
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
This is a companion to the "Ten Years of Rails Upgrades" conference talk. You'll find various utilities that we use at Clio to help us prepare for and complete Rails upgrades.
These scripts are still early days and may not work in every environment or app.
I wouldn't recommend adding this to your Gemfile long-term. Rather, try out the scripts and use them as a point of reference. Feel free to tweak them to better fit your environment.
bundle_report
Learn about your Gemfile and see what needs updating.
# Show all out-of-date gems
bundle_report outdated
# Show five oldest, out-of-date gems
bundle_report outdated | head -n 5
# Show gems that don't work with Rails 5.2.0
bundle_report compatibility --rails-version=5.2.0
bundle_report --help
If you're using RSpec, add this snippet to rails_helper.rb
or spec_helper.rb
(whichever loads Rails).
RSpec.configure do |config|
# Tracker deprecation messages in each file
if ENV["DEPRECATION_TRACKER"]
DeprecationTracker.track_rspec(
config,
shitlist_path: "spec/support/deprecation_warning.shitlist.json",
mode: ENV["DEPRECATION_TRACKER"],
transform_message: -> (message) { message.gsub("#{Rails.root}/", "") }
)
end
end
We don't use MiniTest, so there isn't a prebuilt config for it but I suspect it's pretty similar to DeprecationTracker.track_rspec
.
Once you have that, you can start using deprecation tracking in your tests:
# Run your tests and save the deprecations to the shitlist
DEPRECATION_TRACKER=save rspec
# Run your tests and raise an error when the deprecations change
DEPRECATION_TRACKER=compare rspec
deprecations
commandOnce you have stored your deprecations, you can use deprecations
to display common warnings, run specs, or update the shitlist file.
deprecations info
deprecations info --pattern "ActiveRecord::Base"
deprecations run
deprecations --help # For more options and examples
Right now, the path to the shitlist is hardcoded so make sure you store yours at spec/support/deprecations.shitlist.json
.
This command helps you dual-boot your application.
next --init # Create Gemfile.next
vim Gemfile # Tweak your dependencies conditionally using `next?`
next bundle install # Install new gems
next rails s # Start server using Gemfile.next
Add this line to your application's Gemfile:
gem 'ten_years_rails'
And then execute:
$ bundle
Or install it yourself as:
$ gem install ten_years_rails
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that ten_years_rails demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.