You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
NOTE: For currently supported Ruby versions, [check out the Travis build status](https://travis-ci.org/e2/ruby_dep). If you need support for an different/older version of Ruby, open an issue with "backport" in the title and provide a compelling case for supporting the version of Ruby you need. When in doubt, open a new issue or [read the FAQ on the Wiki](https://github.com/e2/ruby_dep/wiki/FAQ).
5
+
## Description
6
6
7
+
RubyDep helps users avoid incompatible, buggy and insecure Ruby versions.
7
8
8
-
## The problem
9
+
It's for gem owners to add to their runtime dependencies in their gemspec.
9
10
10
-
Your gem shouldn't (and likely doesn't) support all possible Ruby versions.
11
+
1. It automatically sets your gemspec's `required_ruby_version` based on rubies tested in your `.travis-yml`
12
+
2. It warns users of your project if they're using a buggy or vulnerable version of Ruby
11
13
12
-
(And not all Ruby versions are secure to even be installed).
14
+
NOTE: RubyDep uses it's own approach on itself. This means it can only be installed on Ruby versions tested here: [check out the Travis build status](https://travis-ci.org/e2/ruby_dep). If you need support for an different/older version of Ruby, open an issue with "backport" in the title and provide a compelling case for supporting the version of Ruby you need.
15
+
When in doubt, open a new issue or [read the FAQ on the Wiki](https://github.com/e2/ruby_dep/wiki/FAQ).
13
16
14
-
You need a way to protect users who don't know about this. So, you need to tell users which Ruby versions you support in:
15
17
16
-
1. Your gemspec
17
-
2. Your README
18
-
3. Your .travis.yml file
19
-
4. Any issues you get about which version of Ruby is supported or not
18
+
## Problem 1: "Which version of Ruby does your project support?"
20
19
21
-
But, maintaning that information in 4 different places breaks the principle of
22
-
single responsibility.
20
+
Your gem shouldn't (and likely doesn't) support all possible Ruby versions.
23
21
24
-
And users often don't really "read" a README if they can avoid it.
22
+
So you have to tell users which versions your gem supports.
25
23
24
+
But, there are at least 3 places where you list the Rubies you support:
26
25
27
-
## The solution
26
+
1. Your gemspec
27
+
2. Your README
28
+
3. Your .travis.yml file
29
+
30
+
That breaks the principle of single responsibility.
28
31
29
-
This gem helps you and your project users avoid Ruby version problems by:
32
+
Is it possible to just list the supported Rubies in just one place?
30
33
31
-
- warning users if their Ruby is seriously outdated or contains serious vulnerabilities
32
-
- helps you manage which Ruby versions you actually support (and prevents installing other versions)
34
+
Yes. That's what RubyDep helps with.
33
35
34
-
How? This gems detects which Ruby version users are using and which ones your project supports.
36
+
## Solution to problem 1
35
37
36
-
It assumes you are using Travis and the versions listed in your `.travis.yml`are supported.
38
+
Since Travis doesn't allow generated `.travis.yml`files, option 3 is the only choice.
37
39
38
-
This helps you limit the Ruby versions you support - just by adding/removing entries in your Travis configuration file.
40
+
With RubyDep, your gemspec's `required_ruby_version` can be automatically set based on which Rubies you test your gem on.
39
41
40
-
Also, you it can warn users if they are using an outdated version of Ruby.
42
+
What about the README? Well, just insert a link to your Travis build status page!
41
43
42
-
(Or one with security vulnerabilities).
44
+
If you're running Travis builds on a Ruby you support (and it's not in the "allow failures" section), it means you support that version of Ruby, right?
43
45
46
+
RubyDep intelligently creates a version constraint to encompass Rubies listed in your `.travis.yml`.
44
47
45
-
## Usage
48
+
## Usage (to solve Problem 1)
46
49
47
50
### E.g. in your gemspec file:
48
51
@@ -65,32 +68,59 @@ If users see their Ruby version "green" on Travis, it suggests it's supported, r
65
68
66
69
(Or, you can point to the rubygems.org site where the required Ruby version is listed).
67
70
71
+
### In your `.travis.yml`:
72
+
73
+
To add a "supported Ruby", simply add it to the Travis build.
74
+
75
+
To test a Ruby version, but not treat it as "supported", simply add that version to the `allowed_failures` section.
76
+
77
+
78
+
## Problem 2: Users don't know they're using an obsolete/buggy/insecure version of Ruby
79
+
80
+
Users don't track news updates on https://ruby-lang.org, so they may not know their ruby has known bugs or even serious security vulnerabilities.
81
+
82
+
And sometimes, that outdated/insecure Ruby is bundled by their operation system to begin with!
68
83
69
-
### In your library:
84
+
## The solution to problem 2
85
+
86
+
RubyDep has a small "database" of Ruby versions with information about which are buggy and insecure.
87
+
88
+
If you like, your gem can use RubyDep to show those warnings - to encourage users to upgrade and protect them from nasty bugs or bad security holes.
89
+
90
+
This way, when most of the Ruby community has switched to newer versions, everyone can be more productive by having faster, more stable and more feature-rich tools. And less time will be wasted supporting obsolete versions that users simply don't know are worth upgrading.
91
+
92
+
This also helps users understand that they should nudge their hosting providers, managers and package maintainers to provided up-to-date versions of Ruby to that everyone can benefit.
93
+
94
+
### Usage (to solve Problem 2)
95
+
96
+
In your gemspec:
97
+
98
+
```ruby
99
+
s.add_runtime_dependency 'ruby_dep', '~> 1.1'
100
+
```
101
+
102
+
Somewhere in your library:
70
103
71
104
```ruby
72
105
require'ruby_dep/warnings'
73
106
RubyDep::Warning.show_warnings
107
+
ENV['RUBY_DEP_GEM_SILENCE_WARNINGS'] ='1'# to ignore repeating the warning if other gems use `ruby_dep` too
74
108
```
75
109
76
-
## Tips
110
+
That way, as soon as there's a severe vulnerability discovered in Ruby (and RubyDep is updated), users will be notified quickly.
77
111
78
-
To disable warnings, just set the following environment variable:
79
112
80
-
`RUBY_DEP_GEM_SILENCE_WARNINGS=1`
81
-
82
-
You can follow these rules of thumb, whether you use RubyDep or not:
113
+
## Tips
83
114
84
-
1.Avoid changing major version numbers, even if you're dropping a major version of Ruby (e.g. 1.9.2)
85
-
2. If you want to support a current version, add it to your `.travis.yml` (e.g. ruby-2.3.1)
115
+
1.To disable warnings, just set the following environment variable: `RUBY_DEP_GEM_SILENCE_WARNINGS=1`
116
+
2. If you want to support a newer version of Ruby, just add it to your `.travis.yml` (e.g. ruby-2.3.1)
86
117
3. To support an earlier version of Ruby, add it to your `.travis.yml` and release a new gem version.
87
-
4. If you want to support a range of Rubies, include the whole range without gaps in minor version numbers (e.g. 2.0.0, 2.1.0, 2.2.0, 2.3.0) and ruby_dep will use the whole range. (If there's a gap, older versions will be considered "unsupported")
88
-
5. If you just want to test a Ruby version (but not actually support it), put it into the "allow failures" part of your Travis build matrix. (ruby_dep ignores versions there).
89
-
6. If you want to drop support for a Ruby, remove it from the `.travis.yml` and just bump your gem's minor number.
118
+
4. If you want to support a range of Rubies, include the whole range without gaps in minor version numbers (e.g. 2.0, 2.1, 2.2, 2.3) and ruby_dep will use the whole range. (If there's a gap, older versions will be considered "unsupported").
119
+
5. If you want to drop support for a Ruby, remove it from the `.travis.yml` and just bump your gem's minor number (Yes! Bumping just the minor if fine according to SemVer).
120
+
5. If you just want to test a Ruby version (but not actually support it), put it into the `allow failures` part of your Travis build matrix. (ruby_dep ignores versions there).
0 commit comments