Skip to main content

Dependencies

TW Pro backend consists in multiple applications that use external gems as dependencies. The uala-core is a Rails engine that all the other application uses so some dependencies can be defined there.

Gems​

Dependencies definition​

When searching for dependencies definition, you should look at (in this order):

  1. application's Gemfile
  2. uala-core's gemspec file
  3. shared/*_dependencies.gemfile.rb files

Outdated dependencies​

To quickly find outdated dependencies, the bundle outdated command can help a lot, providing the full list of an application's dependencies with current and latest version.

Update dependencies​

Once a dependency needs to be updated, it can be updated with the usual bundle update {gem} (optionally with the --conservative option, to prevent updating {gem}'s dependencies as well), but when the dependency is used by more than one application, it's better to update it everywhere in order to keep the same version and to test the new version only once. This can help while doing that.

Vulnerabilities alerts​

GitHub has a built-in vulnerabilities alert system that is active in TW Pro backend repository.

image

Automated alerts are configurable in the personal GitHub profile in the notification settings page.

It also offers the Dependabot integration which can automatically open PRs for vulnerabilities fix. At the moment it's disabled since many applications are present and each dependency needs to be updated in all of them, not individually. The Dependabot settings page can provide more details on that and custom configuration is available in: :::code source="../../../.github/dependabot.yml" title=".github/dependabot.yml" :::

Rails update​

!ref Rails gem versions

Here you can find some tips that are helpful in the process of updating Rails gems. This project doesn't use the rails gem dependency directly, but only children gems that are used in different apps.

:::code source="../../../uala-core/uala-core.gemspec" title="uala-core/uala-core.gemspec" range="6-7" :::

How to (minor or patch versions)​

  1. First things first, read the CHANGELOG on rails gem sources to understand what's changed in a newer version
  2. Update the uala-core.gemspec file setting the new version
  3. Run bundle update over all applications passing the gem set (see this) (NOTE that in uala-admin, rails is a dependency so that need to be added to the bundle update command)
  4. Start test suite locally before pushing, to check that there are no major issues
  5. Wait for the CI to pass

!!!info Please note There are some monkey patch files in the project which are strictly linked to a Rails version. An exception is raised when the application start after Rails update, and this helps identifying those points, checking that the new version is the same or compatible, and if so, fix the check. !!!

Ruby update​

!ref Ruby releases

How to​

  1. install new Ruby version locally with your favorite package manager (rbenv, rvm, ...)
  2. update all references to old Ruby version to the new one (Gemfile, uala-core.gemspec, Dockerfile)
  3. new Ruby version may require an update for parser gem
  4. bundle the application to let all gems installation in new Ruby version
  5. ensure the application boots correctly (rails console, rspec, ...)
  6. push changes and let the CI/CD pipelines do all the checks needed