Bump nokogiri from 1.16.2 to 1.19.4 - #761
Merged
Merged
Conversation
Fixes SEC-67393: resolves multiple Snyk-reported vulnerabilities (including CVE-2025-49794, CVE-2024-55549, CVE-2024-34459) in the transitive nokogiri dependency pulled in via slather.
- SwiftLint job: install swiftlint via brew before linting (the macos-latest
runner no longer bundles it), which surfaced 4 real attribute_name_spacing
errors in OfflineConnections.swift that were silently never caught before.
- Setup action: bump ruby/setup-ruby to v1.321.0 (from an outdated pinned
SHA) so it recognizes the runner's current system Ruby (3.4.10) as an
installable version, fixing the pod-lint and test jobs.
Bundler 2.1.4 is incompatible with Ruby 3.4 (removed DidYouMean::SPELL_CHECKERS), which the CI runner now installs after the ruby/setup-ruby version fix.
Xcode 14.1 is no longer available on any GitHub-hosted macOS runner image (oldest available is 15.0.1 on the deprecated macos-14 image); macos-latest now defaults to Xcode 16.4.
The pinned SHA predated Xcode 16 entirely, so it couldn't recognize
Xcode 16.4 as installed on the runner ("No Xcode ~> >=16.4.0 <16.5.0-0").
Also replaces the floating v2 tag in the test action with a pinned SHA,
matching this repo's action-pinning convention.
macos-latest now resolves to macos-26-arm64, which only carries Xcode 26.0.1-26.6; Xcode 16.4 doesn't exist on this runner image either.
NandanPrabhu
commented
Aug 12, 2026
pmathew92
previously approved these changes
Aug 12, 2026
pmathew92
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
nokogirifrom 1.16.2 to 1.19.4 (with transitivemini_portile2andraccbumps) inGemfile.lock, resolving the Snyk-reported vulnerabilitiesTest plan
bundle checkconfirms the Gemfile's dependencies are satisfiedgit diffonGemfile.lockshows only the expected version bumps (nokogiri, mini_portile2, racc)