Duplicate vulnerabilities reported for gems that have multiple arch specs on the lockfile

[jrodriigues]

Description

Steps To Reproduce

In a fresh directory:

1. $ bundle init
2. $ bundle add nokogiri --version 1.19.3
3. $ bundler-audit check --update

Expected Behavior

nokogiri 1.19.4 fixed 9 security advisories, even though only 8 seem to be registered in the database (GHSA-g9g8-vgvw-g3vf is not showing).
The output of bundler-audit check should print 8 vulnerabilities, one for each database entry.

Actual Behaviour

The output of bundler-audit check prints 64 vulnerabilities.
This can be confirmed by running:

$ irb -r bundler/audit/scanner/

scanner = Bundler::Audit::Scanner.new
scanner.report.advisories.length
=> 64

The reason for this behaviour is because scanner.lockfile.specs contains a spec for each arch of nokogiri registered in the lockfile. In my case:

scanner.lockfile.specs
=>
[#<Bundler::LazySpecification @name="nokogiri" (1.19.3-aarch64-linux-gnu)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-aarch64-linux-musl)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-arm-linux-gnu)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-arm-linux-musl)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-arm64-darwin)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-x86_64-darwin)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-x86_64-linux-gnu)>,
 #<Bundler::LazySpecification @name="nokogiri" (1.19.3-x86_64-linux-musl)>,
 #<Bundler::LazySpecification @name="racc" (1.8.1)>]

So each vulnerability on the database is declared once for each nokogiri spec.

Environment

$ bundler-audit --version
bundler-audit 0.9.3

$ bundle --version
4.0.14

$ ruby --version
ruby 3.3.11 (2026-03-26 revision 1f2d15125a) [x86_64-linux]

$ git --version
git version 2.34.1

[jasnow]

@jrodriigues - Regarding the missing advisory: GHSA-g9g8-vgvw-g3vf, it iis on the project's security page but not yet in GHSA.

[jasnow]

Update:

1. GHSA-g9g8-vgvw-g3vf will be worked over in rubysec/ruby-advisory-db repo.
2. NOTE that https://rubygems.org/gems/nokogiri/versions/1.19.4 has multiple versions so "bundle audit" is getting its input from bundler, so we are going to mark this as an enhancement.

[jrodriigues]

That makes sense, I originally marked it as a bug because I wasn't sure if bundle audit is meant to rely fully on bundler's output or not.
Let me know if you would like me to open a PR for this, or if you are going to push something yourself.

[jasnow]

Let me know if you would like me to open a PR for this, or if you are going to push something yourself.

I am more on the ruby-advisory-db side so I will let others respond to your offer.