[
https://issues.apache.org/jira/browse/SPARK-58371?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Yang Jie reassigned SPARK-58371:
--------------------------------
Assignee: Yang Jie
> Update json gem version to 2.21.1
> ---------------------------------
>
> Key: SPARK-58371
> URL: https://issues.apache.org/jira/browse/SPARK-58371
> Project: Spark
> Issue Type: Improvement
> Components: Documentation
> Affects Versions: 5.0.0
> Reporter: Yang Jie
> Assignee: Yang Jie
> Priority: Major
> Labels: pull-request-available
>
> Upgrade the {{json}} gem from 2.12.2 to 2.21.1 in {{docs/Gemfile.lock}}.
> {{json}} is a transitive dependency of the docs build toolchain (pulled in by
> {{jekyll}}, which requires {{json (~> 2.6)}}). 2.21.1 satisfies that
> constraint and {{json}} has no runtime dependencies, so only the locked spec
> version changes.
> 2.21.1 includes the fix for:
> - GHSA-x2f5-4prf-w687 / CVE-2026-54696 (low): heap out-of-bounds write in the
> JSON generator when streaming to an IO via {{JSON.dump(obj, io)}} or
> {{JSON::State#generate(obj, io)}}. Affects {{>= 2.9.0, < 2.19.9}}; fixed in
> 2.19.9.
> Following the same pattern as SPARK-57633 (concurrent-ruby 1.3.7), this picks
> up the latest release rather than the minimum patched version.
> This only affects the documentation build toolchain and introduces no
> user-facing change.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
