Yang Jie created SPARK-58371:
--------------------------------
Summary: Update json gem version to 2.21.1
Key: SPARK-58371
URL: https://issues.apache.org/jira/browse/SPARK-58371
Project: Spark
Issue Type: Improvement
Components: Documentation
Affects Versions: 5.0.0
Reporter: Yang Jie
Upgrade the {{json}} gem from 2.12.2 to 2.21.1 in {{docs/Gemfile.lock}}.
{{json}} is a transitive dependency of the docs build toolchain (pulled in by
{{jekyll}}, which requires {{json (~> 2.6)}}). 2.21.1 satisfies that constraint
and {{json}} has no runtime dependencies, so only the locked spec version
changes.
2.21.1 includes the fix for:
- GHSA-x2f5-4prf-w687 / CVE-2026-54696 (low): heap out-of-bounds write in the
JSON generator when streaming to an IO via {{JSON.dump(obj, io)}} or
{{JSON::State#generate(obj, io)}}. Affects {{>= 2.9.0, < 2.19.9}}; fixed in
2.19.9.
Following the same pattern as SPARK-57633 (concurrent-ruby 1.3.7), this picks
up the latest release rather than the minimum patched version.
This only affects the documentation build toolchain and introduces no
user-facing change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
