Should bundler-audit verify it is up-to-date?

[rubysec]

Should bundler-audit verify it is up-to-date?

[dzhlobo]

I like this proposal but it breaks "Does not require a network connection" feature. But it's better than connect and verify db of vulnerabilities is up-to-date.

[thbar]

I love the no network connection requirement as well; maybe it could be a configurable option in some way?

[postmodern]

Eventually will migrate bundler-audit to using ruby-advisory-db. In order to ensure we are running against the latest list of advisories, it would have to do a git pull. We could also add a --no-update option.

[postmodern]

Or we could have it fall back to using the vendored copy of ruby-advisory-db in data/ruby-advisory-db/ if the update/download fails.

[postmodern]

The 0.8.0 branch (which will be merged/released soon) will now auto-download/auto-update the ruby-advisory-db on each run; unless --no-update is given.

[postmodern]

bundler-audit 0.8.0.rc1 has been released! Please test and provide any QA feedback.

$ gem install --pre bundler-audit