Skip to content

Fix CVE-2025-27221#818

Merged
nozaq merged 2 commits into
licensee:mainfrom
nozaq:fix-cve-2025-27221
Mar 4, 2025
Merged

Fix CVE-2025-27221#818
nozaq merged 2 commits into
licensee:mainfrom
nozaq:fix-cve-2025-27221

Conversation

@nozaq

@nozaq nozaq commented Mar 4, 2025

Copy link
Copy Markdown
Collaborator

Note

This PR requires a major release since required_ruby_version has been updated. Maybe not 😁

This PR updates nokogiri to version 1.18.3 to address CVE-2025-27221.
As nokogiri v1.18.3 no longer supports Ruby 3.0.x, the minimum required Ruby version has been upgraded to 3.1.0.

Additionally, Ruby 3.3 and 3.4 have been added to the CI test matrix.

@nozaq nozaq added the ruby Pull requests that update Ruby code label Mar 4, 2025
@nozaq nozaq self-assigned this Mar 4, 2025
@nozaq

nozaq commented Mar 4, 2025

Copy link
Copy Markdown
Collaborator Author

Ruby 3.0 was removed from the CI test matrix alongside the required_ruby_version update. It appears that core (3.0) must also be removed from the required status checks for this PR to be merged.

I can update the status check settings myself, but I’d like to have this PR reviewed first 😉

@MikeMcQuaid MikeMcQuaid left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @nozaq! Feel free to update the CI configuration. I don't feel strongly about whether this needs a major release or not; if we think it does it may be worth considering if there's any other functionality we want/need to remove before doing that.

@nozaq nozaq merged commit dd71f0f into licensee:main Mar 4, 2025
@nozaq

nozaq commented Mar 4, 2025

Copy link
Copy Markdown
Collaborator Author

@MikeMcQuaid Thank you! I've just updated the required status checks: I removed core (3.0) and added core (3.3) and core (3.4).

I also don't have a strong opinion on whether we should make this a major release, so simply including it in the next minor release should be sufficient.

If we think it does, we might consider whether there's any other functionality we want or need to remove before we do that.

Regardless of this PR, I agree that summarizing what to include in the next major release is a great idea. Even if it won’t happen immediately, creating a milestone and linking issues would be a good place to start?

@nozaq nozaq deleted the fix-cve-2025-27221 branch March 4, 2025 14:21
@MikeMcQuaid

Copy link
Copy Markdown
Contributor

Regardless of this PR, I agree that summarizing what to include in the next major release is a great idea. Even if it won’t happen immediately, creating a milestone and linking issues would be a good place to start?

Works for me, great idea!

@nozaq

nozaq commented Mar 4, 2025

Copy link
Copy Markdown
Collaborator Author

Just created a milestone and link some existing issues to it: https://github.com/licensee/licensed/milestone/1

Please feel free to add issues🙂

GitHub
A Ruby gem to cache and verify the licenses of dependencies - 6.0.0 Milestone · licensee/licensed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ruby Pull requests that update Ruby code

Development

Successfully merging this pull request may close these issues.

2 participants