From adedc5318cee3240f6fc1756891857f036e1ac37 Mon Sep 17 00:00:00 2001 From: Ben Balter Date: Tue, 29 Sep 2026 20:09:04 -0400 Subject: [PATCH 1/2] Bump jekyll-seo-tag, jekyll-feed and jekyll-redirect-from for security fixes Co-Authored-By: Claude Opus 5.5 --- lib/github-pages/dependencies.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index 52ffa371..c4d782da 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -21,13 +21,13 @@ class Dependencies "github-pages-health-check" => "1.18.2", # Plugins - "jekyll-redirect-from" => "0.16.0", + "jekyll-redirect-from" => "0.17.0", "jekyll-sitemap" => "1.4.0", - "jekyll-feed" => "0.17.0", + "jekyll-feed" => "0.18.0", "jekyll-gist" => "1.5.0", "jekyll-paginate" => "1.1.0", "jekyll-coffeescript" => "1.2.2", - "jekyll-seo-tag" => "2.8.0", + "jekyll-seo-tag" => "2.9.1", "jekyll-github-metadata" => "2.16.1", "jekyll-avatar" => "0.8.0", "jekyll-remote-theme" => "0.4.3", From 09226aae33e55821159937a5be7eeb6a348da7c5 Mon Sep 17 00:00:00 2001 From: Ben Balter Date: Wed, 30 Sep 2026 19:20:12 -0400 Subject: [PATCH 2/2] Bump jekyll-remote-theme to 0.6.2 for rubyzip and local-path fixes jekyll-remote-theme 0.4.3 caps rubyzip below 3.0, so github-pages users can't pick up the fix for CVE-2026-85396, which only landed in rubyzip 3.4.0 (#966). 0.5.2 was the first release to allow rubyzip 3.x, but 0.5.0 through 0.6.0 are affected by GHSA-3343-386p-v26g (local-path remote_theme reads outside the site source in safe mode), so go straight to 0.6.2. 0.6.0 also caps download and extraction size and adds request timeouts. 0.6.x requires Ruby >= 3.0, which matches the oldest Ruby in the CI matrix. Co-Authored-By: Claude Opus 5.5 --- lib/github-pages/dependencies.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/github-pages/dependencies.rb b/lib/github-pages/dependencies.rb index c4d782da..01640639 100644 --- a/lib/github-pages/dependencies.rb +++ b/lib/github-pages/dependencies.rb @@ -30,7 +30,7 @@ class Dependencies "jekyll-seo-tag" => "2.9.1", "jekyll-github-metadata" => "2.16.1", "jekyll-avatar" => "0.8.0", - "jekyll-remote-theme" => "0.4.3", + "jekyll-remote-theme" => "0.6.2", "jekyll-include-cache" => "0.2.1", # Plugins to match GitHub.com Markdown