Hello! Figured I'd drop a few advisories I know of that aren't in the DB yet because they haven't been reviewed by GitHub yet: - `sanitize`: https://github.com/rgrove/sanitize/security/advisories/GHSA-wgw9-qhqg-8hv5 - `ransack`: https://github.com/activerecord-hackery/ransack/security/advisories/GHSA-vxc9-rm8f-p56j and https://github.com/activerecord-hackery/ransack/security/advisories/GHSA-j3f8-w227-4hh8 - `avo`: https://github.com/avo-hq/avo/security/advisories/GHSA-x65r-p6hf-94hv and https://github.com/avo-hq/avo/security/advisories/GHSA-h7x6-9mqf-vgmx - a bunch in `net-ssh`: https://github.com/net-ssh/net-ssh/security - `savon`: https://github.com/savonrb/savon/security/advisories/GHSA-x99v-rwvj-g9p5
Activity
connorshea commentedon Oct 23, 2026
mcp also has this one: GHSA-4m5j-jjfc-97gx
and datadog: GHSA-p7cx-x3jr-jj6w
jasnow commentedon Oct 24, 2026
@connorshea - Should there be a separate net-sftp advisory for GHSA-3x7f-q7wf-fp73 ?
connorshea commentedon Oct 24, 2026
I don't think so, because if you update net-ssh it should be sufficient for resolving the issue from what I understand.
jasnow commentedon Oct 24, 2026
#1272 covers the net-ssh advisories.
jasnow commentedon Oct 24, 2026
#1273 covers 4 more.
jasnow commentedon Oct 24, 2026
Final 4 in #1274
jasnow commentedon Oct 25, 2026
Think we can close this issue and track progress with the PRs.
connorshea commentedon Oct 25, 2026
Works for me, thanks as always 🫡