From a61a8bfbc63bbfee1c981b8e80748a1bae87fde6 Mon Sep 17 00:00:00 2001 From: Sojan Jose Date: Fri, 17 Jul 2026 16:04:56 -0700 Subject: [PATCH] chore(deps): address bundle audit vulnerabilities (#15055) Updates the vulnerable Ruby dependencies reported by bundle audit so the application resolves to patched versions. ## Why The latest Ruby advisory database reports known vulnerabilities in Datadog, Loofah, and Rails HTML Sanitizer on `develop`, including a high-severity denial-of-service advisory in Datadog. ## What changed - Updates `datadog` from 2.19.0 to 2.38.0 - Updates `loofah` from 2.23.1 to 2.25.2 - Updates `rails-html-sanitizer` from 1.6.1 to 1.7.1 - Refreshes Datadog's required native packages ## Validation Verified the resolved bundle is satisfied, bundle audit reports no known vulnerabilities, and Datadog 2.38.0 loads successfully. --- Gemfile.lock | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 68674155e..46a1c0449 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -211,13 +211,14 @@ GEM activerecord (>= 5.a) database_cleaner-core (~> 2.0.0) database_cleaner-core (2.0.1) - datadog (2.19.0) - datadog-ruby_core_source (~> 3.4, >= 3.4.1) - libdatadog (~> 18.1.0.1.0) - libddwaf (~> 1.24.1.0.3) + datadog (2.38.0) + cgi + datadog-ruby_core_source (~> 3.5, >= 3.5.3) + libdatadog (~> 36.0.0.1.0) + libddwaf (~> 1.30.0.0.0) logger msgpack - datadog-ruby_core_source (3.4.1) + datadog-ruby_core_source (3.5.3) date (3.5.1) debug (1.8.0) irb (>= 1.5.0) @@ -522,15 +523,16 @@ GEM logger (~> 1.6) letter_opener (1.10.0) launchy (>= 2.2, < 4) - libdatadog (18.1.0.1.0) - libdatadog (18.1.0.1.0-x86_64-linux) - libddwaf (1.24.1.0.3) + libdatadog (36.0.0.1.0) + libdatadog (36.0.0.1.0-arm64-darwin) + libdatadog (36.0.0.1.0-x86_64-linux) + libddwaf (1.30.0.0.2) ffi (~> 1.0) - libddwaf (1.24.1.0.3-arm64-darwin) + libddwaf (1.30.0.0.2-arm64-darwin) ffi (~> 1.0) - libddwaf (1.24.1.0.3-x86_64-darwin) + libddwaf (1.30.0.0.2-x86_64-darwin) ffi (~> 1.0) - libddwaf (1.24.1.0.3-x86_64-linux) + libddwaf (1.30.0.0.2-x86_64-linux) ffi (~> 1.0) line-bot-api (1.28.0) lint_roller (1.1.0) @@ -547,7 +549,7 @@ GEM activesupport (>= 4) railties (>= 4) request_store (~> 1.0) - loofah (2.23.1) + loofah (2.25.2) crass (~> 1.0.2) nokogiri (>= 1.12.0) mail (2.8.1) @@ -740,8 +742,8 @@ GEM activesupport (>= 5.0.0) minitest nokogiri (>= 1.6) - rails-html-sanitizer (1.6.1) - loofah (~> 2.21) + rails-html-sanitizer (1.7.1) + loofah (~> 2.25, >= 2.25.2) nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0) rails-i18n (7.0.10) i18n (>= 0.7, < 2)