Skip to content

Commit 36924d5

Browse files
committed
fix(deps): Bump faraday to 1.10.6 in performance-tests
Addresses GHSA-98m9-hrrm-r99r (CVE-2026-54297): uncontrolled recursion in Faraday::NestedParamsEncoder allowing a stack-exhaustion DoS via deeply nested query parameters. The fix is shipped in faraday 1.10.6 (backport) and 2.14.3. Bumps the locked version in performance-tests/Gemfile.lock from 1.10.5 to 1.10.6; the gem stays on the 1.x line to remain compatible with fastlane 2.228.0 and faraday-* 1.x sub-gems.
1 parent 56958a5 commit 36924d5

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

performance-tests/Gemfile.lock

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ GEM
4646
dotenv (2.8.1)
4747
emoji_regex (3.2.3)
4848
excon (0.112.0)
49-
faraday (1.10.5)
49+
faraday (1.10.6)
5050
faraday-em_http (~> 1.0)
5151
faraday-em_synchrony (~> 1.0)
5252
faraday-excon (~> 1.1)

0 commit comments

Comments
 (0)