From 7a7466c4fa7377ef7698e478d028035618f1ddc1 Mon Sep 17 00:00:00 2001
From: ryanbond <ryan@lightspeedsystems.com>
Date: Wed, 10 Jun 2026 10:17:28 -0500
Subject: [PATCH] RP-6332: Fix Dependabot alerts (json, addressable, ffi)

Resolve four open high-severity Dependabot alerts by upgrading the
affected gems via Gemfile/Gemfile.lock only. No gem public API changes.

- json 2.1.0 -> 2.7.6 (GHSA-jphg-qwrw-7w9g): direct runtime dep declared
  in clever-ruby.gemspec as ">= 1.8, < 3"; bumped within range, no gemspec
  change required.
- addressable 2.4.0 -> 2.9.0 (GHSA-h27x-rffw-24p4, GHSA-jxhc-q857-3j6g):
  pulled transitively by webmock (dev/test); added a ">= 2.9.0" pin in the
  development/test group so bundler resolves the patched version.
- ffi 1.9.18 -> 1.16.3 (GHSA-2gw2-8q9w-cw8p): pulled transitively by
  sys-uname/ethon (dev/test); pinned ">= 1.9.24, < 1.17" in the
  development/test group (cap keeps Ruby 2.6 toolchain compatibility, since
  ffi >= 1.17 requires Ruby >= 3.0).

Spec suite (rspec) passes: 2 examples, 0 failures.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 Gemfile      |  6 ++++++
 Gemfile.lock | 10 +++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/Gemfile b/Gemfile
index f58bec06..4d8c7f17 100644
--- a/Gemfile
+++ b/Gemfile
@@ -4,4 +4,10 @@ gemspec
 
 group :development, :test do
   gem 'rake', '~> 12.3.3'
+  # Security pins for transitive dev/test dependencies (Dependabot RP-6332).
+  # ffi >= 1.9.24 fixes GHSA-2gw2-8q9w-cw8p; cap below 1.17 to keep
+  # compatibility with the project's Ruby 2.6 toolchain.
+  gem 'ffi', '>= 1.9.24', '< 1.17'
+  # addressable >= 2.9.0 fixes GHSA-h27x-rffw-24p4 / GHSA-jxhc-q857-3j6g.
+  gem 'addressable', '>= 2.9.0'
 end
diff --git a/Gemfile.lock b/Gemfile.lock
index fb99e1c6..0ea19c49 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -8,7 +8,8 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.4.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
     autotest (5.0.0)
       minitest-autotest (~> 1.0)
     autotest-fsevent (0.2.14)
@@ -20,9 +21,9 @@ GEM
     diff-lcs (1.3)
     ethon (0.12.0)
       ffi (>= 1.3.0)
-    ffi (1.9.18)
+    ffi (1.16.3)
     hashdiff (0.3.6)
-    json (2.1.0)
+    json (2.7.6)
     minitest (5.11.3)
     minitest-autotest (1.1.1)
       minitest-server (~> 1.0)
@@ -30,6 +31,7 @@ GEM
     minitest-server (1.0.5)
       minitest (~> 5.0)
     path_expander (1.0.4)
+    public_suffix (5.1.1)
     rake (12.3.3)
     rspec (3.8.0)
       rspec-core (~> 3.8.0)
@@ -59,11 +61,13 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  addressable (>= 2.9.0)
   autotest (~> 5.0, >= 4.4.6)
   autotest-fsevent (~> 0.2, >= 0.2.12)
   autotest-growl (~> 0.2, >= 0.2.16)
   autotest-rails-pure (~> 4.1, >= 4.1.2)
   clever-ruby!
+  ffi (>= 1.9.24, < 1.17)
   rake (~> 12.3.3)
   rspec (~> 3.6, >= 3.6.0)
   vcr (~> 5.0, >= 3.0.1)