name "remove-old-gems"
default_version "1.0.0"

license :project_license
skip_transitive_dependency_licensing true

build do
  block "Removing old versions of rexml < 3.4.2" do
    gembin = "#{install_dir}/embedded/bin/gem"

    next unless File.exist?(gembin)

    puts "Removing old versions of rexml < 3.4.2"
    env = with_standard_compiler_flags(with_embedded_path)

    # remove [-a] all rexml < 3.4.2 and [-I] ignore dependencies
    # Note: We do NOT use -x flag to avoid removing executables/binstubs
    command "#{gembin} uninstall rexml -v \"<3.4.2\" -a -I", env: env
  end

  block "Removing old versions of net-imap < 0.6" do
    gembin = "#{install_dir}/embedded/bin/gem"

    next unless File.exist?(gembin)

    puts "Removing old versions of net-imap < 0.6"
    env = with_standard_compiler_flags(with_embedded_path)

    # remove [-a] all net-imap < 0.6 and [-I] ignore dependencies. The bundle
    # resolves net-imap to 0.6.x; a stale 0.5.x left in the embedded gem dir
    # otherwise lingers and trips the CVE scanners.
    # CVEs: GHSA-j3g3-5qv5-52mj (<0.2.5); GHSA-75xq-5h9v-w6px /
    #   GHSA-vcgp-9326-pqcp / GHSA-hm49-wcqc-g2xg / GHSA-87pf-fpwv-p7m7 (<0.5.14);
    #   GHSA-46q3-7gv7-qmgg / GHSA-8p34-64r3-mwg8 / GHSA-c4fp-cxrr-mj66 (<0.5.15)
    # Note: We do NOT use -x flag to avoid removing executables/binstubs
    command "#{gembin} uninstall net-imap -v \"<0.6\" -a -I", env: env
  end
end
