.2.11 is implied
    Geoff> for bundler. Technically speaking this line could be
    Geoff> rewritten as:

    Geoff> gem 'rails, '~> 3.2'

I did a "bundle update" to bring Rails up to 3.2.11 very soon after
3.2.11 came out, but I didn't explicitly upgrade Gemfile.  Instead I
just let Gemfile.lock enforce the 3.2.11 requirement.  That seemed
like the right thing to do at the time.

However, after seeing Jon's pull request, I thought about the fact that
although *I'm* familiar with the security vulnerability and that's why
I did the bundle update, there's no trace of that thought process in
either the gem lines or comments in the Gemfile.  As such, I think
making it explicit is a good idea.

So by saying:

  ~> 3.2.11

we're saying that it is not acceptable to use 3.2.10 or 3.2.x where x
< 11.  My comment explains why we have that seemingly arbitrary
restriction.


    Geoff> Either way, though, running $ bundle install makes sure
    Geoff> that your local Rails install is version 3.2.11.

Yup.  My tiny mod (incorporating Jon's pull-request and an explanatory
comment) won't change which version of Rails gets installed via bundle
install, but it will make it more clear why we don't want an earlier
version of 3.2, even though the code would still work.
-- 
Cliff Matthews
work: ctm@devctm.com    fun: ctm@sceim.net

+1 505 821 3877 Home    +1 505 363 5754 cell