Skip to content

fix(all): Bump excon to 1.5.0 to address GHSA-48rx-c7pg-q66r - #325

Merged
harsh62 merged 1 commit into
mainfrom
bump-excon-1.5.0
Jul 13, 2026
Merged

harsh62 merged 1 commit into
mainfrom
bump-excon-1.5.0

Conversation

@ekjotmultani

Copy link
Copy Markdown
Member

Issue #, if available:

Dependabot alert: https://github.com/aws-amplify/amplify-ui-android/security/dependabot/14

Description of changes:

Bumps the excon gem from 0.112.0 to 1.5.0 to fix GHSA-48rx-c7pg-q66r (moderate severity).

The vulnerability affects excon versions < 1.5.0. Since fastlane 2.235.0 constrained excon to < 1.0.0, this PR also updates fastlane from 2.235.0 to 2.237.0 (which relaxes the constraint to < 2.0.0), allowing bundler to resolve excon 1.5.0.

Changes are scoped to scripts/Gemfile and scripts/Gemfile.lock only.

How did you test these changes?

  • bundle check passes with the updated lockfile
  • bundle update excon fastlane resolved cleanly via bundler (no manual lockfile edits)
  • Verified excon 1.5.0 is pinned in the resulting lockfile

Documentation update required?

  • No

General Checklist

  • Added Unit Tests
  • Added Integration Tests
  • Security oriented best practices and standards are followed (e.g. using input sanitization, principle of least privilege, etc)
  • Ensure commit message has the appropriate scope (e.g fix(liveness): message, fix(authenticator): message, fix(all): message)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Update fastlane from 2.235.0 to 2.237.0 to allow excon >= 1.0.0,
then bump excon from 0.112.0 to 1.5.0 via bundler.
@ekjotmultani
ekjotmultani requested review from a team as code owners July 10, 2026 22:33
@codecov

codecov Bot commented Jul 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.20%. Comparing base (99f8717) to head (509504a).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #325      +/-   ##
==========================================
- Coverage   37.22%   37.20%   -0.02%     
==========================================
  Files         123      123              
  Lines        5013     5013              
  Branches      705      705              
==========================================
- Hits         1866     1865       -1     
  Misses       2955     2955              
- Partials      192      193       +1     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@harsh62
harsh62 merged commit 8aeeb0b into main Jul 13, 2026
7 of 8 checks passed
@harsh62
harsh62 deleted the bump-excon-1.5.0 branch July 13, 2026 16:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants