chore: Ruby 3.4 upgrade and full dependency security update#607

Open

jgamblin wants to merge 13 commits intomainfrom

security-update

Commits on Mar 28, 2026

chore: update .ruby-version to Ruby 3.4.9

jgamblin
and
claude
committed
chore: update Gemfile with Ruby 3.4 and tightened gem constraints

jgamblin
and
claude
committed
chore: bundle update all gems to latest compatible versions

jgamblin
and
claude
committed
chore: update Containerfile to Ruby 3.4 and remove stale CVE workarounds

jgamblin
and
claude
committed
chore: replace bundler-audit action with direct invocation for Ruby 3.4 compat

jgamblin
and
claude
committed
chore: regenerate .rubocop_todo.yml for rubocop 1.86

jgamblin
and
claude
committed
chore: bump actions/checkout v4 → v5 for Node.js 24 support

jgamblin
and
claude
committed
fix: use JSON.generate instead of JSON.dump to avoid segfault

jgamblin
and
claude
committed
fix: update simplecov-cobertura 2.1 → 3.1 for rexml 3.4 compat

jgamblin
and
claude
committed
fix: sanitize file paths to prevent directory traversal (CWE-22)

jgamblin
and
claude
committed
style: use modifier unless for path traversal guard

jgamblin
and
claude
committed
test: add coverage for safe_output_path and path traversal sanitization

jgamblin
and
claude
committed
test: add write_file coverage and nocov for defensive guard

jgamblin
and
claude
committed