# SPDX-License-Identifier: GPL-3.0-only
# SPDX-FileCopyrightText: 2026 OpenVox MCP Server Contributors
# frozen_string_literal: true

source 'https://rubygems.org'

gemspec

# Security: json < 2.19.9 has heap buffer overflow in streaming IO (CVE-2026-54696, CVE-2026-33210)
gem 'json', '>= 2.19.9'

# Security: rack < 3.2.6 has multiple CVEs (CVE-2026-26961 etc.)
gem 'rack', '>= 3.2.6'

# Security: jwt < 2.10.3 has empty-key HMAC bypass (CVE-2026-45363)
gem 'jwt', '>= 2.10.3'

# Security: activesupport < 7.2.3.1 has ReDoS/XSS/DoS (CVE-2026-33169 etc.)
gem 'activesupport', '>= 7.2.3.1'

# Security: concurrent-ruby < 1.3.7 has threading bugs (CVE-2026-54904/54905/54906)
gem 'concurrent-ruby', '>= 1.3.7'

# Security: erb < 6.0.4 has deserialization guard bypass (CVE-2026-41316)
gem 'erb', '>= 6.0.4'

group :development, :test do
  # Plugin gems — local path for co-development, skipped in CI.
  # For cross-repo work: bundle config local.openvox-mcp-puppet /path/to/checkout
  # Release-time packaging deferred to roadmap (see design/issues/031).
  gem 'openvox-mcp-puppet', path: '../openvox-mcp-puppet' if File.directory?('../openvox-mcp-puppet')

  # Build automation
  gem 'rake', '~> 13.0'

  # Testing
  gem 'rack-test', '~> 2.1'
  gem 'rspec', '~> 3.13'
  gem 'rspec_junit_formatter', '~> 0.6'
  gem 'simplecov', '~> 0.22'
  gem 'simplecov-cobertura', '~> 2.1'

  # Mutation testing - especially valuable for AI-generated code
  gem 'mutant-rspec', '~> 0.12'

  # License compliance
  gem 'license_finder', '~> 7.2'

  # Code quality
  gem 'flay', '~> 2.13'
  gem 'reek', '~> 6.3'
  gem 'rubocop', '~> 1.71'
  gem 'rubocop-rspec', '~> 3.3'

  # Documentation
  gem 'yard', '~> 0.9'

  # Security scanning
  gem 'bundler-audit', '~> 0.9'
  gem 'ruby_audit', '~> 3.1'

  # Git hooks
  gem 'mdl', '~> 0.17'
  gem 'overcommit', '~> 0.64'

  # Integration testing (packaging verification)
  # Pinned: kitchen-vagrant 2.x+ requires Vagrant 2.4+ (BSL-licensed).
  # We use Vagrant 2.3.6 (last MPL-2.0 release).
  # Security: kitchen-inspec 3.1 + inspec-core >= 7.0 fixes CVE-2026-25765 + CVE-2026-54297.
  # inspec-core 7.x unlocks faraday >= 1 (vs 4.x's faraday < 1.4 constraint).
  # inspec-core sourced from Cinc (Apache-2.0 rebuild of InSpec) to avoid Chef EULA.
  # Ruby 3.4 stdlib extractions inspec-core needs (removed from 3.4 default gems)
  gem 'base64'
  gem 'mutex_m'
  gem 'nkf'
  source 'https://rubygems.cinc.sh' do
    gem 'inspec-core', '~> 7.0'
  end
  gem 'kitchen-inspec', '~> 3.1'
  gem 'kitchen-vagrant', '~> 1.14'
  gem 'test-kitchen', '~> 3.6'
end
