[RAILS] Response to Github vulnerability alerts

Purpose of the article

Since I am a beginner, I would appreciate it if you could point out any mistakes. I am posting it for the purpose of memorandum and output. Even though I am a beginner, I have a desire to help even a little.

Notification from Github (by email)

Set actionview to 6.0.3.3, which is vulnerable to security. Notification with. It is important to note here that Gemfile.lock is written, but since Gemfile.lock is a file that Bundler automatically creates and updates, developers should not edit it on their own. (Quoted from Cherry book P430). If you want to change it, it's a gemfile.

Alert information on Github

Again, I'm telling you to set the actionview to 6.0.3.3.

Coping

I will refer to this article. https://qiita.com/Nash-BETA/items/0d4e876cf9460778b985 However, the actionview is not in the gemfile. I can't fix it. ..

I will refer to this article. https://reasonable-code.com/github-security-alert/ It is said that even if you follow the instructions and update as follows, the version remains the same as below. I can't change it to 6.0.3.3. ..

$ bundle update actionview Bundler attempted to update actionview but its version stayed the same Bundle updated!
https://reasonable-code.com/github-security-alert/

Please refer to the answer of teratail below. https://teratail.com/questions/249997　 https://teratail.com/questions/240417 It says that to change the actionview, you need to change the gem of rails itself.

Here is a hint for the solution! !! Raise the version of Rails that depends on actionview.

gem 'rails', '~> 6.0.3', '>= 6.0.3.2'

From

gem 'rails', '~> 6.0.3', '>= 6.0.3.3'

Change to bundle update.

$ bundle update
Fetching gem metadata from https://rubygems.org/............
Fetching gem metadata from https://rubygems.org/.
Resolving dependencies...........
Using actionview 6.0.3.3 (was 6.0.3.2)

It seems that it can be changed to 6.0.3.3. .. Check gemfile.lock.

actionview (= 6.0.3.3)

I was able to change it safely! !! The alert information on github has also disappeared.