Bump json to 2.20.0 (CVE-2026-54696)

Fixes a heap buffer overflow in the JSON generator when streaming an oversized object to an IO (JSON.dump(obj, io) / JSON::State#generate). Affects json 2.9.0-2.19.8; patched in 2.19.9. Bumps to the current 2.20.0 line via `bundle update json --conservative` (lockfile-only). GHSA-x2f5-4prf-w687 / https://nvd.nist.gov/vuln/detail/CVE-2026-54696 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Update brakeman
2026-10-29 17:04:04 +09:00 · 2026-07-06 10:09:20 +02:00 · 2026-06-29 14:35:42 +02:00 · 2026-06-29 14:35:42 +02:00 · 2026-06-29 13:32:23 +02:00 · 2026-06-29 13:32:14 +02:00
1 changed files with 11 additions and 11 deletions
@@ -137,7 +137,7 @@ GEM
    bcrypt (3.1.22)
    benchmark (0.5.0)
    bigdecimal (3.3.1)
-    brakeman (8.0.4)
+    brakeman (8.0.5)
      racc
    builder (3.3.0)
    bundler-audit (0.9.3)
@@ -153,13 +153,13 @@ GEM
      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
    chunky_png (1.4.0)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.7)
    connection_pool (2.5.5)
    crack (1.0.0)
      bigdecimal
      rexml
-    crass (1.0.6)
-    date (3.5.0)
+    crass (1.0.7)
+    date (3.5.1)
    debug (1.11.0)
      irb (~> 1.10)
      reline (>= 0.3.8)
@@ -191,7 +191,7 @@ GEM
    jbuilder (2.14.1)
      actionview (>= 7.0.0)
      activesupport (>= 7.0.0)
-    json (2.13.2)
+    json (2.20.0)
    jwt (3.2.0)
      base64
    kredis (1.8.0)
@@ -224,7 +224,7 @@ GEM
      ruby2_keywords (~> 0.0.1)
    net-http-persistent (4.0.6)
      connection_pool (~> 2.2, >= 2.2.4)
-    net-imap (0.6.4)
+    net-imap (0.6.4.1)
      date
      net-protocol
    net-pop (0.1.2)
@@ -234,13 +234,13 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.19.3-aarch64-linux-gnu)
+    nokogiri (1.19.4-aarch64-linux-gnu)
      racc (~> 1.4)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-darwin)
+    nokogiri (1.19.4-x86_64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
    openssl (3.3.0)
    ostruct (0.6.3)
@@ -380,7 +380,7 @@ GEM
    thruster (0.1.15-x86_64-darwin)
    thruster (0.1.15-x86_64-linux)
    tilt (2.6.1)
-    timeout (0.4.4)
+    timeout (0.6.1)
    tsort (0.2.0)
    tzinfo (2.0.6)
      concurrent-ruby (~> 1.0)
Author	SHA1	Message	Date
Rosa GutierrezandClaude Opus 4.8	9ebc47a8f0	Bump json to 2.20.0 (CVE-2026-54696) Fixes a heap buffer overflow in the JSON generator when streaming an oversized object to an IO (JSON.dump(obj, io) / JSON::State#generate). Affects json 2.9.0-2.19.8; patched in 2.19.9. Bumps to the current 2.20.0 line via `bundle update json --conservative` (lockfile-only). GHSA-x2f5-4prf-w687 / https://nvd.nist.gov/vuln/detail/CVE-2026-54696 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-06 10:09:20 +02:00
Rosa Gutierrez	962c48af13	Update `brakeman`	2026-06-29 14:35:42 +02:00
Rosa GutierrezandClaude Opus 4.8	0920ceab6b	Upgrade crass to 1.0.7 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-29 14:35:42 +02:00
dependabot[bot]	12bb943af8	Bump concurrent-ruby from 1.3.5 to 1.3.7 Bumps [concurrent-ruby](https://github.com/ruby-concurrency/concurrent-ruby) from 1.3.5 to 1.3.7. - [Release notes](https://github.com/ruby-concurrency/concurrent-ruby/releases) - [Changelog](https://github.com/ruby-concurrency/concurrent-ruby/blob/master/CHANGELOG.md) - [Commits](https://github.com/ruby-concurrency/concurrent-ruby/compare/v1.3.5...v1.3.7) --- updated-dependencies: - dependency-name: concurrent-ruby dependency-version: 1.3.7 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 13:32:23 +02:00
dependabot[bot]	e4f88b425a	Bump nokogiri from 1.19.3 to 1.19.4 Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.19.3 to 1.19.4. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.19.3...v1.19.4) --- updated-dependencies: - dependency-name: nokogiri dependency-version: 1.19.4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 13:32:14 +02:00
dependabot[bot]	bfa9f66633	Bump net-imap from 0.6.4 to 0.6.4.1 Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.4 to 0.6.4.1. - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](https://github.com/ruby/net-imap/compare/v0.6.4...v0.6.4.1) --- updated-dependencies: - dependency-name: net-imap dependency-version: 0.6.4.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2026-06-29 13:31:57 +02:00