Skip to content

backport (3.x): Bump snakeyaml from 1.31 to 1.33 to resolve CVE-2022-38752 on JRuby #587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 27, 2022
Merged

backport (3.x): Bump snakeyaml from 1.31 to 1.33 to resolve CVE-2022-38752 on JRuby #587

merged 2 commits into from
Sep 27, 2022

Conversation

@chadlwilson
Copy link
Contributor

@chadlwilson chadlwilson commented Sep 27, 2022

Resolves CVE-2022-38752 and makes another couple of defensive changes around code point limits.

Backport of #585.

Additional context

@chadlwilson chadlwilson changed the title backport (3.x): Bump snakeyaml from 1.31 to 1.33 to resolve CVE-2022-38752 backport (3.x): Bump snakeyaml from 1.31 to 1.33 to resolve CVE-2022-38752 on JRuby Sep 27, 2022
@headius headius merged commit 81a290e into ruby:3-3-stable Sep 27, 2022
@chadlwilson chadlwilson deleted the backport-3-snakeyaml-133 branch September 27, 2022 15:19
@chadlwilson chadlwilson mentioned this pull request Sep 30, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@chadlwilson @headius