From 40750ebf30caa5f03accafff381af4250ca8cf2e Mon Sep 17 00:00:00 2001 From: Ronald Tse Date: Thu, 17 Sep 2026 19:08:27 +0800 Subject: [PATCH] fix: require rubyzip ~> 3.4 (CVE-2026-85396 path traversal) rubyzip prior to 3.4.0 is vulnerable to path traversal (https://nvd.nist.gov/vuln/detail/cve-2026-85396). - Raise the rubyzip dependency from ~> 2.3 to ~> 3.4 - Replace the removed Zip::File::CREATE constant with the rubyzip 3.x create: true keyword argument Requires lutaml-model 0.8.32+, which relaxes its own rubyzip constraint to ~> 3.4. Fixes #32 --- lib/unitsdb/commands/release.rb | 2 +- unitsdb.gemspec | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/unitsdb/commands/release.rb b/lib/unitsdb/commands/release.rb index fb0e8ab..da5225d 100644 --- a/lib/unitsdb/commands/release.rb +++ b/lib/unitsdb/commands/release.rb @@ -51,7 +51,7 @@ def create_zip_archive(db) output_path = File.join(@options[:output_dir], "unitsdb-#{@options[:version]}.zip") - Zip::File.open(output_path, Zip::File::CREATE) do |zipfile| + Zip::File.open(output_path, create: true) do |zipfile| { dimensions: Unitsdb::Dimensions, unit_systems: Unitsdb::UnitSystems, diff --git a/unitsdb.gemspec b/unitsdb.gemspec index fbf61a6..53d5006 100644 --- a/unitsdb.gemspec +++ b/unitsdb.gemspec @@ -38,7 +38,7 @@ Gem::Specification.new do |spec| spec.add_dependency "lutaml-model", "~> 0.8.0" spec.add_dependency "rdf", "~> 3.1" spec.add_dependency "rdf-turtle", "~> 3.1" - spec.add_dependency "rubyzip", "~> 2.3" + spec.add_dependency "rubyzip", "~> 3.4" spec.add_dependency "table_tennis", "~> 0.0.7" spec.add_dependency "thor", "~> 1.0" end