bundler-alive
Advanced tools
bundler-alive checks if gems in a RubyGem's Gemfile.lock are active.
Currently, GitHub.com and GitLab.com are supported as a source code repository. If the source code repository is archived, then reports as not alive.
$ gem install bundler-alive
$ bundle-alive
6 gems are in Gemfile.lock
..W....
Get all source code repository URLs of gems are done!
.....
Errors:
[bundle-alive] Not found in RubyGems.org.
Archived gems:
Name: journey
URL: http://github.com/rails/journey
Total: 6 (Archived: 1, Alive: 4, Unknown: 1)
Not alive gems are found!
Default Gemfile.lock location is in your current directory. You can specify it.
$ bundle-alive -G /path/to/Gemfile.lock
You MUST set environment variables to access source code repository services.
| Repository service | ENV variable |
|---|---|
| GitHub | BUNDLER_ALIVE_GITHUB_TOKEN |
| GitLab | BUNDLER_ALIVE_GITLAB_TOKEN |
You can ignore certain gems.
$ bundle-alive -i journey rubocop-junit-formatter
The URL for some gems in RubyGems.org may have changed. You can follow the URL (default: doesn't follow).
$ bundle-alive --follow_redirect
In some cases, some gems cannot find the URL of their source code repositories. For this case, you can specify a mapping between the gem and its URL.
Put .bundler-alive.yml in your current directory. The following code is the sample.
---
gems:
coffee-script-source:
url: https://github.com/jashkenas/coffeescript/
You can also specify the file path.
$ bundle-alive -c /path/to/.bundler-alive.yml
.bundler-alive.default.yml may also be helpful. Considering that having these mappings obtained automatically in the future.
Bug reports and pull requests are welcome on GitHub at https://github.com/kyoshidajp/bunlder-alive.
This gem was inspired by the following products.
FAQs
Unknown package
We found that bundler-alive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean operators.
Research
Socket researchers identified a malicious Chrome extension that manipulates Raydium swaps to inject an undisclosed SOL transfer, quietly routing fees to an attacker wallet.
Research
/Security News
Another wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.