From 88719299d7b845bf5964924a93130facc1fc0fc8 Mon Sep 17 00:00:00 2001 From: mmeest Date: Wed, 16 Sep 2026 14:42:38 +0300 Subject: [PATCH] Bump rubyzip to 3.6.0 to fix CVE-2026-85396. Co-authored-by: Cursor --- Gemfile | 1 + Gemfile.lock | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/Gemfile b/Gemfile index 46c2101f5..60e43a2dc 100644 --- a/Gemfile +++ b/Gemfile @@ -93,6 +93,7 @@ group :test do # gem 'selenium-webdriver' gem 'minitest-mock', require: false gem 'selenium-webdriver' + gem 'rubyzip', '>= 3.4.0' gem 'simplecov', require: false gem 'simplecov-json', require: false gem 'spy' diff --git a/Gemfile.lock b/Gemfile.lock index 07a651bf5..b274dc41d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -518,7 +518,7 @@ GEM faraday (>= 1) faraday-multipart (>= 1) ruby-progressbar (1.13.0) - rubyzip (3.1.0) + rubyzip (3.6.0) sass-embedded (1.93.2-aarch64-linux-gnu) google-protobuf (~> 4.31) sass-embedded (1.93.2-aarch64-linux-musl) @@ -688,6 +688,7 @@ DEPENDENCIES ruby-lsp ruby-lsp-rails ruby-openai (~> 8.0) + rubyzip (>= 3.4.0) scenic selenium-webdriver simplecov