From 9466d2c2c366b230dbd1f5c36f77b9a42c96531a Mon Sep 17 00:00:00 2001 From: Jose Diaz-Gonzalez Date: Sun, 2 Aug 2026 03:06:21 -0400 Subject: [PATCH] chore(deps): bump json from 2.15.2.1 to 2.21.2 in /.github Resolves Dependabot alert 9 (GHSA-x2f5-4prf-w687 / CVE-2026-54696), a low-severity heap buffer overflow in the json gem's IO-streaming generator path. The gem is a transitive dependency of `package_cloud` used only by the CI release tooling, and 2.21.2 satisfies the existing `json (~> 2.9)` constraint. --- .github/Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/Gemfile.lock b/.github/Gemfile.lock index fea274a..fece9bd 100644 --- a/.github/Gemfile.lock +++ b/.github/Gemfile.lock @@ -21,7 +21,7 @@ GEM http-cookie (1.1.0) domain_name (~> 0.5) insist (1.0.0) - json (2.15.2.1) + json (2.21.2) logger (1.7.0) mime-types (3.7.0) logger