Uninstall the default net-imap gem shipped with Ruby
What does this MR do?
The default net-imap gem shipped with Ruby is vulnerable, and GitLab Rails already bundles a newer, patched version (0.6.4). This uninstalls the default version during the gitlab-rails build so the vulnerable copy is not left on disk in the package.
The expected default net-imap version depends on the Ruby version (stdgems.org/net-imap):
- Ruby 3.3.9–3.3.11 →
net-imap0.4.21 - Ruby 3.4.4–3.4.9 →
net-imap0.5.8 - Ruby 4.0 →
net-imap0.6.2
All of these default versions are uninstalled (mirroring the existing rexml cleanup), so this works across the current, next, and future Ruby versions. This list must be updated when bumping Ruby.
Related issues
Relates to https://gitlab.com/gitlab-org/gitlab/-/work_items/600949
Checklist
See Definition of done.
Required
- MR title and description are up to date, accurate, and descriptive.
- MR targeting the appropriate branch.
- Latest Merge Result pipeline is green.
- When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
- The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable. (N/A)
For GitLab team members
- The manual
Trigger:ee-packagejobs have a green pipeline running against latest commit. - If
config/softwareorconfig/patchesdirectories are changed, make sure thebuild-package-on-all-osjob within theTrigger:ee-packagedownstream pipeline succeeded.
Edited by Stan Hu