Dependabot cannot create a pull request as one or more other dependencies require a version that is incompatible with this update

Question

In one of my repositories today, I got this security notification:

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template=" string://<%= `).

 NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

I tried creating a dependabot security update but it couldn't update to the required version.

How to resolve this?

Answer 1

I had the same problem in a few repositories this week. They were all using GitHub pages to generate static sites, so the JSON vulnerability was probably irrelevant. However, it's easier if you can just upgrade away from the vulnerable version of kramdown.

The problem with my repositories was that they were using versions of the github-pages gem older than 207. Those required vulnerable versions of kramdown, so Dependabot wouldn't touch it. I'm not sure why Dependabot couldn't update github-pages .

To solve it, I used the bundle update --all command . bundle update github-pages also works, although in my project it had the same result. It installed a bunch of updates, and recorded them in the Gemfile.lock file. When I committed that change, the security notification on GitHub went away.

Answer 2

In my case I solved it by modifying the Gemfile.lock file, it is located in the root directory of the repository.

CTRL + F kramdown

Appears in three places in the file

Gemfile.lock 
line 70  kramdown (= 1.17.0) update to 2.3.0
line 105 kramdown (~> 1.14)  update to 2.3.0
line 170 kramdown (1.17.0)   update to 2.3.0

Create a new branch to modify, commit, and submit the changes. Open Pull Request, merge and confirm merge.

Then tell me how it went. Regards

Answer 3

Clone that repo locally. Run npm update . It will automatically update all your packages. No need to rely on dependabot. To verify the update run npm outdated .

To upgrade yarn.lock dependencies, run yarn upgrade --latest .