From 483db980006fd6985982565578ff4127044e6e67 Mon Sep 17 00:00:00 2001
From: Minerva Sky <258328972+minerva-sky@users.noreply.github.com>
Date: Mon, 17 Aug 2026 03:35:27 -0400
Subject: [PATCH] Patch 14 security advisories with conservative lockfile bumps

bundler-audit flags five gems in the lockfile: faraday 2.11.0 (SSRF via
protocol-relative URLs CVE-2026-25765/CVE-2026-33637, nested-params DoS
CVE-2026-54297), uri 0.13.1 (credential leakage CVE-2025-27221 and its
bypass CVE-2025-61594), concurrent-ruby 1.3.4 (three lock/atomics bugs
incl. CVE-2026-54904), addressable 2.8.7 (template ReDoS CVE-2026-35611),
and rexml 3.3.1 (five DoS advisories incl. CVE-2024-49761).

Bump those five plus faraday-multipart, all in place, via
bundle lock --update addressable rexml concurrent-ruby uri faraday
faraday-multipart --conservative: faraday 2.14.3, uri 1.1.1,
concurrent-ruby 1.3.8, addressable 2.9.0, rexml 3.4.4,
faraday-multipart 1.2.0.

faraday-multipart is the one bump with no advisory behind it: 1.0.4
declares required_ruby_version < 4, so the lock cannot even install on
current stable Ruby (4.x) dev machines; 1.2.0 lifts that ceiling and
keeps the Faraday::UploadIO alias that ruby-openai 7.1.0's multipart
path calls (verified present in 1.2.0's source).

ruby-openai stays at 7.1.0; no gemspec changes, so nothing changes for
gem consumers. bundler-audit is clean and the full suite (610 examples)
plus standardrb pass on the new lock. Local verification ran on Ruby
4.0.6; the CI run on 3.2.4 is the adjudicating evidence for the uri
0.x->1.x default-parser transition on that Ruby.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 Gemfile.lock | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index 130c334..6b2f484 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -20,8 +20,8 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     ast (2.4.2)
     async (2.24.0)
       console (~> 1.29)
@@ -32,7 +32,7 @@ GEM
     base64 (0.2.0)
     bigdecimal (3.1.8)
     cgi (0.5.2)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.8)
     console (1.30.2)
       fiber-annotation
       fiber-local (~> 1.1)
@@ -69,11 +69,12 @@ GEM
       dry-logic (~> 1.4)
       zeitwerk (~> 2.6)
     event_stream_parser (1.0.0)
-    faraday (2.11.0)
-      faraday-net_http (>= 2.0, < 3.4)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
       logger
-    faraday-multipart (1.0.4)
-      multipart-post (~> 2)
+    faraday-multipart (1.2.0)
+      multipart-post (~> 2.0)
     faraday-net_http (3.3.0)
       net-http
     fiber-annotation (0.2.0)
@@ -102,8 +103,7 @@ GEM
     rainbow (3.1.1)
     rake (13.2.1)
     regexp_parser (2.8.3)
-    rexml (3.3.1)
-      strscan
+    rexml (3.4.4)
     rspec (3.13.0)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -155,7 +155,6 @@ GEM
       unicode-display_width (>= 1.5, < 3.0)
       unicode_utils (~> 1.4)
     strings-ansi (0.2.0)
-    strscan (3.1.0)
     thor (1.3.2)
     timecop (0.9.10)
     traces (0.15.2)
@@ -179,7 +178,7 @@ GEM
       tty-screen (~> 0.8)
     unicode-display_width (2.5.0)
     unicode_utils (1.4.0)
-    uri (0.13.1)
+    uri (1.1.1)
     vcr (6.3.1)
       base64
     webmock (3.23.1)