Pin rexml and activesupport

GoogleCloudPlatform · Nov 28, 2024 · 15babcf · 15babcf
1 parent 485c9c1
commit 15babcf
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/fluent-plugin-google-cloud.gemspec b/fluent-plugin-google-cloud.gemspec
@@ -34,6 +34,16 @@ Gem::Specification.new do |gem|
   gem.add_runtime_dependency 'opencensus', '0.5.0'
   gem.add_runtime_dependency 'opencensus-stackdriver', '0.4.1'
 
+  # CVE-2023-28120, CVE-2023-22796, CVE-2023-38037: activesupport is a
+  # transitive dependency of google-api-client, which has not been updated
+  # upstream to a patched version, so we are pinning it here instead.
+  gem.add_runtime_dependency 'activesupport', '~> 6.1', '>= 6.1.7.5'
+
+  # CVE-2024-49761: rexml is a transitive dependency of google-api-client,
+  # which has not been updated upstream to a patched version, so we are
+  # pinning it here instead.
+  gem.add_runtime_dependency 'rexml', '~> 3.3', '>= 3.3.9'
+
   gem.add_development_dependency 'mocha', '1.9.0'
   # Keep this the same as in
   # https://github.com/fluent/fluent-plugin-prometheus/blob/master/fluent-plugin-prometheus.gemspec