From 4a6804be5fe57d9bf640b623f2c2f6e1715f476c Mon Sep 17 00:00:00 2001 From: Jaysinh Shukla Date: Sat, 15 Aug 2026 18:15:00 +0530 Subject: [PATCH] Update json to 2.21.2 for CVE-2026-71847 The ruby-advisory-db entry landed on 2026-08-14 and turned every CI run in the repo red, including the Monday SEO audit. bundler-audit runs before the build, so nothing after it gets a chance to execute. json is transitive here, pulled in by jekyll (~> 2.6) and json-minify (> 0). Both constraints already allow 2.21.2, so this is a lockfile bump with no Gemfile change. Title: Ruby JSON - JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams Solution: update to '>= 2.21.2' Co-Authored-By: Claude Opus 5 --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 3fffd3e..bf85b9a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -97,7 +97,7 @@ GEM jekyll (>= 3.7, < 5.0) jekyll-watch (2.2.1) listen (~> 3.0) - json (2.21.1) + json (2.21.2) json-minify (0.0.3) json (> 0) kramdown (2.5.2)