Skip to content

Update locked json gem to 2.21.2 to unblock Dependabot security updates - #37

Merged
iantaylor-NOAA merged 2 commits into
masterfrom
copilot/fix-dependabot-failure
Aug 12, 2026
Merged

Update locked json gem to 2.21.2 to unblock Dependabot security updates#37
iantaylor-NOAA merged 2 commits into
masterfrom
copilot/fix-dependabot-failure

Conversation

Copilot AI commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Dependabot was failing on the Bundler update job because the repository lockfile resolved json to 2.20.0, while the first non-vulnerable version is 2.21.2. This change updates the locked transitive dependency so Dependabot can produce a valid security update.

  • Root cause

    • Gemfile.lock pinned json at 2.20.0
    • Dependabot reported security_update_not_possible because 2.20.0 was the latest resolvable version in the existing lock state, but not a patched one
  • Change

    • Bumped the locked json gem from 2.20.0 to 2.21.2
    • Kept the Gemfile unchanged since dependency management already flows through github-pages; only the resolved lock state needed correction
  • Scope

    • No site content, Jekyll config, or workflow logic changes
    • Single-file update in Gemfile.lock
-    json (2.20.0)
+    json (2.21.2)

Co-authored-by: iantaylor-NOAA <4992918+iantaylor-NOAA@users.noreply.github.com>
@iantaylor-NOAA
iantaylor-NOAA marked this pull request as ready for review August 12, 2026 17:18
Copilot AI changed the title [WIP] Fix failing GitHub Actions job Dependabot Update locked json gem to 2.21.2 to unblock Dependabot security updates Aug 12, 2026
Copilot AI requested a review from iantaylor-NOAA August 12, 2026 17:19
@iantaylor-NOAA
iantaylor-NOAA merged commit f797eb3 into master Aug 12, 2026
2 checks passed
@iantaylor-NOAA
iantaylor-NOAA deleted the copilot/fix-dependabot-failure branch August 12, 2026 17:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants