From eb5068a3f23f6edf4ed52140e43ee7f3e3e6e102 Mon Sep 17 00:00:00 2001 From: Ian Maia Date: Mon, 28 Sep 2026 18:21:10 +0200 Subject: [PATCH 1/2] Bump fastlane to fix rubyzip path traversal vulnerability --- CHANGELOG.md | 2 +- Gemfile | 12 +-- Gemfile.lock | 94 +++++++++++++---------- fastlane-plugin-wpmreleasetoolkit.gemspec | 2 +- 4 files changed, 58 insertions(+), 52 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 78967d54b..aebbd4ece 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,7 +14,7 @@ _None_ ### Bug Fixes -_None_ +- Bump `fastlane` to `~> 2.240` to require `rubyzip >= 3.4.0`, fixing CVE-2026-85396 / GHSA-47m2-wp7j-p9vc. [#775] ### Internal Changes diff --git a/Gemfile b/Gemfile index f21e6827b..16bfbc5a1 100644 --- a/Gemfile +++ b/Gemfile @@ -9,16 +9,8 @@ gem 'activesupport', '~> 8.1' gem 'buildkite-test_collector', '~> 2.3' gem 'codecov', require: false gem 'danger-dangermattic', '~> 1.0' -# Security: -# - https://github.com/lostisland/faraday/pull/1665 -# - https://github.com/lostisland/faraday/pull/1681 -# -# Faraday 2.0 is not compatible with Fastlane -# -# See also: -# - https://github.com/fastlane/fastlane/issues/21334 -# - https://github.com/fastlane/fastlane/pull/30089 -gem 'faraday', '~> 1.10', '>= 1.10.6' +# Security: https://github.com/advisories/GHSA-98m9-hrrm-r99r +gem 'faraday', '~> 2.14', '>= 2.14.3' gem 'pry', '~> 0.12.2' gem 'rmagick', '~> 5.3' gem 'rspec', '~> 3.8' diff --git a/Gemfile.lock b/Gemfile.lock index 73dc591e3..04b4c95a0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -6,7 +6,7 @@ PATH chroma (= 0.2.0) diffy (~> 3.3) dotenv (~> 2.8) - fastlane (~> 2.237) + fastlane (~> 2.240) gettext (~> 3.5) git (~> 1.3) google-cloud-storage (~> 1.31) @@ -70,6 +70,7 @@ GEM sawyer (>= 0.6) buildkite-test_collector (2.13.0) concurrent-ruby + cgi (0.5.2) chroma (0.2.0) claide (1.1.0) claide-plugins (0.9.2) @@ -125,41 +126,29 @@ GEM dotenv (2.8.1) drb (2.2.3) emoji_regex (3.2.3) + erb (6.0.7) erubi (1.13.1) excon (1.5.0) logger - faraday (1.10.6) - faraday-em_http (~> 1.0) - faraday-em_synchrony (~> 1.0) - faraday-excon (~> 1.1) - faraday-httpclient (~> 1.0) - faraday-multipart (~> 1.0) - faraday-net_http (~> 1.0) - faraday-net_http_persistent (~> 1.0) - faraday-patron (~> 1.0) - faraday-rack (~> 1.0) - faraday-retry (~> 1.0) - ruby2_keywords (>= 0.0.4) + faraday (2.14.4) + faraday-net_http (>= 2.0, < 3.5) + json + logger faraday-cookie_jar (0.0.8) faraday (>= 0.8.0) http-cookie (>= 1.0.0) - faraday-em_http (1.0.0) - faraday-em_synchrony (1.0.1) - faraday-excon (1.1.0) + faraday-follow_redirects (0.5.0) + faraday (>= 1, < 3) faraday-http-cache (2.7.0) faraday (>= 0.8) - faraday-httpclient (1.0.1) faraday-multipart (1.2.0) multipart-post (~> 2.0) - faraday-net_http (1.0.2) - faraday-net_http_persistent (1.2.0) - faraday-patron (1.0.0) - faraday-rack (1.0.0) - faraday-retry (1.0.4) - faraday_middleware (1.2.1) - faraday (~> 1.0) + faraday-net_http (3.4.4) + net-http (~> 0.5) + faraday-retry (2.4.0) + faraday (~> 2.0) fastimage (2.4.1) - fastlane (2.237.0) + fastlane (2.240.1) CFPropertyList (>= 2.3, < 5.0.0) abbrev (~> 0.1) addressable (>= 2.9.0, < 3.0.0) @@ -169,24 +158,27 @@ GEM base64 (~> 0.2) benchmark (>= 0.1.0) bundler (>= 2.4.0, < 5.0.0) + cgi (~> 0.4) colored (~> 1.2) commander (~> 4.6) csv (~> 3.3) dotenv (>= 2.1.1, < 3.0.0) emoji_regex (>= 0.1, < 4.0) excon (>= 0.71.0, < 2.0.0) - faraday (~> 1.0) - faraday-cookie_jar (~> 0.0.6) - faraday_middleware (~> 1.0) + faraday (~> 2.7) + faraday-cookie_jar (~> 0.0.8) + faraday-follow_redirects (~> 0.3) + faraday-multipart (~> 1.0) + faraday-retry (~> 2.0) fastimage (>= 2.1.0, < 3.0.0) fastlane-sirp (>= 1.1.0) gh_inspector (>= 1.1.2, < 2.0.0) - google-apis-androidpublisher_v3 (~> 0.3) + google-apis-androidpublisher_v3 (~> 0.99) google-apis-playcustomapp_v1 (~> 0.1) - google-cloud-env (>= 1.6.0, < 2.3.0) + google-cloud-env (>= 1.6.0, < 2.4.0) google-cloud-storage (~> 1.31) highline (~> 2.0) - http-cookie (~> 1.0.5) + irb (>= 1.8) json (< 3.0.0) jwt (>= 2.10.3, < 4) logger (>= 1.6, < 2.0) @@ -199,11 +191,11 @@ GEM optparse (>= 0.1.1, < 1.0.0) ostruct (>= 0.1.0) plist (>= 3.1.0, < 4.0.0) - rubyzip (>= 2.0.0, < 3.0.0) - security (= 0.1.5) + rubyzip (>= 3.4.0, < 4.0.0) + security (~> 0.3) simctl (~> 1.6.3) terminal-notifier (>= 2.0.0, < 3.0.0) - terminal-table (~> 3) + terminal-table (~> 4) tty-screen (>= 0.6.3, < 1.0.0) tty-spinner (>= 0.8.0, < 1.0.0) word_wrap (~> 1.0.0) @@ -272,6 +264,12 @@ GEM mutex_m i18n (1.14.8) concurrent-ruby (~> 1.0) + io-console (0.9.4) + irb (1.18.0) + pp (>= 0.6.0) + prism (>= 1.3.0) + rdoc (>= 4.0.0) + reline (>= 0.4.2) java-properties (0.3.0) jmespath (1.6.2) json (2.21.2) @@ -299,6 +297,8 @@ GEM nanaimo (0.4.0) nap (1.1.0) naturally (2.3.0) + net-http (0.9.1) + uri (>= 0.11.1) nkf (0.2.0) nokogiri (1.19.4) mini_portile2 (~> 2.8.2) @@ -318,6 +318,9 @@ GEM racc pkg-config (1.6.5) plist (3.7.2) + pp (0.6.4) + prettyprint + prettyprint (0.2.0) prime (0.1.4) forwardable singleton @@ -335,8 +338,19 @@ GEM rake (13.4.2) rake-compiler (1.3.1) rake + rbs (4.2.0) + logger + prism (>= 1.6.0) + tsort rchardet (1.10.2) + rdoc (8.0.0) + erb + prism (>= 1.6.0) + rbs (>= 4.0.0) + tsort regexp_parser (2.12.0) + reline (0.7.0) + io-console (~> 0.5) representable (3.2.0) declarative (< 0.1.0) trailblazer-option (>= 0.1.1, < 0.2.0) @@ -379,13 +393,12 @@ GEM rubocop-rspec (3.0.0) rubocop (~> 1.40) ruby-progressbar (1.13.0) - ruby2_keywords (0.0.5) - rubyzip (2.4.1) + rubyzip (3.7.0) sawyer (0.9.3) addressable (>= 2.3.5) faraday (>= 0.17.3, < 3) securerandom (0.4.1) - security (0.1.5) + security (0.3.0) signet (0.21.0) addressable (~> 2.8) faraday (>= 0.17.5, < 3.a) @@ -401,10 +414,11 @@ GEM simplecov-html (0.10.2) singleton (0.3.0) terminal-notifier (2.0.0) - terminal-table (3.0.2) - unicode-display_width (>= 1.1.1, < 3) + terminal-table (4.0.0) + unicode-display_width (>= 1.1.1, < 4) text (1.3.1) trailblazer-option (0.1.2) + tsort (0.2.0) tty-cursor (0.7.1) tty-screen (0.8.2) tty-spinner (0.9.3) @@ -440,7 +454,7 @@ DEPENDENCIES buildkite-test_collector (~> 2.3) codecov danger-dangermattic (~> 1.0) - faraday (~> 1.10, >= 1.10.6) + faraday (~> 2.14, >= 2.14.3) fastlane-plugin-wpmreleasetoolkit! pry (~> 0.12.2) rmagick (~> 5.3) diff --git a/fastlane-plugin-wpmreleasetoolkit.gemspec b/fastlane-plugin-wpmreleasetoolkit.gemspec index a19815b54..94e7a3acb 100644 --- a/fastlane-plugin-wpmreleasetoolkit.gemspec +++ b/fastlane-plugin-wpmreleasetoolkit.gemspec @@ -27,7 +27,7 @@ Gem::Specification.new do |spec| spec.add_dependency 'chroma', '0.2.0' spec.add_dependency 'diffy', '~> 3.3' spec.add_dependency 'dotenv', '~> 2.8' - spec.add_dependency 'fastlane', '~> 2.237' + spec.add_dependency 'fastlane', '~> 2.240' spec.add_dependency 'gettext', '~> 3.5' spec.add_dependency 'git', '~> 1.3' spec.add_dependency 'java-properties', '~> 0.3.0' From 85faf49f01987873349f65643691978224f3dcba Mon Sep 17 00:00:00 2001 From: Ian Maia Date: Mon, 28 Sep 2026 19:47:45 +0200 Subject: [PATCH 2/2] Remove redundant direct Faraday dependency --- Gemfile | 2 -- Gemfile.lock | 1 - 2 files changed, 3 deletions(-) diff --git a/Gemfile b/Gemfile index 16bfbc5a1..9774e9c4a 100644 --- a/Gemfile +++ b/Gemfile @@ -9,8 +9,6 @@ gem 'activesupport', '~> 8.1' gem 'buildkite-test_collector', '~> 2.3' gem 'codecov', require: false gem 'danger-dangermattic', '~> 1.0' -# Security: https://github.com/advisories/GHSA-98m9-hrrm-r99r -gem 'faraday', '~> 2.14', '>= 2.14.3' gem 'pry', '~> 0.12.2' gem 'rmagick', '~> 5.3' gem 'rspec', '~> 3.8' diff --git a/Gemfile.lock b/Gemfile.lock index 04b4c95a0..1f6857cec 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -454,7 +454,6 @@ DEPENDENCIES buildkite-test_collector (~> 2.3) codecov danger-dangermattic (~> 1.0) - faraday (~> 2.14, >= 2.14.3) fastlane-plugin-wpmreleasetoolkit! pry (~> 0.12.2) rmagick (~> 5.3)