[Snyk] Security upgrade cocoapods from 1.13.0 to 1.16.0

[pavelbe4solutions]

Snyk has created this PR to fix 5 vulnerabilities in the rubygems dependencies of this project.

Snyk changed the following file(s):

• Gemfile

⚠️ Warning

Failed to update the Gemfile.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-RUBY-REXML-7577227	666
	Improper Restriction of XML External Entity Reference ('XXE') SNYK-RUBY-REXML-7814166	624
	Denial of Service (DoS) SNYK-RUBY-REXML-7577228	559
	Uncontrolled Resource Consumption SNYK-RUBY-REXML-6861566	479
	Denial of Service (DoS) SNYK-RUBY-REXML-7462086	479

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled Resource Consumption

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"cocoapods","from":"1.13.0","to":"1.16.0"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-RUBY-REXML-6861566","priority_score":479,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Uncontrolled Resource Consumption"},{"exploit_maturity":"No Known Exploit","id":"SNYK-RUBY-REXML-7462086","priority_score":479,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-RUBY-REXML-7577227","priority_score":666,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.9","score":345},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"},{"exploit_maturity":"No Known Exploit","id":"SNYK-RUBY-REXML-7577228","priority_score":559,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.9","score":345},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Denial of Service (DoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-RUBY-REXML-7814166","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Restriction of XML External Entity Reference ('XXE')"}],"prId":"2cf6c795-c494-4586-8cb1-b7251fa0c446","prPublicId":"2cf6c795-c494-4586-8cb1-b7251fa0c446","packageManager":"rubygems","priorityScoreList":[479,479,666,559,624],"projectPublicId":"0d53aca4-774d-402b-9e1c-22fb9af85863","projectUrl":"https://app.snyk.io/org/pavelbe4solutions/project/0d53aca4-774d-402b-9e1c-22fb9af85863?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["updated-fix-title","pr-warning-shown","priorityScore"],"type":"auto","upgrade":["SNYK-RUBY-REXML-6861566","SNYK-RUBY-REXML-7462086","SNYK-RUBY-REXML-7577227","SNYK-RUBY-REXML-7577228","SNYK-RUBY-REXML-7814166"],"vulns":["SNYK-RUBY-REXML-6861566","SNYK-RUBY-REXML-7462086","SNYK-RUBY-REXML-7577227","SNYK-RUBY-REXML-7577228","SNYK-RUBY-REXML-7814166"],"patch":[],"isBreakingChange":false,"remediationStrategy":"vuln"}'

[dryrunsecurity]

DryRun Security Summary

The pull request updates the cocoapods gem version from ~> 1.13 to ~> 1.16, >= 1.16.0, and also updates other dependencies like activesupport, fastlane, and xcpretty, following best practices for Gemfile structure and Ruby version requirement.

Expand for full summary

Summary:

The code change in this pull request updates the version of the cocoapods gem from ~> 1.13 to ~> 1.16, >= 1.16.0. This is a minor version update, which typically includes new features, bug fixes, and potentially some breaking changes. As an application security engineer, it's important to review the release notes and change log for the new version to understand any security-related changes or fixes that may be relevant.

Additionally, the code change updates other dependencies, such as activesupport, fastlane, and xcpretty, to specific versions. Keeping dependencies up-to-date is a good practice to ensure the latest security patches and bug fixes are in place. However, it's also crucial to test the changes thoroughly to identify any potential compatibility issues or problems.

The Gemfile structure follows best practices, with the source set to "https://rubygems.org" and the use of the eval_gemfile method to load any additional plugins or dependencies from a separate Pluginfile. The Ruby version requirement is set to ">= 2.6.10", which is a good practice to ensure the application is running on a supported and secure version of Ruby.

Files Changed:

• Gemfile: The primary change in this file is the update of the cocoapods gem version from ~> 1.13 to ~> 1.16, >= 1.16.0. This is a minor version update that should be reviewed for any security-related changes or fixes. The code also updates the versions of other dependencies, such as activesupport, fastlane, and xcpretty, which is a good practice to keep the application secure and up-to-date. The Gemfile structure follows best practices, and the Ruby version requirement is set to a supported and secure version.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.