Disagreement on #read_remote_file advisory CVE-2026-53727 affected versions

[eliotsykes]

This advisory claims the affected css_parser versions as < 3.0.0: GHSA-9pmc-p236-855h https://github.com/advisories/GHSA-9pmc-p236-855h.

However, this advisory claims the affected css_parser version is only 2.2.0: GHSA-9pmc-p236-855h https://github.com/premailer/css_parser/security/advisories/GHSA-9pmc-p236-855h.

Which of these is correct?

If the affected versions are < 3.0.0, then ruby-advisory-db will need updating too: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/css_parser/CVE-2026-53727.yml

[grosser]

1.22.0 seems to only have the ssl fix commit

same for 2.2.0 commit

so afaik <3 is correct

I update GHSA-9pmc-p236-855h to say <3 too

rubysec/ruby-advisory-db#1220 to fix ruby-advisory-db ... maybe should say affected_versions, seems duplicated but 🤷