bundler-audit

bundle-audit check

Analyze Ruby dependencies with bundler-audit, detecting known vulnerabilities in the gems from the Gemfile.lock.

Run it in the pipeline of Ruby projects when you want dependency analysis: bundle-audit queries the vulnerability database (Ruby Advisory DB) against the gems in the Gemfile.lock and reports findings — gems with CVEs, severity, and the fix version. It's the reference SCA for Ruby: the pipeline check with the ecosystem's format. In Ruby DevSecOps, bundle-audit is the pipeline gate: a high-severity finding blocks the merge (use --update to refresh the database).

Don't use it as a complete analysis: bundle-audit covers gem advisories — code vulnerabilities (SAST, Brakeman 008) are out of scope. The database needs updating (bundle-audit update): new CVEs require the update. And note: bundle-audit detects by gem version — false positives from reachability need triage. For commercial SCA, use Snyk (019); bundle-audit is Ruby's native check.