Fix remaining Dependabot security alerts#2803
Merged
Conversation
- **Rails example**: Upgrade Rails 7.1.5 → 7.2.3, rack 2.2.14 → 3.2.5, nokogiri 1.18.9 → 1.19.2 (fixes Active Storage path traversal, Rack directory traversal, Active Support ReDoS/DoS/XSS, Action View XSS, and Active Storage glob injection/DoS/content type bypass) - **Django example**: Update sqlparse 0.5.0 → 0.5.3 (DoS fix) - **VS Code extension**: Add flatted resolution → 3.4.2 (prototype pollution fix) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The regenerated Gemfile.lock had BUNDLED WITH 2.6.9 and RUBY VERSION 3.4.4, but the Nix devbox.json pins bundler@2.5 and ruby@3.3. Bundler 2.5.5 refuses to run when the lockfile requires ~> 2.6, causing the stacks_rails_run_test CI job to fail. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
savil
approved these changes
Mar 25, 2026
The Rails 7.2 upgrade broke CI because rack 3.x requires config changes incompatible with the 7.1-era blog app. Instead, update within the 7.1.x line: - Rails 7.1.5.2 → 7.1.6 (latest security patches) - Rack 2.2.14 → 2.2.22 (fixes CVE-2025-27610 directory traversal) - Nokogiri 1.18.9 → 1.19.2 - Pin rack to ~> 2.2.15 to prevent accidental rack 3 resolution - Match BUNDLED WITH (2.5.5) and RUBY VERSION (3.3.0) to Nix env Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The Rails 7.2.3 upgrade pulls in psych 5.3.1 which requires yaml.h headers to build its native extension. Adding libyaml with dev output makes the headers available in the Devbox environment.
… mikeland73/fix-lint-issues
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan
go build ./...still passes (no Go changes, but confirmed)🤖 Generated with Claude Code