From 25d08f24a120d1fffe2bc135936d1c6d8b9a6962 Mon Sep 17 00:00:00 2001
From: Minerva Sky <258328972+minerva-sky@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:06:57 -0400
Subject: [PATCH 1/3] fix: bump addressable 2.8.7 -> 2.9.0 (CVE-2026-35611)

---
 Gemfile.lock | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index d2e50be..1d54dd5 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -21,8 +21,8 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.2)
     async (2.24.0)
       console (~> 1.29)
@@ -73,8 +73,8 @@ GEM
     faraday (2.11.0)
       faraday-net_http (>= 2.0, < 3.4)
       logger
-    faraday-multipart (1.0.4)
-      multipart-post (~> 2)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
     faraday-net_http (3.3.0)
       net-http
     fiber-annotation (0.2.0)
@@ -140,7 +140,7 @@ GEM
     rubocop-performance (1.19.1)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
-    ruby-openai (7.1.0)
+    ruby-openai (8.3.0)
       event_stream_parser (>= 0.3.0, < 2.0.0)
       faraday (>= 1)
       faraday-multipart (>= 1)

From 1b5195ef7bfc0dad06597853630e89f9438ce07e Mon Sep 17 00:00:00 2001
From: Minerva Sky <258328972+minerva-sky@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:08:15 -0400
Subject: [PATCH 2/3] fix: bump concurrent-ruby 1.3.4 -> 1.3.7 (CVE-2026-54904,
 CVE-2026-54905)

---
 Gemfile.lock | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 1d54dd5..de316b0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -33,7 +33,7 @@ GEM
     base64 (0.2.0)
     bigdecimal (3.1.8)
     cgi (0.5.2)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.8)
     console (1.30.2)
       fiber-annotation
       fiber-local (~> 1.1)

From 2b51398c141bb38b10aa92dcf0c7427bcf944341 Mon Sep 17 00:00:00 2001
From: Minerva Sky <258328972+minerva-sky@users.noreply.github.com>
Date: Wed, 2 Sep 2026 14:10:29 -0400
Subject: [PATCH 3/3] fix: bump faraday, rexml, uri (remaining bundler-audit
 CVEs)

---
 Gemfile.lock | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index de316b0..7a83df0 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -70,8 +70,9 @@ GEM
       dry-logic (~> 1.4)
       zeitwerk (~> 2.6)
     event_stream_parser (1.0.0)
-    faraday (2.11.0)
-      faraday-net_http (>= 2.0, < 3.4)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
       logger
     faraday-multipart (1.2.0)
       multipart-post (~> 2.0)
@@ -105,8 +106,7 @@ GEM
     rainbow (3.1.1)
     rake (13.2.1)
     regexp_parser (2.8.3)
-    rexml (3.3.1)
-      strscan
+    rexml (3.4.4)
     rgl (0.6.7)
       pairing_heap (>= 0.3, < 4.0)
       rexml (~> 3.2, >= 3.2.4)
@@ -164,7 +164,6 @@ GEM
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
-    strscan (3.1.0)
     thor (1.3.2)
     timecop (0.9.10)
     traces (0.15.2)
@@ -188,7 +187,7 @@ GEM
       tty-screen (~> 0.8)
     unicode-display_width (2.5.0)
     unicode_utils (1.4.0)
-    uri (0.13.1)
+    uri (1.1.1)
     vcr (6.3.1)
       base64
     webmock (3.23.1)