Skip to content

Bump gem CVE floors unlocked by Ruby 3.0 - #1537

Open
benrfairless wants to merge 3 commits into
chore/1355-rails-7-0-defaultsfrom
chore/1355-gem-floors
Open

Bump gem CVE floors unlocked by Ruby 3.0#1537
benrfairless wants to merge 3 commits into
chore/1355-rails-7-0-defaultsfrom
chore/1355-gem-floors

Conversation

@benrfairless

@benrfairless benrfairless commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What and why

Bumps the gem security floors that were explicitly blocked on the Ruby upgrade (oaf-internal#316), now unblocked by #1534: faraday >= 2.14.1 (resolves 2.14.3, fixing CVE-2026-25765, CVE-2026-33637 and CVE-2026-54297) and nokogiri unpinned from 1.15.7 (resolves 1.17.2, clearing the advisories fixable on Ruby 3.0).
The faraday bump forced excon 1.2.5 and docker-api 2.4.0: faraday-net_http 3.4 pulls in the standalone uri gem, whose parsing excon 0.92 mishandles for the Docker unix:// socket, breaking every Docker API call, and docker-api 2.2.0 mutates an array excon 1.x freezes. Sits at the top of the stack so it can drop off harmlessly if anything misbehaves.

  • Part of Update morph to Ruby 3.0.7 #1356 / oaf-internal#316
  • Deferred: the remaining nokogiri advisories need >= 1.18.9 and the open excon advisory (CVE-2026-54171, Medium) needs >= 1.5.0; both need Ruby >= 3.1, so they stay deferred with the Ruby ceiling, tracked in oaf-internal#316.
  • Also records the Phase 1 and 2 PR numbers in doc/UPGRADE_PATH.md (§2.5, §6), noting the mined chore/rails_61 and chore/rails_70_and_ruby_30 branches can be deleted once these PRs merge.

Type of change

  • Chore
  • Documentation

How this was checked

In the containerised dev environment: CI profile 854 examples / 0 failures (coverage 81.46% against the 80.05 threshold) - the docker-utils and worker specs exercise the excon/docker-api path against a real Docker socket; rubocop and haml-lint clean, srb tc unchanged at 101 (not CI-enforced). bundle exec bundle-audit check confirms the faraday advisories cleared and the residual nokogiri/excon findings are the Ruby-3.1-blocked ones noted above.
CodeRabbit review of the full #1534-#1537 stack diff: 0 findings.

  • Ran the automated tests
  • Ran /code-review (or equivalent): fixed any concerns (and rechecked), linked follow-up issues above, or noted why they are not important above
  • Documentation updated, or not needed (doc/UPGRADE_PATH.md)

Assisted-by: OpenCode:anthropic.claude-fable-5

@benrfairless
benrfairless added this pull request to stack #1531 September 11, 2026 09:25
@socket-security

socket-security Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedgem/​nokogiri@​1.15.7-x86_64-linux ⏵ 1.17.2-x86_64-linux10010090100100
Updatedgem/​docker-api@​2.2.0 ⏵ 2.4.097 +1100100100100
Updatedgem/​faraday@​2.8.1 ⏵ 2.14.398 +1100 +18100100100

View full report

benrfairless added a commit that referenced this pull request Sep 11, 2026
@benrfairless
Record Phase 1 and 2 PR numbers in the upgrade plan
1fda9f3 
Phase 1 landed as the #1528/#1529 stack and Phase 2 as
#1534-#1537 stacked on it; the mined chore/rails_61 and
chore/rails_70_and_ruby_30 branches can be deleted once those
merge.

Part of #1355

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
@benrfairless benrfairless self-assigned this Sep 11, 2026
@benrfairless benrfairless changed the title chore/1355 gem floors Bump gem CVE floors unlocked by Ruby 3.0 Sep 11, 2026
@benrfairless
benrfairless marked this pull request as ready for review September 11, 2026 10:10
@benrfairless
benrfairless requested a review from a team as a code owner September 11, 2026 10:10
This was referenced Sep 11, 2026
Merged
Open
Open
Br3nda pushed a commit that referenced this pull request Sep 15, 2026
@benrfairless
Record Phase 1 and 2 PR numbers in the upgrade plan
df69ff4 
Phase 1 landed as the #1528/#1529 stack and Phase 2 as
#1534-#1537 stacked on it; the mined chore/rails_61 and
chore/rails_70_and_ruby_30 branches can be deleted once those
merge.

Part of #1355

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
@Br3nda
Br3nda force-pushed the chore/1355-gem-floors branch from 1fda9f3 to df69ff4 Compare September 15, 2026 06:32
Br3nda pushed a commit that referenced this pull request Sep 15, 2026
@benrfairless
Record Phase 1 and 2 PR numbers in the upgrade plan
a645071 
Phase 1 landed as the #1528/#1529 stack and Phase 2 as
#1534-#1537 stacked on it; the mined chore/rails_61 and
chore/rails_70_and_ruby_30 branches can be deleted once those
merge.

Part of #1355

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
@Br3nda
Br3nda force-pushed the chore/1355-gem-floors branch from df69ff4 to a645071 Compare September 15, 2026 07:12
Br3nda pushed a commit that referenced this pull request Sep 15, 2026
@benrfairless @Br3nda
Record Phase 1 and 2 PR numbers in the upgrade plan
88206e7 
Phase 1 landed as the #1528/#1529 stack and Phase 2 as
#1534-#1537 stacked on it; the mined chore/rails_61 and
chore/rails_70_and_ruby_30 branches can be deleted once those
merge.

Part of #1355

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
@Br3nda
Br3nda force-pushed the chore/1355-gem-floors branch from a645071 to 88206e7 Compare September 15, 2026 07:35
@benrfairless
Bump faraday and nokogiri past CVE floors
0f0f4db 
Both pins were explicitly blocked on the Ruby 3.0 upgrade
(oaf-internal#316):

- faraday >= 2.14.1 (resolves 2.14.3) fixes CVE-2026-25765,
  CVE-2026-33637 and CVE-2026-54297.
- nokogiri resolves to 1.17.2, clearing the advisories fixable on
  Ruby 3.0. The remaining nokogiri advisories need >= 1.18.9, which
  needs Ruby >= 3.1: they stay deferred with the Ruby ceiling and
  tracked in oaf-internal#316.

Regenerate Sorbet RBIs for the changed gems (bundle exec tapioca
gem faraday nokogiri faraday-net_http).

Part of #1356

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
@benrfairless
Update excon and docker-api to restore Docker API access
c219d58 
faraday-net_http 3.4 pulls in the standalone uri gem, whose parsing
excon 0.92 mishandles for the Docker unix:// socket ("The :host
parameter should not be set for unix:// connections"), breaking
every Docker API call. excon 1.2.5 handles it, and docker-api moves
to 2.4.0 because 2.2.0 mutates an array excon 1.x freezes.

excon 1.2.5 is the ceiling on Ruby 3.0; the open excon advisory
(CVE-2026-54171, Medium, redirect header redaction) is fixed in
1.5.0, which needs a newer Ruby: deferred with the Ruby ceiling and
tracked in oaf-internal#316 like the residual nokogiri advisories.

Regenerate Sorbet RBIs for the changed gems (bundle exec tapioca
gem excon docker-api net-http uri).

Part of #1356

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
@benrfairless
Record Phase 1 and 2 PR numbers in the upgrade plan
e98618b 
Phase 1 landed as the #1528/#1529 stack and Phase 2 as
#1534-#1537 stacked on it; the mined chore/rails_61 and
chore/rails_70_and_ruby_30 branches can be deleted once those
merge.

Part of #1355

Assisted-by: OpenCode:anthropic.claude-fable-5
Signed-off-by: Ben Fairless <[email protected]>
This was referenced Oct 20, 2026
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Br3nda Br3nda Br3nda approved these changes

Assignees

@benrfairless benrfairless

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@benrfairless @Br3nda