Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vendor data present #7

Open
mensfeld opened this issue May 28, 2021 · 0 comments
Open

Vendor data present #7

mensfeld opened this issue May 28, 2021 · 0 comments

Comments

@mensfeld
Copy link

Hey there,

My name is Maciej Mensfeld and I run security & quality assessment for OSS libraries using WhiteSource Diffend.io.

While reviewing the changes for this lib, I noticed, that the vendor directory is being included.

Is this needed? Usually, it's added by mistake and causes:

a) confusion
b) problems when tracking changes
c) extensive library size

ref: https://my.diffend.io/gems/rfix/2.0.4/3.0.0/page/4#d2h-911935

It seems (at least in 3.0.0 that out of all vendor packages at least dry-cli and strings-ansi are declared as dependencies in the gemspec.

If the presence of vendor data is valid I would love the reasoning. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant