Skip to content

i18n dependency version conflict preventing activesupport update to fix CVE-2023-22796 #866

@agnostic-apollo

Description

@agnostic-apollo

Before submitting an issue, please be sure to

This issue affects

  • The site generated by GitHub Pages
  • Building sites locally

Issue

The CVE-2023-22796 requires activesupport to be updated to 6.1.7.1 or 7.0.4.1.

The github-pages 227 gem depends on jekyll = 3.9.2, which depends on i18n ~> 0.7.

The activesupport 6.1.7.1 depends on i18n >= 1.6, < 2, which prevents an update. The activesupport 6.0.6.1 was the last version that depended on i18n >= 0.7, < 2, which then used i18n 0.9.5 to also satisfy jekyll's i18n ~> 0.7 requirement.

Note sure what can be done, other than possibly updating to jekyll >= 4.0.0, which depends on i18n >= 0.9.5, < 2. Any suggestions? Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions