From bc93fcf710edc28f3679522a50c70335a71689ec Mon Sep 17 00:00:00 2001 From: Christian Rogobete Date: Wed, 11 Nov 2026 21:10:09 +0100 Subject: [PATCH] Move the XDR generator to activesupport 8.1.4.1 Before this change, the XDR generator tool locked activesupport 6.1.7.10 through the xdrgen fork, and GHSA-8474-xrp6-wh69 is fixed only in 8.0.5.2 and 8.1.4.1. The advisory affected the build tool only: the gem is not part of the SDK, and xdrgen does not call the affected method. This change: - Pins the xdrgen fork at the commit that requires activesupport 8.1.4.1 or later and Ruby 3.2 or later. - Updates the lock: activesupport 8.1.4.1 with the gems it needs. - States Ruby 3.2 or later in the generator documentation. The generator tests pass and the regenerated XDR code is identical to the committed code. --- tools/xdr-generator/Gemfile | 7 +++---- tools/xdr-generator/Gemfile.lock | 26 ++++++++++++++++++-------- tools/xdr-generator/README.md | 2 +- 3 files changed, 22 insertions(+), 13 deletions(-) diff --git a/tools/xdr-generator/Gemfile b/tools/xdr-generator/Gemfile index 6a9226da..58b038ba 100644 --- a/tools/xdr-generator/Gemfile +++ b/tools/xdr-generator/Gemfile @@ -1,9 +1,8 @@ source "https://rubygems.org" -# Soneso fork requires concurrent-ruby >= 1.3.7 (fixes GHSA-h8w8-99g7-qmvj and -# two further advisories) and provides logger; switch back to stellar/xdrgen -# master once https://github.com/stellar/xdrgen/pull/231 is merged. -gem "xdrgen", git: "https://github.com/Soneso/xdrgen", ref: "99390b91b0f15c1f0ef7a55b6cf12d0700531336" +# The Soneso fork carries activesupport 8.1.4.1 or later (GHSA-8474-xrp6-wh69) +# and concurrent-ruby 1.3.7 or later, until stellar/xdrgen ships both. +gem "xdrgen", git: "https://github.com/Soneso/xdrgen", ref: "ef4590880e978dc9b662e5f9863979ef0f4c590d" # Ruby 3.4 removed these from stdlib -- must be explicit gem "base64" diff --git a/tools/xdr-generator/Gemfile.lock b/tools/xdr-generator/Gemfile.lock index 74630498..d5cbd545 100644 --- a/tools/xdr-generator/Gemfile.lock +++ b/tools/xdr-generator/Gemfile.lock @@ -1,10 +1,10 @@ GIT remote: https://github.com/Soneso/xdrgen - revision: 99390b91b0f15c1f0ef7a55b6cf12d0700531336 - ref: 99390b91b0f15c1f0ef7a55b6cf12d0700531336 + revision: ef4590880e978dc9b662e5f9863979ef0f4c590d + ref: ef4590880e978dc9b662e5f9863979ef0f4c590d specs: xdrgen (0.1.3) - activesupport (~> 6) + activesupport (>= 8.1.4.1, < 9) concurrent-ruby (>= 1.3.7) logger memoist (~> 0.11.0) @@ -14,19 +14,28 @@ GIT GEM remote: https://rubygems.org/ specs: - activesupport (6.1.7.10) - concurrent-ruby (~> 1.0, >= 1.0.2) + activesupport (8.1.4.1) + base64 + bigdecimal + concurrent-ruby (~> 1.0, >= 1.3.1) + connection_pool (>= 2.2.5) + drb i18n (>= 1.6, < 2) + json + logger (>= 1.4.2) minitest (>= 5.1) - tzinfo (~> 2.0) - zeitwerk (~> 2.3) + securerandom (>= 0.3) + tzinfo (~> 2.0, >= 2.0.5) + uri (>= 0.13.1) base64 (0.3.0) benchmark (0.5.0) bigdecimal (4.1.3) concurrent-ruby (1.3.7) + connection_pool (3.0.2) drb (2.2.3) i18n (1.15.2) concurrent-ruby (~> 1.0) + json (3.1.0) logger (1.7.0) memoist (0.11.0) minitest (6.0.6) @@ -35,12 +44,13 @@ GEM mutex_m (0.3.0) polyglot (0.3.5) prism (1.9.0) + securerandom (0.4.1) slop (3.6.0) treetop (1.5.3) polyglot (~> 0.3) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - zeitwerk (2.8.2) + uri (1.1.2) PLATFORMS aarch64-linux diff --git a/tools/xdr-generator/README.md b/tools/xdr-generator/README.md index 31fe690a..510bba51 100644 --- a/tools/xdr-generator/README.md +++ b/tools/xdr-generator/README.md @@ -6,7 +6,7 @@ Generates PHP XDR types from Stellar's `.x` definition files using the [xdrgen]( - Docker (for Makefile targets) - Ruby, PHP, and the Composer dependencies in `vendor/` on the host, for the SEP-51 round-trip test emission that `make xdr-update` runs outside Docker -- Ruby 3.x and Bundler (only if running the generator without Docker) +- Ruby 3.2 or later and Bundler (only if running the generator without Docker) ## Usage