Skip to content

Update all project dependencies #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
justin808 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update all project dependencies #258

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .rubocop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
require:
plugins:
- rubocop-rake
- rubocop-rspec

Expand Down
14 changes: 7 additions & 7 deletions Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,13 +5,13 @@ source "https://rubygems.org"
gemspec

gem "debug", "~> 1"
gem "overcommit", "~> 0.60.0"
gem "overcommit", "~> 0.68.0"
gem "rake", "~> 13.0"
gem "rspec", "~> 3.12.0"
gem "rspec", "~> 3.13"
gem "rspec-retry", "~> 0.6.2"
gem "rubocop", "~> 1.64.1"
gem "rubocop-rake", "~> 0.6.0"
gem "rubocop-rspec", "~> 3.0.1"
gem "rubocop", "~> 1.81"
gem "rubocop-rake", "~> 0.7.1"
gem "rubocop-rspec", "~> 3.8"
gem "simplecov", "~> 0.22.0"
gem "timecop", "~> 0.9.6"
gem "webmock", "~> 3.18.1"
gem "timecop", "~> 0.9.10"
gem "webmock", "~> 3.26"
155 changes: 86 additions & 69 deletions Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,105 +2,122 @@ PATH
remote: .
specs:
cpflow (4.1.1)
dotenv (~> 2.8.1)
jwt (~> 2.8.1)
psych (~> 5.1.0)
thor (~> 1.2.1)
dotenv (~> 3.1)
jwt (~> 3.1)
psych (~> 5.2)
thor (~> 1.4)

GEM
remote: https://rubygems.org/
specs:
addressable (2.8.7)
public_suffix (>= 2.0.2, < 7.0)
ast (2.4.2)
base64 (0.2.0)
bigdecimal (3.1.8)
childprocess (4.1.0)
crack (1.0.0)
ast (2.4.3)
base64 (0.3.0)
bigdecimal (3.3.1)
childprocess (5.1.0)
logger (~> 1.5)
crack (1.0.1)
bigdecimal
rexml
debug (1.9.2)
date (3.5.0)
debug (1.11.0)
irb (~> 1.10)
reline (>= 0.3.8)
diff-lcs (1.5.1)
docile (1.4.0)
dotenv (2.8.1)
hashdiff (1.1.0)
diff-lcs (1.6.2)
docile (1.4.1)
dotenv (3.1.8)
erb (6.0.0)
hashdiff (1.2.1)
iniparse (1.5.0)
io-console (0.7.2)
irb (1.13.2)
io-console (0.8.1)
irb (1.15.3)
pp (>= 0.6.0)
rdoc (>= 4.0.0)
reline (>= 0.4.2)
json (2.7.2)
jwt (2.8.2)
json (2.16.0)
jwt (3.1.2)
base64
language_server-protocol (3.17.0.3)
overcommit (0.60.0)
childprocess (>= 0.6.3, < 5)
language_server-protocol (3.17.0.5)
lint_roller (1.1.0)
logger (1.7.0)
overcommit (0.68.0)
childprocess (>= 0.6.3, < 6)
iniparse (~> 1.4)
rexml (~> 3.2)
parallel (1.25.1)
parser (3.3.3.0)
rexml (>= 3.3.9)
parallel (1.27.0)
parser (3.3.10.0)
ast (~> 2.4.1)
racc
psych (5.1.2)
pp (0.6.3)
prettyprint
prettyprint (0.2.0)
prism (1.6.0)
psych (5.2.6)
date
stringio
public_suffix (6.0.0)
racc (1.8.0)
public_suffix (6.0.2)
racc (1.8.1)
rainbow (3.1.1)
rake (13.2.1)
rdoc (6.7.0)
rake (13.3.1)
rdoc (6.15.1)
erb
psych (>= 4.0.0)
regexp_parser (2.9.2)
reline (0.5.9)
tsort
regexp_parser (2.11.3)
reline (0.6.3)
io-console (~> 0.5)
rexml (3.3.1)
strscan
rspec (3.12.0)
rspec-core (~> 3.12.0)
rspec-expectations (~> 3.12.0)
rspec-mocks (~> 3.12.0)
rspec-core (3.12.3)
rspec-support (~> 3.12.0)
rspec-expectations (3.12.4)
rexml (3.4.4)
rspec (3.13.2)
rspec-core (~> 3.13.0)
rspec-expectations (~> 3.13.0)
rspec-mocks (~> 3.13.0)
rspec-core (3.13.6)
rspec-support (~> 3.13.0)
rspec-expectations (3.13.5)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.12.0)
rspec-mocks (3.12.7)
rspec-support (~> 3.13.0)
rspec-mocks (3.13.7)
diff-lcs (>= 1.2.0, < 2.0)
rspec-support (~> 3.12.0)
rspec-support (~> 3.13.0)
rspec-retry (0.6.2)
rspec-core (> 3.3)
rspec-support (3.12.2)
rubocop (1.64.1)
rspec-support (3.13.6)
rubocop (1.81.7)
json (~> 2.3)
language_server-protocol (>= 3.17.0)
language_server-protocol (~> 3.17.0.2)
lint_roller (~> 1.1.0)
parallel (~> 1.10)
parser (>= 3.3.0.2)
rainbow (>= 2.2.2, < 4.0)
regexp_parser (>= 1.8, < 3.0)
rexml (>= 3.2.5, < 4.0)
rubocop-ast (>= 1.31.1, < 2.0)
regexp_parser (>= 2.9.3, < 3.0)
rubocop-ast (>= 1.47.1, < 2.0)
ruby-progressbar (~> 1.7)
unicode-display_width (>= 2.4.0, < 3.0)
rubocop-ast (1.31.3)
parser (>= 3.3.1.0)
rubocop-rake (0.6.0)
rubocop (~> 1.0)
rubocop-rspec (3.0.1)
rubocop (~> 1.61)
unicode-display_width (>= 2.4.0, < 4.0)
rubocop-ast (1.48.0)
parser (>= 3.3.7.2)
prism (~> 1.4)
rubocop-rake (0.7.1)
lint_roller (~> 1.1)
rubocop (>= 1.72.1)
rubocop-rspec (3.8.0)
lint_roller (~> 1.1)
rubocop (~> 1.81)
ruby-progressbar (1.13.0)
simplecov (0.22.0)
docile (~> 1.1)
simplecov-html (~> 0.11)
simplecov_json_formatter (~> 0.1)
simplecov-html (0.12.3)
simplecov-html (0.13.2)
simplecov_json_formatter (0.1.4)
stringio (3.1.1)
strscan (3.1.0)
thor (1.2.2)
stringio (3.1.8)
thor (1.4.0)
timecop (0.9.10)
unicode-display_width (2.5.0)
webmock (3.18.1)
tsort (0.2.0)
unicode-display_width (3.2.0)
unicode-emoji (~> 4.1)
unicode-emoji (4.1.0)
webmock (3.26.1)
addressable (>= 2.8.0)
crack (>= 0.3.2)
hashdiff (>= 0.4.0, < 2.0.0)
Expand All @@ -112,16 +129,16 @@ PLATFORMS
DEPENDENCIES
cpflow!
debug (~> 1)
overcommit (~> 0.60.0)
overcommit (~> 0.68.0)
rake (~> 13.0)
rspec (~> 3.12.0)
rspec (~> 3.13)
rspec-retry (~> 0.6.2)
rubocop (~> 1.64.1)
rubocop-rake (~> 0.6.0)
rubocop-rspec (~> 3.0.1)
rubocop (~> 1.81)
rubocop-rake (~> 0.7.1)
rubocop-rspec (~> 3.8)
simplecov (~> 0.22.0)
timecop (~> 0.9.6)
webmock (~> 3.18.1)
timecop (~> 0.9.10)
webmock (~> 3.26)

BUNDLED WITH
2.3.26
8 changes: 4 additions & 4 deletions cpflow.gemspec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,10 +15,10 @@ Gem::Specification.new do |spec|

spec.required_ruby_version = ">= 2.7.0"

spec.add_dependency "dotenv", "~> 2.8.1"
spec.add_dependency "jwt", "~> 2.8.1"
spec.add_dependency "psych", "~> 5.1.0"
spec.add_dependency "thor", "~> 1.2.1"
spec.add_dependency "dotenv", "~> 3.1"
spec.add_dependency "jwt", "~> 3.1"
spec.add_dependency "psych", "~> 5.2"
spec.add_dependency "thor", "~> 1.4"
Comment on lines +18 to +21
Copy link

@coderabbitai coderabbitai bot Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

Verify JWT and dotenv 3.x API compatibility with application code.

Both jwt and dotenv have major version bumps (2→3) with breaking changes:

JWT 3.0 requires token signatures to be verified before accessing payload, dropped the HS512256 algorithm, and removed deprecated claim verification methods. Dotenv 3.0 introduced several updates and changed how Dotenv::Railtie is handled.

While the PR summary confirms tests pass, ensure the application code:

  • Calls JWT.decode with explicit algorithm verification (as per best practices)
  • Does not rely on removed or renamed dotenv methods (though Dotenv::Railtie still works as Dotenv::Rails)
  • Handles multiline environment variables correctly if applicable

Run the following to verify JWT and dotenv usage patterns:

🏁 Script executed:

#!/bin/bash
# Description: Check JWT and dotenv API usage in the codebase for compatibility issues

# Find JWT.decode calls to ensure explicit algorithm is specified
echo "=== JWT.decode calls (should have algorithm: parameter) ==="
rg -n 'JWT\.decode' -A 2 --type=rb -g '!spec/**' -g '!test/**'

# Find dotenv method calls
echo -e "\n=== Dotenv API usage ==="
rg -n 'Dotenv\.' --type=rb -g '!spec/**' -g '!test/**' | head -20

# Check for use of removed dotenv methods (overload, deprecated names)
echo -e "\n=== Potentially deprecated dotenv method names ==="
rg -n 'Dotenv\.overload' --type=rb

Length of output: 218

🏁 Script executed:

#!/bin/bash
# Description: Check JWT and dotenv API usage with corrected ripgrep syntax

# Find JWT.decode calls to ensure explicit algorithm is specified
echo "=== JWT.decode calls (should have algorithm: parameter) ==="
rg -n 'JWT\.decode' -A 2 -g '*.rb' -g '!spec/**' -g '!test/**'

# Find dotenv method calls
echo -e "\n=== Dotenv API usage ==="
rg -n 'Dotenv\.' -g '*.rb' -g '!spec/**' -g '!test/**' | head -30

# Check for use of removed dotenv methods (overload, deprecated names)
echo -e "\n=== Potentially deprecated dotenv method names ==="
rg -n 'Dotenv\.overload' -g '*.rb'

# Also check the gemspec file itself and main entry points
echo -e "\n=== Files in lib directory ==="
find lib -name '*.rb' 2>/dev/null | head -20

Length of output: 931

🌐 Web query:

JWT gem 3.0 breaking changes decode method signature

💡 Result:

Short answer: In ruby-jwt 3.0 the public decode signature is still

JWT.decode(jwt, key = nil, verify = true, options = {}, &keyfinder)

but behavior around the options and algorithm handling changed — decoding now uses the new JWT::Decode class and expects algorithm/algorithm objects via the options (see ALGORITHM_KEYS), and the gem restructured algorithms (custom algorithms must follow the JWT::JWA::SigningAlgorithm interface). See the 3.x docs/changelog for details. [1][2][3]

Sources

  • Gem release / versions (3.0.0, 3.1.x). [RubyGems]. [1]
  • JWT.decode method signature in 3.x docs (shows decode(jwt, key = nil, verify = true, options = {})). [2]
  • UPGRADING / CHANGELOG notes about algorithm restructuring and decode/claim verification changes. [3]

🌐 Web query:

ruby-jwt 3.0 upgrade guide verify false breaking changes

💡 Result:

Short answer: ruby-jwt 3.0 removed the old “skip verification by reading payload” behavior — the gem now requires the token signature to be verified before you can access the payload, and several deprecated claim/verify APIs were removed. That’s the breaking change behind “verify=false” style usage. [1][2]

What changed (essentials)

  • v3.0 requires signature verification before accessing payload — you can no longer rely on calling decode (or accessing EncodedToken#payload) without verifying the signature first. [2]
  • Deprecated claim verification helpers (old verify methods) and some Verify/algorithm APIs were removed; see the UPGRADING notes for API replacements. [1][2]

What to do when upgrading

  • Stop using patterns that relied on skipping verification (e.g. any code that decoded/inspected payload without verifying signature). Instead explicitly verify the signature when decoding or use the new EncodedToken API:
    • Use JWT::EncodedToken.new(token).verify!(signature: { algorithm: 'HS256', key: 'secret' }) then read payload. (EncodedToken#verify! bundles signature + claim validation.) [4]
    • Or call the library’s verify API that both checks signature and claims before reading payload. [1][4]
  • Update code that used deprecated JWT::Claims.verify! / Verify class methods to the new JWT::Claims.verify_payload! / EncodedToken flow. [1]
  • If you used an option like verify: false (or other ways to bypass verification), remove/replace it — those patterns are no longer supported. [1][2]

References

  • UPGRADING notes (ruby-jwt repository). [1]
  • CHANGELOG v3.0.0 (breaking changes: require verification before payload; removed deprecated claim verification; dropped HS512256). [2]
  • README / GitHub docs showing EncodedToken/verify! usage. [4]

If you want, tell me one example of how you currently call JWT.decode or read payload and I’ll show the exact replacement for v3.0.

🏁 Script executed:

#!/bin/bash
# Check if controlplane_api_direct.rb was modified and look for tests

echo "=== Searching for tests that cover JWT token decode ==="
rg -n 'JWT\.decode|api_token.*token|controlplane.*api' -g '*.rb' | grep -i test | head -20

echo -e "\n=== Full context of JWT.decode usage ==="
rg -n 'JWT\.decode' -B 5 -A 5 -g '*.rb' -g '!spec/**' -g '!test/**'

echo -e "\n=== Check if there are spec files testing controlplane_api_direct ==="
find . -name '*spec*.rb' -o -name '*test*.rb' | xargs grep -l 'controlplane_api_direct\|JWT.decode' 2>/dev/null | head -10

echo -e "\n=== Look at the full method containing JWT.decode ==="
rg -n 'def.*payload\|def.*decode' -B 2 -A 15 lib/core/controlplane_api_direct.rb | head -40

Length of output: 1014

Fix JWT.decode call to use JWT 3.x compatible API at lib/core/controlplane_api_direct.rb:92.

The current code uses the deprecated JWT 2.x API which is no longer supported in JWT 3.x. The line payload, = JWT.decode(api_token[:token], nil, false) will fail at runtime because JWT 3.0 removed the ability to decode/access payloads without signature verification and no longer accepts the verify=false parameter for skipping verification.

This method will throw a JWT::DecodeError when called with JWT 3.x (or later versions). Update this line to pass algorithms via options or use the new JWT::EncodedToken API to maintain compatibility.

🤖 Prompt for AI Agents 
In cpflow.gemspec around lines 18 to 21, update the JWT.decode usage in
lib/core/controlplane_api_direct.rb line 92 to be compatible with JWT 3.x:
replace the deprecated JWT 2.x call that relied on verify=false with a call that
supplies the required options (pass an algorithms option when calling
JWT.decode, e.g. an empty array to indicate no algorithms) or switch to the new
JWT::EncodedToken API to extract the payload without signature verification;
ensure the new call follows the JWT 3.x method signature and returns the payload
as before.


spec.files = `git ls-files -z`.split("\x0").reject do |file|
file.match(%r{^(coverage|pkg|spec|tmp)/})
Expand Down
Loading