[Snyk] Fix for 1 vulnerabilities

[pavelbe4solutions]

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix 1 vulnerabilities in the rubygems dependencies of this project.

Snyk changed the following file(s):

• docs/Gemfile
• docs/Gemfile.lock

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Denial of Service (DoS) SNYK-RUBY-REXML-7462086	551

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)

[dryrunsecurity]

DryRun Security Summary

This pull request updates the versions of the github-pages and jekyll-feed gems in the project's Gemfile, which can bring new features, bug fixes, and security improvements, but the changes should be carefully reviewed and tested to ensure no regressions or security issues are introduced.

Expand for full summary

Summary:

The code changes in this pull request are focused on updating the versions of the github-pages and jekyll-feed gems used in the project's Gemfile. These updates are a common practice to ensure the application is using the latest stable versions of the required dependencies, which can bring new features, bug fixes, and security improvements.

While these changes do not directly introduce any security vulnerabilities, it's important to note that updating dependencies can sometimes introduce breaking changes or new security vulnerabilities, which should be carefully reviewed before deploying the changes to a production environment. Additionally, the update to the activesupport and addressable gems, which are major version bumps, should be thoroughly tested to ensure no regressions or security issues are introduced.

Files Changed:

• docs/Gemfile: The github-pages gem version has been updated to ">= 229", and the jekyll-feed gem version has been updated to "~> 0.16", ">= 0.16.0". These changes ensure that the latest versions of these gems, or any version greater than or equal to the specified versions, will be used.
• docs/Gemfile.lock: This file has been updated to reflect the changes made to the Gemfile. The key changes include updates to the activesupport gem (from version 6.0.5 to 7.1.3.4), the addressable gem (from version 2.8.0 to 2.8.7), and several other gems, including github-pages, jekyll-feed, and jekyll-seo-tag. These updates could bring new features, bug fixes, or security improvements to the project, but they should be thoroughly tested to ensure no regressions or security issues are introduced.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[kodem-security]

Kodem Security Scan ✅

All good, no new security risks were found for this PR

---

Resolved security issues

🔨 Fixed CVEs: 🔴 2 High | 🟠 3 Medium | 🟡 1 Low

Fixed CVEs by package:

Package	Fixed CVEs
activesupport 6.0.5	1 High | 1 Medium | 1 Low CVEs CVE-2023-22796 - A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially cr... CVE-2023-28120 - Possible XSS Security Vulnerability in SafeBuffer#bytesplice... CVE-2023-38037 - Active Support Possibly Discloses Locally Encrypted Files...
rexml 3.2.5	2 Medium CVEs CVE-2024-35176 - REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability ... CVE-2024-39908 - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it p...
tzinfo 1.2.9	1 High CVEs CVE-2022-31163 - TZInfo is a Ruby library that provides access to time zone data and allows times to be converted usi...