{"action":"created","issue":{"url":"https://api.github.com/repos/alphagov/smart-answers/issues/1825","labels_url":"https://api.github.com/repos/alphagov/smart-answers/issues/1825/labels{/name}","comments_url":"https://api.github.com/repos/alphagov/smart-answers/issues/1825/comments","events_url":"https://api.github.com/repos/alphagov/smart-answers/issues/1825/events","html_url":"https://github.com/alphagov/smart-answers/pull/1825","id":95650322,"number":1825,"title":"Update to ruby 2.2.2","user":{"login":"tadast","id":218239,"avatar_url":"https://avatars.githubusercontent.com/u/218239?v=3","gravatar_id":"","url":"https://api.github.com/users/tadast","html_url":"https://github.com/tadast","followers_url":"https://api.github.com/users/tadast/followers","following_url":"https://api.github.com/users/tadast/following{/other_user}","gists_url":"https://api.github.com/users/tadast/gists{/gist_id}","starred_url":"https://api.github.com/users/tadast/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tadast/subscriptions","organizations_url":"https://api.github.com/users/tadast/orgs","repos_url":"https://api.github.com/users/tadast/repos","events_url":"https://api.github.com/users/tadast/events{/privacy}","received_events_url":"https://api.github.com/users/tadast/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-07-17T12:47:57Z","updated_at":"2015-07-20T13:28:36Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/alphagov/smart-answers/pulls/1825","html_url":"https://github.com/alphagov/smart-answers/pull/1825","diff_url":"https://github.com/alphagov/smart-answers/pull/1825.diff","patch_url":"https://github.com/alphagov/smart-answers/pull/1825.patch"},"body":"Ruby 2.1.5 has a security vulnerability [1]. It is not clear whether it can\r\nbe exploited in smartanswers, but perhaps it's easier to upgrade the ruby\r\nversion than to investigate the ways to exploit the app.\r\n\r\nI also had to switch to psych for YAML parsing as syck does not seem to be compatible with Ruby 2.2.2 [at the moment](https://github.com/tenderlove/syck/issues/9). It's been deprecated for a long time anyway.\r\n\r\nMinor syntax changes were required to make smartanswers work with psych,\r\nnamely, interpolation can only happen if the string value is surrounded by\r\nquotes. I've ran all regression tests after making the change and the outcomes\r\nhave not changed so I'm confident no more changes are required.\r\n\r\n[1]- https://www.ruby-lang.org/en/news/2015/04/13/ruby-openssl-hostname-matching-vulnerability/"},"comment":{"url":"https://api.github.com/repos/alphagov/smart-answers/issues/comments/122884665","html_url":"https://github.com/alphagov/smart-answers/pull/1825#issuecomment-122884665","issue_url":"https://api.github.com/repos/alphagov/smart-answers/issues/1825","id":122884665,"user":{"login":"tadast","id":218239,"avatar_url":"https://avatars.githubusercontent.com/u/218239?v=3","gravatar_id":"","url":"https://api.github.com/users/tadast","html_url":"https://github.com/tadast","followers_url":"https://api.github.com/users/tadast/followers","following_url":"https://api.github.com/users/tadast/following{/other_user}","gists_url":"https://api.github.com/users/tadast/gists{/gist_id}","starred_url":"https://api.github.com/users/tadast/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tadast/subscriptions","organizations_url":"https://api.github.com/users/tadast/orgs","repos_url":"https://api.github.com/users/tadast/repos","events_url":"https://api.github.com/users/tadast/events{/privacy}","received_events_url":"https://api.github.com/users/tadast/received_events","type":"User","site_admin":false},"created_at":"2015-07-20T13:28:36Z","updated_at":"2015-07-20T13:28:36Z","body":"> Could we not have one PR to address the vulnerability which upgrades to 2.1.6 and another which is effectively the upgrade from 2.1 to 2.2?\r\n\r\nWhat's the benefit of doing that after the fact? "}}