Skip to content

CHEF-37568 - Regenerate oc-id Gemfile.lock for net-imap 0.5.15 - #4229

Open
lbakerchef wants to merge 4 commits into
mainfrom
CHEF-37568/lbaker
Open

CHEF-37568 - Regenerate oc-id Gemfile.lock for net-imap 0.5.15#4229
lbakerchef wants to merge 4 commits into
mainfrom
CHEF-37568/lbaker

Conversation

@lbakerchef

@lbakerchef lbakerchef commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Summary

Re-locks src/oc-id/Gemfile.lock so net-imap resolves to 0.5.15, matching the raised NET_IMAP_FIX_VERSION_0_5 floor in safe_versions.rb (see companion chef-server-omnibus-config PR chef/chef-server-omnibus-config#28).

Jira

https://progresssoftware.atlassian.net/browse/CHEF-37568

CVEs closed

CVE-2026-47240, CVE-2026-47241, CVE-2026-47242

Stacked branch note

This branch is based on CHEF-33469/lbaker (#4227, still open/unmerged), which laid the groundwork for the safe_versions.rb floor-enforcement mechanism. Diff will include #4227's commits until that merges — please review only the top commit (Gemfile.lock regeneration).

Testing

Regenerated under Ruby 3.1.7 (oc-id's actual CI target — see .github/workflows/brakeman-analysis.yml) with bundler 2.3.27, matching the existing lockfile's BUNDLED WITH version, in an ephemeral Docker container (safe_versions.rb staged temporarily to mimic the omnibus build's copy step, then removed — it is not part of this repo's tree).

Verified:

  • net-imap resolves to 0.5.15 in both the GEM and DEPENDENCIES sections.
  • Diff is minimal — only net-imap's version line changed; no other dependencies moved, no unexpected conflicts.
  • BUNDLED WITH 2.3.27 unchanged.
  • omnibus submodule pointer untouched (no bump as part of this change set).

@lbakerchef
lbakerchef requested review from a team as code owners August 11, 2026 07:18
@lbakerchef lbakerchef self-assigned this Aug 11, 2026
@lbakerchef
tie rack/rexml floors to omnibus-config safe_versions.rb
0450903 
Add explicit rack/rexml version floors to the three Gemfiles here
that pull in chef and/or chef-zero (chef-server-ctl, oc-id,
oc-chef-pedant), sourced dynamically from the same
SafeVersions::MINIMUM_SAFE_RACK_VERSION / MINIMUM_SAFE_REXML_VERSION
constants that ruby_gems_cleanup.rb enforces on upgrade, reached via
the omnibus/ submodule's libraries/safe_versions.rb (bumped in the
prior commit). This makes the safety floor a single source of
truth instead of two independently maintained values that can
drift apart.

- src/chef-server-ctl/Gemfile: new rack + rexml floors (had none).
- src/oc-id/Gemfile: replaced the previous static
  `gem 'rack', '>= 3.2.4'` with the dynamic floor; added a new
  rexml floor (had none).
- oc-chef-pedant/Gemfile: new rack floor only (rexml isn't in its
  resolved dependency graph).

Each Gemfile wraps the require_relative in begin/rescue LoadError
and fails open (warns, defaults to no floor) if the submodule isn't
checked out or the file can't otherwise be reached, or if the
expected constants aren't defined/are blank -- so a developer who
hasn't run `git submodule update --init` still gets a working
`bundle install`, just without the extra floor enforced. A genuine
bug in safe_versions.rb's own Ruby (syntax error, etc.) is not
swallowed and will still fail the build loudly, by design.

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>

extend oc-id's rack/rexml Gemfile floor pattern to net-imap (CHEF-35182)

Add a net-imap version floor to oc-id's Gemfile using the same
resolve_safe_version.call(:CONSTANT) pattern already used for
rack/rexml, sourced from omnibus-config's safe_versions.rb (the
same file ruby_gems_cleanup.rb enforces on upgrade):

  gem 'net-imap', ">= #{resolve_safe_version.call(:NET_IMAP_FIX_VERSION)}"

net-imap isn't a direct oc-id dependency -- it's pulled in
transitively via mail -- but CVE-2025-XXXXX (net-imap response
injection) affects versions below 0.5.14 (Ruby < 3.2) or 0.6.4
(Ruby >= 3.2). NET_IMAP_FIX_VERSION resolves to whichever floor
applies to the Ruby this Gemfile is bundled under, so `bundle
install` refuses to resolve a vulnerable net-imap regardless of
what mail or any other dependency would otherwise pull in.

Comment updated to mention net-imap alongside rack/rexml and to
point at NET_IMAP_FIX_VERSION specifically, since (unlike the
rack/rexml floors) it's a computed value rather than a fixed one --
see safe_versions.rb for why.

Companion change in chef-server-omnibus-config (commit f38c231,
"extend safe-versions floors to net-imap") adds the
NET_IMAP_FIX_VERSION_0_4/_0_5/_0_6 constants, the generic
NET_IMAP_FIX_VERSION resolution, and generalizes ruby_gems_cleanup.rb's
vulnerable-gem sweep to cover net-imap; that repo's submodule
pointer is bumped in a separate commit here.

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
@lbakerchef
regen Gemfile.lock
3dcfcef 
Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
@lbakerchef
Regenerate oc-id Gemfile.lock for net-imap 0.5.15
1df7ed4 
Re-locks src/oc-id/Gemfile.lock so net-imap resolves to 0.5.15, matching
the raised NET_IMAP_FIX_VERSION_0_5 floor in safe_versions.rb (see the
companion chef-server-omnibus-config PR). Closes CVE-2026-47240,
CVE-2026-47241, and CVE-2026-47242.

Regenerated under Ruby 3.1.7 (oc-id's actual CI target) with bundler
2.3.27, matching the existing lockfile's BUNDLED WITH version. Only
net-imap's version line changed in the GEM and DEPENDENCIES sections;
no other dependencies moved.

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Base automatically changed from CHEF-33469/lbaker to main August 19, 2026 07:58
@lbakerchef lbakerchef mentioned this pull request Aug 20, 2026
Open
5 tasks
lbakerchef added a commit that referenced this pull request Aug 20, 2026
@lbakerchef
TEMPORARY - REVERT ME - do not merge: bump oc-id net-imap for CI proof
e654642 
Cherry-picks the src/oc-id/Gemfile.lock change from commit 1df7ed4
(CHEF-37568/lbaker, open PR #4229) so net-imap resolves to 0.5.15 in
both the GEM and DEPENDENCIES sections, matching the NET_IMAP_FIX_VERSION
floor raised by the temporarily-bumped omnibus/ submodule pointer above
(53d3dbb).

This exists purely as local CI-proof scaffolding: it lets oc-id's job
run cleanly end to end, confirming the CHEF-37669 fallback mechanism
has no other side effects beyond the already-diagnosed, orthogonal
net-imap floor mismatch. CHEF-37568 (PR #4229) is a separate, already
open PR that will apply this exact same bump to main independently, on
its own schedule -- unrelated to this ticket's own scope.

Must be reverted (alongside 53d3dbb) before this branch merges to
main. Checked no other safe_versions.rb floor (rack, rexml) is affected
by the submodule bump -- both already satisfied in all three Gemfile.locks
without any change.

Cherry-picked from 1df7ed4.

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
lbakerchef added a commit that referenced this pull request Aug 20, 2026
@lbakerchef
TEMPORARY - REVERT ME - do not merge: bump oc-id net-imap for CI proof
1d5ad6a 
Cherry-picks the src/oc-id/Gemfile.lock change from commit 1df7ed4
(CHEF-37568/lbaker, open PR #4229) so net-imap resolves to 0.5.15 in
both the GEM and DEPENDENCIES sections, matching the NET_IMAP_FIX_VERSION
floor raised by the temporarily-bumped omnibus/ submodule pointer above
(53d3dbb).

This exists purely as local CI-proof scaffolding: it lets oc-id's job
run cleanly end to end, confirming the CHEF-37669 fallback mechanism
has no other side effects beyond the already-diagnosed, orthogonal
net-imap floor mismatch. CHEF-37568 (PR #4229) is a separate, already
open PR that will apply this exact same bump to main independently, on
its own schedule -- unrelated to this ticket's own scope.

Must be reverted (alongside 53d3dbb) before this branch merges to
main. Checked no other safe_versions.rb floor (rack, rexml) is affected
by the submodule bump -- both already satisfied in all three Gemfile.locks
without any change.

Cherry-picked from 1df7ed4.

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
jashaik
jashaik previously approved these changes Aug 21, 2026
View reviewed changes
lbakerchef added a commit that referenced this pull request Aug 21, 2026
@lbakerchef
bump oc-id net-imap for CI proof
1344882 
Cherry-picks the src/oc-id/Gemfile.lock change from commit 1df7ed4
(CHEF-37568/lbaker, open PR #4229) so net-imap resolves to 0.5.15 in
both the GEM and DEPENDENCIES sections, matching the NET_IMAP_FIX_VERSION
floor raised by the temporarily-bumped omnibus/ submodule pointer above
(53d3dbb).

This exists purely as local CI-proof scaffolding: it lets oc-id's job
run cleanly end to end, confirming the CHEF-37669 fallback mechanism
has no other side effects beyond the already-diagnosed, orthogonal
net-imap floor mismatch. CHEF-37568 (PR #4229) is a separate, already
open PR that will apply this exact same bump to main independently, on
its own schedule -- unrelated to this ticket's own scope.

Should be reverted (alongside 53d3dbb) before this branch merges to
main. Checked no other safe_versions.rb floor (rack, rexml) is affected
by the submodule bump -- both already satisfied in all three Gemfile.locks
without any change.

Cherry-picked from 1df7ed4.

Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jashaik jashaik jashaik left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@lbakerchef lbakerchef

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@lbakerchef @jashaik