You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by ya...@apache.org on 2026/04/27 06:48:36 UTC
(spark) branch master updated: [SPARK-56631][DOC] Update `addressable` gem version to 2.9.0
This is an automated email from the ASF dual-hosted git repository.
LuciferYang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/spark.git
The following commit(s) were added to refs/heads/master by this push:
new 6facdefe608e [SPARK-56631][DOC] Update `addressable` gem version to 2.9.0
6facdefe608e is described below
commit 6facdefe608ee516db314ff06477ffbc28db2db7
Author: YangJie <ya...@baidu.com>
AuthorDate: Mon Apr 27 14:48:22 2026 +0800
[SPARK-56631][DOC] Update `addressable` gem version to 2.9.0
### What changes were proposed in this pull request?
Bump `addressable` (transitive dependency of `jekyll`) from 2.8.7 to 2.9.0 in `docs/Gemfile.lock`.
### Why are the changes needed?
`addressable` < 2.9.0 has a high-severity ReDoS vulnerability ([CVE-2026-35611](https://nvd.nist.gov/vuln/detail/CVE-2026-35611), [GHSA-h27x-rffw-24p4](https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4), CVSS 7.5) in `Addressable::Template#match`. 2.9.0 fully remediates the vulnerability and also widens the `public_suffix` upper bound to `< 8.0` (the resolved `public_suffix 6.0.2` continues to satisfy).
Release notes: https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md
### Does this PR introduce _any_ user-facing change?
No.
### How was this patch tested?
Pass GitHub Actions.
### Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Code
Closes #55555 from LuciferYang/SPARK-56631.
Authored-by: YangJie <ya...@baidu.com>
Signed-off-by: yangjie01 <ya...@baidu.com>
---
docs/Gemfile.lock | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock
index 70a51382190c..ae4d11e4a1d1 100644
--- a/docs/Gemfile.lock
+++ b/docs/Gemfile.lock
@@ -1,8 +1,8 @@
GEM
remote: https://rubygems.org/
specs:
- addressable (2.8.7)
- public_suffix (>= 2.0.2, < 7.0)
+ addressable (2.9.0)
+ public_suffix (>= 2.0.2, < 8.0)
base64 (0.3.0)
bigdecimal (3.2.2)
colorator (1.1.0)
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org