Ruby 2.7.2 uses 2.7.0 libraries

user_1220312 0
Viewed 235

I have Ruby 2.7.2 installed using rbenv, but when I run the following code:

require 'webrick'

WEBrick::VERSION
=> "1.6.0"
WEBrick::HTTPUtils.method(:mime_type).source_location
=> ["/Users/my_user/.rbenv/versions/2.7.2/lib/ruby/2.7.0/webrick/httputils.rb", 133]

I have the webrick version 1.6, which has a security issue which was patched in ruby 2.7.2.

This also happens in our dev/prod environments were we use a docker image with ruby 2.7.2, so, I don't think is an rbenv issue.

What I want to know is, why my ruby interpreter is using libraries from version 2.7.0?

bundler rubygems ruby-on-rails ruby
3 Answers

The versioned directory within the lib directory, i.e. 2.6.0 in your example does not denote the exact Ruby the library files belong to but instead the "library compatible version".

In the old times, when even minor versions were widely different, you had directories such as 1.8.6, or 1.8.7 there because those Ruby versions were rather different from each other. Their patch releases however were compatible enough that installed gems should be compatible within that version range.

With the Ruby 1.9.x releases, this was a mixed bag. Ruby 1.9.0 and 1.9.1 each had their respective versioned directories. Ruby 1.9.2 and 1.9.3 claimed to be library compatible withy Ruby 1.9.1 and thus continued to use the 1.9.1 directory. This was explained in a FAQ within the release announcement of Ruby 1.9.2

With Ruby 2.x, this scheme was further refined. Unless there are strict breaking changes (of which there were non yet), All minor releases use the library version of its first point release. All Ruby 2.1.x versions thus use 2.1.0, all Ruby 2.7.x versions use 2.7.0 and so on.

As such, while you definitely should not mix the standard libraries of multiple ruby versions, the library version number in the lib directories stays the same over different point releases. This allows for example to retain installed gems for a certain minor release when updating the Ruby version.

The version of your webrick library is thus the one you want to have. In the Ruby release, the Ruby team has just backported the fix for the webrick library rather than bumping the while library.

user_4217050

Further to the accepted answer, read the vulnerability notes carefully:

Please update the webrick gem to version 1.6.1 or later. You can use gem update webrick to update it. If you are using bundler, please add gem "webrick", ">= 1.6.1" to your Gemfile.

Affected versions

  • webrick gem 1.6.0 or prior
  • bundled versions of webrick in ruby 2.7.1 or prior

You are not using the webrick gem. You are using the bundled version.

Gems on your machine will be located in:

/Users/my_user/.rbenv/versions/2.7.2/lib/ruby/gems/2.7.0/gems/...

But your webrick library is in:

/Users/my_user/.rbenv/versions/2.7.2/lib/ruby/2.7.0/...

The security fix was applied to the ruby 2.7.2 bundled version.

user_19546100

What I want to know is, why my ruby interpreter is using libraries from version 2.7.0?

/Users/my_user/.rbenv/versions/2.7.2/lib/ruby/2.7.0/webrick/httputils.rb

This is a common source of confusion. It's just how ruby works.

  • If you look inside e.g. .rbenv/versions/2.6.3 you will find 2.6.3/lib/ruby/2.6.0.
  • If you look inside e.g. .rbenv/versions/3.0.2 you will find 2.6.3/lib/ruby/3.0.0.

This directory structure has been around for a long time, since at least 1.9.3, maybe earlier.

user_5677620
Related