Skip to content

i18n dependency version conflict preventing activesupport update to fix CVE-2023-22796 #866

@agnostic-apollo

Description

@agnostic-apollo

Before submitting an issue, please be sure to

This issue affects

  • The site generated by GitHub Pages
  • Building sites locally

Issue

The CVE-2023-22796 requires activesupport to be updated to 6.1.7.1 or 7.0.4.1.

The github-pages 227 gem depends on jekyll = 3.9.2, which depends on i18n ~> 0.7.

The activesupport 6.1.7.1 depends on i18n >= 1.6, < 2, which prevents an update. The activesupport 6.0.6.1 was the last version that depended on i18n >= 0.7, < 2, which then used i18n 0.9.5 to also satisfy jekyll's i18n ~> 0.7 requirement.

Note sure what can be done, other than possibly updating to jekyll >= 4.0.0, which depends on i18n >= 0.9.5, < 2. Any suggestions? Thanks.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions