bundler-audit

bundler-audit

• Homepage
• Issues
• Documentation

Description

Patch-level verification for bundler.

Features

• Checks for vulnerable versions of gems in Gemfile.lock.
• Checks for insecure gem sources (http:// and git://).
• Allows ignoring certain advisories that have been manually worked around.
• Prints advisory information.
• Does not require a network connection.

Synopsis

Audit a project's Gemfile.lock:

…

Update the ruby-advisory-db that bundle audit uses:

…

Update the ruby-advisory-db and check Gemfile.lock (useful for CI runs):

$ bundle-audit check --update

Checking the Gemfile.lock without updating the ruby-advisory-db:

$ bundle-audit check --no-update

Ignore specific advisories:

$ bundle-audit check --ignore OSVDB-108664

Checking a custom Gemfile.lock file:

$ bundle-audit check --gemfile-lock Gemfile.custom.lock

Output the audit's results in JSON:

$ bundle-audit check --format json

Output the audit's results in JSON, to a file:

$ bundle-audit check --format json --output bundle-audit.json

Rake Tasks

Bundler-audit provides rake tasks for checking the code and for updating its vulnerability database.

Simply add the following code to the Rakefile:

require 'bundler/audit/task'
Bundler::Audit::Task.new

The following rake tasks will then become available:

$ rake -T
rake bundle:audit
rake bundle:audit:update

Configuration File

bundler-audit also supports a per-project configuration file:

.bundler-audit.yml:

---
ignore:
  - CVE-YYYY-XXXX
  - ...

• ignore: [Array<String>] - A list of advisory IDs to ignore.

You can provide a path to a config file using the --config flag:

$ bundle-audit check --config bundler-audit.custom.yaml

Requirements

• git
• ruby >= 2.0.0
• rubygems >= 1.8
• thor ~> 1.0
• bundler >= 1.2.0

Install

$ [sudo] gem install bundler-audit

Git

• Debian / Ubuntu:

$ sudo apt install git

• RedHat / Fedora:

$ sudo dnf install git

• Alpine Linux:

$ apk add git

• macOS:

$ brew install git

Contributing

1. https://github.com/rubysec/bundler-audit/fork
2. git clone YOUR_FORK_URI
3. cd bundler-audit/
4. bundle install
5. bundle exec rake spec
6. git checkout -b YOUR_FEATURE
7. Make your changes
8. bundle exec rake spec
9. git commit -a
10. git push origin YOUR_FEATURE

Policy on Generative AI Contributions

To safeguard project security and respect our maintainers' volunteer time, a human-in-the-loop is strictly required for all submissions. While AI tools are permitted as assistants, contributors must personally review, understand, and take full responsibility for their work. Any contributions that appear to be unreviewed machine output will be closed immediately, and repeat offenders will be banned from the project and reported.

License

Copyright (c) 2013-2026 Hal Brodigan (postmodern.mod3 at gmail.com)

bundler-audit is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

bundler-audit is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with bundler-audit. If not, see https://www.gnu.org/licenses/.