From 80903de42ede0a65bd336003ffde1310456a7fb5 Mon Sep 17 00:00:00 2001
From: Samuel Bhuiyan <samuel_bhuiyan@rapid7.com>
Date: Mon, 20 Jul 2026 12:50:19 +0100
Subject: [PATCH] =?UTF-8?q?Bump=20nokogiri=201.18.10=E2=86=921.19.4=20and?=
 =?UTF-8?q?=20oj=203.13.21=E2=86=923.17.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes 12 High severity DefectHub findings (161838-161849) expiring Jul 24
plus expired Medium finding 16722 (nokogiri 1.13.9, May 26):
- nokogiri: XXE Injection, Use After Free
- oj: Multiple Use After Free, Stack-Based Buffer Overflow, Integer
  Overflow, Heap-Based Buffer Overflow, Out-of-Bounds Write

Added bigdecimal as new transitive dependency required by oj >= 3.17.

Supersedes Dependabot PR #110 which only covers oj.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 Gemfile.lock | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/Gemfile.lock b/Gemfile.lock
index ee6f793..383d5bb 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -21,6 +21,7 @@ GEM
       cucumber (>= 4.0, < 9.0)
       rspec-expectations (~> 3.4)
       thor (~> 1.0)
+    bigdecimal (4.1.2)
     bit-struct (0.17)
     builder (3.2.4)
     childprocess (4.1.0)
@@ -60,10 +61,11 @@ GEM
     mini_portile2 (2.8.9)
     multi_test (1.1.0)
     net-dns (0.9.0)
-    nokogiri (1.18.10)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oj (3.13.21)
+    oj (3.17.3)
+      bigdecimal (>= 3.0)
     racc (1.8.1)
     rake (13.0.6)
     recog (3.0.3)