Conversation
Carries nokogiri 1.19.3 transitively (`fastlane-plugin-wpmreleasetoolkit` 14.4.1's gemspec floors it at `>= 1.19.3`), closing GHSA-c4rq-3m3g-8wgx without an explicit `gem 'nokogiri'` pin. The toolkit's Gemfile.lock entry also gets a SHA pin to 14.4.1 (matching the existing 13.8.1 SHA-pin form). Lockfile churn beyond the headline bumps comes from rt 14.3.1 dropping `activesupport` from runtime deps, rt 14.0 raising the Fastlane floor (already satisfied), and rt's PO-generation path adding the `gettext` family + `dotenv` for `EnvManager`. Supersedes the open nokogiri-only pin PR (#497) — the rt 14.x gemspec carries the floor transitively, so an explicit `gem 'nokogiri'` line is no longer needed. --- Generated with the help of Claude Code, https://claude.com/claude-code Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s Ruby release tooling dependency (fastlane-plugin-wpmreleasetoolkit) from the 13.x line to 14.x, picking up the toolkit’s newer dependency floors (notably bringing in nokogiri >= 1.19.3 transitively) and updating the Bundler-resolved dependency set accordingly.
Changes:
- Bump
fastlane-plugin-wpmreleasetoolkitfrom~> 13.8to~> 14.4inGemfile. - Refresh
Gemfile.lockto resolvefastlane-plugin-wpmreleasetoolkitto14.4.1, and pull in the updated transitive dependencies (includingnokogiri 1.19.3).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Gemfile | Updates the release-toolkit plugin version constraint to ~> 14.4. |
| Gemfile.lock | Updates the resolved dependency graph for the toolkit bump, including resolving nokogiri to 1.19.3. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
How was CI `install_gem` working before? Haven't investigated but it's quite surprising. On this branch, it failed as it usually does when the repo is not configured to vendor gems: https://buildkite.com/automattic/gutenbergkit/builds/2240
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
fastlane-plugin-wpmreleasetoolkitfrom~> 13.8(locked at 13.8.1) to~> 14.4(resolves to 14.4.1).Carries
nokogiri 1.19.3transitively via the toolkit's gemspec floor, closing GHSA-c4rq-3m3g-8wgx without an explicitgem 'nokogiri'pin.Supersedes #497 — that PR's explicit
gem 'nokogiri', '>= 1.19.3'pin is no longer needed once the toolkit is on 14.4.1+, which carries the floor in its own gemspec.Why now
Part of the release-toolkit 14.x bump campaign.
GutenbergKit is one of the 9 consumer repos that the breaking-change inspection (
rt-versions.md) flagged as clean — no Fastfile call sites use any of the APIs broken or removed in rt 12.0, 13.0, or 14.0.Lockfile delta beyond the headline bumps
activesupportand friends drop out — rt 14.3.1 removedactivesupportfrom runtime deps.gettextfamily added — used by rt's PO-generation path.dotenvadded — rt's newEnvManager(14.4.0) wraps it.~> 2.230already satisfies the new rt floor of>= 2.231).Test plan
mokagio/bump-rt-14.bundle exec fastlane laneslistspublish_to_s3,xcframework_sign,set_up_signing_release(verified locally).🤖 Generated with Claude Code
Posted by Claude (Opus 4.7) on behalf of @mokagio with approval.