From 761a5261327238e2810103a6a2ab26bbe0f782b2 Mon Sep 17 00:00:00 2001 From: Tu2607 Date: Thu, 12 Nov 2026 06:19:21 +0000 Subject: [PATCH 1/2] (maint) Bump activesupport to 8.0.5.2 Addresses CVE-2026-126080 (GHSA-8474-xrp6-wh69), a possible DoS in ActiveSupport::Inflector#safe_constantize. Also resolves the older activesupport advisories fixed in 8.0.4.1 (CVE-2026-33176, CVE-2026-33169, CVE-2026-33170). activesupport is a transitive dependency (jira-ruby, github_changelog_generator); this is a patch-level lockfile bump only. Co-Authored-By: Claude Opus 5.5 --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 3b529ba..dc22990 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -51,7 +51,7 @@ GEM base64 nkf rexml - activesupport (8.0.2) + activesupport (8.0.5.2) base64 benchmark (>= 0.3) bigdecimal From 09368d292a290c80c7aec69ca2389d90901652d2 Mon Sep 17 00:00:00 2001 From: Tu2607 Date: Fri, 13 Nov 2026 18:19:10 +0000 Subject: [PATCH 2/2] (maint) Pin CI runners to ubuntu-24.04 ubuntu-latest now resolves to ubuntu-26.04, where the toolcache Ruby 3.2 cannot compile native extensions (io-event fails in extconf with "The compiler failed to generate an executable file"). Pin to the last known-good image until CI is moved to 26.04. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yaml | 2 +- .github/workflows/mend_ruby.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index dcab248..0bc067c 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -20,7 +20,7 @@ env: jobs: rspec: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 strategy: fail-fast: false matrix: diff --git a/.github/workflows/mend_ruby.yaml b/.github/workflows/mend_ruby.yaml index e44dfdc..d9ee74e 100644 --- a/.github/workflows/mend_ruby.yaml +++ b/.github/workflows/mend_ruby.yaml @@ -12,7 +12,7 @@ env: jobs: scan: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - name: Checkout repo uses: actions/checkout@v4