[benbalter]

This bumps four plugins to releases that fix published security advisories. GitHub Pages currently pins affected versions of all four.

Gem	Current	New	Advisory
jekyll-redirect-from	0.16.0	0.17.0	GHSA-xfg6-hjrc-hpvx: unescaped redirect_to allows script injection in generated redirect pages
jekyll-seo-tag	2.8.0	2.9.1	GHSA-572m-7cg5-6j5r: unescaped metadata fields and the JSON-LD block allow HTML/script injection
jekyll-feed	0.17.0	0.18.0	GHSA-3gx8-pqcm-38hw: post.lang isn't escaped in feed entries, plus a CDATA ]]> breakout
jekyll-remote-theme	0.4.3	0.6.2	Unblocks rubyzip >= 3.4.0 for CVE-2026-85396 (#966); 0.6.2 also avoids GHSA-3343-386p-v26g

Fixes #966.

Why jekyll-remote-theme 0.6.2 and not 0.5.2

0.4.3 requires rubyzip < 3.0, so sites using the github-pages gem can't pick up the rubyzip path traversal fix. 0.5.2 is the first release to allow rubyzip 3.x. But 0.5.0–0.6.0 are affected by GHSA-3343-386p-v26g: a local-path remote_theme can read files outside the site source, even in safe mode. That was fixed in 0.6.1, and 0.6.2 only changes metadata. 0.6.0 also caps download and zip extraction size and adds request timeouts.

With this branch, rubyzip resolves to 3.7.0, and bundle-audit reports no known vulnerabilities in the resolved bundle.

Notes for reviewers

• jekyll-remote-theme 0.6.x requires Ruby >= 3.0 and adds a runtime dependency on the openssl gem (>= 3.1.2). The gemspec still says >= 2.3.0, but the CI matrix already starts at 3.0.
• jekyll-remote-theme 0.5.0 added @latest refs, local filesystem paths (rejected in safe mode as of 0.6.1), and proxy support.
• jekyll-seo-tag 2.9.x also includes the 2.9.0 features (for example twitter:description, 100-word description truncation, and canonical: false), so some sites' <head> output will change slightly.
• jekyll-redirect-from 0.17.0 skips redirect_to targets that aren't http(s) or relative (with a build warning), and percent-encodes quotes, <, >, \ and similar characters in targets.

Testing

script/cibuild in Docker on Ruby 3.3: 157 of 158 specs pass. The one failure also happens on master: the unpinned jekyll-octicons dev dependency now adds data-component="Octicon" to its <svg> output, which breaks the <svg height="32" match in spec/github-pages/integration_spec.rb. The Ruby 3.0 Docker image doesn't build right now (its apt-get step fails), which is also unrelated to this change.

🤖 Generated with Claude Code

[parkr]

Thanks for bumping, @benbalter.

[parkr]

@benbalter #966 outlines that jekyll-remote-theme needs an update for security reasons as well. Would it make sense to fold that into this PR?

[benbalter]

@parkr Good call, folded in via 09226aa. jekyll-remote-theme goes to 0.6.2 rather than 0.5.2 (the first release to allow rubyzip 3.x), because 0.5.0–0.6.0 are affected by GHSA-3343-386p-v26g. rubyzip now resolves to 3.7.0, and bundle-audit is clean on the resolved bundle. The other direct pins have no open advisories. I updated the description with details; the main caveat is that 0.6.x requires Ruby >= 3.0.

[lehors]

Yes, please!

[lehors]

Thanks for putting this PR together @benbalter.
I'm surprised it is taking so long for this PR to be merged and a new release to be produced given the number of projects impacted with the high severity vulnerability this is addressing...

[benbalter]

I'm surprised it is taking so long for this PR to be merged and a new release to be produced given the number of projects impacted with the high severity vulnerability this is addressing...

If you're interested, contacting GitHub support (or posting in the relevant community forum) would likely be the best path.

[lehors]

I'm surprised it is taking so long for this PR to be merged and a new release to be produced given the number of projects impacted with the high severity vulnerability this is addressing...

If you're interested, contacting GitHub support (or posting in the relevant community forum) would likely be the best path.

Done (sent email to GitHub support).

[kumadee]

My company has also raised a support case with GitHub to prioritize this PR. Will update when we get a response from GitHub.

[lehors]

So, I got the following response from GitHub support:

pages-gem depends on an old version of Jekyll that we cannot update without breaking million of sites.

The path forward is for the user to remove pages-gem and start using the latest version of Jekyll themselves.

We have this sample workflow for publishing a Jekyll Pages site without the pages-gem here:

https://github.com/actions/starter-workflows/blob/main/pages/jekyll.yml

In my experience it takes quite a bit more to make the change though. There are several configurations that need adjusting to get the same output.

You can see an example below:
ossf/security-baseline#572

[parkr]

Interesting response. This PR does not attempt to move to a new Jekyll. It only updates some plugins with vulnerabilities.

[cetinajero]

Interesting response. This PR does not attempt to move to a new Jekyll. It only updates some plugins with vulnerabilities.

My thoughts exactly! 🫠

[benbalter]

@parkr right, this PR doesn't touch Jekyll. It keeps Pages on Jekyll 3.10.0 and only bumps four plugins with published advisories. I checked it for breakage on existing sites:

• Same Jekyll range. Each new plugin version allows the same Jekyll versions its old one did, and the resolved bundle still has jekyll 3.10.0, liquid 4.0.4, kramdown 2.4.0, and jekyll-sass-converter 1.5.2. The only other changes are rubyzip 2.4.1 → 3.7.0 and the new openssl gem that jekyll-remote-theme pulls in.
• Same output. On Ruby 3.3 (the version actions/jekyll-build-pages uses), I built just-the-docs, minimal-mistakes, pages-themes/minimal, and pages-themes/primer as remote themes, with both master and this branch. The output only differs in the jekyll-seo-tag <head> block (twitter:* tags use name= instead of property=, and it adds twitter:description and article:modified_time). Theme assets are byte-identical.
• Specs. 158 examples run on both master and this branch, with the same single failure (the jekyll-octicons fixture) on both.

One real behavior change to know about: jekyll-redirect-from 0.17.0 only allows http(s) and relative redirect_to targets. So a page with redirect_to: mailto:… (or another non-http scheme) now logs a warning and builds as a normal page (usually blank) instead of redirecting. I expect that's rare, but it's worth a line in the release notes.

Also, jekyll-remote-theme 0.6.x requires Ruby >= 3.0. That's fine for the Pages builder, but anyone running the gem locally on Ruby 2.x won't be able to resolve it. I can bump required_ruby_version to >= 3.0 here so they get a clear error.

pages-gem depends on an old version of Jekyll that we cannot update without breaking million of sites.

TL;DR: The dependencies are backwards compatible with the current Pages version of Jekyll and can be updated without updating Jekyll itself.