Ruby. Bundle is locked to json-canonicalization

Question

I'm trying to upgrade a Mastodon instance (from v4.0.2). I have no knowledge of ruby and I follow the instructions blindly. I have managed to update ruby to the latest version, but when I run bundle install I receive this message. how can I solve that?

$ bundle install
Fetching gem metadata from https://rubygems.org/.........
Your bundle is locked to json-canonicalization (0.3.2) from rubygems repository https://rubygems.org/ or installed
locally, but that version can no longer be found in that source. That means the author of json-canonicalization
(0.3.2) has removed it. You'll need to update your bundle to a version other than json-canonicalization (0.3.2) that
hasn't been removed in order to install.

Answer 1

Yesterday I tried also to upgrade from 4.1.9 to the 4.2.x branch. I planned to start with 4.2.0 and the going until current 4.2.3, but I got the same error and I'm not a Ruby expert at all.

At the end, I was able to upgrade to 4.2.3 without this error (I presume it was a old dependency that was bumped on 4.2.3) using the guide from 4.2.0 (bundle install, yarm whatever, database updagre and so on).

I saw there was few differences betweeen 4.2.0 and 4.2.3 so I went for it. Everything looks good one day later.

Answer 2

This error may cause widespread problems just now as people upgrade from previous minor releases because of the critical security flaw that needs a patch applied as soon as possible and in any case before 14 Feb 2024. If the upgrade path involves 4.2.0 to get to 4.2.5, this error is likely to be encountered.

My solution when installing 4.2.0 was simply to change the version number of json-canonicalization to 0.3.3 (which is currently still available) in Gemfile.lock. This eliminates the error, but does produce a warning that you need to git commit before the next upgrade, which is harmless.

It's probably possible to upgrade directly to 4.2.5 from 4.1.x, saving time and avoiding this error, provided

• Ruby is upgraded to 3.2.3 per the Mastodon 4.2.4 release notes.
• The two db:migrate commands are run per the Mastodon.4.2.0 release notes.