diff --git a/README.md b/README.md index b7a3f587..c19eb5a0 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ Audit a project's `Gemfile.lock`: Criticality: Medium URL: http://www.osvdb.org/show/osvdb/91452 Title: XSS vulnerability in sanitize_css in Action Pack - Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 + Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Name: actionpack Version: 3.2.10 @@ -39,7 +39,7 @@ Audit a project's `Gemfile.lock`: Criticality: Medium URL: http://osvdb.org/show/osvdb/91454 Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails - Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 + Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Name: actionpack Version: 3.2.10 @@ -47,7 +47,7 @@ Audit a project's `Gemfile.lock`: Criticality: High URL: http://osvdb.org/show/osvdb/89026 Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution - Solution: upgrade to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11 + Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11 Name: activerecord Version: 3.2.10 @@ -55,7 +55,7 @@ Audit a project's `Gemfile.lock`: Criticality: High URL: http://osvdb.org/show/osvdb/91453 Title: Symbol DoS vulnerability in Active Record - Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 + Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Name: activerecord Version: 3.2.10 @@ -63,7 +63,7 @@ Audit a project's `Gemfile.lock`: Criticality: Medium URL: http://direct.osvdb.org/show/osvdb/90072 Title: Ruby on Rails Active Record attr_protected Method Bypass - Solution: upgrade to ~> 2.3.17, ~> 3.1.11, >= 3.2.12 + Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12 Name: activerecord Version: 3.2.10 @@ -71,7 +71,7 @@ Audit a project's `Gemfile.lock`: Criticality: High URL: http://osvdb.org/show/osvdb/89025 Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass - Solution: upgrade to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11 + Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11 Name: activesupport Version: 3.2.10 @@ -79,7 +79,7 @@ Audit a project's `Gemfile.lock`: Criticality: High URL: http://www.osvdb.org/show/osvdb/91451 Title: XML Parsing Vulnerability affecting JRuby users - Solution: upgrade to ~> 3.1.12, >= 3.2.13 + Solution: update to ~> 3.1.12, >= 3.2.13 Unpatched versions found! diff --git a/lib/bundler/audit/cli/formats/junit.rb b/lib/bundler/audit/cli/formats/junit.rb index 26cea193..be94c000 100644 --- a/lib/bundler/audit/cli/formats/junit.rb +++ b/lib/bundler/audit/cli/formats/junit.rb @@ -101,7 +101,7 @@ def bundle_title(result) def advisory_solution(advisory) unless advisory.patched_versions.empty? - "upgrade to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}" + "update to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}" else "remove or disable this gem until a patch is available!" end diff --git a/lib/bundler/audit/cli/formats/text.rb b/lib/bundler/audit/cli/formats/text.rb index 399f143c..e9f455d6 100644 --- a/lib/bundler/audit/cli/formats/text.rb +++ b/lib/bundler/audit/cli/formats/text.rb @@ -104,7 +104,7 @@ def print_advisory(gem, advisory) end unless advisory.patched_versions.empty? - say "Solution: upgrade to ", :red + say "Solution: update to ", :red say advisory.patched_versions.map { |v| "'#{v}'" }.join(', ') else say "Solution: ", :red diff --git a/spec/cli/formats/junit_spec.rb b/spec/cli/formats/junit_spec.rb index ffbc05fa..0d0a2d3a 100644 --- a/spec/cli/formats/junit_spec.rb +++ b/spec/cli/formats/junit_spec.rb @@ -240,8 +240,8 @@ end context "when Advisory#patched_versions is not empty" do - it 'must print "Solution: upgrade to ..."' do - expect(output).to include("Solution: upgrade to #{CGI.escapeHTML(advisory.patched_versions.map { |v| "'#{v}'" }.join(', '))}") + it 'must print "Solution: update to ..."' do + expect(output).to include("Solution: update to #{CGI.escapeHTML(advisory.patched_versions.map { |v| "'#{v}'" }.join(', '))}") end end diff --git a/spec/cli/formats/text_spec.rb b/spec/cli/formats/text_spec.rb index 88f5de8e..987f291b 100644 --- a/spec/cli/formats/text_spec.rb +++ b/spec/cli/formats/text_spec.rb @@ -229,8 +229,8 @@ end context "when Advisory#patched_versions is not empty" do - it 'must print "Solution: upgrade to ..."' do - expect(output_lines).to include("Solution: upgrade to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}") + it 'must print "Solution: update to ..."' do + expect(output_lines).to include("Solution: update to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}") end end