Repository navigation
CHEF-39789: update embedded InSpec and Addressable - #4254
Closed
lbakerchef wants to merge 1 commit into
Closed
lbakerchef wants to merge 1 commit into
lbakerchef wants to merge 1 commit into
Conversation
Advance omnibus configuration to resolve InSpec Core 5.24.24 and Addressable 2.9.0 while retaining Chef Client 18.10.17. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: Lincoln Baker <51833247+lbakerchef@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Advance the omnibus submodule to the configuration change that resolves embedded InSpec Core / InSpec Core Bin 5.24.24 and Addressable 2.9.0 while retaining Chef Client 18.10.17.
The existing Chef Client/InSpec appbundler wrappers pin Addressable 2.8.7. Updating their owning bundle before wrapper generation fixes that dependency without changing the already-fixed Server application lockfiles.
Issues Resolved
https://progresssoftware.atlassian.net/browse/CHEF-39789
GHSA-h27x-rffw-24p4 / CVE-2026-35611.
Validation
The referenced configuration passed targeted Docker resolution, source-gem build/installation, generated-wrapper checks, Chef local convergence/idempotence, and five InSpec checks. Only the three intended gem versions changed. No new Cookstyle offenses versus baseline.
Full omnibus package build, fresh-install/upgrade VM testing, and package-wide stale-gem inventory remain pending.
Merge coordination
Merge the companion chef-server-omnibus-config PR first. If its merge rewrites the configuration commit, update this gitlink to the final merged SHA before merging this PR. No omnibus-software-private change is required.
Companion: https://github.com/chef/chef-server-omnibus-config/pull/36
Check List
AI-assisted change developed with GitHub Copilot.