Bump nokogiri and oj to fix 16 security findings#111
Open
sbhuiyan-r7 wants to merge 1 commit into
Open
Conversation
Fixes 12 High severity DefectHub findings (161838-161849) expiring Jul 24 plus expired Medium finding 16722 (nokogiri 1.13.9, May 26): - nokogiri: XXE Injection, Use After Free - oj: Multiple Use After Free, Stack-Based Buffer Overflow, Integer Overflow, Heap-Based Buffer Overflow, Out-of-Bounds Write Added bigdecimal as new transitive dependency required by oj >= 3.17. Supersedes Dependabot PR #110 which only covers oj. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
sbhuiyan-r7
changed the title
atwaddle-r7
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Remediation
Addresses all 16 active DefectHub findings for this repo (12 High + 4 Medium) by bumping nokogiri and oj:
nokogiri 1.18.10 → 1.19.4
oj 3.13.21 → 3.17.3
Changes
nokogiribumped from 1.18.10 to 1.19.4 (deps unchanged: mini_portile2 ~> 2.8.2, racc ~> 1.4)ojbumped from 3.13.21 to 3.17.3 (adds bigdecimal >= 3.0 as new runtime dep)bigdecimal (4.1.2)as transitive dependencyCompatibility
nokogiriandojdependencies — no constraint conflicts