Skip to content

Bump excon to 1.5.0 to address GHSA-48rx-c7pg-q66r - #4247

Merged
harsh62 merged 1 commit into
mainfrom
dependabot/bundler/excon-1.5.0-root
Jul 13, 2026
Merged

Bump excon to 1.5.0 to address GHSA-48rx-c7pg-q66r#4247
harsh62 merged 1 commit into
mainfrom
dependabot/bundler/excon-1.5.0-root

Conversation

@ekjotmultani

@ekjotmultani ekjotmultani commented Jul 10, 2026

Copy link
Copy Markdown
Member

Summary

Bumps the excon gem from 0.112.0 to 1.5.0 in the root Gemfile.lock to resolve a security vulnerability.

Security Advisory

  • GHSA: GHSA-48rx-c7pg-q66r
  • Vulnerable range: < 1.5.0
  • Patched version: 1.5.0
  • Affected manifest: Gemfile.lock

Changes

  • Updated Gemfile to relax the fastlane version pin from '2.235.0' to '~> 2.237'. This was required because fastlane 2.235.0 constrained excon to < 1.0.0, blocking the security update. Fastlane 2.237.0 relaxes this to < 2.0.0.
  • Regenerated Gemfile.lock via bundle lock, bumping excon from 0.112.0 to 1.5.0 and fastlane from 2.235.0 to 2.237.0.

Related

@ekjotmultani
Bump excon to 1.5.0 to address GHSA-48rx-c7pg-q66r
610377b 
Update fastlane from 2.235.0 to ~> 2.237 to relax the excon version
constraint (< 1.0.0 -> < 2.0.0), allowing excon to be bumped from
0.112.0 to 1.5.0.
@ekjotmultani
ekjotmultani requested a review from a team as a code owner July 10, 2026 23:05
@harsh62
harsh62 merged commit 62faa46 into main Jul 13, 2026
171 of 175 checks passed
@harsh62
harsh62 deleted the dependabot/bundler/excon-1.5.0-root branch July 13, 2026 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@harsh62 harsh62 harsh62 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ekjotmultani @harsh62