Skip to content

[Snyk] Security upgrade octokit from 4.6.2 to 4.23.0 #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hashim21223445 wants to merge 3 commits into
base: master
Choose a base branch
from
Open

[Snyk] Security upgrade octokit from 4.6.2 to 4.23.0 #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6711fe2
fix: hooks/ruby/delete-repository-event/Gemfile & hooks/ruby/delete-r…
snyk-bot Feb 10, 2026
4a8e18b
fix: hooks/ruby/delete-repository-event/Gemfile & hooks/ruby/delete-r…
snyk-bot Feb 16, 2026
e82466f
fix: hooks/ruby/delete-repository-event/Gemfile & hooks/ruby/delete-r…
snyk-io[bot] Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion hooks/ruby/delete-repository-event/Gemfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
source "https://rubygems.org"

gem "octokit"
gem "octokit", ">= 4.23.0"

@gemini-code-assist gemini-code-assist Bot Feb 10, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

The version constraint >= 4.23.0 has resulted in octokit being upgraded to version 10.0.0 in Gemfile.lock, a major version jump from 4.6.2. Major version updates often include breaking changes that could break this hook's functionality, especially since the application code using octokit is not being updated in this PR. The PR title and Snyk's metadata suggest an upgrade to 4.23.0, not a major version jump.

To prevent potential breakages while still resolving the security vulnerability, I recommend using a pessimistic version constraint. This will limit the upgrade to minor/patch versions within the 4.x series.

After applying this suggestion, you will need to run bundle update octokit to update the Gemfile.lock file accordingly.

gem "octokit", "~> 4.23.0"

gem "sinatra"
48 changes: 21 additions & 27 deletions hooks/ruby/delete-repository-event/Gemfile.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,56 +1,50 @@
GEM
remote: https://rubygems.org/
specs:
addressable (2.8.6)
public_suffix (>= 2.0.2, < 6.0)
addressable (2.8.8)
public_suffix (>= 2.0.2, < 8.0)
base64 (0.2.0)
faraday (1.5.1)
faraday-em_http (~> 1.0)
faraday-em_synchrony (~> 1.0)
faraday-excon (~> 1.1)
faraday-httpclient (~> 1.0.1)
faraday-net_http (~> 1.0)
faraday-net_http_persistent (~> 1.1)
faraday-patron (~> 1.0)
multipart-post (>= 1.2, < 3)
ruby2_keywords (>= 0.0.4)
faraday-em_http (1.0.0)
faraday-em_synchrony (1.0.0)
faraday-excon (1.1.0)
faraday-httpclient (1.0.1)
faraday-net_http (1.0.1)
faraday-net_http_persistent (1.2.0)
faraday-patron (1.0.0)
multipart-post (2.1.1)
faraday (2.14.1)
faraday-net_http (>= 2.0, < 3.5)
json
logger
faraday-net_http (3.4.2)
net-http (~> 0.5)
json (2.18.1)
logger (1.7.0)
mustermann (3.0.0)
ruby2_keywords (~> 0.0.1)
octokit (4.6.2)
sawyer (~> 0.8.0, >= 0.5.3)
public_suffix (5.0.4)
net-http (0.9.1)
uri (>= 0.11.1)
octokit (10.0.0)
faraday (>= 1, < 3)
sawyer (~> 0.9)
public_suffix (6.0.2)
rack (3.0.9.1)
rack-protection (4.0.0)
base64 (>= 0.1.0)
rack (>= 3.0.0, < 4)
rack-session (2.0.0)
rack (>= 3.0.0)
ruby2_keywords (0.0.5)
sawyer (0.8.2)
sawyer (0.9.3)
addressable (>= 2.3.5)
faraday (> 0.8, < 2.0)
faraday (>= 0.17.3, < 3)
sinatra (4.0.0)
mustermann (~> 3.0)
rack (>= 3.0.0, < 4)
rack-protection (= 4.0.0)
rack-session (>= 2.0.0, < 3)
tilt (~> 2.0)
tilt (2.3.0)
uri (1.1.1)

PLATFORMS
ruby

DEPENDENCIES
octokit
octokit (>= 4.23.0)
sinatra

BUNDLED WITH
1.14.6
2.3.27
Loading