Uninstall the default net-imap gem shipped with Ruby

What does this MR do?

The default net-imap gem shipped with Ruby is vulnerable, and GitLab Rails already bundles a newer, patched version (0.6.4). This uninstalls the default version during the gitlab-rails build so the vulnerable copy is not left on disk in the package.

The expected default net-imap version depends on the Ruby version (stdgems.org/net-imap):

  • Ruby 3.3.9–3.3.11 → net-imap 0.4.21
  • Ruby 3.4.4–3.4.9 → net-imap 0.5.8
  • Ruby 4.0 → net-imap 0.6.2

All of these default versions are uninstalled (mirroring the existing rexml cleanup), so this works across the current, next, and future Ruby versions. This list must be updated when bumping Ruby.

Relates to https://gitlab.com/gitlab-org/gitlab/-/work_items/600949

Checklist

See Definition of done.

Required

  • MR title and description are up to date, accurate, and descriptive.
  • MR targeting the appropriate branch.
  • Latest Merge Result pipeline is green.
  • When ready for review, MR is labeled workflowready for review per the Distribution MR workflow.
  • The UBT version and corresponding checksum hash have been updated and referenced in the merge request if applicable. (N/A)

For GitLab team members

  • The manual Trigger:ee-package jobs have a green pipeline running against latest commit.
  • If config/software or config/patches directories are changed, make sure the build-package-on-all-os job within the Trigger:ee-package downstream pipeline succeeded.
Edited by Stan Hu

Merge request reports

Loading