Bump yajl-ruby version for security reasons.

Make sure to use version 1.3.1 or later to include fix in brianmario/yajl-ruby#178.
tilezen · Nov 29, 2017 · 2fed19f · 2fed19f
1 parent 6aad9a5
commit 2fed19f
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/Gemfile b/Gemfile
@@ -7,3 +7,6 @@ gem 'foodcritic'  , '= 4.0.0'
 gem 'rainbow'     , '= 2.0.0'
 gem 'rubocop'     , '= 0.24.0'
 gem 'kitchen-vagrant'
+
+# force upgrade of yajl-ruby to 1.3.1 or later to fix security issue
+gem 'yajl-ruby', '~> 1.3', '>= 1.3.1'
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -213,7 +213,7 @@ GEM
       buff-extensions (~> 1.0)
       hashie (>= 2.0.2, < 4.0.0)
     wmi-lite (1.0.0)
-    yajl-ruby (1.2.1)
+    yajl-ruby (1.3.1)
 
 PLATFORMS
   ruby
@@ -226,6 +226,7 @@ DEPENDENCIES
   rainbow (= 2.0.0)
   rubocop (= 0.24.0)
   test-kitchen
+  yajl-ruby (~> 1.3, >= 1.3.1)
 
 BUNDLED WITH
-   1.11.2
+   1.16.0