+ "5eb01f1b1412ed7ea319898da41d13710889d922": "[SPARK-58727][DOC] Update `json` gem version to 2.21.2\n\n### What changes were proposed in this pull request?\n\nThis PR upgrades the `json` gem from 2.21.1 to 2.21.2 in `docs/Gemfile.lock`. It is a transitive dependency (pulled in by `jekyll`, which requires `json (~> 2.6)`), and 2.21.2 satisfies that constraint, so only the locked spec version changes.\n\n`json` has no runtime dependencies, so no other lock entries change and `docs/Gemfile` does not need to be touched.\n\n### Why are the changes needed?\n\n2.21.2 includes the fix for a security advisory that affects `>= 2.20.0, <= 2.21.1`:\n\n- [GHSA-9hj4-r449-hfvc](https://github.com/advisories/GHSA-9hj4-r449-hfvc) / CVE-2026-71847 (low): heap use-after-free in the native C extension's `JSON::ResumableParser`. When the current input buffer is consumed, `cResumableParser_parse` calls `json_str_clear(parser->buffer)` and drops the reference but leaves `state.start`, `state.cursor`, and `state.end` pointing into the released storage. If `partial_value` then reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path reaches `cursor_position`, which dereferences those stale pointers and can terminate the process. Fixed in 2.21.2.\n\nThis addresses https://github.com/apache/spark/security/dependabot/227.\n\nFollowing the same pattern as SPARK-58371 (`json` 2.21.1) and SPARK-57633 (`concurrent-ruby` 1.3.7), this picks up the latest release, which here is also the minimum patched version.\n\n### Does this PR introduce _any_ user-facing change?\n\nNo. This only affects the documentation build toolchain.\n\n### How was this patch tested?\n\nManually verified against `docs/Gemfile` and `docs/Gemfile.lock`:\n\n1. Lock resolution matches. `bundle lock --update=json` resolves `json` to exactly 2.21.2 and touches no other locked spec, confirming 2.21.2 satisfies jekyll's `json (~> 2.6)`. The committed lock is a one-line hand edit so the local Bundler version does not rewrite the `RUBY VERSION` / `BUNDLED WITH` stanzas.\n\n2. Frozen install succeeds. `BUNDLE_FROZEN=true bundle install` installs all 36 gems without modifying the lock file, and `bundle list` reports `json (2.21.2)`.\n\n3. The docs site builds:\n\n```\n$ cd docs && SKIP_API=1 bundle exec jekyll build\nConfiguration file: .../docs/_config.yml\n\n************************\n* Building error docs. *\n************************\nGenerated: docs/_generated/error-conditions.html\n Source: .../docs\n Destination: .../docs/_site\n Incremental build: disabled. Enable with --incremental\n Generating...\nWarning: Tolerating missing API files because the following skip flags are set: SKIP_API\n done in 3.207 seconds.\n Auto-regeneration: disabled. Use --watch to enable.\n```\n\n4. Ran the advisory's `JSON::ResumableParser` sequence (two chunks so the first buffer is consumed and cleared, incomplete trailing object, duplicate key, heap churn plus `GC.start` before `partial_value`) against both 2.21.1 and 2.21.2. Both complete without crashing on this platform, so this is not a local reproduction of the use-after-free -- the advisory's own evidence for the release-build crash is an AddressSanitizer build. The check confirms the version bump does not regress the `ResumableParser` duplicate-key path.\n\n5. Pass GitHub Actions.\n\n### Was this patch authored or co-authored using generative AI tooling?\n\nGenerated-by: Claude Code (Opus 5)\n\nCloses #57951 from LuciferYang/docs-json-gem-2.21.2.\n\nAuthored-by: YangJie <yangjie01@baidu.com>\nSigned-off-by: yangjie01 <yangjie01@baidu.com>"
0 commit comments