Please cut a new release

[johnnyshields]

[zaccari]

The older version of rubyzip has JRuby ObjectSpace enabled which can lead to degraded performance and was fixed in 1.2.0 here (also referenced in #468). Is there anything I can help with to get axlsx to work with the latest rubyzip? My short-term fix is to patch the older gem when deploying to production but it would be nice to have the fixes in a new gem build.

[numbcoder]

Please push a new release!
The older version of rubyzip conflicts with other gems

[matthewrudy]

The rubyzip issue seems resolved?
And now Ruby 2.4.0 is released, would be great to avoid Fixnum deprecation warnings.

[radar]

This gem conflicts with roo's dependency on rubyzip (roo 2.6.0 has a rubyzip dependency of < 2.0.0, ~> 1.1). I'm using both axlsx and roo on a project here and it would help greatly if we could have a new release of axlsx which bumped this rubyzip dependency.

The new version doesn't even need to be off master. It could be off the latest tag and have just one commit in it which bumps the dependency.

[zealot128]

Any progress on that issue so far?
Unfortunately, Rubyzip 1.0.0 ist not recommended anymore and now part of the Ruby security advisory db:

Name: rubyzip
Version: 1.0.0
Advisory: CVE-2017-5946
Criticality: Unknown
URL: https://github.com/rubyzip/rubyzip/issues/315
Title: Directory traversal vulnerability in rubyzip
Solution: upgrade to >= 1.2.1

Vulnerabilities found!

As of now, it is not possible to run a secure rubyzip version together with a Gem version of axlsx.

[panozzaj]

Thank you for maintaining this gem! Came here because of the CVE listed above by @zealot128, which is causing our build to fail today due to running bundle audit to check for known security vulnerabilities.

I can definitely understand that the eventual long-term solution needs regression testing based on reading #419.

I think @radar's proposal of cutting a new gem version that just makes the rubyzip version more flexible but is otherwise identical to the latest release could be a short-term solution if the portions of the rubyzip interface that axlsx uses are not broken by using the newer version of rubyzip. I have not been actively involved with the project, so I could be wrong.

[blackst0ne]

Could you please update the gem?
I came here because of rubyzip.

[fabn]

CI builds are failing (using bundle-audit check --update) because of this and I cannot upgrade rubyzip because it's locked by axlsx:

Bundler could not find compatible versions for gem "rubyzip":
  In Gemfile:
    rubyzip (>= 1.2.1)

    axlsx was resolved to 2.0.1, which depends on
      rubyzip (~> 1.0.0)

[bolek]

same here :(

[gottfrois]

any update on this?

[thbar]

Ping @randym @snood1205 - not sure who is able to publish a new release? This is especially important because of the rubyzip security issue.

[snood1205]

@thbar I'm flattered, but I'm not a member of this team, I just PR'd that fix. You can use the bleeding-edge version with gem 'axlsx', git: 'https://github.com/randym/axlsx', branch: 'master' in your gemfile.

[fxfilmxf]

@randym any update on a new release?

[radar]

If there was an update don't you think he would've posted by now?

[thbar]

@radar I'm more wondering "what needs work for a new release / who & how could we help to do it", but not feeling entitled to anything 😄. My main concern is that some less zealous users, by default, will install axlsx with a vulnerable rubyzip by default. What can we do to make sure this doesn't happen?