From d0602cd819e08d0180ad9baece4d8978c75c34d2 Mon Sep 17 00:00:00 2001 From: Ryan Duguid <152749594+ryanduguid@users.noreply.github.com> Date: Thu, 13 Aug 2026 03:31:47 +1000 Subject: [PATCH 1/2] build: refresh vulnerable Ruby dependencies --- Gemfile.lock | 42 ++++++++++++++++++++++++------------------ 1 file changed, 24 insertions(+), 18 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 53563a88..72890b43 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,42 +9,44 @@ PATH GEM remote: https://rubygems.org/ specs: - activesupport (7.2.1) + activesupport (8.1.3.1) base64 bigdecimal concurrent-ruby (~> 1.0, >= 1.3.1) connection_pool (>= 2.2.5) drb i18n (>= 1.6, < 2) + json logger (>= 1.4.2) minitest (>= 5.1) securerandom (>= 0.3) tzinfo (~> 2.0, >= 2.0.5) + uri (>= 0.13.1) aes_key_wrap (1.1.0) ast (2.4.2) - base64 (0.2.0) - bigdecimal (3.1.8) + base64 (0.3.0) + bigdecimal (4.1.2) bindata (2.5.0) bundler-audit (0.9.2) bundler (>= 1.2.0, < 3) thor (~> 1.0) byebug (11.1.3) coderay (1.1.3) - concurrent-ruby (1.3.4) - connection_pool (2.4.1) + concurrent-ruby (1.3.8) + connection_pool (3.0.2) diff-lcs (1.5.1) - drb (2.2.1) - faraday (2.12.0) - faraday-net_http (>= 2.0, < 3.4) + drb (2.2.3) + faraday (2.14.3) + faraday-net_http (>= 2.0, < 3.5) json logger faraday-follow_redirects (0.3.0) faraday (>= 1, < 3) - faraday-net_http (3.3.0) - net-http - i18n (1.14.6) + faraday-net_http (3.4.4) + net-http (~> 0.5) + i18n (1.15.2) concurrent-ruby (~> 1.0) - json (2.7.2) + json (2.21.2) json-jwt (1.16.6) activesupport (>= 4.2) aes_key_wrap @@ -53,15 +55,18 @@ GEM faraday (~> 2.0) faraday-follow_redirects language_server-protocol (3.17.0.3) - logger (1.6.1) + logger (1.7.0) method_source (1.1.0) - minitest (5.25.1) - net-http (0.4.1) - uri + minitest (6.0.6) + drb (~> 2.0) + prism (~> 1.5) + net-http (0.9.1) + uri (>= 0.11.1) parallel (1.26.3) parser (3.3.5.0) ast (~> 2.4.1) racc + prism (1.9.0) pry (0.14.2) coderay (~> 1.1) method_source (~> 1.0) @@ -98,16 +103,17 @@ GEM rubocop-ast (1.32.3) parser (>= 3.3.1.0) ruby-progressbar (1.13.0) - securerandom (0.3.1) + securerandom (0.4.1) thor (1.3.2) tzinfo (2.0.6) concurrent-ruby (~> 1.0) unicode-display_width (2.6.0) - uri (0.13.1) + uri (1.1.1) PLATFORMS arm64-darwin-23 ruby + x64-mingw-ucrt DEPENDENCIES bundler-audit From e416164334c902631d03d4ba6a9ec1c7e355d03c Mon Sep 17 00:00:00 2001 From: Ryan Duguid <152749594+ryanduguid@users.noreply.github.com> Date: Wed, 19 Aug 2026 15:16:23 +1000 Subject: [PATCH 2/2] fix(deps): raise the shipped runtime floors above every patched advisory The refresh cleared the advisories only in Gemfile.lock. The lock is not packaged (s.files is lib/**/* plus README.md) and does not bind consumers, so the shipped constraints still admitted every vulnerable version. faraday '>= 2.0' -> '>= 2.14.3' GHSA-98m9-hrrm-r99r (high, uncontrolled recursion in NestedParamsEncoder, stack exhaustion DoS) affects >= 2.0.0, <= 2.14.2, patched 2.14.3. GHSA-5rv5-xj5j-3484 (low, incomplete fix for the SSRF below) affects >= 2.0.0, <= 2.14.1, patched 2.14.2. GHSA-33mh-2634-fwr2 (medium, SSRF via protocol-relative host override in build_exclusive_url) affects >= 2.0.0, <= 2.14.0, patched 2.14.1. json '>= 2.1.0' -> '>= 2.21.2' A 2.3.0 floor would clear GHSA-jphg-qwrw-7w9g (high, unsafe object creation) but leave four later advisories reachable: GHSA-9m3q-rhmv-5q44 (high, OOB read, patched 2.10.2), GHSA-3m6g-2423-7cp3 (high, format string injection, patched 2.19.2 on the 2.18+ line), GHSA-x2f5-4prf-w687 (low, generator heap overflow, patched 2.19.9) and GHSA-9hj4-r449-hfvc (low, freed buffer deref, patched 2.21.2). 2.21.2 clears all five and matches the lock. json-jwt '>= 1.16.3' -> '>= 1.16.6' GHSA-c8v6-786g-vjx6 (medium, sign/encryption confusion allowing bypass of identity checks) affects >= 1.16.0, < 1.16.6, patched 1.16.6. This SDK verifies OAuth2 id_tokens and access_tokens through json-jwt. Also removed x64-mingw-ucrt from PLATFORMS. It was a side effect of regenerating the lock on Windows, unrelated to the refresh, and forces future `bundle lock` runs to satisfy a platform the project neither tests nor supports. Recorded the Ruby floor contradiction in the Gemfile: activesupport 8.1.3.1, connection_pool 3.0.2 and minitest 6.0.6 each require Ruby >= 3.2 and faraday 2.14.3 requires >= 3.0, so the lock cannot install on Ruby 3.1.x while the gemspec still declares ">= 2.3". PR #387 raises that floor and must land with or before this. Advisory ranges verified with `gh api /advisories?ecosystem=rubygems&affects=`; versions and required_ruby_version verified against the RubyGems API. Nothing was executed: no Ruby toolchain is installed on this machine. --- Gemfile | 8 ++++++++ Gemfile.lock | 7 +++---- xero-ruby.gemspec | 6 +++--- 3 files changed, 14 insertions(+), 7 deletions(-) diff --git a/Gemfile b/Gemfile index 38b44272..aa7d960a 100644 --- a/Gemfile +++ b/Gemfile @@ -2,6 +2,14 @@ source 'https://rubygems.org' gemspec +# NOTE: the resolved lock has an effective Ruby floor of 3.2, which contradicts +# required_ruby_version ">= 2.3" in xero-ruby.gemspec. activesupport 8.1.3.1 +# (pulled in transitively by json-jwt), connection_pool 3.0.2 and minitest 6.0.6 +# each declare required_ruby_version >= 3.2, and faraday 2.14.3 declares >= 3.0, +# so `bundle install` fails on Ruby 3.1.x and below despite the gemspec claiming +# support back to 2.3. PR #387 raises the gemspec floor to ">= 3.2" and must +# land with or before this dependency refresh. + group :development, :test do gem 'rake', '~> 13.2.1' gem 'pry-byebug' diff --git a/Gemfile.lock b/Gemfile.lock index 72890b43..c7f311a7 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -2,9 +2,9 @@ PATH remote: . specs: xero-ruby (18.1.0) - faraday (>= 2.0, < 3.0) - json (~> 2.1, >= 2.1.0) - json-jwt (~> 1.16, >= 1.16.3) + faraday (>= 2.14.3, < 3.0) + json (~> 2.1, >= 2.21.2) + json-jwt (~> 1.16, >= 1.16.6) GEM remote: https://rubygems.org/ @@ -113,7 +113,6 @@ GEM PLATFORMS arm64-darwin-23 ruby - x64-mingw-ucrt DEPENDENCIES bundler-audit diff --git a/xero-ruby.gemspec b/xero-ruby.gemspec index 2662de90..094a8287 100644 --- a/xero-ruby.gemspec +++ b/xero-ruby.gemspec @@ -26,9 +26,9 @@ Gem::Specification.new do |s| s.license = "Unlicense" s.required_ruby_version = ">= 2.3" - s.add_runtime_dependency 'faraday', '>= 2.0', '< 3.0' - s.add_runtime_dependency 'json', '~> 2.1', '>= 2.1.0' - s.add_runtime_dependency 'json-jwt', '~> 1.16', '>= 1.16.3' + s.add_runtime_dependency 'faraday', '>= 2.14.3', '< 3.0' + s.add_runtime_dependency 'json', '~> 2.1', '>= 2.21.2' + s.add_runtime_dependency 'json-jwt', '~> 1.16', '>= 1.16.6' s.add_development_dependency 'rspec', '~> 3.6', '>= 3.6.0' s.files = Dir.glob("{lib}/**/*") + %w(README.md)