Skip to content

Commit bf4f774

Browse files
committed
Downgrade uri gem to 0.12.5
This is a default gem, and Ruby 3.2.9 ships 0.12.4. Version 0.12.5 addresses a CVE, so we ship this version until Ruby 3.2.10 is released which should include it.
1 parent 9930ec8 commit bf4f774

1 file changed

Lines changed: 6 additions & 2 deletions

File tree

configs/components/rubygem-uri.rb

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
#####
22
# Component release information:
33
# https://rubygems.org/gems/uri
4+
# Notes:
5+
# 2025-12-14: This is a default gem, and is only included here to address
6+
# CVE-2025-61594. This component should be removed once Ruby 3.2.10 is released.
47
#####
58
component 'rubygem-uri' do |pkg, _settings, _platform|
69
### Maintained by update_gems automation ###
7-
pkg.version '1.1.1'
8-
pkg.sha256sum '379fa58d27ffb1387eaada68c749d1426738bd0f654d812fcc07e7568f5c57c6'
10+
# PINNED
11+
pkg.version '0.12.5'
12+
pkg.sha256sum '883424e272244f029ad3b9fe0e9ad18d1c33cdadff0a366c301ce737c62eb414'
913
### End automated maintenance section ###
1014

1115
instance_eval File.read('configs/components/_base-rubygem.rb')

0 commit comments

Comments
 (0)