From e1e44dfe79788a220f41a32c168a62c21ca6d3c3 Mon Sep 17 00:00:00 2001 From: Aravind Kumar Date: Sun, 2 Aug 2026 17:45:06 +0530 Subject: [PATCH 1/3] sca-scan.yml --- .github/workflows/sca-scan.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/sca-scan.yml b/.github/workflows/sca-scan.yml index c8bd00c..13a39ec 100644 --- a/.github/workflows/sca-scan.yml +++ b/.github/workflows/sca-scan.yml @@ -5,6 +5,9 @@ on: jobs: security-sca: runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write steps: - uses: actions/checkout@master - name: Run Snyk to check for vulnerabilities From fb5acb37a2f6ab2f72940a8ea5e823fd4b455b55 Mon Sep 17 00:00:00 2001 From: OMpawar-21 Date: Thu, 13 Aug 2026 13:16:19 +0530 Subject: [PATCH 2/3] fix: upgrade json to 2.21.2 to remediate CVE-2026-71847 (CVSS 8.7 High) Bumps json gem from 2.20.0 to 2.21.2 to fix a Use After Free vulnerability (CWE-416) in JSON::ResumableParser#partial_value. Bumps SDK version to 0.10.1. Co-Authored-By: Claude Sonnet 4.6 --- CHANGELOG.md | 7 +++++++ Gemfile.lock | 4 ++-- lib/contentstack/version.rb | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c32d184..4ac9804 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ ## CHANGELOG +## Version 0.10.1 +### Date: 13th-August-2026 + ### Security + - Upgraded `json` dependency from `2.20.0` to `2.21.2` to remediate CVE-2026-71847 (SNYK-RUBY-JSON-18599450) — Use After Free (CWE-416) in `JSON::ResumableParser#partial_value`, CVSS 8.7 High. + +------------------------------------------------ + ## Version 0.10.0 ### Date: 27th-July-2026 ### Features diff --git a/Gemfile.lock b/Gemfile.lock index 0fbc2ec..a7ecf01 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -39,7 +39,7 @@ GEM hashdiff (1.2.1) i18n (1.14.8) concurrent-ruby (~> 1.0) - json (2.20.0) + json (2.21.2) logger (1.7.0) minitest (6.0.6) drb (~> 2.0) @@ -127,7 +127,7 @@ CHECKSUMS drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373 hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1 i18n (1.14.8) sha256=285778639134865c5e0f6269e0b818256017e8cde89993fdfcbfb64d088824a5 - json (2.20.0) sha256=9362bc6e55a952b056abf9167cf053358181c904cb70cd6eee0808ea830fc32b + json (2.21.2) sha256=1f1d3b7cf2b3ba1a69beca0bb6db13d5438b80bff3cd54cdaaa620b9b07c1c6a logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203 minitest (6.0.6) sha256=153ea36d1d987a62942382b61075745042a2b3123b1cd48f4c3675af9cc7d6f1 nokogiri (1.19.3-aarch64-linux-gnu) sha256=46b89e5d7b9e844c2ee360794240c6ea2a4e6fa0c5892a4ed487db621224b639 diff --git a/lib/contentstack/version.rb b/lib/contentstack/version.rb index c3b972e..da7e26e 100644 --- a/lib/contentstack/version.rb +++ b/lib/contentstack/version.rb @@ -1,3 +1,3 @@ module Contentstack - VERSION = "0.10.0" + VERSION = "0.10.1" end From 1c6c77b9775df4e7f6964c928a3394d195e548dc Mon Sep 17 00:00:00 2001 From: OM PAWAR Date: Thu, 13 Aug 2026 13:22:45 +0530 Subject: [PATCH 3/3] Update release date for version 0.10.1 --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4ac9804..3e0caf8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,7 @@ ## CHANGELOG ## Version 0.10.1 -### Date: 13th-August-2026 +### Date: 17th-August-2026 ### Security - Upgraded `json` dependency from `2.20.0` to `2.21.2` to remediate CVE-2026-71847 (SNYK-RUBY-JSON-18599450) — Use After Free (CWE-416) in `JSON::ResumableParser#partial_value`, CVSS 8.7 High. @@ -206,4 +206,4 @@ - Initial release ------------------------------------------------- \ No newline at end of file +------------------------------------------------