From d510aad851513e652c7fdf63bf1455cbc0e3137e Mon Sep 17 00:00:00 2001 From: Ian Maia Date: Mon, 13 Jul 2026 14:34:31 +0200 Subject: [PATCH 1/4] Bump fastlane to fix excon vulnerability --- CHANGELOG.md | 1 + Gemfile.lock | 14 ++++++++------ fastlane-plugin-wpmreleasetoolkit.gemspec | 2 +- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 261e42fc4..1d6a784ed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,6 +17,7 @@ _None_ - `StringsFileValidationHelper.find_duplicated_keys` now parses unquoted keys/values and inter-token comments, matching the grammar `plutil` accepts, instead of raising `Invalid character`. This lets `ios_lint_localizations`' `check_duplicate_keys` work on `InfoPlist.strings`-style files. [#741] - `ios_lint_localizations`' `check_duplicate_keys` now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat `.strings`. [#741] - `L10nHelper.merge_strings` now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. [#741] +- Bump the `fastlane` floor to `~> 2.237` to pull in `excon >= 1.5.0`, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. ### Internal Changes diff --git a/Gemfile.lock b/Gemfile.lock index a4787a6c0..f54cdf336 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -6,7 +6,7 @@ PATH chroma (= 0.2.0) diffy (~> 3.3) dotenv (~> 2.8) - fastlane (~> 2.235) + fastlane (~> 2.237) gettext (~> 3.5) git (~> 1.3) google-cloud-storage (~> 1.31) @@ -126,7 +126,8 @@ GEM drb (2.2.3) emoji_regex (3.2.3) erubi (1.13.1) - excon (0.112.0) + excon (1.5.0) + logger faraday (1.10.6) faraday-em_http (~> 1.0) faraday-em_synchrony (~> 1.0) @@ -158,10 +159,10 @@ GEM faraday_middleware (1.2.1) faraday (~> 1.0) fastimage (2.4.1) - fastlane (2.235.0) + fastlane (2.237.0) CFPropertyList (>= 2.3, < 5.0.0) abbrev (~> 0.1) - addressable (>= 2.8, < 3.0.0) + addressable (>= 2.9.0, < 3.0.0) artifactory (~> 3.0) aws-sdk-s3 (~> 1.197) babosa (>= 1.0.3, < 2.0.0) @@ -173,7 +174,7 @@ GEM csv (~> 3.3) dotenv (>= 2.1.1, < 3.0.0) emoji_regex (>= 0.1, < 4.0) - excon (>= 0.71.0, < 1.0.0) + excon (>= 0.71.0, < 2.0.0) faraday (~> 1.0) faraday-cookie_jar (~> 0.0.6) faraday_middleware (~> 1.0) @@ -187,9 +188,10 @@ GEM highline (~> 2.0) http-cookie (~> 1.0.5) json (< 3.0.0) - jwt (>= 2.1.0, < 4) + jwt (>= 2.10.3, < 4) logger (>= 1.6, < 2.0) mini_magick (>= 4.9.4, < 5.0.0) + multi_json (~> 1.12) multipart-post (>= 2.0.0, < 3.0.0) mutex_m (~> 0.3) naturally (~> 2.2) diff --git a/fastlane-plugin-wpmreleasetoolkit.gemspec b/fastlane-plugin-wpmreleasetoolkit.gemspec index e64ef38f7..6f4cd673b 100644 --- a/fastlane-plugin-wpmreleasetoolkit.gemspec +++ b/fastlane-plugin-wpmreleasetoolkit.gemspec @@ -30,7 +30,7 @@ Gem::Specification.new do |spec| spec.add_dependency 'chroma', '0.2.0' spec.add_dependency 'diffy', '~> 3.3' spec.add_dependency 'dotenv', '~> 2.8' - spec.add_dependency 'fastlane', '~> 2.235' + spec.add_dependency 'fastlane', '~> 2.237' spec.add_dependency 'gettext', '~> 3.5' spec.add_dependency 'git', '~> 1.3' spec.add_dependency 'java-properties', '~> 0.3.0' From f473eca47b174aed31185938c1a0bb6aafd91fff Mon Sep 17 00:00:00 2001 From: "Ian G. Maia" Date: Mon, 13 Jul 2026 14:45:49 +0200 Subject: [PATCH 2/4] Update CHANGELOG with pr reference --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1d6a784ed..ca8c6b3b4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,7 @@ _None_ - `StringsFileValidationHelper.find_duplicated_keys` now parses unquoted keys/values and inter-token comments, matching the grammar `plutil` accepts, instead of raising `Invalid character`. This lets `ios_lint_localizations`' `check_duplicate_keys` work on `InfoPlist.strings`-style files. [#741] - `ios_lint_localizations`' `check_duplicate_keys` now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat `.strings`. [#741] - `L10nHelper.merge_strings` now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. [#741] -- Bump the `fastlane` floor to `~> 2.237` to pull in `excon >= 1.5.0`, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. +- Bump the `fastlane` floor to `~> 2.237` to pull in `excon >= 1.5.0`, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. [#754] ### Internal Changes From 4907bee088fb88bc680d3ac093f9747dfef27ac8 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 13 Jul 2026 12:47:07 +0000 Subject: [PATCH 3/4] Remove outdated comment about circular fastlane dependency in gemspec --- fastlane-plugin-wpmreleasetoolkit.gemspec | 3 --- 1 file changed, 3 deletions(-) diff --git a/fastlane-plugin-wpmreleasetoolkit.gemspec b/fastlane-plugin-wpmreleasetoolkit.gemspec index 6f4cd673b..a4d84aae7 100644 --- a/fastlane-plugin-wpmreleasetoolkit.gemspec +++ b/fastlane-plugin-wpmreleasetoolkit.gemspec @@ -22,9 +22,6 @@ Gem::Specification.new do |spec| spec.bindir = 'bin' spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) } - # Don't add a dependency to fastlane or fastlane_re - # since this would cause a circular dependency - # spec.add_dependency 'your-dependency', '~> 1.0.0' spec.add_dependency 'buildkit', '~> 1.5' spec.add_dependency 'chroma', '0.2.0' From 9a494f7fcd9f03368d91cbd55a093df66ae875c4 Mon Sep 17 00:00:00 2001 From: "Ian G. Maia" Date: Mon, 13 Jul 2026 17:57:20 +0200 Subject: [PATCH 4/4] Update CHANGELOG.md Co-authored-by: Olivier Halligon --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ca8c6b3b4..fd3c1f7a4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -17,7 +17,7 @@ _None_ - `StringsFileValidationHelper.find_duplicated_keys` now parses unquoted keys/values and inter-token comments, matching the grammar `plutil` accepts, instead of raising `Invalid character`. This lets `ios_lint_localizations`' `check_duplicate_keys` work on `InfoPlist.strings`-style files. [#741] - `ios_lint_localizations`' `check_duplicate_keys` now warns and skips, rather than crashing, on a file that parses as a property list but isn't a tokenizable flat `.strings`. [#741] - `L10nHelper.merge_strings` now prefixes keys via a comment-aware tokenizer, so unquoted keys, unquoted values, and keys behind an inter-token comment are prefixed in the output consistently with the reported keys. [#741] -- Bump the `fastlane` floor to `~> 2.237` to pull in `excon >= 1.5.0`, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. [#754] +- Bump `fastlane` to `~> 2.237` to pull in `excon >= 1.5.0`, fixing CVE-2026-54171 / GHSA-48rx-c7pg-q66r. [#754] ### Internal Changes