Repository navigation
Bump jekyll-seo-tag, jekyll-feed, jekyll-redirect-from, and jekyll-remote-theme for security fixes - #965
Bump jekyll-seo-tag, jekyll-feed, jekyll-redirect-from, and jekyll-remote-theme for security fixes#965benbalter wants to merge 2 commits into
Conversation
…y fixes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Thanks for bumping, @benbalter. |
|
@benbalter #966 outlines that jekyll-remote-theme needs an update for security reasons as well. Would it make sense to fold that into this PR? |
jekyll-remote-theme 0.4.3 caps rubyzip below 3.0, so github-pages users can't pick up the fix for CVE-2026-85396, which only landed in rubyzip 3.4.0 (github#966). 0.5.2 was the first release to allow rubyzip 3.x, but 0.5.0 through 0.6.0 are affected by GHSA-3343-386p-v26g (local-path remote_theme reads outside the site source in safe mode), so go straight to 0.6.2. 0.6.0 also caps download and extraction size and adds request timeouts. 0.6.x requires Ruby >= 3.0, which matches the oldest Ruby in the CI matrix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
benbalter
changed the title
|
@parkr Good call, folded in via 09226aa. jekyll-remote-theme goes to 0.6.2 rather than 0.5.2 (the first release to allow rubyzip 3.x), because 0.5.0–0.6.0 are affected by GHSA-3343-386p-v26g. rubyzip now resolves to 3.7.0, and |
|
Thanks for putting this PR together @benbalter. |
If you're interested, contacting GitHub support (or posting in the relevant community forum) would likely be the best path. |
Done (sent email to GitHub support). |
3 participants
This bumps four plugins to releases that fix published security advisories. GitHub Pages currently pins affected versions of all four.
redirect_toallows script injection in generated redirect pagespost.langisn't escaped in feed entries, plus a CDATA]]>breakoutFixes #966.
Why jekyll-remote-theme 0.6.2 and not 0.5.2
0.4.3 requires
rubyzip < 3.0, so sites using the github-pages gem can't pick up the rubyzip path traversal fix. 0.5.2 is the first release to allow rubyzip 3.x. But 0.5.0–0.6.0 are affected by GHSA-3343-386p-v26g: a local-pathremote_themecan read files outside the site source, even in safe mode. That was fixed in 0.6.1, and 0.6.2 only changes metadata. 0.6.0 also caps download and zip extraction size and adds request timeouts.With this branch, rubyzip resolves to 3.7.0, and
bundle-auditreports no known vulnerabilities in the resolved bundle.Notes for reviewers
opensslgem (>= 3.1.2). The gemspec still says>= 2.3.0, but the CI matrix already starts at 3.0.@latestrefs, local filesystem paths (rejected in safe mode as of 0.6.1), and proxy support.twitter:description, 100-word description truncation, andcanonical: false), so some sites'<head>output will change slightly.redirect_totargets that aren't http(s) or relative (with a build warning), and percent-encodes quotes,<,>,\and similar characters in targets.Testing
script/cibuildin Docker on Ruby 3.3: 157 of 158 specs pass. The one failure also happens onmaster: the unpinnedjekyll-octiconsdev dependency now addsdata-component="Octicon"to its<svg>output, which breaks the<svg height="32"match inspec/github-pages/integration_spec.rb. The Ruby 3.0 Docker image doesn't build right now (itsapt-getstep fails), which is also unrelated to this change.🤖 Generated with Claude Code