[opensourcedex]

bundler-audit is a free, open source threat detection & response project written in Ruby and released under GPL-3.0. It has 2,759 GitHub stars, 247 forks and 49 open issues, and was last pushed 41 hours ago. On this registry it ranks #17 of 18 tracked projects in Threat Detection & Response, with 5 head-to-head comparisons available.

What is bundler-audit?

bundler-audit is a command-line security scanner that checks a Ruby project's Gemfile.lock for known-vulnerable gem versions and insecure gem sources, built for Ruby developers and CI pipelines that need patch-level verification of the gems they ship.

What it is

bundler-audit is a Ruby security tool that performs patch-level verification for Bundler. It reads a project's Gemfile.lock, compares the resolved gem versions against a database of known advisories, and reports which entries are vulnerable, at what criticality, and which version ranges would resolve the problem. It also checks for insecure gem sources, meaning sources declared with http:// or git:// rather than a secure transport. The project lives in the Ruby and Bundler ecosystem and is published as a gem, with its source hosted under the rubysec organisation.

The concrete problem it solves is that a lockfile pins exact versions, but nothing in the ordinary Bundler workflow tells you whether those pinned versions carry published vulnerabilities. Without tooling, that check is a manual exercise in cross-referencing every gem version against security announcements. bundler-audit replaces that manual cross-referencing with a single command that exits with a failure status when unpatched versions are found, which is what makes it usable as a gate rather than a report. Its advisory data comes from ruby-advisory-db, a separate repository that the tool can fetch and update on demand, and it is able to run the audit itself without a network connection once that data is present.

Key capabilities

  • Checks for vulnerable versions of gems recorded in Gemfile.lock, printing name, version, advisory identifier, criticality, URL, title, and the suggested upgrade range for each finding.
  • Checks for insecure gem sources, specifically http:// and git:// entries.
  • Refreshes its advisory data with bundle-audit update, which pulls the ruby-advisory-db repository and reports the number of advisories loaded.
  • Combines the two steps for CI with bundle-audit check --update, or skips the fetch with bundle-audit check --no-update.
  • Ignores specific advisories that have been manually worked around, using bundle-audit check --ignore OSVDB-108664.
  • Audits a non-default lockfile through bundle-audit check --gemfile-lock Gemfile.custom.lock.
  • Emits machine-readable results with bundle-audit check --format json, optionally written to a file with --output bundle-audit.json.
  • Runs without a network connection when the advisory database is already present locally.

Who uses it and how

  • CI pipelines run bundle-audit check --update so that each build refreshes the advisory database before deciding whether the lockfile is clean.
  • Teams that cannot reach the network during builds run the audit offline against a previously fetched ruby-advisory-db.
  • Projects that have accepted a known finding, or applied an out-of-band fix, record the advisory identifier with --ignore so the build stays green without losing visibility of other findings.
  • Repositories with more than one lockfile, such as Gemfile.custom.lock, audit each one explicitly with --gemfile-lock.
  • Automation consumes --format json output, written with --output bundle-audit.json, to feed dashboards or ticket creation instead of parsing console text.

Getting started

bundler-audit ships as the Ruby gem bundler-audit and is run from the command line as bundle-audit; the README's own workflow is to update the advisory database with bundle-audit update and then audit the project with bundle-audit check, or to do both at once with bundle-audit check --update.

How it compares

The facts name no competing products and no paid alternatives that this project replaces, and they name no similar security scanners. Within this registry it stands alone as a Bundler-specific patch-level verification tool.

When to use it — and when not to

Use it when the project is Ruby and dependency versions are pinned in a Gemfile.lock, and especially when the audit needs to gate a CI run or execute offline. A self-hoster or CI operator must arrange the advisory data themselves, either by allowing bundle-audit update to fetch ruby-advisory-db or by keeping a local copy fresh, because an outdated database produces false negatives rather than errors. It is the wrong tool for non-Ruby dependency trees, and teams that want hosted dashboards, automated upgrade pull requests, or per-advisory triage beyond an ignore list will need something else alongside it; the README provided here is also thin, ending mid-section after a Rake Tasks heading, so expect to consult the homepage and documentation for integration details beyond the command-line synopsis.

project readme (upstream, from github) — read inline

bundler-audit

CI Gem Version

Description

Patch-level verification for bundler.

Features

  • Checks for vulnerable versions of gems in Gemfile.lock.
  • Checks for insecure gem sources (http:// and git://).
  • Allows ignoring certain advisories that have been manually worked around.
  • Prints advisory information.
  • Does not require a network connection.

Synopsis

Audit a project's Gemfile.lock:

$ bundle-audit
Name: actionpack
Version: 3.2.10
Advisory: OSVDB-91452
Criticality: Medium
URL: http://www.osvdb.org/show/osvdb/91452
Title: XSS vulnerability in sanitize_css in Action Pack
Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13

Name: actionpack
Version: 3.2.10
Advisory: OSVDB-91454
Criticality: Medium
URL: http://osvdb.org/show/osvdb/91454
Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13

Name: actionpack
Version: 3.2.10
Advisory: OSVDB-89026
Criticality: High
URL: http://osvdb.org/show/osvdb/89026
Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11

Name: activerecord
Version: 3.2.10
Advisory: OSVDB-91453
Criticality: High
URL: http://osvdb.org/show/osvdb/91453
Title: Symbol DoS vulnerability in Active Record
Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13

Name: activerecord
Version: 3.2.10
Advisory: OSVDB-90072
Criticality: Medium
URL: http://direct.osvdb.org/show/osvdb/90072
Title: Ruby on Rails Active Record attr_protected Method Bypass
Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12

Name: activerecord
Version: 3.2.10
Advisory: OSVDB-89025
Criticality: High
URL: http://osvdb.org/show/osvdb/89025
Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11

Name: activesupport
Version: 3.2.10
Advisory: OSVDB-91451
Criticality: High
URL: http://www.osvdb.org/show/osvdb/91451
Title: XML Parsing Vulnerability affecting JRuby users
Solution: update to ~> 3.1.12, >= 3.2.13

Unpatched versions found!

Update the ruby-advisory-db that bundle audit uses:

$ bundle-audit update
Updating ruby-advisory-db ...
remote: Counting objects: 44, done.
remote: Compressing objects: 100% (24/24), done.
remote: Total 39 (delta 19), reused 29 (delta 10)
Unpacking objects: 100% (39/39), done.
From https://github.com/rubysec/ruby-advisory-db
 * branch            master     -> FETCH_HEAD
Updating 5f8225e..328ca86
Fast-forward
 CONTRIBUTORS.md                    |  1 +
 gems/actionmailer/OSVDB-98629.yml  | 17 +++++++++++++++++
 gems/cocaine/OSVDB-98835.yml       | 15 +++++++++++++++
 gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
 gems/sounder/OSVDB-96278.yml       | 13 +++++++++++++
 gems/wicked/OSVDB-98270.yml        | 14 ++++++++++++++
 6 files changed, 73 insertions(+)
 create mode 100644 gems/actionmailer/OSVDB-98629.yml
 create mode 100644 gems/cocaine/OSVDB-98835.yml
 create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
 create mode 100644 gems/sounder/OSVDB-96278.yml
 create mode 100644 gems/wicked/OSVDB-98270.yml
ruby-advisory-db: 64 advisories

Update the ruby-advisory-db and check Gemfile.lock (useful for CI runs):

$ bundle-audit check --update

Checking the Gemfile.lock without updating the ruby-advisory-db:

$ bundle-audit check --no-update

Ignore specific advisories:

$ bundle-audit check --ignore OSVDB-108664

Checking a custom Gemfile.lock file:

$ bundle-audit check --gemfile-lock Gemfile.custom.lock

Output the audit's results in JSON:

$ bundle-audit check --format json

Output the audit's results in JSON, to a file:

$ bundle-audit check --format json --output bundle-audit.json

Rake Tasks

Bundler-audit provides rake tasks for checking the code and for updating its vulnerability database.

Simply add the following code to the Rakefile:

require 'bundler/audit/task'
Bundler::Audit::Task.new

The following rake tasks will then become available:

$ rake -T
rake bundle:audit
rake bundle:audit:update

Configuration File

bundler-audit also supports a per-project configuration file:

.bundler-audit.yml:

---
ignore:
  - CVE-YYYY-XXXX
  - ...
  • ignore: [Array\] - A list of advisory IDs to ignore.

You can provide a path to a config file using the --config flag:

$ bundle-audit check --config bundler-audit.custom.yaml

Requirements

Install

$ [sudo] gem install bundler-audit

Git

  • Debian / Ubuntu:
$ sudo apt install git
  • RedHat / Fedora:
$ sudo dnf install git
  • Alpine Linux:
$ apk add git
  • macOS:
$ brew install git

Contributing

  1. https://github.com/rubysec/bundler-audit/fork
  2. git clone YOUR_FORK_URI
  3. cd bundler-audit/
  4. bundle install
  5. bundle exec rake spec
  6. git checkout -b YOUR_FEATURE
  7. Make your changes
  8. bundle exec rake spec
  9. git commit -a
  10. git push origin YOUR_FEATURE

Policy on Generative AI Contributions

To safeguard project security and respect our maintainers' volunteer time, a human-in-the-loop is strictly required for all submissions. While AI tools are permitted as assistants, contributors must personally review, understand, and take full responsibility for their work. Any contributions that appear to be unreviewed machine output will be closed immediately, and repeat offenders will be banned from the project and reported.

License

Copyright (c) 2013-2026 Hal Brodigan (postmodern.mod3 at gmail.com)

bundler-audit is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

bundler-audit is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with bundler-audit. If not, see .

Frequently asked questions

Is bundler-audit free to use?

bundler-audit is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does bundler-audit do?

Patch-level verification for Bundler

What is bundler-audit written in?

bundler-audit is primarily written in Ruby. Its source is publicly available at https://github.com/rubysec/bundler-audit, and it has 2,759 GitHub stars.