Discussed in #8839
As discovered by @sathish-krishnamurthy in #8839, gems that are supposed to be "bundled" in JRuby (preinstalled as normal gems that can be fully uninstalled) are actually still installing some files into the stdlib location (as if they were still "default" gems). In this case, net-imap installs as expected to lib/ruby/gems/shared but also drops some files into stdlib:
- lib/ruby/stdlib/net/net-imap.gemspec
- lib/ruby/stdlib/net/imap.rb
I can confirm that there are other gems also installing these files:
[] jruby $ find lib/ruby/stdlib -name \*.gemspec
lib/ruby/stdlib/net/net-smtp.gemspec
lib/ruby/stdlib/net/net-protocol.gemspec
lib/ruby/stdlib/net/net-imap.gemspec
lib/ruby/stdlib/net/net-pop.gemspec
lib/ruby/stdlib/net/net-ftp.gemspec
lib/ruby/stdlib/fileutils/fileutils.gemspec
Because net-imap has a recent CVE, users may want to be able to uninstall the old version and install a new version, but because of this issue security tools like Jfrog will still flag the installation.
We need to fix the build to not copy any bundled gem files into stdlib.
This affects both 9.4 and 10.
See #8825 and #8839 for the net-imap update PRs.
Discussed in #8839
As discovered by @sathish-krishnamurthy in #8839, gems that are supposed to be "bundled" in JRuby (preinstalled as normal gems that can be fully uninstalled) are actually still installing some files into the stdlib location (as if they were still "default" gems). In this case, net-imap installs as expected to
lib/ruby/gems/sharedbut also drops some files into stdlib:I can confirm that there are other gems also installing these files:
Because net-imap has a recent CVE, users may want to be able to uninstall the old version and install a new version, but because of this issue security tools like Jfrog will still flag the installation.
We need to fix the build to not copy any bundled gem files into stdlib.
This affects both 9.4 and 10.
See #8825 and #8839 for the net-imap update PRs.