From 0ee0e8aa952387af0f0723c8fbae2439db89862f Mon Sep 17 00:00:00 2001 From: nthmost-orkes Date: Mon, 19 Oct 2026 23:06:04 -0700 Subject: [PATCH 1/2] Upgrade dependencies with known CVEs Clears the ruby-sdk HIGH/CRITICAL findings from the Trivy scan: - concurrent-ruby 1.3.6 -> 1.3.8 (CVE-2026-54906 critical, CVE-2026-54904) - faraday 2.8.1 -> 2.15.0 (CVE-2026-54297) - addressable 2.8.8 -> 2.9.0 (CVE-2026-35611, transitive) Direct deps (concurrent-ruby, faraday) get raised floors in the gemspec so gem consumers resolve to patched versions, not just the dev lock; addressable is transitive and moves in Gemfile.lock only. --- Gemfile.lock | 30 +++++++++++++++++++----------- conductor_ruby.gemspec | 4 ++-- 2 files changed, 21 insertions(+), 13 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index cf4ec9d..184d513 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -2,8 +2,8 @@ PATH remote: . specs: conductor_ruby (0.1.1) - concurrent-ruby (~> 1.2) - faraday (~> 2.0) + concurrent-ruby (>= 1.3.7, < 2.0) + faraday (>= 2.14.3, < 3.0) faraday-net_http_persistent (~> 2.0) faraday-retry (~> 2.0) json (>= 2.0) @@ -11,7 +11,7 @@ PATH GEM remote: https://rubygems.org/ specs: - addressable (2.8.8) + addressable (2.9.0) public_suffix (>= 2.0.2, < 8.0) ast (2.4.3) async (2.39.0) @@ -23,7 +23,7 @@ GEM base64 (0.3.0) bigdecimal (4.0.1) coderay (1.1.3) - concurrent-ruby (1.3.6) + concurrent-ruby (1.3.8) connection_pool (2.5.5) console (1.35.1) fiber-annotation @@ -33,11 +33,12 @@ GEM bigdecimal rexml diff-lcs (1.6.2) - faraday (2.8.1) - base64 - faraday-net_http (>= 2.0, < 3.1) - ruby2_keywords (>= 0.0.4) - faraday-net_http (3.0.2) + faraday (2.15.0) + faraday-net_http (>= 2.0, < 3.6) + json + logger + faraday-net_http (3.5.0) + net-http (~> 0.5) faraday-net_http_persistent (2.3.1) faraday (~> 2.5) net-http-persistent (>= 4.0.4, < 5) @@ -57,10 +58,16 @@ GEM hana (~> 1.3) regexp_parser (~> 2.0) simpleidn (~> 0.2) + logger (1.7.0) method_source (1.1.0) metrics (0.15.0) + net-http (0.10.0) + net-protocol (>= 0.3.0) + uri (>= 0.11.1) net-http-persistent (4.0.8) connection_pool (>= 2.2.4, < 4) + net-protocol (0.4.0) + timeout parallel (1.24.0) parser (3.3.10.1) ast (~> 2.4.1) @@ -71,7 +78,7 @@ GEM coderay (~> 1.1) method_source (~> 1.0) reline (>= 0.6.0) - public_suffix (5.1.1) + public_suffix (7.0.5) racc (1.8.1) rainbow (3.1.1) rake (13.3.1) @@ -110,10 +117,11 @@ GEM rubocop (~> 1.33) rubocop-capybara (~> 2.17) ruby-progressbar (1.13.0) - ruby2_keywords (0.0.5) simpleidn (0.3.0) + timeout (0.6.1) traces (0.18.2) unicode-display_width (2.6.0) + uri (1.1.2) webmock (3.26.1) addressable (>= 2.8.0) crack (>= 0.3.2) diff --git a/conductor_ruby.gemspec b/conductor_ruby.gemspec index e828d15..91b51aa 100644 --- a/conductor_ruby.gemspec +++ b/conductor_ruby.gemspec @@ -30,12 +30,12 @@ Gem::Specification.new do |spec| spec.require_paths = ['lib'] # HTTP client with HTTP/2 support - spec.add_dependency 'faraday', '~> 2.0' + spec.add_dependency 'faraday', '>= 2.14.3', '< 3.0' spec.add_dependency 'faraday-net_http_persistent', '~> 2.0' spec.add_dependency 'faraday-retry', '~> 2.0' # Concurrency primitives - spec.add_dependency 'concurrent-ruby', '~> 1.2' + spec.add_dependency 'concurrent-ruby', '>= 1.3.7', '< 2.0' # JSON handling spec.add_dependency 'json', '>= 2.0' From 66793f073617aa4555d9955e5033483740e4d193 Mon Sep 17 00:00:00 2001 From: nthmost-orkes Date: Tue, 20 Oct 2026 02:09:08 -0700 Subject: [PATCH 2/2] Fix CI fallout from the dependency bumps - rest_client_spec: faraday >= 2.9 stores keyword middleware options in @kwargs (not @args); read that so the retry-config assertions work under faraday 2.15 - Gemfile: cap public_suffix < 7.0. The addressable 2.9.0 bump (dev-only, via webmock) pulled public_suffix 7, which needs Ruby >= 3.2 and broke the Ruby 3.0/3.1 CI jobs; 6.0.2 has no Ruby floor and still clears the CVEs. --- Gemfile | 5 +++++ Gemfile.lock | 3 ++- spec/conductor/http/rest_client_spec.rb | 5 ++++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/Gemfile b/Gemfile index 8e86acf..8c2993e 100644 --- a/Gemfile +++ b/Gemfile @@ -10,3 +10,8 @@ end gem 'prometheus-client', '~> 4.0' gem 'rake', '~> 13.0' gem 'webrick', '~> 1.8' + +# public_suffix 7 requires Ruby >= 3.2; cap it so the dev/test resolution (it +# comes in transitively via webmock -> addressable) keeps working on the +# Ruby 3.0/3.1 CI jobs the gemspec still supports. +gem 'public_suffix', '< 7.0' diff --git a/Gemfile.lock b/Gemfile.lock index 184d513..91de5d0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -78,7 +78,7 @@ GEM coderay (~> 1.1) method_source (~> 1.0) reline (>= 0.6.0) - public_suffix (7.0.5) + public_suffix (6.0.2) racc (1.8.1) rainbow (3.1.1) rake (13.3.1) @@ -137,6 +137,7 @@ DEPENDENCIES json_schemer (~> 2.0) prometheus-client (~> 4.0) pry (~> 0.14) + public_suffix (< 7.0) rake (~> 13.0) rspec (~> 3.0) rubocop (~> 1.0) diff --git a/spec/conductor/http/rest_client_spec.rb b/spec/conductor/http/rest_client_spec.rb index db0feed..4efafd0 100644 --- a/spec/conductor/http/rest_client_spec.rb +++ b/spec/conductor/http/rest_client_spec.rb @@ -19,7 +19,10 @@ let(:retry_options) do handler = client.connection.builder.handlers.find { |h| h.klass == Faraday::Retry::Middleware } - handler.instance_variable_get(:@args).first + # faraday >= 2.9 stores keyword middleware options in @kwargs; older faraday + # passed them as a single positional options hash in @args.first. + kwargs = handler.instance_variable_get(:@kwargs) + kwargs.nil? || kwargs.empty? ? handler.instance_variable_get(:@args).first : kwargs end describe 'retry configuration' do