Skip to content

v1.0.2 — dev-dependency security bump (json), housekeeping

Choose a tag to compare

View all tags
@ncr ncr released this 01 Sep 21:40
· 6 commits to master since this release
v1.0.2
dbb0d26
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Housekeeping — no library behavior changes. No action is needed by users:
the shipped gem does not depend on json and was never affected by the
advisory below.

Security

  • Development dependency json bumped 2.21.1 → 2.21.2 to clear
    CVE-2026-71847 / GHSA-9hj4-r449-hfvc (JSON::ResumableParser#partial_value
    dereferences a freed input buffer on truncated duplicate-key streams).
    json reaches this repo only transitively (standard → rubocop → json)
    and lives solely in the development Gemfile.lock; the bump keeps the CI
    bundler-audit gate green. (#143)

Changed

  • Release workflow: the laggy rubygems full-index await was replaced with a
    versions-API check, so a successful publish no longer fails the run. (#142)

Full diff: v1.0.1...v1.0.2

Assets 2
Loading