Skip to content

Fix Dependabot vulnerabilities in Gemfile.lock - #19

Merged
monperrus merged 1 commit into
masterfrom
fix-dependabot-vulns
Oct 7, 2026
Merged

monperrus merged 1 commit into
masterfrom
fix-dependabot-vulns

Conversation

@monperrus

Copy link
Copy Markdown
Contributor

Fixes the 12 open Dependabot alerts (4 high, 6 moderate, 2 low), all in Gemfile.lock:

  • concurrent-ruby 1.2.3 → 1.3.8
  • webrick 1.8.1 → 1.9.2
  • rexml 3.2.6 → 3.4.4
  • google-protobuf 3.25.3 → 4.36.2 (pulls sass-embedded 1.69.5 → 1.105.1, jekyll-sass-converter 3.0.0 → 3.1.0)

Done with bundle update --conservative in ruby:3.3. The generated _site is byte-identical to master's build.

🤖 Generated with Claude Code

bundle update --conservative; sass-embedded/jekyll-sass-converter follow
because google-protobuf 3.25.3 has no patched 3.x on the sass-embedded path.
Built _site is byte-identical to master's.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@monperrus
monperrus merged commit f8acce3 into master Oct 7, 2026
2 checks passed
@monperrus
monperrus deleted the fix-dependabot-vulns branch October 7, 2026 05:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant