Auditing dependencies

What is outdated

Two different questions hide behind "dependencies are fine". The first is age: is a newer version available? The second is safety: is the version you have known to be broken? Bundler answers the first with bundle outdated:

bundle outdated

Gem Current Latest Requested Groups Release Date
minitest 5.27.0 6.0.6 ~> 5.20 default

The line says everything at once: the Ruby project has 5.27.0, the newest release is 6.0.6, and the Gemfile asks for 5.x. That is not a bug; it is a decision to stay on the 5 line, and the report makes the decision visible. A major version is not a free upgrade, so read the release notes before changing the constraint.

The advisory check

The second question has its own tool. bundler-audit compares Gemfile.lock with the ruby-advisory-db and reports gems with a known vulnerability:

gem install bundler-audit

2 gems installed

Update the advisory database and check the lock file

bundler-audit check --update

Cloning into '/root/.local/share/ruby-advisory-db'... ruby-advisory-db: advisories: 1351 advisories last updated: 2026-11-04 09:42:55 -0500 commit: 516ea4757d5eec778c49af8371c23309c4b70f42 No vulnerabilities found

--update clones or refreshes the newest list before the check; without it the result depends on when the list was last refreshed. On a dependency that has no advisory it prints No vulnerabilities found and exits zero; any finding prints the gem, the advisory id and the fixed version, and makes the command exit nonzero.

The step in the pipeline

Like the linter, the audit gets a Rake task and a place in the pipeline task:

desc "Check the lock file for known advisories" task :audit do sh "bundler-audit check --update" end desc "Run the whole pipeline" task ci: %i[test lint audit]

Put the audit last in the list: it downloads a database, so it is slower than the tests and it should not delay a failure that a test would catch. The pipeline fails on the first red step, and the order decides which red step a reader sees.

What to watch for

An audit is a snapshot, not a certificate. The advisory database grows every week, so a pipeline that was green last month can be red today with no change of your own; that is the tool working, not breaking.

Do not silence a finding with a version pin. Update the gem, or, when the update is impossible yet, record the exception in one place with a date and a reason, so the next reader knows it was a decision.

Next: Secrets in a pipeline

Article author: Arthur Isaev