Update rexml dependency for CVE-2024-35176

johnfairh · johnfairh · commit 429f5e2d8553 · 2024-05-24T13:43:19.000+01:00
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -14,7 +14,7 @@ PATH
       mustache (~> 1.1)
       open4 (~> 1.3)
       redcarpet (~> 3.4)
-      rexml (~> 3.2)
+      rexml (>= 3.2.7, < 4.0)
       rouge (>= 2.0.6, < 5.0)
       sassc (~> 2.1)
       sqlite3 (~> 1.3)
@@ -173,7 +173,8 @@ GEM
     rchardet (1.8.0)
     redcarpet (3.6.0)
     regexp_parser (2.9.0)
-    rexml (3.2.6)
+    rexml (3.2.8)
+      strscan (>= 3.0.9)
     rouge (4.2.1)
     rubocop (1.63.4)
       json (~> 2.3)
@@ -198,6 +199,7 @@ GEM
       faraday (>= 0.17.3, < 3)
     sqlite3 (1.7.3)
       mini_portile2 (~> 2.8.0)
+    strscan (3.1.0)
     terminal-table (3.0.2)
       unicode-display_width (>= 1.1.1, < 3)
     typhoeus (1.4.1)
diff --git a/jazzy.gemspec b/jazzy.gemspec
@@ -22,7 +22,7 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'mustache', '~> 1.1'
   spec.add_runtime_dependency 'open4', '~> 1.3'
   spec.add_runtime_dependency 'redcarpet', '~> 3.4'
-  spec.add_runtime_dependency 'rexml', '~> 3.2'
+  spec.add_runtime_dependency 'rexml', ['>= 3.2.7', '< 4.0']
   spec.add_runtime_dependency 'rouge', ['>= 2.0.6', '< 5.0']
   spec.add_runtime_dependency 'sassc', '~> 2.1'
   spec.add_runtime_dependency 'sqlite3', '~> 1.3'
