Nokogiri dependency hell again...

[schungx]

Will there be an updated version with nokogiri 1.12 any time soon?

[nertzy]

This is a similar problem to #196

I left a comment with some advice for the Azure ruby team: #196 (comment)

[scwells]

Currently running into this issue as well due to a nokogiri vulnerability. Failing bundler-audit.

Reference GHSA-2rr5-8q37-2w7h

Possible to get it bumped to 1.12.5 ?

[tbuehlmann]

Came here for the CVE as well. Do we really need the pessimistic operator ~> 1.11.0.rc2 for nokigiri? Can we loosen that up?

[nertzy]

I opened a support issue with Azure. I encourage everyone else to do the same to make it clear that this is important to Azure customers.

[schungx]

I agree. Azure needs to LISTEN to customers.

I have been totally fed up by the past year of pain (starting with the gem suddenly moving to persistent connections without an option to turn it off, and thus causing massive build conflicts due to Faraday dependency conflicting with Bundler). I couldn't even keep it at a lower version because the host system has moved on, and the nokogiri dependencies are specified so narrowly.

So I've said sod it and since moved on to S3, which is much more normal.

[schungx]

IMHO I think this gem is getting out of maintenance.

[cooperka]

✅ Solution in the meantime: @mschiller made a nice fork directly off of master than you can use while Azure takes their time fixing this high-risk security vulnerability. Here's their fork: https://github.com/mschiller/azure-storage-ruby/commit/c84806f766b773cdeea72a7f73d79ddab598b256

You can use it in your app like this (don't forget to bundle update nokogiri after this change):

gem "azure-storage-blob", github: "mschiller/azure-storage-ruby", tag: "c84806f766b773cdeea72a7f73d79ddab598b256"

[jwipeout]

when are you guys going to fix this?

[grosscr]

I opened a support ticket with azure, and they responded that:

Ruby is unsupported, its in community domain. You can send a Pull Request to follow up on the Github issue.

So, seems like we're likely on our own. :/

[srp-developers]

@grosscr Could you please respond to them with links to these pull requests, each of which address this problem?

#177
#182
#183
#199

[schungx]

And I also have an issue #190 which requests the move to persistent connections be made optional (or have a way to turn off) behind an option flag. It doesn't seem anybody is listening at Azure's side...