axlsx
axlsx copied to clipboard
randym
Allow both minor and patch changes in dependencies
The optimistic operator ~> is tricky. I only recently learned how it works. The level of precision determines what ranges are allowed (http://guides.rubygems.org/patterns/).
With the current gemspec rubyzip and htmlentities are pinned down to only path level changes. This change allows rubyzip >= 1.1 && < 2.0 which is fine.
Only allowing patch level changes causes needless dependency issues.
This adjustment is theoretically safe as long as semantic versioning is adhered to by the dependencies.
I'd second, at the very least, loosening up 'rubyzip', '~> 1.1.7' to 'rubyzip', '~> 1.1'. I'm in an unfortunate position with multiple dependences that use rubyzip, and this makes it hard to add Axlsx into the mix.
@randym Any chance that this would be accepted and merged since there is an High severity vulnerability in rubyzip versions older than 1.2.1? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5946
@romansklenar In case it's useful to you too, I've moved on to xlsxtream, which is an excellent library for writing XLSX-files.
It doesn't handle fancy color formatting etc., but works really well for simple files.
Chiming in with a +1 on requesting this to be merged due to the vulnerability in rubyzip versions older than 1.2.1
