TechPrufer
Sign inGet started

Blogs›Shopify›Deprecation Management Toolkit

Deprecation Management Toolkit

Deprecation Management Toolkit

2
posts
2018–2022

Shopify has developed and enhanced its tools and strategies for managing code deprecations. Initial efforts focused on preventing developers from accidentally using deprecated code and addressing the challenges of complex dependency upgrades. The Deprecation Toolkit was introduced as an open-source Ruby gem that uses a whitelist approach to track and manage deprecations. It allows for gradual fixing of existing deprecations while enforcing stricter rules for new ones. This post details the iterative development of tooling to address the dependency confusion vulnerability in over 600 Ruby applications, including a Bundler plugin to automate lockfile migrations and a CLI tool built on the CI system for large-scale migration. The team also collaborated with the Bundler and Heroku Buildpack teams to address broader community issues and prevent future vulnerabilities by ensuring correct Bundler versions are used in local development and CI.

2022

Fixing the Dependency Confusion Vulnerability in 600+ Ruby Apps - Shopify

1/27/2022

This post details the development of a Bundler plugin to automate the migration of `Gemfile.lock` files to a newer format without updating gem versions, addressing the dependency confusion vulnerability. It also describes the creation of a CLI tool on top of the CI system to manage large-scale migrations, including environment setup, command execution, and pull request creation. The post highlights collaboration with the Heroku Buildpack team to update their Ruby buildpack and with the Bundler team to improve lockfile regeneration capabilities. Finally, it outlines measures to prevent future vulnerabilities by enforcing the recommended Bundler version in local development and CI.

2018

Introducing the Deprecation Toolkit - Shopify

9/19/2018

Introduced the open-source Deprecation Toolkit, a Ruby gem designed to manage code deprecations. The toolkit uses a whitelist approach to track acceptable deprecations by recording them during test runs. It then compares subsequent deprecation triggers against this whitelist, raising errors for new or removed deprecations by default. This allows for gradual fixing of existing deprecations while preventing the introduction of new ones, facilitating dependency upgrades and improving codebase health.